August 16, 2026
By Xari Jalil
LAHORE
On the night of May 23, 2025, police vehicles descended on a modest brick house in Adda Bahar, a small settlement about two kilometres outside Kot Addu in Muzaffargarh.
For residents, the raid initially appeared inexplicable. The house belonged to Shafi Khosa, described locally as a farmer and daily-wage labourer. His 19-year-old son, Junaid, had told people that a facility had been set up there where children could exercise and learn to fight. Some residents simply called it a “fighting school”.
Children from the surrounding area regularly went there. For families whose children had few recreational spaces and whose parents often spent long hours working, the arrangement did not immediately appear suspicious.
Inside, however, investigators found a very different reality.
The facility contained cameras, webcams, professional lighting equipment and high-speed internet. Children were being sexually exploited and the abuse was being recorded and, in some cases, livestreamed. The material was then being sold through encrypted channels and the dark web to buyers outside Pakistan.
According to the Human Rights Commission of Pakistan (HRCP), at least 50 children were victimised in the operation. The case, involving a transnational network and international demand, has become the central case study in HRCP’s new report, “Hidden in Plain Sight: A Study of Online Child Sexual Exploitation in Pakistan.”
But the report’s central warning is considerably larger than the Muzaffargarh case.
It argues that Pakistan’s problem is not simply that children are being abused online. It is that the country’s institutions are still not equipped to recognise, track, prevent or respond to the full nature of that abuse. The technology has moved ahead. The criminals have adapted. The laws have partially followed. The child-protection system has not.
A crime that began in a neighbourhood
The Muzaffargarh case illustrates how easily online exploitation can be concealed within an ordinary physical environment. The children were not necessarily being approached by strangers on anonymous websites. Some were relatives, friends and children from the neighbourhood. The facility itself was presented as a place for physical activity.
The HRCP study found that the surrounding community had little reason to suspect what was happening. Children had few recreational opportunities, while parents were often away for work. Limited digital literacy further reduced awareness of what cameras, internet connectivity and online distribution could enable.
One 12-year-old boy interviewed for the study had never attended school and earned small amounts of money selling nimko at a bus stop. He was taken to the house by his cousin to watch what he had been told would be a “fight”.
The child recalled being surprised that the “fight” involved naked bodies, but repeatedly described it as “just a fight”.
Records later confirmed that he was among the children who had been repeatedly sexually abused and recorded at the facility.
That account captures one of the report’s most disturbing findings: children may not always understand what is happening to them as abuse, particularly when grooming, deception, manipulation or economic vulnerability are involved.
By the time the nature of the abuse becomes obvious, the exploitation may already have been recorded, distributed and replicated online.
Investigators found that dozens of children were brought to the facility daily. The material was reportedly sold through encrypted channels, with the NCCIA director general stating that videos were priced at between $100 and $500 depending on factors including length, quality and buyers’ requirements. The physical location was therefore only the beginning. The actual crime extended into a global digital marketplace.
The report argues that it is misleading to think of the Muzaffargarh case as an offline sexual-abuse case in which technology happened to be involved. Without digital infrastructure, the operation could not have functioned at the same scale or speed.
Cameras allowed abuse to be recorded. High-speed internet enabled transmission. Encrypted communications connected perpetrators. The dark web provided access to international buyers. Digital files could then be copied and redistributed beyond the control of the people who originally created them.
That changes the nature of the harm. An abused child can potentially continue to be victimised long after being removed from the physical location where the abuse occurred. The images can be copied, traded, re-uploaded and can be used to threaten or blackmail the child or family. The child may have no way of knowing where the material has gone either.
In this context the report recommends abandoning the commonly used term “child pornography” in favour of “online child sexual exploitation and abuse” (OCSEA) and “child sexual abuse material” (CSAM). The terminology matters because “pornography” can imply consensual sexual activity or entertainment. Children cannot consent to sexual exploitation. The material is evidence of abuse, not pornography involving a child.
