Two Europol StopChildAbuse Images Geolocated: Part II — Cambodia
In the previous part of this investigation, we showed how a batch of images published by Europol, Group ImageG13, was geolocated to a small coastal village in southwest Madagascar. Based on the evidence discussed, it was determined that ImageG13 was most likely produced between January 2002 and March 2004. Given the number of hotels and bars in the area during this period and the reported levels of exploitation of minors, it is also very likely the image was related to sex tourism.
Part II of the investigation analyzes another batch of images, ImageC20, which have been geolocated to Siem Reap, Cambodia. Similarly to the previous case, the location was found close to a hotel building and is most probably related to sex tourism too.
On this occasion, the city district investigated was found to be visited by thousands of local and international tourists during a yearly festival. The amount of images recorded by visitors allowed us to build a timeline to chronolocate ImageC20 by observing a nearby construction site as a reference. The preparation of a 3D model in conjunction with solar data and shadow analysis allowed us to estimate the approximate year, month and time of the day when ImageC20 was taken.
Siem Reap, Cambodia
1. The Location:
Group ImageC20 was geolocated to coordinates (13°21’24.90″N 103°51’31.60″E) in Siem Reap, Cambodia at the level of the Wat Bo village in the city centre.
Figure 21: Group ImageC20 A,B & C as published by Europol on their website #StopChildAbuse #TraceAnObject. The images were geolocated to Siem Reap, Cambodia near the Wat Bo village (bottom). The red mark indicates approximately where the pictures were taken: an empty plot of land now occupied by a shopping centre and situated next to a hotel formerly known as the “Angkor Sayana Hotel & Spa”.
2. Initial Observations
– ImageC20-A,B & C from Figure 21 were assumed to be taken on the same plot of land. In order to determine the site layout, the main elements on each image were identified and numbered. An analysis based on these elements and their respective shadows allowed us to establish a connection between the three images.
– The wall featured on ImageC20-C was believed to be a continuation of the wall [7] featured on ImageC20-B. By assuming this, different sections of a building are also visible behind the fences and bushes. A sketch of a hypothetical building [1] behind the fence, served as the connection between the three pieces as shown in Figure 22. All of the puzzle pieces were put together indicating that the offender did the three shots pointing towards the same wall.
Figure 22: Group ImageC20 rearranged to define the land plot orientation based on sunlight direction, shadows and other elements seen in the images. A building was believed to be located behind the fence and some of its parts appeared on both ImageC20 A & C
– On the right side of ImageC20-C, just behind the fence, a window [2] located just between a tree [6*] and the bushes was visible. On the top left corner of ImageC20-A, a building overhang [3] was noticed. A shadow seemed to be projected on another nearby building surface [19], indicating that the building [1] or another object that was not visible was probably taller than the adjacent houses.
– ImageC20-A & B feature a building with pink roofing sheets [4]. They also show a pile of long, straight wooden poles [5] lying on the ground between trees [6] and a fencing wall [7].
– The borders of the land plot suggested an improvised construction. The bottom wall section [7], made of bricks, seems to have lost its render and painting. Above and along the same wall, a top section made from galvanised-type roofing sheets [9,12] was noticed. Some of the sections of the lower brick wall featured metal spikes [11].
– Power line cables and a post [14] were noticed on the top left corner of ImageC20-C. This indicated the plot of land was likely to be next to a road. Based on the multiple number of cables hanging, the property was likely to be in a large village. More details of the electricity post [14] were found by zooming in and reducing the brightness of the original ImageC20-C. The post seemed to be made of concrete and of trapezoidal shape. It also featured several reinforcing concrete ribs as shown in Figure 25. This element was of extreme importance when carrying out the screening process detailed in the following section.
– The original title posted by Europol on ImageC20-C was the following: “This is most likely a village in Asia, do you recognise where is it located?”. This statement was used to centre the initial search efforts in Asia. Further analysis on vegetation led the investigation team to believe it could be in southeast Asia.
