Two Europol StopChildAbuse Images Geolocated: Part II — Cambodia
In the previous part of this investigation, we showed how a batch of images published by Europol, Group ImageG13, was geolocated to a small coastal village in southwest Madagascar. Based on the evidence discussed, it was determined that ImageG13 was most likely produced between January 2002 and March 2004. Given the number of hotels and bars in the area during this period and the reported levels of exploitation of minors, it is also very likely the image was related to sex tourism.
Part II of the investigation analyzes another batch of images, ImageC20, which have been geolocated to Siem Reap, Cambodia. Similarly to the previous case, the location was found close to a hotel building and is most probably related to sex tourism too.
On this occasion, the city district investigated was found to be visited by thousands of local and international tourists during a yearly festival. The amount of images recorded by visitors allowed us to build a timeline to chronolocate ImageC20 by observing a nearby construction site as a reference. The preparation of a 3D model in conjunction with solar data and shadow analysis allowed us to estimate the approximate year, month and time of the day when ImageC20 was taken.
Siem Reap, Cambodia
1. The Location:
Group ImageC20 was geolocated to coordinates (13°21’24.90″N 103°51’31.60″E) in Siem Reap, Cambodia at the level of the Wat Bo village in the city centre.
2. Initial Observations
– ImageC20-A,B & C from Figure 21 were assumed to be taken on the same plot of land. In order to determine the site layout, the main elements on each image were identified and numbered. An analysis based on these elements and their respective shadows allowed us to establish a connection between the three images.
– The wall featured on ImageC20-C was believed to be a continuation of the wall  featured on ImageC20-B. By assuming this, different sections of a building are also visible behind the fences and bushes. A sketch of a hypothetical building  behind the fence, served as the connection between the three pieces as shown in Figure 22. All of the puzzle pieces were put together indicating that the offender did the three shots pointing towards the same wall.
– On the right side of ImageC20-C, just behind the fence, a window  located just between a tree [6*] and the bushes was visible. On the top left corner of ImageC20-A, a building overhang  was noticed. A shadow seemed to be projected on another nearby building surface , indicating that the building  or another object that was not visible was probably taller than the adjacent houses.
– ImageC20-A & B feature a building with pink roofing sheets . They also show a pile of long, straight wooden poles  lying on the ground between trees  and a fencing wall .
– The borders of the land plot suggested an improvised construction. The bottom wall section , made of bricks, seems to have lost its render and painting. Above and along the same wall, a top section made from galvanised-type roofing sheets [9,12] was noticed. Some of the sections of the lower brick wall featured metal spikes .
– Power line cables and a post  were noticed on the top left corner of ImageC20-C. This indicated the plot of land was likely to be next to a road. Based on the multiple number of cables hanging, the property was likely to be in a large village. More details of the electricity post  were found by zooming in and reducing the brightness of the original ImageC20-C. The post seemed to be made of concrete and of trapezoidal shape. It also featured several reinforcing concrete ribs as shown in Figure 25. This element was of extreme importance when carrying out the screening process detailed in the following section.
– The original title posted by Europol on ImageC20-C was the following: “This is most likely a village in Asia, do you recognise where is it located?”. This statement was used to centre the initial search efforts in Asia. Further analysis on vegetation led the investigation team to believe it could be in southeast Asia.
– Thick and high tree trunks  elevate in a straight line behind the posts and cables. There are also several trees of the same type within the land plot [6,6*].
– Also, on the left side of ImageC20-C, an improvised tent was visible. The tent seemed to be made of a blue-green tarpaulin held together by a wooden structure . On one side of the tent, there were clothes hanging as if they were drying after having been washed. On the other side of the tent, to the left, a red parasol was visible . The whole configuration indicated the possibility of people living or working under this tent.
– Behind the steel roofing sheet fence , the tip of a similar blue tent structure is visible.
– Based on all this information, a preliminary sketch of the site was produced to assist the geolocation process. Using this sketch, general urban layouts from satellite imagery could be quickly assessed as potential leads for a geolocation.
3. The Screening Process
Initial efforts focused on finding urban centres in southeast Asia that could lead to a village featuring the following elements:
– Houses with pink roofing sheets type .
– Concrete electricity posts type .
– Tall trees type  along the roads.