The report says OCSEA encompasses an entire continuum: initial contact, grooming, coercion, recording, circulation, blackmail and the long-term psychological and social consequences for the child.
Pakistan’s biggest problem
One of the most important findings concerns grooming. A perpetrator may begin with apparently harmless communication, gradually establish trust, introduce sexualised conversations, request images, offer gifts or money, threaten exposure or manipulate the child into believing that they are responsible for what is happening.
Yet Pakistan’s institutional response often does not recognise grooming as an early stage of exploitation. The report says grooming is frequently treated as merely inappropriate communication or “bad influence”, rather than as a deliberate mechanism of sexual exploitation.
The same problem applies to ‘sextortion’.
By the time authorities become involved, the perpetrator may already possess intimate images and be threatening to distribute them. The Digital Rights Foundation (DRF), which operates a national cyber-harassment helpline, has documented similar patterns in which survivors seek assistance only after threats have escalated and the situation becomes unmanageable.
For children, the consequences can be particularly severe. A child may fear that disclosure will lead to punishment by parents, humiliation within the community or loss of family honour. In a society where sexual abuse carries profound stigma, the threat of exposure itself can become a weapon.
Alarming numbers
Pakistan does not have a national database capable of providing a reliable figure for OCSEA. That is one of the report’s most significant findings. HRCP examines available evidence to identify patterns of abuse, institutional response and failure. There are, however, indicators of the scale of digital activity.
According to figures cited in the report from the National Center for Missing and Exploited Children (NCMEC)’s CyberTipline, Pakistan-linked reports of suspected child sexual abuse material numbered:
- 1,288,513 in 2020
- 2,030,801 in 2021
- 2,059,884 in 2022
- 1,924,739 in 2023
- 1,036,608 in 2024
These numbers do not represent the number of Pakistani children abused, instead they are reports generated by technology companies and other electronic service providers about suspected material linked to accounts, IP addresses or other digital activity associated with Pakistan. They may include automated detections, duplicate reports, recirculated material or activity involving people outside Pakistan.
Most importantly, Pakistan does not publicly report what happens to these referrals after they arrive.
There is no publicly available national figure showing how many resulted in investigations, FIRs, arrests, prosecutions, convictions, identification of children, removal of material or psychosocial support. That creates a profound accountability gap. The evidence may exist, but the public cannot see the chain connecting the alert to protection.
No clear answer about what happens next
The NCMEC CyberTipline is an important international source of information because US law requires electronic service providers to report suspected child sexual abuse material to NCMEC. Pakistan’s NCCIA is now the country’s central cybercrime body receiving such referrals.
But receiving a referral is only the beginning. Authorities must determine what happened, identify the child where possible, preserve evidence, locate suspects, coordinate with other institutions and determine whether a child remains in immediate danger. HRCP has not found any publicly available system showing how effectively this process works in Pakistan. This is particularly important because Pakistan’s digital ecosystem has expanded rapidly.
By October 2025, the country had approximately 117 million internet users and 79.9 million active social-media accounts, according to data cited in the report. Many children access the internet through family devices or accounts rather than through individually registered accounts. Greater connectivity has brought enormous educational and social opportunities. But it has also created an enormous potential attack surface for people seeking to exploit children.
The new danger is not confined to Facebook or messaging apps
The report warns that OCSEA is increasingly taking place across a much wider digital ecosystem. Gaming platforms, livestreaming services, informal chat spaces, encrypted messaging applications, online forums and invitation-only groups can all provide environments in which children are groomed or exploited.
In gaming environments, perpetrators can communicate with children in real time, use chats or profiles to establish contact, move conversations off-platform, solicit images, engage in financial sextortion or facilitate livestreamed abuse. Encrypted groups create another layer of difficulty. According to the report, perpetrators can use such groups to exchange material, discuss methods of targeting children, share information about avoiding detection and maintain control over victims.
The Muzaffargarh case itself reportedly involved Telegram being used to coordinate activities and exchange information related to the abuse. The dark web adds another layer.