– Thick and high tree trunks [18] elevate in a straight line behind the posts and cables. There are also several trees of the same type within the land plot [6,6*].
– Also, on the left side of ImageC20-C, an improvised tent was visible. The tent seemed to be made of a blue-green tarpaulin held together by a wooden structure [16]. On one side of the tent, there were clothes hanging as if they were drying after having been washed. On the other side of the tent, to the left, a red parasol was visible [17]. The whole configuration indicated the possibility of people living or working under this tent.
– Behind the steel roofing sheet fence [12], the tip of a similar blue tent structure is visible[13].
– Based on all this information, a preliminary sketch of the site was produced to assist the geolocation process. Using this sketch, general urban layouts from satellite imagery could be quickly assessed as potential leads for a geolocation.
Figure 23: Preliminary sketch of the site produced to assist the geolocation process. The layout is based on the initial observations described and the connection of ImageC20-A,B&C as described previously.
3. The Screening Process
Initial efforts focused on finding urban centres in southeast Asia that could lead to a village featuring the following elements:
– Houses with pink roofing sheets type [4].
– Concrete electricity posts type [14].
– Tall trees type [18] along the roads.
The following countries were checked for potential geolocation matches: Thailand, Singapore, Vietnam, Indonesia, Laos and Cambodia. After a full day of navigating via street view in Google Earth through the principal cities of these countries, only Siem Reap was shortlisted as a potential candidate. This city presented the largest number of similarities to the source photograph, including vegetation, buildings, fencing and, most importantly, electricity posts type [14]. Some of these similarities are listed in Figure 24–Figure 27 in the exact order they were found.
Figure 24: Top: A section of ImageC20-B. Bottom: Pink roofing sheets was the main material observed from satellite on many of the houses in Siem Reap
Figure 25: Left: edited image of the electricity post featured on ImageC20-C. Right: matching sample found on the main roads of Siem Reap. The posts are of trapezoidal shape with two partially hollow faces. The post is reinforced with ribs up to approximately 3/5 of its total height
Figure 26: Middle: A section of ImageC20-B showing a fence. Top and Bottom: Fencing samples observed in houses across Siem Reap. They feature similar brickwork, height and coping to those featuring in ImageC20-B. In some low-income residential areas and construction sites, galvanised steel sheets are a popular solution to increase the height of walls for security reasons. Some of them feature zig-zag spikes made by cutting the sheets as noticed on ImageC20. The type of young palm trees were very similar.
Figure 27: Similar trees to those featuring in the background of ImageC20 were mainly found along the Siem Reap River which crosses the city from north to south. Two adjacent main roads run along its path: “River Road” (northbound) and “Pokambor Avenue” (southbound).
4. Geolocating Group ImageC20
All the findings listed in the screening process strongly indicated that group ImageC20 was likely to be geolocated in Siem Reap. A satellite image of the city revealed a large concentration of trees type [18] along the Siem Reap river which has been marked in yellow in Figure 28. Parallel to the river, there are two main roads called “River Road” (northbound) and “Pokambor Avenue” (southbound). Both have been fully fitted with concrete posts type [14] as seen in 2013 Google maps street view.
Figure 28: A dense belt of trees type [18] was identified along the Siem Reap River. Two main roads run along the river: “River Road” (northbound) and “Pokambor Avenue” (southbound). Both became the main search area.
Using Google street view, a match was found on River Road at the level of the “Wat Bo” village (coordinates 13°21’24.90″N 103°51’31.60″E); just between a hotel formerly known as the “Angkor Sayana Hotel & Spa” and an empty plot of land which is now occupied by a shopping centre as shown in Figure 21. The empty plot of land, and its surroundings, largely matched the sketch drawn in Figure 23 in the previous section.