The following countries were checked for potential geolocation matches: Thailand, Singapore, Vietnam, Indonesia, Laos and Cambodia. After a full day of navigating via street view in Google Earth through the principal cities of these countries, only Siem Reap was shortlisted as a potential candidate. This city presented the largest number of similarities to the source photograph, including vegetation, buildings, fencing and, most importantly, electricity posts type . Some of these similarities are listed in Figure 24–Figure 27 in the exact order they were found.
4. Geolocating Group ImageC20
All the findings listed in the screening process strongly indicated that group ImageC20 was likely to be geolocated in Siem Reap. A satellite image of the city revealed a large concentration of trees type  along the Siem Reap river which has been marked in yellow in Figure 28. Parallel to the river, there are two main roads called “River Road” (northbound) and “Pokambor Avenue” (southbound). Both have been fully fitted with concrete posts type  as seen in 2013 Google maps street view.We took a section of the original ImageC20-C featuring a post  and a “tree fork”  next to it. This image was zoomed and flipped horizontally to recreate the relative view a person standing on the road would see as shown in Figure 29. The result was used as a visual pattern to check trees next to posts along 5 km, up and down the river.
Using Google street view, a match was found on River Road at the level of the “Wat Bo” village (coordinates 13°21’24.90″N 103°51’31.60″E); just between a hotel formerly known as the “Angkor Sayana Hotel & Spa” and an empty plot of land which is now occupied by a shopping centre as shown in Figure 21. The empty plot of land, and its surroundings, largely matched the sketch drawn in Figure 23 in the previous section.
Now that a match for the tree fork and post was found, further verifications of the site were needed. By exploring Road 22 adjacent to the plot of land, more matching elements were identified. The triangular roof elevation covered in pink roofing sheets , the fencing wall  and the overhang  are visible on street view from 2013 (See Figure 30).
Observing the hotel from Samdech Tep Vong Street and Road 22, it was determined that the overhang  seen on ImageC20-A is an awning attached around the building’s perimeter above the third floor (See Figure 31). Doing further visual checks, the middle brown window on the ground floor of the hotel matched the relative position, style and colour of window  seen on ImageC20-C (See Figure 32).
Having identified all these elements, the location was considered verified.
5. When Was ImageC20 Likely Taken?
From the previous section, we know ImageC20-C was taken in a plot of land featuring several trees and a section of a building which belonged to the Angkor Sayana Hotel.
The earliest satellite image available for the location dates back to April 2004. According to this image, the hotel did not exist by then. The surrounding land was occupied by houses and trees.
Another satellite image from December 2015 shows the hotel; but this time, the adjacent property to the south was fully occupied by a concrete structure. Hence, ImageC20 could not have been taken at this point in time since trees are missing on the image.
The investigation was then limited to the period 2004-2015. However, more information was needed to build a more detailed timeline based on the evolution of the hotel construction and its surroundings.
The original name of the Hotel was Angkor Sayana Hotel & Spa but it was recently rebranded as Pierre Hotel. The former managing company was called INUNISSION Group Co., Ltd and acquired the hotel around 2011. In January 2013, the Phnom Pehn Post reported that Innussion had the lease of the hotel for at least 10 years. The hotel opened its doors in January 2012 and this is confirmed by multiple users on TripAdvisor.
An image of the Hotel from 2013 features the pool and a wall with spikes in the background (See Figure 34). This wall is located exactly where the galvanised roofing sheets  were on ImageC20-C. For obvious aesthetic reasons, this means that ImageC20 was likely taken before the hotel was fully finished and operating in January 2012.
From Figure 31 and Figure 32, there is evidence indicating that the hotel was built at least up to the third floor and fitted with awnings  when ImageC20 was taken. Windows around the ground level were likely already in place.
Hence, the estimation of the date for ImageC20 was done based on answers to the following questions: at which point, between April 2004 and January 2012, that is, during the construction of the Angkor Sayana Hotel, was the following criteria more likely to be met?
Criteria for the hotel:
- Built up to the third floor or above with awnings  attached.
- Windows  fitted in the ground floor.
- Perimeter fence  constructed with galvanised sheets.
Criteria for the adjacent property:
- A blue tent  on the front corner adjacent to the hotel.
- A red parasol  in front of the blue tent on the street side.