Because it offers anonymity and operates largely outside the visibility of mainstream platforms, it can provide perpetrators with access to international markets while allowing payments and material to move across borders. When one network is exposed, others can potentially reassemble elsewhere.
The result is a form of abuse that is networked, scalable and transnational.
Law struggling to keep up with AI
The report also highlights an emerging threat that did not require a physical act of abuse to cause harm: AI-generated and synthetic sexual imagery involving children. Existing photographs can be manipulated using “nudification” tools or deepfake technologies to create sexualised images of real children.
The child may never have been photographed in a sexual situation and may not even know the material exists. But the consequences can still be devastating. Such images can be used for humiliation, blackmail, sexual extortion, grooming or social punishment. This creates a difficult legal question. Traditional definitions of CSAM often assume that the material documents an actual incident of abuse.
AI-generated material can challenge that assumption. Yet, HRCP argues, the absence of physical abuse during the creation of an image does not eliminate the violation of the child’s privacy, dignity or safety.
It also creates new investigative demands. Authorities must determine whether an image depicts a real child, whether an identifiable child’s likeness was used, whether existing photographs were manipulated and whether the image is connected to blackmail or another form of exploitation.
That requires technical expertise that ordinary cybercrime units may not possess.
Perhaps the report’s most important conclusion is that Pakistan cannot be described as having “no laws” against online child exploitation. The problem is how those laws fit together — and what happens to the child once a case enters the system.
The Criminal Law (Amendment) Act 2016 introduced Sections 292-A and 292-B into the Pakistan Penal Code, criminalising the production, distribution, possession, access to and facilitation of material depicting the sexual abuse of a child. Section 377-A also established child sexual abuse as a distinct offence. These provisions represent a significant departure from the older approach, under which child sexual abuse was often treated through concepts of obscenity, morality or “unnatural offences”.
Pakistan also has the Prevention of Electronic Crimes Act (PECA) 2016, the Juvenile Justice System Act (JJSA) 2018 and the Zainab Alert, Response and Recovery Act (ZARRA) 2020, alongside provincial child-protection laws.
But these instruments were created at different times and for different purposes. PECA was primarily designed as a cybercrime law, addressing areas including cybersecurity, data integrity and national security. Child protection appeared within that framework rather than being the organising principle of it.
Provincial child-protection systems, meanwhile, were largely designed around physical abuse, abandonment, trafficking and neglect, but the digital environment cut across all of them. The result is what one child-protection worker, who was interviewed for the study, described as cases “falling between systems.”
Cybercrime investigators focus on devices, accounts and digital evidence and child-protection agencies may become involved only after a child has been rescued. The police have their own procedures, while prosecutors and courts have another; tech companies have their own reporting and content-moderation systems.
No single institution necessarily follows the child through the entire process.
A child who has been sexually exploited may be required to explain what happened repeatedly to different authorities. The child may have to deal with police, investigators, child-protection officials, prosecutors and courts — institutions that may not share a common child-sensitive protocol.
Advocate Miqdad Syed, cited in the report, points to the difficulty of expecting a 12-year-old to navigate a courtroom after experiencing a deeply personal crime. He also raises concerns about situations in which children’s wishes and perspectives are not adequately considered.
The report says Pakistan’s system also lacks standardised procedures for minimising secondary victimisation. That can happen when the institutions meant to protect the child inadvertently expose them to further harm.
The handling of evidence can itself become a source of harm
OCSEA cases present law-enforcement agencies with unusually sensitive evidence. Investigators may seize images or videos depicting children being sexually abused. That material must be preserved as evidence — but its handling must also prevent further circulation.
The HRCP report says Pakistan’s legal framework does not provide sufficiently detailed statutory protocols governing the seizure, storage, viewing, transfer, retention and destruction of such material. The report raises particular concern over allegations that footage from the Muzaffargarh case circulated among local journalists through a police source.
