Branislav Grković, participant in the “Investigative Reporting Program: Stories on the Theme of Organized Crime,” implemented by the Mediacentar Sarajevo NetNovinar Training Center and Center for Investigative Journalism from Zagreb, discovered that laws in Serbia do not treat possession of child pornography as a crime. The story was published across four pages in the paper Vreme on 8 February 2007.

Branislav Grkovic’s story was published in magazine „Vreme“:
Superscript headline: Cyber criminal
Headline: Anonymous Abusers
Subheadline: If you possess a gun without a permit, you will face a sentence of up to three-year imprisonment. A hard-disk full of child pornography or 100 DVDs sitting on the shelves in somebody's room will carry no punishment at all. Possession of pornographic material in which children are abused is not a criminal offence in Serbia.
Signature: Branislav Grković

A couple of months ago, in a town in Serbia, some time around 7:30 p. m. a Jovan got out of his house. From a phone box he phoned a man he had met that very day in the chat room as a 25-year old Branislav. Jovan gave him instructions – he would leave three DVDs in front of the palace in a dark, less busy downtown alley. He quickly made for the palace, hid the "merchandise" at the arranged place and went to a phone box in a nearby park at an even quicker pace. Being impatient, he phoned him again. "Have you started yet? Where are you?". "I'm just entering the street", Branislav replied. Jovan hung up but couldn't bear the uncertainty. He rang again. "I took it and left the money," said Branislav and finally Jovan moved. Instead the 1500 dinars, a group of police in plain clothes waited for him and arrested him. In December last year, Jovan was sentenced to a six-month imprisonment (six months’ imprisonment), a year on probation. That was only the third conviction in Serbia for the distribution of pornographic material in which children are abused. In the course of investigation, Jovan said that over several months he had obtained 20 GB of pornographic pictures with children through the Internet. He decided to make some money and tried to find buyers through the chat room. He was not lucky enough.

CYBER STAKE-OUT. The said case is a unique one to Serbia by something else. It was revealed because the said "buyer" Branislav was not a "lover of child pornography". Having recognised Jovan's offer as something unlawful, he himself organised the "hand-over" and reported it all to the police. In addition to an unlimited access to education, entertainment and business, the Internet created ample opportunity for abuse. Currently, the total number of Internet users in the world (Internet World Stats, January 2007) is around 1.95 billion and it cannot be expected that only institutions of individual states and cyber industry be responsible for the prevention of posting undesirable material on the Internet. The INHOPE (Internet Hotline Providers in Europe), for example, is a network of national hotline operators, the role of which is to enable the users to report what they deem undesirable material on the Internet. Then, the INHOPE makes an evaluation as to whether such material constitutes a breach of the law. If so, the police is notified. If it has been established that the material originates from the territory of a specific country, the notification is posted to the international network of such services and the local hotline operators then notify their police. The INHOPE operates as a non-profit organisation, the operations of which are 50% financed by the EU and 50% by the Internet providers themselves.

"With regard to child pornography on the Internet, the police may act following notifications of users themselves. You have to make it possible for them to report any such case, as it is illusory to think that the policy can see everything that is posted onto the network," says Ognjen Haramina, Head of the Computer Crime Department of the Croatian Police Forces and one of the leading cyber crime experts in our region. Following an invitation of the USA's FBI, Haramina became a member of a special international unit that is in charge of detecting child pornography on the Internet and heads a special unit of the Croatian Ministry of the Interior with 30 persons on the team, which has done a lot on combating piracy in Croatia over past years. Also, 120 cases related to child pornography have been tried in Croatia so far.

The Chair of the Association of Internet Providers of Serbia, Vojislav Rodić, says that something like the Inhope will be the road Serbia should tread as well. "Internet providers should not be additionally burdened and assigned the role of a censor. The best would be to set up specialised organisations which users will be able to notify of anything suspicious." Rodić adds that in Serbia there is no adequate legislation, and he illustrates this by the fact that the regulations that govern the operations of such companies do not specify which data a provider is obligated to store or for which period of time, which is crucial for tracking those who have committed criminal offences through the Internet.

