What this project is
Noesis is the Greek term for direct, unmediated understanding, the mind grasping the structure beneath reality rather than relying on basic sensory perception or step-by-step reasoning. CaseNoesis is designed to help gain insight into case data across the full range of modern offense types to surface how platform affordances are misused and how crime types evolve alongside technology.
The theoretical foundation is the affordance–misuse–harm framework developed in Affordances for Harm: How Offenders Misuse Platform Capabilities to Exploit Children, and Where to Intervene. CaseNoesis is the empirical test of whether that framework generalizes beyond the ICAC typology it was derived from and expands to include: fraud, cyber-enabled crime, trafficking, and any offense that leads to exploitation or technology-mediated harm.
This platform is early stage and under active development .
The φ / η / ψ mapping
Platforms are the wrong unit of analysis. They emerge, scale, and disappear. The unit that holds across platform generations is affordance: a capability the platform's design makes available, independent of designer intent.
Trajectory → Type
Maps offense trajectories L to exploitation types E. A complete trajectory terminates to a single type.
Type → Harms
Maps each exploitation type to the set of victim-facing harms H it comprises.
Affordance → Harms
Maps each affordance class to harms observed across all trajectories in which it appears.
Optimal trajectory
where \(L^{*}_{g,A} \in \mathrm{Seq}(A)\) is the perceived optimal path an offender pursuing goal \(g\) traces through affordance environment \(A\), \(U_g\) is the utility function for goal \(g\), and \(\mathbb{E}[\cdot]\) is taken over stochastic outcomes (victim compliance, detection risk, platform intervention).
Exploitation state machine
A trajectory \(L\) is expressed as a state path \(\sigma(L) = (s_0, s_1, \ldots, s_T)\) through
\(S\)
Finite offense-phase classes from the CAC ontology: \(S \supseteq \{\mathrm{InitialContactPhase},\, \mathrm{ConditioningPhase},\,\)
\(\mathrm{ExploitationPhase},\, \ldots\}\).
\(A\)
Affordance environment: anonymity, ephemerality, contact discovery, unmonitored communication, distribution infrastructure, generative synthesis.
\(T : S \times A \to \Delta(S)\)
\(T\) is represented as CAC phase edges between states, accelerated by affordances. Edges run state-to-state, with affordances attached where present.
\(R_G\)
Goal-conditioned rewards. \(R_g(s)\) measures how much reaching state \(s\) advances goal \(g \in G\).
\(s_0\)
\(s_0 = \mathrm{InitialContactPhase}\). Every enforcement-record trajectory begins here.
\(F\)
\(F \subseteq S\), terminal \(\mathrm{ExploitationPhase}\) instances. A trajectory ends when \(s_t \in F\).
\(L^{*}_{g,A}\) is the Bellman-optimal affordance path from \(s_0\) to \(F\) through \(M\); the machine implements Equation (1).
Goal-dependent divergence
Harm content of a trajectory
A path resolves to an exploitation type; an exploitation type resolves to the harms that constitute it.
Marginal exploitation utility
An affordance with high \(u(a_{\mathrm{new}}, g)\) for any exploitation goal \(g\) is a measurable risk before it is a documented harm.
Key terminology
Affordance: a neutral capability the platform's design makes possible. Misuse surface: how an offender turns that affordance toward an offense (offender-facing). Harm vector: what happens to a victim; victim-facing, drawn from the fixed set \(H\). Backbone \(B\): the invariant stage sequence every complete trajectory passes through: InitialContactPhase, ConditioningPhase, ExploitationPhase, MaintenancePhase.
The paper
For years, the history of the internet has been championed through the lens of platforms, growth, and innovation. Far less often do we systematically examine the harms that have scaled alongside that same infrastructure. From large-scale content distribution and global connectivity to encrypted messaging and AI-generated imagery, the capabilities that make technology worth using have also made it exploitable.
The same infrastructure that connected billions of people quietly rewired the economics of child exploitation, not because these technologies were designed to cause harm, but because offenders are adaptive: some pursue children deliberately, others are capitalizing on access and opportunity the internet has made possible for the first time.
This paper draws on 7,426 curated Internet Crimes Against Children case records spanning 2002 to 2026 and asks: which platform capabilities offenders exploit most consistently, how technology is weaponized within specific offense subtypes, including grooming, sextortion, production of CSAM, and coordinated criminal networks, and where disruption is most realistic. Across 30+ platforms and 61 task forces, the same capability types surface again and again: anonymity, disappearing content, file distribution, contact discovery, trust-building at speed, regardless of which platform is in the headlines.
The technology changes. The exploitation mechanics do not.
Empirical laws & closure theorem
Induced from the complete observable ICAC universe (7,426 enforcement records, 24 years, 30+ platforms). Each is stated as a falsifiable universal.
Axiom 1 (Goal Closure)
The goal set \(G\) is finite, historically stable, and prior to technology. An offender acts on a goal: reach a child, obtain or produce material, coerce, distribute, sell. Technology changes which trajectory realizes a goal and at what cost. It does not add an element to \(G\).
Theorem 1 (Closure of \(H\))
The victim-facing harm set \(H\) is finite and closed.
Proof sketch: By Axiom 1, \(G\) is closed. The exploitation type set \(E\) is the image of \(G\) under the offender's trajectory choice; closure is preserved under surjective image. The harm set \(H\) is the image of \(E\) under \(\eta : E \to 2^H\), and inherits closure from \(E\) in turn. Technology acts on trajectories through \(A\), never on the sets \(G\), \(E\), or \(H\) themselves.
Falsification: A single documented case in which any exploitation type proceeds without a contact phase.
Falsification: A documented trajectory in which any element of \(B\) is absent.
Falsification: A documented case in which a new affordance produces an exploitation type \(e \notin E\).
Falsification: A documented case in which platform removal produced goal modification rather than trajectory substitution.
What's coming
- I Data ingestion: Multi-offense-category pipeline for publicly available enforcement records (press releases, court filings) across fraud, cyber-enabled crime, trafficking, and categories yet to be defined.
- II Offense category expansion: Taxonomy and ontology mapping that extends the φ/η/ψ apparatus beyond the CSEA domain in which it was originally validated.
- III Cross-domain validation: Testing whether the empirical laws (contact primacy, backbone invariance, type invariance, affordance displacement) hold across offense types and platform generations outside the ICAC corpus.