After the Union government imposed the COVID-19 lockdown in end-March 2020, Kerala police began to monitor 11 social media websites including WhatsApp, Facebook, Instagram, TikTok and Telegram. But the focus was on two platforms—WhatsApp and Telegram. Some of these groups—named Sreyayude, Thavalam, Manthanga Girl and Thanasertha—had over 200 members each.

The arrests revealed how consumption of CSAM spanned the spectrum of society. In Idukki, it was a doctor in his early 30s working at a primary health centre, while in Kottayam, it was a hotel management graduate working in West Asia who got stuck in India when he came home and the government announced a sudden lockdown. In Kannur, it was a man in his late 30s who had done a short stint in the Indian Navy and then taken up a job in Abu Dhabi. He had come to Kerala recently.

According to the police, many of those arrested were men in their early 20s. In Kollam, everyone arrested was below 25 years old, including a 16-year-old. In the case of the minor, police officers have said that they will consult mental health experts and send him for counselling.

According to the CCSEC officer, some people had sold CSAM for small amounts of money. “In about three or four cases, the persons involved provided CSAM content in return for money. The sums involved were typically between Rs 25 and Rs 50 and transacted over Paytm or UPI,” he said.

Source: Kerala Police

Source: National Centre for Missing
and Exploited Children

India’s laws against CSAM are comprehensive, says A Nagarathna, a legal scholar who heads the Advanced Centre on Research, Development and Training in Cyber Laws and Forensics at the National Law School of India University, Bengaluru.

“But the implementation is completely lacking,” she says.

The numbers back her. The NCMEC recorded nearly 2 million instances of access to CSAM from India in 2019 alone. But the National Crime Records Bureau’s data show that we are prosecuting a tiny fraction of this.

Consider the IT Act, which prosecutes the publishing of CSAM under Section 67(B). NCRB started collecting data on cybercrime since 2014 and has data on prosecuting CSAM from 2014 till 2019.

Only five and eight cases were filed in 2014 and 2015 respectively under Section 67(B). Since then, numbers have increased—17 cases were filed in 2016, 46 in 2017, and 82 in 2018. In 2019, 102 cases were registered under Section 67(B), with Kerala(27) and Uttar Pradesh(25) accounting for half of these cases.

More shockingly, the police in the 19 metropolitan cities filed only 15 of these cases in the four years between 2016 and 2019. Delhi accounts for six of these, while Bengaluru, Chennai, and Mumbai have filed two cases each.

Police have filed charge sheets for 120 of the 260 cases across India between 2014 and 2019, a follow-up rate of 46 pc. But at the courts, CSAM convictions turn into a trickle.

In the six years between 2014 and 2019, trials were completed in only eight cases: Six people have been convicted in these cases. By the end of 2019, the courts had a pendency percentage of 98.8 pc for cases filed under the IT Act to prosecute CSAM.

The POCSO Act has seen more prosecutions than the IT Act—between 2014 and 2019, 2481 cases have been filed under Section 14 and Section 15 of the Act.

In particular, the last few years have seen a significant drive to register more cases, with 374 cases in 2017, 812 cases in 2018, and 1114 cases in 2019. Odisha leads in registered cases with 885 cases, followed by Bihar (368), Rajasthan, Kerala, and Jharkhand.

But, just as in IT cases, our biggest cities have seen very few prosecutions. Of the 2,347 cases filed from 2016-2019, only 87 of these were filed in the largest 19 metros. Jaipur alone accounts for more than half with 27 cases. Hyderabad filed no cases in these four years, while Delhi, Mumbai, Kolkata, Chennai, and Bangalore filed 42 cases altogether.

POCSO SECTION 14 and 15
(2014-2019)

Tap on grey boxes to reveal more data

Source: National Centre for Missing and Exploited Children

Once POSCO cases are registered, the police have largely been prompt in filing charge sheets. Between 2014 and 2019, over 80 per cent of FIRs were converted into charge sheets.

But it is at the courts where prosecution gets stuck. Between 2014 and 2019, out of 1,777 cases that were pending trial, only 295 cases could be decided: 129 cases resulted in convictions while 164 resulted in acquittals.

The NCRB data on trafficking also classifies cases where children have been trafficked under the head of “Child pornography”. Between 2016 and 2019, 316 such cases have been recorded in Karnataka, Kerala, Madhya Pradesh, and Rajasthan.