PEDOPHILES' TRICKS AND GIMMICKS. It was not the Internet that brought about paedophilia. It was paedophiles who abused it. Before that, they would have to meet in person to exchange such material. Today, they operate in the anonymous vastness of the sea of users of the world computer network. However, as unlimited as the Internet may seem to be, once the cyber police has detected unlawful activities within the network, it is possible to locate those who commit offences, or at least the computers from which they have committed them. Every computer that is logged on the Internet, namely, is assigned an IP address, which is at that moment being used by that Internet connection only and by no other connections in the whole network. The IP address and time of connection are the information that is sufficient to locate the computer from which the connection has been made.

That is exactly what paedophile groups know as well and they are quite logically trying  to protect themselves. "Anyone who tries to distribute child pornography will log on to the Internet through their provider. As a rule, in order to conceal their traces, they will go through one or more proxy servers, so that the moment they've done it they will have the address of a proxy server and not the one of the computer which accessed the Internet. Most of proxy servers will not allow certain things, and that is why such people will use providers that charge their services. Payments made with credit cards are a sort of identification and users are therefore allowed to do whatever they please because they are no longer considered anonymous. That is the reason why those persons will usually pay with either stolen or forged credit cards," Haramina explains.

There are two broad groups of cyber paedophiles: those who just distribute child pornography for money and those who gather together to "enjoy in" and exchange the material. It is estimated that there are some 100,000 paedophile web pages on the worldwide network. These sites, Haramina explains, have a short network life span – from  a couple of hours to a month, they will disappear on their own and pop up very soon under a different name in order to make it difficult for the police to trace them. Haramina says that pages that are on for several months will be an extremely rare case. "If in that time you fail to locate all of them and collect the information you need, then you will probably, as an outcome, lose the one who has organised the job.  On average, at the global level, approximately 50% of web page owners are detected when the page is on for a month or two."

Costs of posting a site are low. If an average monthly fee is $30, the author will make decent money from several hundreds of visitors. If one and the same person has more than one site, it will be a source of considerable income.

The access to these pages is not an easy one. It is impossible to find them through the usual search methods as paedophile circles have developed a protection system of their own. Whoever wants to access such a site will have to first prove that he is "a true lover" by first taking a number of "steps". He will receive an invitation from one site to visit another, where he will be assigned a password to enter the third one and finally, in order to be granted access to the next level he will have to offer photographs that have not been seen before or that the "candidate" has taken himself.

Another way of protection is coding of photographs. A digital photograph is composed of dots (pixels) that are defined by their coordinates and colour hues. Coding of these two sets of data will turn a photograph into an indistinguishable blur, but if you have the code, it takes a couple of  "mouse clicks" to revert it to what it was before – a photograph.

In order to conceal their identity, paedophiles or those who engage in distributions, except for proxy servers, will revert to other techniques as well. The Internet development makes it possible for them to hide files and location from which they have been sent. For example, you can send an e-mail from Belgrade and make it look you have sent it from Russia by using web services that will forward the mail to the address indicated and delete the original address. Addresses of proxy servers and similar web services are easy to trace on the Internet just as are the instruction for their use.

In addition to the afore listed techniques, paedophiles have developed a special jargon for mutual recognition. Despite it all, however, there is no absolute protection, and Haramina claims that the most efficient manner of combating paedophiles is to sneak in their circles. "The easiest way to penetrate those groups is to police process an individual and get the access data from him. Then you can continue operating under his identity and collect information. The international unit that was located in Baltimore managed to penetrate 24 groups and finally revealed 2000 persons".

LAW?!: Child abuse in the form of pornography is provided for by Article 185 of the Criminal Code of the Republic of Serbia, which stipulates that "whoever abuses a child to produce photographs, audio and video records or shows shall be punished with a sentence carrying six-month to five-year imprisonment", whereas "whoever sells, shows, publicly displays or makes available such material in the electronic format shall be punished with a sentence carrying up to two-year imprisonment". This is where the legislator has made a gross negligence. If you possess a gun without a permit, you will face a sentence of up to three-year imprisonment. A hard-disk full of child pornography or 100 DVDs sitting on the shelves in somebody's room will carry no punishment at all. Possession of pornographic material in which children are abused is not a criminal offence in Serbia. Deputy Prosecutor of the Second Municipal Prosecutor's Office, Branko Stamenković, who took part in two suchlike cases in our country, says that this is a serious deficiency of our legislation, although the criminal qualification of the possession of such pornographic material is standard in the countries of the European Union. "We shall, as a country, have to sanction the possession of such material as our country is a signatory to the Council of Europe's Convention on Cybercrime. It is necessary to forbid any possession of such material, because all experiences so far point to the fact that the perpetrators of this crime will undergo certain psychological development – from being interested in watching such material to trying to realise their fixation in the real life".

