Inside India’s problem with reporting child sexual abuse material

Why in the News

The National Human Rights Commission (NHRC) has issued notices to two Union ministries and the Delhi Police over paid Instagram advertisements. The advertisements allegedly used search terms such as “rape video” and “child video” to direct users to Telegram channels offering child sexual abuse material (CSAM). The Commission has directed that an Action Taken Report reach it within two weeks. The advertisements had passed the review systems of Meta, which owns Instagram, and remained available until the company’s attention was drawn to them. Two questions follow from that failure: whether the statutory duty to report the offence was complied with, and whether a platform whose artificial intelligence systems actively shape content can still claim the legal protections available to intermediaries.

What is a CyberTipline report?

1. An alert raised by the platform: A CyberTipline report is generated when a technology platform detects suspected child sexual abuse material and refers it for law enforcement follow up.
2. It locates the material, not its source: A report often identifies where the material was found, not where it originated, and establishing origin requires a separate investigation.
3. How it reaches an Indian investigator: Reports are processed by the National Crime Records Bureau (NCRB) and the Indian Cybercrime Coordination Centre (I4C), and are then routed and assigned to the relevant State and district authorities.

What has the Commission asked of the platform?

1. Whether the offences were reported at all: Meta has been asked whether the alleged offences were reported, and, if they were not, to identify those responsible for ensuring compliance.
2. The duty lies on any person: Section 19 of the Protection of Children from Sexual Offences (POCSO) Act, 2012 requires any person who apprehends that an offence under the Act is likely to be committed, or who knows one has been committed, to report it to the Special Juvenile Police Unit or the local police.
3. Internal processes do not discharge it: The Commission’s stated position is that the obligation cannot be substituted by internal correspondence, grievance redressal or regulatory engagement.

Is a platform that shapes content still an intermediary?

1. The systems do more than host: A supplementary representation before the Commission argued that Meta’s artificial intelligence assisted tools generate captions, recommend posting schedules, optimise engagement and assist monetisation.
2. The classification question has been referred: The Ministry of Information and Broadcasting has been asked to examine whether such functions remain consistent with intermediary status, or whether they resemble the role of a publisher of online curated content under the Information Technology Rules, 2021.
3. The stake in the answer: Intermediary status carries protection from liability for content that others post. A publisher of curated content carries responsibility for what it puts out.

How many reports arrive, and how many become cases?

1. The volume: India received around 1.9 million CyberTipline reports in 2025.
2. The conversion is small: Only a fraction of those reports translate into police action.
3. Verification precedes registration: Authorities conduct a preliminary verification before a first information report is registered, and not every report progresses beyond that stage.

Where does a report stall before an FIR?

1. Report quality varies: The reports vary significantly in quality and completeness, so many cannot carry a preliminary verification at all.
2. A prima facie test on the material: Investigators assess whether the flagged material prima facie depicts child sexual abuse material. Once jurisdiction is identified and the material verified, the case is forwarded to the local police station or cyber police unit.
3. Age is the recurring obstacle: Verifying the age of the victim is among the more recurring difficulties, since poor image quality, blurred visuals or uncertainty about age obstruct that finding.
4. Attribution comes last: Only once a first information report is registered do investigators begin identifying the individual behind the account.

What decides the outcome in court?

1. A designated forum: Cases are generally tried before the special courts designated under the POCSO Act.
2. Convictions turn on digital evidence: Defence arguments frequently focus on whether the accused was actually the person using the device, the SIM card or the internet connection linked to the offence.
3. An unidentified offender ends the case: Where investigators cannot identify the person responsible, police may file a closure report.

Challenges to CSAM detection and prosecution in India

1. Encryption removes the point of detection: Offenders increasingly use encrypted platforms, where the service provider cannot scan content and therefore generates no report at all. Eg. End to end encrypted messaging leaves no server side copy for a platform to match against a database of known material.
   The Fix: Require significant platforms to report metadata level signals, such as advertising keywords and channel invitation links, where the content itself is not visible to them.
2. Synthetic material defeats hash matching: Detection relies on matching a file against databases of known material, and newly generated images produce no match. Eg. Images of children produced by generative models carry no prior hash record.
   The Fix: Extend detection to classifier based models and recognise synthetic child sexual abuse material explicitly as an offence in the governing statute.
3. The reporting duty has no platform specific machinery: Section 19 places the duty on any person, and prescribes no route by which a foreign incorporated platform files with an Indian police unit. Eg. Reports currently arrive through the CyberTipline chain rather than as a statutory filing by the company.
   The Fix: Prescribe a designated reporting channel and a fixed filing deadline for significant social media intermediaries under the Information Technology Rules.
4. Judicial expansion has outpaced investigative capacity: The offence has been widened by the courts, and district cyber units have not grown to match it. Eg. In Just Rights for Children Alliance v. S. Harish (2024) the Supreme Court held that storing and viewing child sexual abuse material is itself an offence under Section 15 of the POCSO Act.
   The Fix: Fund district cyber forensic units and a national facility for medical and forensic age estimation, so verification is not left to the investigating officer’s judgement.

Conclusion

Detection is not the constraint in this system. The constraint sits between an automated alert and a chargeable case, where verification, jurisdiction and identification each remove a share of what was reported, and a closure report is the default outcome when identification fails. A platform whose systems recommend, caption and monetise what appears on it is not simply carrying what other people post, and the protection designed for a passive carrier does not obviously fit it. How the Ministry of Information and Broadcasting answers that classification question is the thing to watch.

Back2Basics: National Human Rights Commission

1. A statutory body: The NHRC was constituted under the Protection of Human Rights Act, 1993, and is not a constitutional body.
2. Composition: It has a Chairperson and members, with the chairpersons of specified national commissions, including the National Commission for Protection of Child Rights, as ex officio members.
3. Powers: It inquires suo motu or on a petition into a violation of human rights or negligence in preventing one, and holds the powers of a civil court for that inquiry.
4. Limits: Its findings are recommendatory, and it can require the concerned government to report the action taken on them.

Matching Previous Year Question

“[2017] In India, it is legally mandatory for which of the following to report on cyber security incidents? 1. Service providers 2. Data Centres 3. Body corporate Select the correct answer using the code given below: (a) 1 only (b) 1 and 2 only (c) 3 only (d) 1, 2 and 3 ANSWER: (d)”