Figure 29: A visual pattern was used to check every pair of tree-posts located along 10 km of road along the river
Now that a match for the tree fork and post was found, further verifications of the site were needed. By exploring Road 22 adjacent to the plot of land, more matching elements were identified. The triangular roof elevation covered in pink roofing sheets [4], the fencing wall [7] and the overhang [3] are visible on street view from 2013 (See Figure 30).
Figure 30: Verification of additional matching elements from ImageC20. The pink roof sheets building, the original fencing wall, as well as the building overhang were identified using Google street view
Observing the hotel from Samdech Tep Vong Street and Road 22, it was determined that the overhang [3] seen on ImageC20-A is an awning attached around the building’s perimeter above the third floor (See Figure 31). Doing further visual checks, the middle brown window on the ground floor of the hotel matched the relative position, style and colour of window [2] seen on ImageC20-C (See Figure 32).
Having identified all these elements, the location was considered verified.
Figure 31: Google street view of the back of the hotel from Road 22 and Samdech Tep Vong Street in 2013. The awning of the hotel above the third floor was already fitted to the hotel when ImageC20 was taken
Figure 32: Verification of additional matching elements from ImageC20. One of the side elevation windows on the ground floor match the relative position, height and style of the one featuring on ImageC20-C
5. When Was ImageC20 Likely Taken?
From the previous section, we know ImageC20-C was taken in a plot of land featuring several trees and a section of a building which belonged to the Angkor Sayana Hotel.
The earliest satellite image available for the location dates back to April 2004. According to this image, the hotel did not exist by then. The surrounding land was occupied by houses and trees.
Another satellite image from December 2015 shows the hotel; but this time, the adjacent property to the south was fully occupied by a concrete structure. Hence, ImageC20 could not have been taken at this point in time since trees are missing on the image.
The investigation was then limited to the period 2004-2015. However, more information was needed to build a more detailed timeline based on the evolution of the hotel construction and its surroundings.
Figure 33: Satellite images of corner of River Road & Samdech Tep Vong in different years. In 2004 the hotel building (marked in red) did not exist. In 2015 the adjacent property south of the hotel was fully occupied with a concrete structure and all trees were missing. Therefore, ImageC20 could have only be taken during the period 2004-2015
The original name of the Hotel was Angkor Sayana Hotel & Spa but it was recently rebranded as Pierre Hotel. The former managing company was called INUNISSION Group Co., Ltd and acquired the hotel around 2011. In January 2013, the Phnom Pehn Post reported that Innussion had the lease of the hotel for at least 10 years. The hotel opened its doors in January 2012 and this is confirmed by multiple users on TripAdvisor.
An image of the Hotel from 2013 features the pool and a wall with spikes in the background (See Figure 34). This wall is located exactly where the galvanised roofing sheets [12] were on ImageC20-C. For obvious aesthetic reasons, this means that ImageC20 was likely taken before the hotel was fully finished and operating in January 2012.
Figure 34: Google street view of the hotel from Road 22 in 2013 (left). A TripAdvisor picture of the pool in 2013 (right). Both were compared with ImageC20-C. The brown wooden windows were already fitted to the building when ImageC20 was taken. Also the missing galvanised roofing sheets on the wall in 2013 suggests ImageC20-C was taken during the construction of the hotel before it started to operate.
From Figure 31 and Figure 32, there is evidence indicating that the hotel was built at least up to the third floor and fitted with awnings [3] when ImageC20 was taken. Windows around the ground level were likely already in place.
Hence, the estimation of the date for ImageC20 was done based on answers to the following questions: at which point, between April 2004 and January 2012, that is, during the construction of the Angkor Sayana Hotel, was the following criteria more likely to be met?
Criteria for the hotel:
- Built up to the third floor or above with awnings [3] attached.
- Windows [2] fitted in the ground floor.
- Perimeter fence [12] constructed with galvanised sheets.
Criteria for the adjacent property:
- A blue tent [16] on the front corner adjacent to the hotel.
- A red parasol [17] in front of the blue tent on the street side.
- A young mango tree close to the tent.
- Tall trees along the boundary with the hotel.