Ognjen Haramina says that the Croatian law has an article the purpose of which is "deterrent": "World statistics show that 60% of persons who possess and watch such material will attack children, sooner or later.  You can't suppress any production without dealing with the demand side of it. The majority of developed countries punishes those who possess pornographic pictures of children, but they are in a better position that those who distribute child pornography. The point is to find such persons while they are still in the "watching" phase and have not done serious harm, and make them stop doing such things after they have been tried and re-included into society".
Zoran Đokić, Head of the Crime Department of the Ministry of the Interior of the Republic of Serbia, claims that possession will have to be sanctioned as it would make the police work easier and enable easier identification of child pornography distributors. He says that the Serbian police was informed by their international colleagues that certain paedophile forums and sites had been accessed from the IP addresses in Serbia, but they could not respond adequately as possession of child pornography is not punishable by the law. "Given the power we have now, we cannot search anyone's apartment or computer if there aren't at least reasonable grounds to suspect that the person has exchanged the pornographic material. The question is whether the access to such a site will be a reason good enough for the investigating judge to issue a search warrant on the basis of which the police will be allowed to violate somebody's constitutional right to the integrity of a home."

Đokić explains that to have something like that implemented in practice you need to have a reason good enough. "The reason can be that it is a case of criminal offence at the instance of the public only, for which there are reasonable grounds to suspect it has been committed. If the possession is not a criminal offence, two things are made impossible. First, the man is automatically granted amnesty and second, there is no way to see who he got the material from or to get to the person who produced it".

The absence of criminal qualification of the possession of child pornography is even less understandable if the chronology of events is analysed. The pornographic abuse of minors was introduced into the Serbian legislation for the first time in 2003. In April 2005, the Serbian first cyber criminal was a high school student from Šabac (see the box: Two cases and one narrow escape), in whose computer pictures and texts that are considered child pornography were found. Since it was not proved that he had exchanged the material, he was acquitted. In September 2005, the Serbian Parliament enacted a new criminal bill, which does not qualify the possession of such material as a criminal offence.

COMBAT BUT ON PAPER:  Professor Zoran Stojanović, who was the chair of the Committee for Development of the Criminal Bill, agrees that the possession of such material should be seriously considered as a criminal offence: "The Criminal Code was adopted in a rather short period of time. There were other criminal offences that may have been considered more important. In any case, in the course of developing the CC, child pornography was not a focus of attention. It is up to the legislator and relevant movers to do something in that direction once addenda and changes become the issue of discussion.  This was on the  periphery of the public focus".

One of the first and most important international documents addressing this issue is the Council of Europe's Convention on Cybercrime, Serbia is a signatory to which; however, it has not been ratified by the Parliament yet, although the Ratification Act has been prepared. As early as in June 1995, the Serbian Parliament adopted the Act on the organisation and competencies of state bodies to combat high-tech crimes. This Act was enforced without deferred effects and foresees the establishment of a special court and prosecutor's office, as well as special police forces to combat this type of crimes. In accordance with this Act, their establishment was to be effected by the ministries of the police and justice. Today, more than eighteen months later, not only have the special court and prosecutor's office not been established but the special police unit has not been set up at all. Prosecutor Stamenković says that out of everything that was planned only one unit has been established within the District Court in Belgrade, but not as originally envisaged: "The special prosecutor's office for high-tech crimes has not been set up. It is the republican prosecutor who should appoint the special prosecutor and ensure the implementation of the funds that were allocated by the Government at one of its sessions. Significant resources have been allocated to the prosecutor's office and court, I think we are talking 24 million dinars per institution, so that the only thing lacking is the final decision, that of the republican prosecutor's office in this case".

Why hasn't the special police unit been established yet – was the question we asked Zoran Đokić. "Believe me, I don't know the true answer to that question. The Act has been enacted and it should be applied". Đokić believes that the threat from cyber crimes has not been adequately recognised here: "First, we must be aware that there are cyber crimes in this country. Now, everyone believes that there are as many such crimes as we manage to discover, and what we discover is few and far between. It cannot be a side job of several enthusiasts in the MoI and prosecutor's office. There must be a special service for combating high-tech crimes, the core of which will be police officers who know how to obtain a digital proof of evidence".

