Tackling the 'Iceberg'

Warning: This article contains sensitive content about child sexual exploitation.

In Malaysia, there are two big forces in the battle against child sexual abuse material - the police, who go after bad actors, and activists who fight for victims’ rights.

On one side, the police have scored noteworthy crackdowns that have crippled notorious rings linked to child sexual abuse material (CSAM).

But the police also realise that their successes are just the tip of the iceberg as they face many hurdles in their efforts to go after bad actors online.

As a nonprofit journalism organization, we depend on your support to fund more than 170 reporting projects every year on critical global and local issues. Donate any amount today to become a Pulitzer Center Champion and receive exclusive benefits!

Meanwhile, child rights activists argue that despite these successes and the improvements to how the authorities operate, there is still an enormous disparity between the number of actual complaints and official statistics.

These experts argue that in order to keep children safe online, adults need to change their mindsets about how to combat CSAM.

They’re getting younger

Last year, Malaysia’s largest operation against CSAM thus far had a troubling revelation - not only were victims getting younger, but some of them were also active perpetrators.

These underage individuals, or “suspects” as the police call them, were involved in the production, distribution, and sale of CSAM, according to the police’s Division 11 (D11), which handles sexual, women, and child investigations.

Illustration by Wong Yu Han and Amin Landak.

“In the past, children were just victims, but some are now producing and selling these materials,” said Siti Kamsiah Hassan, the nation’s top police officer in charge of sex crimes.

One group that was crippled in 2025’s nationwide dragnet called “Op Pedo 2.0” comprised individuals aged 12 to 71 who were either users, distributors, or account administrators, said Siti Kamsiah, D11’s principal assistant director.

“These suspects collected CSAM from various platforms to trade, with the profits used to fund online gambling and other illegal activities,” she said.

However, child rights advocates said it is a long-known fact that official data merely scratches the surface of CSAM crimes, and the actual number of cases is far higher.

In its 2025 report, the Internet Watch Foundation, a British-based CSO that works to eliminate CSAM from the internet, said it received a total of 451,210 reports, with up to 311,610 reports confirmed to contain or lead to CSAM.

The foundation’s AI-Generated Child Sexual Abuse Report 2026 further revealed that 8,029 images and videos generated with artificial intelligence they assessed contained CSAM, with 65 percent of videos, or 2,233, being classified as the “most extreme” or Category A. This category is reserved for the most graphic and explicit depictions of sexual abuse.

Although the authorities have done much to make it easier and safer for victims to come forward, there are still barriers to effective CSAM reporting, experts told Malaysiakini.

These barriers, they argued, explained why there is a huge disparity between Malaysian CSAM complaints reported to international platforms such as CyberTipline compared to cases reported to the Malaysian police.

In 2017, police recorded only 17 cases. In 2021, this number reached 140 cases. Cases went up to 230 and 381 in 2024 and 2025, respectively.

Siti Kamsiah explained that the public should be cautious when interpreting this data, as the rise in cases is due to intensified crackdowns.

Yet the CyberTipline, which is managed by the United States’ National Center for Missing & Exploited Children (NCMEC), received about 80,000 CSAM reports in Malaysia in 2025. Although it is based in the US, the agency works with law enforcement bodies globally and is open to receiving tips from anywhere.

Malaysian cases reported to CyberTipline are referred to the Malaysian police for prompt action.

The disparity, said the experts, lies in how both channels take CSAM complaints - CyberTipline reports are anonymous and can be submitted online, while complaints to the police must be lodged in person.

However, experts and child rights advocates such as Firzana Redzuan and Srividhya Ganapathy argued that the disparity also exposes flaws in Malaysia’s system in addressing CSAM despite the continuous improvements by the authorities.

Successes, hauls, and hurdles

Siti Kamsiah said the proliferation of different private messaging platforms, encryption systems, and e-wallets is increasing the distribution and sale of CSAM across borders.

Another worrying development is the use of AI and deepfake apps to create CSAM using real-life images of minors, she added.

Malaysiakini’s two-month investigation revealed how platforms such as X, Telegram, and TikTok were being used to sell both real and AI-generated CSAM along with other problematic content related to children.

Despite the authorities’ success, Siti Kamsiah believes these cases are just the tip of the iceberg as they face several hurdles in investigating CSAM.

“Young victims often feel ashamed to tell their parents,” the senior police officer said, adding that they are afraid of being reprimanded for taking part in a forbidden act.

“Also, since these cases don’t involve physical contact, some are completely unaware that what happened to them is an actual criminal offence.”

There is also a lack of crisis awareness among some victims and their families, who may not know that producing CSAM is illegal and that it is necessary to report abuse to the police, Siti Kamsiah added.

“In reality, criminals will groom underage victims and entice them to provide private images. Once the coercion succeeds, it will escalate into a physical relationship.”

Parents would then only file police reports when the damage is done, at which point the case turns into statutory rape, she said. It is often only later that grooming and CSAM are discovered.

Lastly, the prospect of reliving the trauma when lodging police reports or going through a medical examination at the hospital is too much for many victims, who then choose to suffer in silence.

Difficulties in securing evidence and prosecution

Even with continuous crackdowns, prosecuting perpetrators remains a challenge, said Siti Kamsiah.

From 2018 to 2025, police opened 1,213 investigation papers, but only 43.9 percent of these cases led to charges in court.