Establishing A Timeline
In Siem Reap, the rainy season normally runs from June until November. Flooding of the Siem Reap River is a frequent problem in the city. The town centre was reported to be severely affected by flooding in 2009, 2010 and 2011. Also, Bon Om Touk, a Cambodian Water Festival, is celebrated in November at the level of Wat Bo Bridge close to the Hotel Angkor Sayana.
Using Flickr, Google maps, YouTube and news articles, images mainly related to these events were investigated. Those showing the hotel were used to build a chronological sequence of changes in the construction of the building between 2005 and 2011 (See Figure 35 to Figure 46). A timeline with the main observations is summarised in Table 2.
The majority of the structure and façade of the hotel was finished between 2004 and 2007, with many of the outer accessories fitted by the end of this period (see Figure 35 to Figure 38).
In the second half of 2006 the building was surrounded by scaffolding and green netting (See Figure 36 and 37). This green netting is not observed on ImageC20. Furthermore, imagery of different construction sites as found in Siem Reap revealed that wooden poles are commonly used for scaffolding. The wooden poles [5] laying on the ground on ImageC20-B (see Figure 22), were likely part of the scaffold structure used in the hotel construction. The rear awnings [3] were fitted most probably whilst the scaffolding was in place. Therefore, ImageC20 was likely taken after the scaffolding was decommissioned.
Figure 35: April 2005. View of the construction of the Hotel Angkor Sayana from across the Wat Bo Bridge. The construction of the third floor just started
Figure 36: November 2006. View of the construction of the Hotel Angkor Sayana from across the Wat Bo Bridge. The Hotel was already fitted with a roof . A section of the awning is visible. However, wooden scaffolding and green netting are still in place. No windows are fitted yet to the building
Figure 37: December 2006. View from the corner River Road with Road 22. The hotel was still surrounded with wooden scaffolding and green netting. The latter seems to fall onto the front corner of neighbouring plot of land. This is not featured on ImageC20. A row of tall trees is seen along the fencing dividing the two properties
On February 2007, after scaffolds were decommissioned, the building featured no windows (see Figure 38). By April 2008, the majority of the floors were fitted with wooden frames. However, the ground floor on the north side did not have all of the windows fitted until August 2008 (see Figure 39 and 41).
Figure 38: February 2007. View of the construction of the Hotel Angkor Sayana from across the Wat Bo Bridge. The hotel no longer features scaffolding and green netting around it. No fitted wooden windows are yet visible. The awning above the third floor is clearly visible
Figure 39: April 2008. View of the Hotel Angkor Sayana from Pokambor Avenue (bottom) compared to a view from Samdech Tep Vong Street in 2013 (top). The ground floor of the hotel is not finished. The north wall and its windows are missing. The opposite side feature on ImageC20 could have been in the same conditions. The first floor seems to have the windows frames fitted though
On April 2008, the fencing of the hotel appeared to be made of galvanised steel sheets (see Figure 40). A blue tarpaulin, similar to the one used for the blue tent[16], is also observed on the front of the plot of land. However, its shape did not seem to match the profile of the blue tent [16] from ImageC20.
Figure 40: April 2008. View of the Hotel Angkor Sayana from Pokambor Avenue (north).The construction site is shown still enclosed by a fence of galvanised steel sheets. A blue/green tarpaulin is seen at the front of the adjacent plot of land (marked in pink) just to one side of the tree fork and electricity post. Although in the same position next to the hotel, this does not seem to be the tent seen on ImageC20-C and is likely a more improvised version
Figure 41: August 2008. View of the Hotel Angkor Sayana from across the Wat Bo Bridge. All floors seem to be fully fitted with wooden windows including the ground floor
A picture dated October 2008 is shown in Figure 42. The long distance shot was taken from approximately this point (13°21’32.20″N 103°51’32.41″E) by the river on Pokambor Avenue and pointing towards the corner of the Angkor Sayana Hotel. Although at a long distance, many details can be observed. One footing and a pole belonging to a traffic sign post is visible. This sign is shown in clear detail on another image from 2009. Beyond the traffic sign, a red parasol largely matches the tone, shape and lettering of the one seen on ImageG20-C. Close to the parasol there is a blue area in similar position and height to the tent [16] seen on ImageC20-C.
