1. Features of an integrated National Online Child Protection Strategy
Dr. Frederick Wamala, PhD, CISSP®
“Integrated aspects of child protection on the Internet” for
CIS and European Countries, Odessa, Ukraine, 6-8 April 2011

2. Quotation
“Children have a remarkable ability to master computers from an early age, which is, at the same time, both astounding and frightening for parents. We have the global will to provide a safe environment,” – H.E. Laura Chinchilla, President Costa Rica; Patron, ITU Child Online Protection Initiative, 17 November 2010

3. Agenda Online child protection strategy
ITU Cybersecurity Strategy Guide
Online protection conceptual model
Strategic context
Online child protection goals
Approaches to executing strategy
Online child protection resources

4. Main Messages Great opportunities for children online
Threats and risks to children online too
Proportionate response – Risk vs. reward
Focus on child’s well-being
Blocking content not all
Coherent, cooperative, global response
National values/culture critical to success

5. Online Child Protection Strategy
Strategy defined as:
A “Complex decision-making process that connects the Ends sought (objectives) with the Ways and the Means of achieving those ends,” Drew and Snow (2006)
Thus, an online child protection strategy is:
A nationally-led and globally harmonised effort to build human and institutional capacity to prevent, detect, react and deter online risks to children
Online risks may translate into offline harm
Thus, address risks to children online and offline

6. ITU Cybersecurity Strategy Guide
Child Online Protection
An initiative of the Global Cybersecurity Agenda (GCA) and part of Guide
GCA, security principles and language of strategy
Unique: National values and culture a foundation
Risk management driven
Proportionate response

7. Ends-Ways-Means Strategy Model
“No one starts a war — or rather, no one in his senses ought to do so — without first being clear in his mind what he intends to achieve by that war and how he intends to conduct it,” – Carl von Clausewitz, Military Theorist 7 7

8. Online Protection Conceptual Model

9. Strategic Context: International View
UN Convention on the Rights of the Child:
Article 17: Protect the child from information and material “injurious to his or her well-being.”
WSIS Geneva Declaration of Principles 2003
ICT services must respect “the rights of children as well as their protection and well-being.”
National values/culture – religious, political

10. Threats and Risks: COP Guidelines
Content: illegal or age inappropriate
Contact: Predators; harmful communities
Conduct Online
Risky, harmful and/or illegal interactions (sexting);
Legal sanction – Children arrested over pictures;
Safety; career jeopardy; cyberbullying
Commerce
Unsuitable goods; scams, identity theft and fraud
Excessive Use – Health issues, social skills
Societal: Digital Divide – Access; confidence

11. Ends – Online Protection Objectives
Help children use cyberspace for education, play and exchange while managing risks
Proportionate: Prime risk to child’s well-being
Holistic: Prevent, Detect, React and Deter 11 11

12. Ends: ‘Convincing policymakers’
Education develops “the child's personality, talents and mental and physical abilities to their fullest potential,” Convention, Article 29
WSIS Tunis Commitment November 2005
ICTs expand access to quality education, boost literacy and facilitate learning process itself
Also create an inclusive knowledge economy which respects cultural and linguistic diversity”
“Moral and economic imperative” to educate every child – President Obama, 08/03/2011

13. Ways – Online Protection Priorities
Ways align with the Legal Measures; Technical and Procedural Measures and Organisational Structures GCA Pillars

14. Priority 1: Legal Measures
Cybersecurity Legislation
Establish if statutes dealing with criminal investigations support efforts to deter, respond to and prosecute crimes against children
Equivalence between online and offline crimes
Government Legal Authority
Government requires legal instruments to protect a nation’s future: its children
Determine whether the government has all the required legal powers to protect children
E.g. global cooperation and extradition treaties

15. Priority 2: Technical and Procedural
Procedures provide context for Technical
Child Protection Procedural Measures
Part of a “National Cybersecurity Framework”
Establish whether minimum-security criteria exists for parties working with children and young adults
The core security principles and standards should apply to a wide range of stakeholders
Specific controls for particular risk profiles
Measures should be proportionate to the risks children face in different environments