If accurate, this represents more than a breach of investigative procedure: it potentially exposes children who have already been victimised to a second wave of harm.
The report says sensitive digital evidence may be copied unnecessarily, stored without adequate encryption, viewed by people without investigative justification, shown to journalists or leaked publicly. In other words, the state can rescue a child from one form of exploitation and, through careless evidence handling, contribute to another form of exposure.
Poverty and stigma are part of the problem
It would be easy to describe OCSEA as a problem caused by technology. The report argues that this would miss a crucial part of the picture. Technology may facilitate the exploitation, but social and economic conditions can determine which children are most vulnerable.
In Muzaffargarh, children came from an environment marked by poverty, limited recreational opportunities and parents who could spend long periods away from home for work. The report says economically vulnerable children can be targeted through money, gifts or promises of opportunity.
Digital literacy is another factor. A parent may understand that their child is using a phone to watch videos or play games without understanding how easily an apparently harmless interaction can become grooming, sextortion or exploitation. Children themselves may not recognise manipulation. And families may hesitate to report because they fear stigma.
Social activist Bushra Khaliq told the study that families can be reluctant to report because they fear their “honour (izzat) might get tarnished”, while cases that do reach police may be handled insensitively and cause additional trauma.
That creates a vicious cycle, as fear suppresses reporting; low reporting obscures the scale of the problem; an apparently small problem receives limited institutional priority; and limited institutional capacity means many cases remain invisible.
The report repeatedly returns to the question of data. There is no unified public system that can answer basic questions such as the number of children identified through NCMEC referrals; How many referrals become investigations; How many result in FIRs, How many suspects are arrested; How many cases reach prosecution? How many result in convictions; How many children receive counselling? How many receive long-term rehabilitation? How much abusive material is successfully removed? And how often does the material reappear? At present, different parts of the system see different pieces.
The system remains reactive
The HRCP report does acknowledge that Pakistani institutions have demonstrated the ability to investigate organised online exploitation. The Muzaffargarh operation itself demonstrates that law-enforcement agencies can act when intelligence reaches them.
A 2022 FIA investigation into a dark-web-linked child exploitation network similarly demonstrated the ability to identify organised networks involved in selling material depicting minors to international buyers. But the report says the emphasis in such cases often falls overwhelmingly on arrests and confessions.
Much less attention is given publicly to what happens afterwards. Whether the victims were protected, their material securely handled, and removed from circulation, etc.
What needs to change
HRCP recommends that Pakistan fundamentally rethink OCSEA as a child-rights issue rather than simply a cybercrime issue. Its recommendations include formally recognising OCSEA and CSAM in laws, policies, police training, media guidance and child-protection practice.
It calls for a national coordination mechanism linking the NCCIA, provincial police, child-protection bureaus, the National Commission on the Rights of the Child, prosecutors, courts, education and social-welfare departments and civil-society organisations.
It also calls for anonymised public reporting of NCMEC referrals, domestic complaints, investigations, arrests, prosecutions, convictions, children identified and victims referred for support. Investigations, meanwhile, should be conducted through trauma-informed procedures, with children interviewed in child-friendly environments and spared unnecessary repeated questioning.
Digital evidence must be protected through strict access controls, secure storage and audit trails. Families should have access to a rapid domestic mechanism for requesting the removal of abusive material rather than being forced to navigate foreign technology-company reporting systems themselves.
And the law needs to evolve to cover grooming, sextortion, livestreamed abuse, synthetic and AI-generated sexual imagery, encrypted platforms and cloud-based material. But perhaps most importantly, prevention needs to begin before a case reaches the police. Digital safety education should teach children what grooming, coercion, blackmail and privacy violations look like.
Parents, teachers and community workers should be taught to recognise warning signs. And support for survivors should continue beyond the registration of an FIR or arrest of a suspect. HRCP calls for emergency protection, counselling, family assessment, school reintegration, legal aid, privacy protection and monitoring for retaliation or renewed blackmail.