In October 2009, flooding affected the riverside area. Several images were found with different angles of the spot right behind the tree fork next to the hotel. A wooden structure similar to the one of the tent [16] on ImageC20-C is shown dismantled or collapsed.
As no blue tent is seen on the corner of the plot of land, the blue tarpaulin and wooden structure seen in Figure 43 are believed to be the decommissioned tent [16] from ImageC20, partially seen in Figure 42 from October 2008.
A faded red parasol is also observed in the image, with the parasol’s lettering on it looking very similar to the one featured on ImageC20-C. The faded colour could be the result of the sun striking on the same original bright red parasol observed in the Image from 2008 in Figure 42.
An air compressor was identified close to the parasol. The people in charge of the shack to the right of the image may have had a small stall selling drinks and air service for tuk-tuks, motorbikes and bicycles as seen in other stalls in Siem Reap. The stall might have been operating from the blue tent [16] before its decommissioning.
Figure 42: October 2008. This image found on Flickr was shot from the approximate coordinates (13°21’32.20″N 103°51’32.41″E) on Pokambor Avenue, pointing towards the corner of the Angkor Sayana Hotel. One footing and a pole which belonged to a traffic sign post in front of the hotel is visible. Behind the traffic sign, a red parasol largely matching the tone, shape and lettering of the one seen on ImageG20-C. Close to the parasol a blue area in similar position and height to the tent seen on ImageC20-C
Figure 43: October 2009. Flooding affected the riverside area on October 1st 2009. Different views of the corner of the adjacent plot of land next to the hotel construction site. A wooden structure similar to the one featured on ImageC20-C is shown collapsed. A damaged blue/green tarpaulin is seen next to a faded red parasol. The lettering on this parasol looks very similar to the one featured on ImageC20-C. An air compressor seen close to the parasol. Image Source/ Flickr: SarahDepper – “Siem Reap in flood”
Young leaves in mango trees are of purple or copper colour. This leaf type is observed on an image from October 2009 in approximately the same location of the mango tree from ImageC20-C. However, the tree observed is higher than sheet metal fencing line from the construction site. Due to perspective, the young and less dense tree from ImageC20-C is estimated to be approximately on or below this line.
In ideal conditions, young mango trees can grow up to 1.5m/year. If ImageC20-C is assumed was produced in 2008, this growth rate is consistent with the approximate difference in height observed between the mango tree in 2009 and ImageC20’s on Figure 44.
A blue tent [13] is also observed within the construction site. This element is featured on ImageC20 and has been highlighted in blue.
Figure 44: A mango tree is observed above the fence line. A tree was identified having leaves of copper colour which is typical for young leaves. The same type of leaves are observed on ImageC20-C. An example is offered as a reference. Within the premises of the hotel construction site, a blue tent [13] is also visible. this tent is featured on ImageC20-C and has been highlighted in blue. Image Source/ Flickr: Ignacio Izquierdo – “Siem Reap Flooded”
The same air compressor observed in October 2009 was identified on Figure 45 in 2011, indicating that the people in charge of the shack/stall in 2009 might have been still working/living on this site.
The galvanised metal fencing was replaced by a solid wall with spikes. Also, a young mango tree is seen in the same relative position as the smaller one observed on ImageC20. The shack observed in October 2009 during the flooding was relocated to approximately the same spot where the blue tent [16] was located on ImageC20. Satellite imagery from 2010 indicates this change was already implemented in March 2010. These observations suggest ImageC20 was more likely produced prior to 2010.