16. Priority 2: Technical Measures
Network Protection Strategies
Uniform Access Management (ITU-T X.1205): Authentication and authorisation services
Age verification on social networking sites
Technical Vulnerabilities
Evaluate the adequacy of security clauses, for example, in internet industry codes of conduct
Technical Interface designs
Assess if system designs allow children to control their online experience. For example, by reporting inappropriate content and blocking users

17. Priority 3: Organisational Structures
Role of Government
Does the Government understand its role in orchestrating online child protection activities?
Has top leadership accepted accountability for it?
Evaluate use of legislative powers and economic incentives to ensure that all stakeholders accept responsibility and take steps to boost child safety
National Focal Point (second presentation)
Abuse incident management
Evaluate capacity to prevent, detect, react and deter child safety incidents (second presentation)

18. Priority 3: Organisational Structures
National Cybercrime Units
In line with Legal Measures (1) and Capacity Building (4) Pillars, countries require capability to investigate online offences against children
Assess whether a country has sufficient capacity to enforce laws dealing with child abuse;
Establish whether law enforcement teams have the skills (forensics) to process abuse material;
Determine if a mechanism exists to report child abuse material to law enforcement and track high risk offenders. For example, a national hotline 18 18

19. Means – Actions on Priorities
Means flow from the Ways
Means align with the Legal Measures; Technical and Procedural Measures and Organisational Structures GCA Pillars

20. Priority 1: Legal Measures
Action 1: Cybersecurity Legislation
Review and, if necessary, adapt existing laws or develop new criminal laws to deter, respond to and prosecute crimes against children
Model Cybercrime Legislation
Consider adopting harmonised laws against the abuse of children on all online platforms
ITU cybercrime legislation tools are:
The “ITU Toolkit for Cybercrime Legislation”;
“Understanding Cybercrime: A Guide for Developing Countries

21. ITU Toolkit for Cybercrime Legislation
Offences related to child pornography
Enact strong criminal laws against child abuse material irrespective of whether the acts are committed by cyber or traditional means.

22. ITU Understanding Cybercrime
Content-related offences clause:
Covers illegal content e.g. child pornography
But appreciate national approaches and culture as values/legal systems differ across societies

23. Priority 2: Technical and Procedural
Action 1: Child Protection Procedures
Part of a “National cybersecurity framework”
Minimum child protection security measures
Goal: Vetting and Staff Clearance
Examine the trustworthiness and an individual’s suitability to access information on children
Apply to all individuals in contact with children such educators, guardians and even visitors
The goal is to “prevent unsuitable people from working with children and vulnerable adults”

24. UK Independent Safeguarding Authority

25. UK: Proportionality
New Home Secretary stopped ‘voluntary’ registration with the Vetting and Barring Scheme due to start on 26 July 2010:
“Disproportionate and overly burdensome, and that it unduly infringes on civil liberties”
“A victory for common sense,” Barnardo's
NSPCC a “disturbing gap” on volunteers
“Vetting system should not be a substitute for proper vigilance by individuals and society,” Tim Loughton Children’s Minister

26. Priority 2: Technical and Procedural
Technical Interface design principles

27. Priority 3: Organisational Structures
Action 1: Role of Government
Top Government leaders should demonstrate commitment to online child protection activities

28. Priority 1: Organisational Structures
Action 2: National Cybercrime Units
Create and/or improve forensic capacity to identify and process child abuse material
For example, IMPACT’s Training and Skills Development Centre conducts computer forensics courses with ITU, SANS Institute, EC Council, (ISC)2 and the Honeynet Project.
Action 3: National Focal Point (second talk)
An accountable organisation to serve as a focal point for coordinating online child protection work 28 28

29. Conclusions – Recap Strategy takes a long-term, holistic view
Notes incidents but is not focuses on them
Proportionate – “End justifies the Means”
Child’s well-being the “End” always
This is a dynamic strategy reference model
But model recognises that national values and culture influence perceptions of risk and success of defences against risks to children

30. Questions?
For more information on ITU’s Child Online Protection Initiative Please visit the website: or contact