A police unit's dogged hunt for paedophiles

The L-shaped room has a modest arsenal: a handful of computers, a conference room, an extra space just large enough to stretch legs and store case files.

Shyam Kumar A, a sub inspector, stared at the flickering computer screens, his gaze reflecting determination and weariness in equal measure. The room exuded an atmosphere of unspoken tension. The muffled sound of his colleagues typing and the hum of electronic equipment served as a disquieting soundtrack.

Every day, Shyam and the other five men in the room, a group of constables who all grew up without mobile phones or computers, find themselves playing catch-me-if-you-can with some of the most ingenious criminals who distribute child porn on the internet.

These cops don’t have the technical prowess many cyber experts do. And yet, they are arguably India’s finest when it comes to combating the darkest corners of the digital underworld. The CCSE is the first and only such unit in India to comprehensively monitor what is globally known as CSAM, or child sexual abuse material, on the internet. They have arrested over 400 suspected paedophiles till date, according to official estimates. This is more than any other state, and has recently inspired other states like Telangana and Maharashtra to open similar units.

“We have directly rescued around 13 children through our unit in Kerala," inspector general P Prakash said. He heads Kerala’s cybercrime unit called Cyberdome, of which CCSE is a part of. “We have arrested three doctors, a scientist, government officers, and a lot of students and migrant labourers."

According to Prakash, they are taken as a role model by international organizations like the Interpol, and by other states as well. “We are literally the first such unit to be formed and the most effective unit in India right now," he added.

Last three years alone, the small team at CCSE has brought down an estimated two terabytes of CSAM. Around 3.5 crore CSAM files were transmitted just in peer-to-peer, a file sharing technology, all over India in a week last June, according to estimates shared by Prakash. He claimed that around 35,000 people have used it across 478 cities in India.

“It’s a huge number. And I’m not speaking about social media. I am not speaking about Telegram. Just peer-to-peer, which requires a certain tech knowledge," Prakash said.

Evidence in numbers

The pace of technological advancements in the last decade has given the perpetrators of online crimes an unwavering advantage. New-age cybercriminals, with their arsenal of encrypted networks, anonymized transactions, and sophisticated evasion tactics, present an intricate labyrinth that challenges even the most seasoned law enforcement agencies. And children are the most vulnerable.

In the 2020 Child Safety Online Index, a study by DQ Institute, an international think-tank, India ranked second in terms of the extent of cyber hazards faced by children, and ninth in terms of having the finest measures in place to protect children.

According to the latest figures issued by the National Crime Records Bureau, cybercrimes against minors have progressively climbed from 88 in 2017 to 1,376 by 2021. However, as various studies have pointed out, it is possible that the data is still significantly under-reported because crimes against minors go largely unreported.

According to the National Center for Missing and Exploited Children (NCMEC)—an international NGO established by the US Congress that runs a centralized tip line for reporting online exploitation of children—around two million cases of child sexual abuse are recorded in India each year.

When vigilance against such crimes was strong throughout the covid-19 period, data from the National Crime Records Bureau showed a 261% surge in cybercrime against children in 2020, from 305 instances in 2019 to 1,102 cases in 2020.

Kerala recognized the scale of the problem and decided to fight back as early as 2016, when the Cyberdome initiative was launched by a tech-savvy officer in the state force—additional director general of police Manoj Abraham. Prakash succeeded him late last year. In 2017, the Cyberdome began limited operations against paedophiles. Following the success of their operations in 2018, NCMEC and Interpol officials visited Kerala and conducted workshops for the police officers. Based on those interactions, Kerala incorporated the CCSE expert team as a separate, specialized unit. Its operations started in 2020.

The P-Hunt

The CCSE’s journey begins with NCMEC collecting information about websites or social media groups that peddle CSAM. The NGO shares the information to countries worldwide. The National Crime Records Bureau, under the ministry of home affairs in India, further circulates this data to every state.

However, gaining access to closed communities and chat rooms—spread across social media platforms and the dark web (hidden sites that can be accessed using a specialized browser)—and obtaining actionable intelligence against offenders is a Herculean task. The groups often erase content when they suspect they are being tracked. When they remove content, its members are notified. They delete their accounts.

“We sometimes have to coax them with a made-up profile and strike conversations to gain entry to their groups," said Shyam, clad in his worn-out police uniform.

“Even after acquiring access, it is difficult to stay on. Because most groups will ask users to contribute CSAM content to stay in. As government representatives, we cannot share CSAM content. We get only a short time-window to map the members’ accounts, before we are kicked out," he added.

From this mapping exercise, the cops trace the members using open-source technologies, Interpol resources, and collaboration with social media giants such as Facebook and WhatsApp. At best, they secure the IP address.