Figure 45: November 2011. A ChildSafe network-certified tuk-tuk passing by the plot of land where children were abused. A similar air compressor observed in October 2009 was identified. A young taller mango tree is seen in the same relative position as the smaller one observed on ImageC20. The shack observed in October 2009 during the flooding was relocated to approximately the same spot where the blue tent [16] was located on ImageC20. Satellite imagery from 2010 indicates this change was already implemented in March 2010. The galvanised metal fencing was replaced by a solid wall with spikes
Figure 46: Another example of other initiatives against child abuse seen in Siem reap back in 2005
Table 2: Approximate timeline of the construction of the hotel building and observations on the adjacent property. The information is used to establish a likely period of time within which Imagec20 could have been produced
Using satellite and street view imagery, simplified models of the hotel building and nearby houses were prepared. Orientation and relative sizes of buildings were considered. Based on solar data for the site’s coordinates and neglecting atmospheric and surface factors, an approximation of the shadows cast by the hotel building on adjacent houses was computed.
Although the shape of the resulting shadows might not be exactly the same due to the simplification of the building features and atmospheric factors, the analysis is aimed at providing an intuitive approach that could tell when it is more likely for the shadows of the building to reach the nearby building as seen on ImageC20.
The results are shown in Figure 47. An approximate date was estimated.
There are two options possible: early May or early August at approximately 3pm.
Figure 47: A simplified model of the hotel building helped to calculate an approximate date for ImageC20
Conclusion – Part II ImageC20/Siem Reap, Cambodia
The title of the image posted by Europol helped to focus the search on Asia. After editing ImageC20-C, more features of an electricity post seen in the background of the image were revealed. This information allowed us to narrow down the search to the main roads of Siem Reap in Cambodia, where exactly the same posts were found.
All the trees in the background of the image had long straight trunks and dark leaves. This type of trees were similar to those observed along the Siem Reap River road. The posts featured on ImaceC20 was next to a tree fork with the characteristics described above. A preliminary sketch of the site was prepared to assist in the search of this tree along the river road.
ImageC20 was geolocated in the Wat Bo village of Siem Reap on coordinates 13°21’24.90″N 103°51’31.60″E next to a hotel formerly known as the Angkor Sayana Hotel and within the perimeters of an empty plot of land.
Although no specific images were found showing a clear angle of the blue tent [16] observed on ImageC20-C, the information gathered allowed to establish a timeline for the construction of the hotel to identify its progress year by year until the features observed on ImageC20 were all identified. A red parasol largely matching the one featuring on ImageC20 was also identified from an image dated October 2008.
The mango tree featured on ImageC20-C was identified as a taller tree on an image from 2009. Assuming the tree followed a growth rate lower than the maximum theoretical value of 1.5m/year, It is likely the ImageC20-C was taken in 2008 in order to account for the difference in height observed in the trees until 2009.
After modelling the shadows the hotel building casts on nearby houses, the results were compared against the original image to estimate the time of the year when the images were produced.
Based on the evidence discussed two scenarios are possible:
1) ImageC20 was likely produced between 2007 and 2009; either in early May or August
2) ImageC20 was most likely produced in August 2008 at around 3 pm.
There is evidence the town of Siem Reap was host of many initiatives against child abuse during the analysed period.
Based on the information discussed, there seemed to be a continuous presence of people living or working within the property adjacent to the hotel between 2008 and 2011. The tenants of the shack and stall might have witnessed some suspicious activity on the property. Also, as the operation of the stall remained ongoing until 2012, the construction company, the staff working for the hotel, as well as tuk-tuk drivers regularly stopping by may still be able to provide relevant information about some of the activities that have taken place on the property.
According to experts consulted, the images seem to have been taken with a phone camera. For the period of time in question, this type of technology was just emerging. Perhaps it might be possible for the authorities and experts to obtain data or other information that helps to identify the phone to then trace it back to the owner who used it in Cambodia on the dates and time proposed.
Research by : Carlos Gonzales, Daniel Romein, Timmi Allen and “Bo”
