File exchanges of child pornography are occurring on the Internet primarily through P2P networks. P2P technology enables users to exchange files directly among themselves, without any support from, or connection to, a central server. This lack of a central hub has complicated investigations and facilitated illicit activities. When a central hub is used, the investigation focuses on the exchanges through the hub. With P2P, however, at any given time millions of computers could be connected to P2P networks; this decentralization poses a challenge to investigators. Responding to complaints about the illicit use of P2P networks, the Brazilian police confirmed the severity of the child pornography on these networks. Aiming to curb this problem, the Brazilian Federal Police, using the available expertise of its computer forensic examiners, developed the "EspiaMule" (SpyMule) tool, a software application capable of monitoring the pedophilia file exchanges in P2P networks. The software works primarily as a spy agent, sweeping the World Wide Web in search of people sharing child pornography files. This tool is based on the networks used by the "eMule" application, which is a popular P2P in Brazil. Because eMule is an open source application, the Brazilian Federal Police modified the source code to allow the filtering and identification of computers that share files with illicit content. With a list of files proven to contain child pornography, the developed tool can be used to discover all computers currently connected to the eMule network sharing such files anywhere around the world. Through information collected by the EspiaMule and sent to Interpol, over 400 search warrants were served worldwide, with more than 100 arrests reported. 1 table and 4 notes