Bad actors can use multiple platforms in their attempts to distribute abusive imagery and and exploit children online. Through Lantern, tech companies securely and responsibly share intelligence and threat indicators related to child sexual exploitation and abuse, helping them detect and address harm that may have otherwise gone unnoticed on their platforms.

Before Lantern, no reliable framework existed to coordinate industry efforts against predators exploiting multiple platforms to evade detection. Lantern now bridges that gap, strengthening collective defense across the sector.

Signals are threat indicators, intelligence, or other information that may be relevant for other companies to identify OCSEA activity on their platforms. Common forms of signals include hashes, URLs, and usernames. Participating companies choose which signals to share and ingest based on their policies, legal obligations, use cases, and assessments of potential relevance. 

Lantern supports two primary categories of signals: content-based and incident-based.

Content-based signals relate to material being shared or discussed—including known child sexual abuse material (CSAM), grooming manuals, or other illegal images, video, audio or text. 

These signal types may include: 

• Hashes of known CSAM that can be used to detect and prevent redistribution 
• URLs linking to webpages that host OCSEA content 
• Keywords or codewords used by offenders to evade detection in sharing or engaging with CSAM.

Content-based signals play a crucial role in preventing the rapid dissemination of harmful content, particularly CSAM, across multiple platforms.

For instance, predatory actors may store and share CSAM via hosting providers and share URLs of the content on social media apps.

When a platform identifies a URL with CSAM, after reporting it to relevant authorities, they can alert other participating companies through Lantern. This allows hosting providers and other platforms to act quickly and remove the content, helping stop the spread of abuse across the internet.

Incident-based signals relate to identified events or exchanges that violate child safety policies. By sharing these signals, companies help one another detect evolving threats and respond more effectively—closing the gaps between platforms that bad actors aim to exploit. Examples include: 

• Accounts engaged in grooming or solicitation of minors to create explicit content
• Indicators of financial sextortion
• Patterns suggesting coordinate abuse across services.

By sharing these signals, companies help one another detect evolving threats, and respond more effectively – closing the gaps predators can exploit between platforms.