Dirty work

October 4 was a big day for police in the southern Indian state of Kerala. After a months-long investigation, officials launched an early morning sweep, arresting 43 men suspected of possessing and sharing material depicting child sexual abuse. Sixteen of them were picked up in the city of Kochi by Officer Binoy Joseph and his colleagues. During the raid, Joseph was shocked to realize that he recognized one of the people, a minor who had already been apprehended on similar charges. Once the suspects were in custody, the unit returned to the station, feeling pleased with their work. The raid was the culmination of many long days tracking the suspects’ online activity, gathering IP and physical addresses, and collecting names and phone numbers. Now, authorities would begin the work of searching the more than 300 devices they had confiscated. 

That raid, dubbed P-Hunt (the “p” stands for “pedophile”), was the second major child abuse crackdown by Kerala police in 2020. Since the sweeps first began in 2017, arrests have ramped up significantly: while only one person was apprehended in the first two years, 35 people were taken into custody in 2019, and since the onset of the coronavirus pandemic, numbers have continued to climb. The second most-recent operation, in June, resulted in the arrests of 52 people. This, officials suggest, is reflective of larger trends. “We have seen an increase in complaints and a higher number of people involved [in circulating sexual material of minors] during the pandemic,” says Joseph, who has been a member of Kochi’s cyber crime unit since its inception 12 years ago. Nationally, the number of distress calls made to the main child services hotline has also risen during the health crisis. 

The circulation of materials relating to child abuse is an enormous global problem — a 2019 New York Times investigation found that technology companies reported a record 45 million photos and videos of children being abused in 2018 alone — and India is one of the largest creators and consumers of this material in the world. In 2019, the CyberTipline for the National Center for Missing and Exploited Children (NCMEC), received nearly 2 million reports of child sexual exploitation across the country. While the dark web used to be the primary destination for finding and sharing this material, now it functions as an entry point for end-to-end encrypted platforms like WhatsApp and Telegram that host a thriving market for photos and videos featuring underage children being abused. Between June and July of last year, researchers from the nonprofit Cyber Peace Foundation identified 1,299 groups circulating legal and illegal pornography on WhatsApp, and 350 such channels on Telegram. 

Kerala police are among the most proactive in India when it comes to prosecuting underage sexual abuse. Roughly three years ago, the Countering Child Sexual Exploitation (CCSE) unit was carved out under the umbrella of Cyberdome, a state-level online crime unit, to focus explicitly on the problem. Inspectors are continuously trained in new technologies, which they use to track suspects across various platforms. “It’s very difficult to state how many groups we monitor at a time because they keep changing names and platforms — one we are watching today might disappear and resurface elsewhere a few weeks later,” said Syam Kumar, who has been with the CCSE for a year now. To target their searches, officials use location-specific queries and keywords such as “Kerala” or “Malayalam” — the language spoken across the state. The work isn’t easy. Although there are several national laws criminalizing the possession and circulation of sexual materials involving children, enforcement is lax, and suspects are often released on bail within a few months. Moreover, Indian society tends to stigmatize victims of sexual abuse, which may discourage them from reporting the crimes to police. 

Located in a suburb of Kerala’s capital city of Thiruvananthapuram is a yellow building surrounded by lush greenery. This is the headquarters of the CCSE unit, where a 12-member team monitors activity across the dark web, WhatsApp groups, and Telegram groups, and also investigates tips they receive from the NCMEC and other sources. When officers aren’t actively searching for victims or tracking perpetrators, they might be analyzing data or seized electronic devices. 

A few months ago, Kumar, the CCSE inspector, and his colleagues received a link to join a Telegram group. Run by a 36-year-old IT professional, it was called Kaliyum Chiriyum, which loosely translates to “laugh and play.” It was filled with hundreds of crowd-sourced videos and images of children in dingy rooms being sexually abused, followed by enthusiastic comments and celebratory emojis. These groups are usually active only when somebody has a trove of new material to share, but when they do light up, often around midnight, participants are expected to engage. Kumar joined and immediately began commenting on videos. 

This is only the first step in infiltrating these communities. The tricky part comes next, when authorities must work to carefully gain the trust of administrators and members. While each case presents a unique set of challenges, the fastest way to be accepted is to actively participate and pick up the slang. Malayalam code phrases like Karikku ondo? (Do you have any tender coconut?) and kilunth (tender leaves) come up again and again in the chats, and participants will often refer to “cheesa pizza” or “CP” — an abbreviation of “child pornography.” CCSE officers will also research the admin’s online persona to figure out their interests and steer the conversation accordingly. “The idea is to convince them we are genuine,” said Manoj Abraham, the head of Cyberdome. Once that has happened — and it sometimes takes months — officials will send out a link that allows them to see the IP address of anybody who clicks on it. 