“Whether it is the POCSO or IT Act, cases registered are quite low,” the NLSIU’s Nagarathna says.
There are many reasons behind this—reluctance to register cases, cases not being reported and so on. “When it comes to any cybercrime including this, we hardly have any police officers who take it seriously. Unfortunately, for child sexual abuse, they should be more proactive. But it remains the same,” she says.
According to Nagarathna, police officers need training in handling digital evidence. “We have done a lot of sensitisation programmes for Special Juvenile Police units on sexual offences. But this training does not cover online sexual offences,” she says.

What the NCRB data does not show is how widespread the problem is in India. Vidya Reddy, the Founder-Director of the Chennai-based NGO Tulir – Centre for the Prevention and Healing of Child Sexual Abuse, says that consumption of CSAM happens across class and geographies.

Reddy had participated in the drafting of the 2008 amendment to the IT Act, which criminalised possession of child sexual images.

She cites how a case filed by Tulir in 2015 against a Tamil Facebook group showed that the problem was widespread. This group posted everyday pictures of kids doing normal things such as eating ice-cream, playing in the park, accompanied by Tamil text, transliterated in English, asking “Enna Pannla”—“What should we do?”

“What followed was the most violently graphic sexual comment from people,” says Reddy. “There were 3,000 people commenting on a picture. And those 3,000 people obviously see an eight-year-old eating an ice-cream in a very sexual way,” she said. Reddy says that when a complaint was raised with Facebook, the company responded that the text was not considered as an obscenity by the community guideline moderators working in English.

So, Tulir filed a case against the Facebook page and the police arrested not just the administrator but also went after others. “When they did arrest some of the guys who made the comments, they were your average Joes,” she says. “There was the guy next door, there was a fellow who worked at a Kirana shop, there was a stockbroker, there was a courier delivery guy. They were not just from Tamil Nadu, but from all over the world, not restricted to any geographical part.”

THE TIPPING POINT: CSAM PROSECUTION GETS A BOOST

This mismatch between CSAM consumption and prosecution in India would change only in 2018 with the introduction of a bill in the United States.

In the US, the NCMEC runs CyberTipline, a centralised mechanism that the public, as well as electronic service providers (ESPs) such as Facebook and Google can use to report CSAM. The ESPs account for nearly 99 per cent of the reports. The NCMEC reviews each tip and then forwards it to US law enforcement agencies for investigation.

On December 12, 2018, President Trump signed into law the CyberTipline Modernization Act of 2018, which allowed the CyberTipline to forward tips to foreign law enforcement agencies approved by the US government. Importantly, foreign law enforcement agencies would have access to tips on CSAM from companies based in the US.

In India, matters moved rapidly. By February 2019, the Union Cabinet approved access to Tipline reports from NCMEC to prosecute offenders. On April 26, 2019, a little over four months since the law was passed in the US, the NCMEC signed an agreement with the NCRB, giving the Indian agency access to CyberTipline reports.

The NCRB would also be able to share these reports with law enforcement agencies across India. Access to the Tiplines comes with a few restrictions—the Tipline has to be accessed on a standalone computer through a VPN, and tipline reports cannot be shared with anyone other than law enforcement agencies.

This NCMEC deal helped Indian police departments enforce the IT Act. One of the reasons that only a handful of cases under the IT Act have been recorded is that the Indian government has no jurisdiction over the servers run outside India by companies such as Facebook, Google, Twitter, and Telegram. With the NCMEC deal, the government has found a way to circumvent this when it comes to CSAM content. Now, ESPs like Facebook, Google, and Microsoft report to NCMEC, and they in turn forward these reports to NCRB.

The Indian government has also beefed up the laws to prosecute CSAM. In July 2019, Parliament passed an amendment to the POCSO Act which, among other things, promises more stringent punishments on CSAM. For using children for pornographic purposes, jail was set to a minimum of five years. This could go up to life imprisonment or death if aggravated penetrative sexual assault had happened.

The amendment also increased the punishment for storage of pornographic material to five years. It included two offences. One, failing to destroy, delete, or report CSAM. Two, transmitting, displaying, and distributing such material. In March 2020, the government notified the updated POCSO Rules 2020, making these new amendments effective from March 9.

The sum of these actions has been an unprecedented surge in prosecutions across the country. By March 2020, the NCRB had shared 32,719 NCMEC CyberTipline Reports. The NCRB says more than 182 FIRs have been filed (many states have not yet set up the specialised units, and those that have done so are yet to get going).