This is because CSAM networks in Malaysia take the form of extremely isolated private groups that share dark web links or direct transactions. These groups can also branch out, said Siti Kamsiah.

“When one group obtains and sells materials, their members become new carriers who create a new external group to redistribute the material. This virus-like, sprawling network complicates the police’s efforts in tracking and shutting them down.”

She also explained that criminals are often proficient in exploiting various platforms’ loopholes and features, such as encrypted messages and huge file transfer capacities.

“They mostly build connections through online games, then turn to instant messaging apps (like WhatsApp) to share CSAM. They’ll use Instagram to create private accounts to share bulk images, and they will hide on the dark web.”

Why prosecutions are difficult to start

Digital evidence: Evidence is often scattered across different places - hard disks, virtual cloud services, and, quite frequently, overseas servers. Authorities also face a shortage of digital forensics experts to crack the data due to advanced encryption methods. Digital evidence can also be easily destroyed or corrupted, indefinitely prolonging an investigation.

Data storage: As there is no law requiring internet service providers (ISP) to store all user data for a certain period, authorities sometimes find evidence vital to investigations deleted. As such, Siti Kamsiah urged the government to enact clear regulations and enforce statutory compliance for ISPs to store users’ data for a set period of time. The police can then use the data to obtain the subscribers’ identities and IP addresses as irrefutable, admissible evidence.

Cross-border crimes: While victims may be located in Malaysia, offenders are often secluded on the other side of the world. Red tape between different authorities in cross-border cases makes it nearly impossible to wrap up investigations as soon as possible.

Victims' identities: Images of victims may be old and taken when they were younger. As their facial features change with age, it becomes difficult to legally authenticate their identities in a court case.

Despite these challenges, Siti Kamsiah said police have improved their operations to increase the rate of CSAM reports to track down bad actors.

This included requiring female police officers to handle all cases involving female victims and ensuring that statements are taken in private rooms instead of in the open.

Police are also intensifying collaboration with authorities and institutions in other countries, such as the NCMEC.

Why children still don’t trust the law and other hurdles

Q’s problem was described by Firzana, who founded the child rights advocacy group Monsters Among Us (MAU). The child’s predicament was reported to MAU.

Q’s case highlights one of the barriers to victims lodging reports with local authorities about CSAM, despite repeated calls for them to do so.

The physical and social distance between victims and the authorities is a barrier which some can find too high to surmount, said Firzana.

“If a 12-year-old goes into a community police station to lodge a report all by themselves, will they be treated seriously or will they be seen as messing around?

“Or if a deaf child is sexually abused, can they use sign language to communicate to the police officer? Can the adults in the room comprehend sign language? Let’s not forget that this is the first step towards lodging a police report.”

These experiences illustrate how the investigation system is not designed to give child victims privacy and the ability to report without having to alert their parents, said Srividhya, who co-chairs the Child Rights Innovation and Betterment (CRIB) Foundation.

“Malaysia doesn’t have any local platform that is trusted by the children to seek help without alerting adults,” said Srividhya when describing the second barrier to child-friendly CSAM reporting.

“How will I report it without disclosing the child’s identity? And why should we disclose the child’s identity, really?”

Srividhya also said Malaysia’s criminal justice system is punishment-oriented and is focused on prosecuting offenders and securing convictions as fast as possible. But many child victims are uncomfortable with what the process demands.

“Most underage victims don’t want to stand in court to be cross-examined by a defence lawyer or be forced to recount their trauma in front of strangers,” Srividhya added.

When child victims are too scared to endure the ordeal of a court case, these cases risk being dropped and never recorded in the system, she added.

Prevention and education start with adults

The third barrier to effective CSAM reporting, the child advocates said, is the predominant culture among adults to judge and shame the victims themselves.

While they’re supposed to protect, the fear is that counsellors, teachers, or school authorities’ first reaction would be to reprimand the victim, said Srividhya.

“They would be asked - why did you do something so shameful?” and the parents would be immediately alerted.

“Grownups are busy punishing and blaming the children, while the crime itself is ignored. Harsh feedback like this from adults will often harm the child victims again.”

Srividhya of Child Rights Innovation and Betterment (CRIB) Foundation.

They argue that this is where the greatest change needs to happen for Malaysia to tackle CSAM. For if adults want children to feel safe coming forward, they must change how they treat victims.

In some online sexual abuse cases, victims had sought help from their parents only to be brushed off with remarks such as: “Bear with it, and it’ll be over soon” or “Just ignore them.”

Similarly, advocacy programmes that “encourage children to voice out” would fall on deaf ears when children fear judgment, dismay, and punishment from their parents.

When parents can’t be counted on, is there any choice left for kids seeking refuge?

Need Help?

If you or someone you know is experiencing online sexual exploitation, grooming, or abuse, please seek help and report it to the relevant authorities or support organisations.

Talian Kasih 15999: A 24/7 emergency helpline established by KPWKM and operated by Jabatan Kebajikan Masyarakat (JKM)

Internet Watch Foundation (IWF) – Report online child sexual abuse material: https://report.iwf.org.uk/my

NCMEC CyberTipline – https://report.cybertip.org/

MCMC Complaint Portal: https://aduan.mcmc.gov.my/

In emergencies, please contact 999 immediately.