- A young mango tree close to the tent.
- Tall trees along the boundary with the hotel.
Establishing A Timeline
In Siem Reap, the rainy season normally runs from June until November. Flooding of the Siem Reap River is a frequent problem in the city. The town centre was reported to be severely affected by flooding in 2009, 2010 and 2011. Also, Bon Om Touk, a Cambodian Water Festival, is celebrated in November at the level of Wat Bo Bridge close to the Hotel Angkor Sayana.
Using Flickr, Google maps, YouTube and news articles, images mainly related to these events were investigated. Those showing the hotel were used to build a chronological sequence of changes in the construction of the building between 2005 and 2011 (See Figure 35 to Figure 46). A timeline with the main observations is summarised in Table 2.
The majority of the structure and façade of the hotel was finished between 2004 and 2007, with many of the outer accessories fitted by the end of this period (see Figure 35 to Figure 38).
In the second half of 2006 the building was surrounded by scaffolding and green netting (See Figure 36 and 37). This green netting is not observed on ImageC20. Furthermore, imagery of different construction sites as found in Siem Reap revealed that wooden poles are commonly used for scaffolding. The wooden poles  laying on the ground on ImageC20-B (see Figure 22), were likely part of the scaffold structure used in the hotel construction. The rear awnings  were fitted most probably whilst the scaffolding was in place. Therefore, ImageC20 was likely taken after the scaffolding was decommissioned.
On February 2007, after scaffolds were decommissioned, the building featured no windows (see Figure 38). By April 2008, the majority of the floors were fitted with wooden frames. However, the ground floor on the north side did not have all of the windows fitted until August 2008 (see Figure 39 and 41).
On April 2008, the fencing of the hotel appeared to be made of galvanised steel sheets (see Figure 40). A blue tarpaulin, similar to the one used for the blue tent, is also observed on the front of the plot of land. However, its shape did not seem to match the profile of the blue tent  from ImageC20.
A picture dated October 2008 is shown in Figure 42. The long distance shot was taken from approximately this point (13°21’32.20″N 103°51’32.41″E) by the river on Pokambor Avenue and pointing towards the corner of the Angkor Sayana Hotel. Although at a long distance, many details can be observed. One footing and a pole belonging to a traffic sign post is visible. This sign is shown in clear detail on another image from 2009. Beyond the traffic sign, a red parasol largely matches the tone, shape and lettering of the one seen on ImageG20-C. Close to the parasol there is a blue area in similar position and height to the tent  seen on ImageC20-C.
In October 2009, flooding affected the riverside area. Several images were found with different angles of the spot right behind the tree fork next to the hotel. A wooden structure similar to the one of the tent  on ImageC20-C is shown dismantled or collapsed.
As no blue tent is seen on the corner of the plot of land, the blue tarpaulin and wooden structure seen in Figure 43 are believed to be the decommissioned tent  from ImageC20, partially seen in Figure 42 from October 2008.
A faded red parasol is also observed in the image, with the parasol’s lettering on it looking very similar to the one featured on ImageC20-C. The faded colour could be the result of the sun striking on the same original bright red parasol observed in the Image from 2008 in Figure 42.
An air compressor was identified close to the parasol. The people in charge of the shack to the right of the image may have had a small stall selling drinks and air service for tuk-tuks, motorbikes and bicycles as seen in other stalls in Siem Reap. The stall might have been operating from the blue tent  before its decommissioning.
Young leaves in mango trees are of purple or copper colour. This leaf type is observed on an image from October 2009 in approximately the same location of the mango tree from ImageC20-C. However, the tree observed is higher than sheet metal fencing line from the construction site. Due to perspective, the young and less dense tree from ImageC20-C is estimated to be approximately on or below this line.
In ideal conditions, young mango trees can grow up to 1.5m/year. If ImageC20-C is assumed was produced in 2008, this growth rate is consistent with the approximate difference in height observed between the mango tree in 2009 and ImageC20’s on Figure 44.