As police efforts to bust child abuse rings have become more sophisticated, so too have the techniques abusers use to evade them. Rather than organizing standard WhatsApp group chats, administrators now sometimes set up channels in which members can’t view other participants’ personal details. Other times, admins register for WhatsApp with phone numbers from third-party websites that self-destruct within 15 minutes of use. “They take that time to create and verify their WhatsApp account, after which the number vanishes,” explained Abraham. 

In order to bust the Kaliyum Chiriyum group, Kumar and his colleagues engaged with the admin for a few months before sending him a series of digitally marked images that would covertly reveal his IP address. Typically, one of these images includes a pixel embedded with a unique value that then reveals identifying information about the person who downloads the image, explained Ritesh Bhatia, a cybercrime investigator.

The effort was part of a larger coordinated campaign involving multiple WhatsApp groups. “All raids have to occur simultaneously, as even one arrest too early can tip off others,” Kumar explained. The key thing is not to scare off the targets: Members of a child abuse group will often leave the moment word gets out about an arrest. Some admins even program their groups to self-destruct if they’re apprehended. 

In addition to mass sweeps, police also make isolated arrests based on details from individual chats. In early November, the administrator of one group shared images of a little girl in compromising positions, identifying her as his niece. Police used a specialized link to track down his IP and home address, where they ultimately found the girl. She and her mother had moved in with the man during the pandemic, which is when he began creating and sharing the videos. “The police intervened, called the mother, and arrested this fellow,” said Abraham.

The case reflects what Abraham identifies as a radical shift in the kind of content he’s seen circulating in the last two years. Previously, most material found in local WhatsApp groups featured victims who appeared to be outside of India, and participants in those groups were primarily consumers, not creators. Now, he said, a growing chunk of material is made up of children from Kerala. 

Officers are trained to be attuned to clues that suggest a video has been shot locally: a Malayalam calendar in the backdrop, for example, or a regional language being spoken off-screen. “They are doing this with our children, and most of the time, the offender is a relative or a neighbor, not a stranger,” said Abraham, who refused to share too much insight into police tactics, to avoid compromising their techniques. 

Even as each of India’s 36 states is a world unto itself, Kerala is particularly unique. It is the only state that has a democratically elected communist government, and has remained a leftist stronghold for decades. It is the most literate state in India; 96.2% of its 35 million inhabitants are able to read and write in Malayalam. As of 2018, Kerala also had the highest rate of smartphone penetration and last year had the second highest rate of internet penetration, at 56%, just after New Delhi, with 68%. For experts who study child sexual abuse, this has created something of a chicken-or-egg question: Are the numbers higher in Kerala because education and connectivity mean that people are more likely to report crimes, or has easy access to digital tools led to a statewide increase in the production and distribution of exploitative content? 

There are no easy answers, but the growth and adoption of technology has certainly made the problem of child sexual abuse more visible. Back when the Kerala Police’s cyber cell launched in 2008, only a handful of officers received any instruction in fighting cybercrime. “Facebook hadn’t really made its mark in India yet,” said Joseph, the Kochi police officer. In the last decade, however, both the unit and social media platforms have come a long way. It’s now common for police to receive training in new software and in extracting evidence from confiscated devices. The Kerala police also hold an annual conference on cybersecurity and policing and have established partnerships with other law enforcement agencies across the world.

These efforts all require employing a more preventative model of policing and finding new ways to encourage people to report abuse. “Online crime against children is highly underreported,” said Abraham. “If you look at the traditional policing paradigm, it starts off with a complaint, and then the cops start investigating. But if we sit back and wait for a complaint, it doesn’t come, and then most police assume that there is no crime at all.” Several police stations in India have built areas with toys to make child victims feel safer, and others have painted their walls bright colors and decorated them with cartoons. “From a distance, it looks like a crèche,” said Harish Vasudevan, a lawyer based in Kerala, of one such building. “Until one realizes that it’s a police station.” 

Of course, reporting a crime and securing a conviction are entirely different matters. While Vasudevan and other lawyers acknowledged that the Kerala police are making a noteworthy effort to protect children, they also highlighted that conviction rates for sexual abuse cases are less than 25%. Often this is the result of procedural errors. Police commonly fail to ensure that certain protocols are followed when processing paperwork — that an adult is present during the deposition of a minor, that a medical examination happens promptly — and as a result, suspects avoid jail time. “Without the presence of scientific evidence, it is hard to prove cases,” said Kokila Babu, a lawyer in India who specializes in handling instances of child sexual abuse. 

As for the people who were arrested during the October raid in Kerala, they were all released on bail less than two months later, and their trials have not yet begun. Devices seized from their homes are still in police custody, and their internet activities are being monitored by the CCSE. Abraham acknowledged that this isn’t ideal, but he said that the raids have at least one unexpected advantage: they raise local awareness about sexual violence against children. This “natural deterrence” could play a role in keeping kids safe in the future, he said, which would contribute to his unit’s ultimate aim: making their jobs obsolete.