This is the most time-consuming process in the whole operation. At times, this takes months, as was the case with a kingpin who ran multiple groups circulating CSAM. He was located in Dubai. The cops continued to monitor his internet activity and after nine months, they realized he was coming to Kochi for a vacation. The moment his plane touched down, he was arrested.

Once the CCSE officers successfully identify members in chat rooms, they start to build cases against the suspects. The officers coordinate with their counterparts in various districts, orchestrating simultaneous raids. These raids, nicknamed as P-Hunt (P standing for pornography), are noted in Kerala for their spontaneity and large number of arrests.

The clue in a video

Shyam recollected one of the most remarkable encounters in his team’s battle against the perpetrators of child exploitation.

They uncovered an invite-link on the dark web to a chat room spreading porn material through the encrypted messaging platform, Telegram. A shared video showed a house and a street that bore a striking resemblance to Kerala neighbourhoods.

The team figured out the number associated with the Telegram account. One way of doing this, a senior officer requesting anonymity said, involves getting the suspected offender to click on a malware that will disclose his IP address, which is then sent to field-level units to gather actionable intelligence like a name, address or phone number.

However, in this particular case, the phone number belonged to a non-Malayali. But meticulous footwork eventually led the cops onto the right track. The team coordinated with police stations across Kerala to backtrack a series of forwards before they finally found the original video creator. He was someone indeed located in Kerala. The victim captured in the video was his niece, and she has been suffering at the hands of her own kin and was afraid to speak up.

These were the early days of the team’s operations.

“We are not using any unique software or specialized equipment. Besides the Internet connection, we only have some resources provided to us by organizations such as Interpol," Shyam said. “Strategy is our main tool."

The discoveries shattered their belief in the sanctity of family bonds, leaving them grappling with a newfound understanding of the insidious nature of these crimes. It also shattered their preconceived notions of the stereotypical predator. These were not just sinister figures lurking in the shadows. They were ordinary individuals—neighbours, co-workers, fathers, uncles— leading seemingly normal lives.

Clues from videos, meanwhile, have led to other breakthroughs.

“We seek clues such as something personal in a living room or a bedroom, or a calendar with anything written in Malayalam, and so on. When we get something like that, we ask the platform (where the video is uploaded) for the time and location of the upload," informed Shyam.

He illustrated with an example. A picture of two Malayali-seeming grandparents was in the backdrop of a video being circulated in a paedophile group. The team researched this image and came to know about a likely site from where the video was initially uploaded. The cops then approached the platform for the time and location of the video’s upload.

“We identified the residence, and told the family. They had no idea about this video being distributed. The kids in the family made the video for fun while locked indoors during covid-19, and had uploaded it on social media using one of their parents’ accounts," said Shyam.

The deviant scientist

One of their hardest cases was cracking a Tor-using social media account circulating CSAM, according to a second officer in the CCSE team who didn’t want to be named. Tor is an open-source software that enables anonymous communication.

The cops tracked the account’s online activity daily without any success of pinpointing the user’s location for seven months. Then, one day, they got lucky.

The account used a virtual private network (VPN), which encrypts internet traffic and disguises one’s online identity. But that day, this user forgot to turn on his mobile VPN. The cops seized on the opportunity and tracked him down—he turned out to be a scientist with a doctorate in artificial intelligence, leading a respected social life in Kerala.

Despite such successes, the CCSE team’s journey is fraught with challenges. In their most recent raid, CCSE registered roughly 145 cases. However, only 12 arrests were made. Furthermore, only about 50% of the cases overall have resulted in convictions.

Officials explained that an arrest can only be made when the CSAM is found in a user’s device during a raid. That is dependent on the local officer’s ability. Also, dependent on the capacity of many other stakeholders, ranging from the forensics team to the government prosecutors.

‘Lot more to do’

Nonetheless, things appear to be progressing. Federal agencies and other state governments have recently become aware of the threat posed by CSAM. In September 2022, the Central Bureau of Investigation (CBI) launched Operation Megh Chakra, in which it targeted CSAM that uses cloud-based storage (thus the name). The investigative agency launched widespread operations in 21 states and union territories, arresting over 50 people and seizing their electronic devices. Other major operations include Maharashtra’s Operation Blackface in 2019, in which 105 persons were detained across the state for downloading CSAM.

In Kerala, more awareness workshops are now being held, for everyone from beat constables to high court judges.

“It’s only a three-year old unit. We have a lot more to do. In the two years ahead, we will be able to achieve 100% convictions," hoped Prakash. “We are focussed on agency coordination, better collection of evidence, forensics, and capacity building of the stakeholders," he added.

How does this small team of cops keep itself motivated?

“There is no dramatic motivation behind what we do," answered Prakash. “The motivation lies in the concept itself: the protection of children. No child can themselves present the complaint. They are victims, but not a single case is registered by them. We need to step in, we need to fight."