A blue tent  is also observed within the construction site. This element is featured on ImageC20 and has been highlighted in blue.On Figure 45, an image from November 2011 features a ChildSafe network certified tuk-tuk passing by the plot of land where children were abused. The ChildSafe Movement is a global child protection system established and powered by Friends-International. It was designed to train local citizens and tourists on how to detect and report abuse, and to teach children how to seek protection and create awareness campaigns targeting the international community. During the present investigation, other posts from other institutions were found advertising similar efforts around Siem Reap as early as 2005 (see Figure 46). Although not the objective of this report, it is important to highlight these initiatives as they might be an indicator of the fight against high levels of child abuse seen in this area of Siem Reap during the period in question. Moreover, they might have information of a child abuse network operating in the area around that time.
The same air compressor observed in October 2009 was identified on Figure 45 in 2011, indicating that the people in charge of the shack/stall in 2009 might have been still working/living on this site.
The galvanised metal fencing was replaced by a solid wall with spikes. Also, a young mango tree is seen in the same relative position as the smaller one observed on ImageC20. The shack observed in October 2009 during the flooding was relocated to approximately the same spot where the blue tent  was located on ImageC20. Satellite imagery from 2010 indicates this change was already implemented in March 2010. These observations suggest ImageC20 was more likely produced prior to 2010.
Using satellite and street view imagery, simplified models of the hotel building and nearby houses were prepared. Orientation and relative sizes of buildings were considered. Based on solar data for the site’s coordinates and neglecting atmospheric and surface factors, an approximation of the shadows cast by the hotel building on adjacent houses was computed.
Although the shape of the resulting shadows might not be exactly the same due to the simplification of the building features and atmospheric factors, the analysis is aimed at providing an intuitive approach that could tell when it is more likely for the shadows of the building to reach the nearby building as seen on ImageC20.
The results are shown in Figure 47. An approximate date was estimated.
There are two options possible: early May or early August at approximately 3pm.
Conclusion – Part II ImageC20/Siem Reap, Cambodia
The title of the image posted by Europol helped to focus the search on Asia. After editing ImageC20-C, more features of an electricity post seen in the background of the image were revealed. This information allowed us to narrow down the search to the main roads of Siem Reap in Cambodia, where exactly the same posts were found.
All the trees in the background of the image had long straight trunks and dark leaves. This type of trees were similar to those observed along the Siem Reap River road. The posts featured on ImaceC20 was next to a tree fork with the characteristics described above. A preliminary sketch of the site was prepared to assist in the search of this tree along the river road.
ImageC20 was geolocated in the Wat Bo village of Siem Reap on coordinates 13°21’24.90″N 103°51’31.60″E next to a hotel formerly known as the Angkor Sayana Hotel and within the perimeters of an empty plot of land.
Although no specific images were found showing a clear angle of the blue tent  observed on ImageC20-C, the information gathered allowed to establish a timeline for the construction of the hotel to identify its progress year by year until the features observed on ImageC20 were all identified. A red parasol largely matching the one featuring on ImageC20 was also identified from an image dated October 2008.
The mango tree featured on ImageC20-C was identified as a taller tree on an image from 2009. Assuming the tree followed a growth rate lower than the maximum theoretical value of 1.5m/year, It is likely the ImageC20-C was taken in 2008 in order to account for the difference in height observed in the trees until 2009.
After modelling the shadows the hotel building casts on nearby houses, the results were compared against the original image to estimate the time of the year when the images were produced.
Based on the evidence discussed two scenarios are possible:
1) ImageC20 was likely produced between 2007 and 2009; either in early May or August
2) ImageC20 was most likely produced in August 2008 at around 3 pm.
There is evidence the town of Siem Reap was host of many initiatives against child abuse during the analysed period.
Based on the information discussed, there seemed to be a continuous presence of people living or working within the property adjacent to the hotel between 2008 and 2011. The tenants of the shack and stall might have witnessed some suspicious activity on the property. Also, as the operation of the stall remained ongoing until 2012, the construction company, the staff working for the hotel, as well as tuk-tuk drivers regularly stopping by may still be able to provide relevant information about some of the activities that have taken place on the property.
According to experts consulted, the images seem to have been taken with a phone camera. For the period of time in question, this type of technology was just emerging. Perhaps it might be possible for the authorities and experts to obtain data or other information that helps to identify the phone to then trace it back to the owner who used it in Cambodia on the dates and time proposed.
Research by : Carlos Gonzales, Daniel Romein, Timmi Allen and “Bo”