Michael Polt, the US ambassador to Serbia, as the media have informed, said that the USA were prepared to help Serbia in combating child pornography: "We are willing to help your police get equipped with adequate means and knowledge to combat such crimes".

Ognjen Haramina, who claims he has an excellent cooperation with the Serbian police, explains that the key matter is the exchange of information: "The Internet has no physical boundaries, which means that any cyber crime may be committed from any place in the world. Another aspect of this problem is that, if you survey the operation of one server by means of tools that were designed for it, you will find yourself in a situation in which you will, in a very short time, discover a large number of persons engaged in distribution or possessing such material. But, if you come from a small country, such as are Croatia and Serbia, you will find out that a large number of such persons will be from other countries and only a small number will be from yours. Thus, this problem comes down to the international exchange of data. When we started working on this problem intensively, we would send the data to other police forces and they would be returned to us once they had been processed. Over past two or three years the Croatian Ministry of the Interior has received lots of information from other police forces on cases identified as Internet crimes. Such exchange of information between police forces has increasingly intensified globally. What is best, which we have been witnessing as of recently, is the fact that those countries have recognised our infrastructure for combating the distribution of child pornography and have now started to provide us with information that will eventually improve our results".

Had the Jovan from the beginning of this text not tried to make some money, he could have continued obtaining children pornography undisturbed. Serbia is still a zone in which, because of its deficient law, any trace of the international distribution of paedophile material can be easily lost. The shortest way to qualify the possession of children pornography as a crime is to have addenda and changes of the law initiated by the Government or MP caucus.  The MPs would just need to invest a good will and a couple of minutes of their work and that would already be a good step in a good direction. And, one of the EU standards would be fulfilled as well.

Two cases and one narrow escape

Three cases of child pornography distribution have been processed in Serbia so far. By the first verdict, Nikola Bugarčić, who was employed as a driver at the OSCE Head Office in Belgrade at the time, was sentenced to three years’ imprisonment. The court established that he had sold five CDs with pornography material on which children were seen, at the price of Euro 150 and that he had attempted to sell another three. Shortly after, Jugoslav Stefanović was sentenced to 12 years’ imprisonment. Apart from distributing such material, Stefanović produced it himself- moreover, he himself took part in it in front of the camera, and was therefore convicted of the crime of unnatural sexual assault and intercourse with a person under 14 years of age. Both cases were found after a tip-off by the FBI that someone in the territory of Serbia had been sending such material to other Internet users. Toward the end of April 2005, the FBI informed the Serbian police that one of their agents had received five e-mails and a total of 23 photographs from the address lili4oll@yahoo.com and that it had been established that the distribution had been done from a computer in Serbia. Five IP addresses used by the Serbian provider and the time of the Internet connection were delivered. Initial investigation showed that two of five addresses matched, and the trace led to Šabac, where photos of paedophilic nature and texts in Serbian describing sexual intercourse with babies were found on a computer belonging to a secondary-school student. However, the photographs sent to the US were not found. The investigation afterwards established that a mistake had been made in calculating the time difference. The investigation was launched from the beginning and a total match of the IP addresses was made, and the trace led to Loznica, where Jugoslav Stefanović, with whom the photos received from the FBI were found, was arrested. The police found photos and films he himself had taped, on which he had a sexual intercourse with a nine-year-old girl. On that occasion, contacts with the person who had offered Stefanović films for sale were found. The investigation established that the mails had been sent by someone through the computer network of the OSCE Head Office in Belgrade. The police then decided to continue communication, already launched, with the “seller” and scheduled the “purchase and sale”, after which Nikola Bugarčić was arrested.The case of the fellow in Šabac is particularly interesting. He was practically found by accident, but it is exactly this that serves as a warning that distribution of such material as crime must be taken seriously. At the time of the investigation, the provider, the services of which were used by the person from Loznica and the person from Šabac, had about 80,000 users. What are the odds that the two of them, who were not connected at all, would get identical IP addresses and that two matches would be found on account of a mistake in calculating the time of the internet connection, and that it would then be found that both of them had pornographic material in their possession? It was not proven that the guy from Šabac had sent the prohibited material to anyone. According to our law, he could not be held criminally responsible.

The story was created in the Investigative Reporting Program: Stories on the Theme of Organized Crime the first generation of the “Investigative Reporting Program. The program is implemented successfully by NetNovinar - Center for Investigative Reporting and Media Education (founders: Mediacentar Sarajevo and Investigative Journalism Center, Zagreb)