2026 INSC 1149REPORTABLE IN THE SUPREME COURT OF INDIA CRIMINAL APPELLATE JURISDICTION M.A. NOS. 2553-2554 OF 2026 In Criminal Appeal Nos. 2161-2162 of 2024 IN THE MATTER OF: JUST RIGHTS FOR CHILDREN ALLIANCE & ANR. …APPLICANTS VERSUS S. HARISH & ORS. …RESPONDENTS O R D E R M.A. Nos. 2553-2554 of 2026 Page 1 of 136 INDEX I. BACKGROUND ......................................................................................... 3 II.
FRAMEWORK FOR THE DETECTION AND REMOVAL OF CSEAM.......................................................................................................... 8 A. Advanced Mechanisms for the Detection & Removal of CSEAM 8 i. Some Problems in the Existing Mechanism. ............................... 8 ii. Matching and Listing of Hash & URL of CSEAM. .................... 9 iii. The Position in India. ..................................................................... 14 B.
Comprehensive National Database for the Detection and Removal of CSEAM................................................................................................ 21 i. Need for a National Database for Hash & URL Lists of CSEAM. ............................................................................................. 21 ii. Indian Cyber Crime Coordination Centre’s Sahyog Portal. ... 23 iii.
Safeguards and Standard Operating Procedure for the Maintenance and Use of Hash & URL List Database. ............. 25 a. Procedural Difference viz-a-viz CSEAM of ‘Unknown Origin’ and ‘Known Origin’ ................................................... 27 b. Requirement of Proper Notice and Grievance Redressal .. 32 c. Additional Safeguards Required for the use of Hash & URL List Database. ............................................................................ 34 C.
Mechanisms for the Reporting of CSEAM....................................... 37 i. Some Lacunas in the Existing Mechanism. ................................ 42 ii. Streamlining & Standardization of Reporting Mechanism. .. 45 iii. Efficacy of the Grievance Redressal Mechanism relating to CSEAM. ............................................................................................. 49 a. Misconception on what constitutes “CSEAM” and Misreading of our decision in Just Rights (supra). ............. 50 b.
Dedicated Grievance Officers for managing CSEAM and reports related thereto. ............................................................ 63 c. The Proper Authority and Timelines for reporting of CSEAM by Intermediaries. ..................................................... 70 d. Need for a Prescribed Form for the Reporting of CSEAM by the intermediaries. ................................................................... 74 M.A.
Nos. 2553-2554 of 2026 Page 2 of 136 e. Safeguards for the Grievance Redressal Mechanism in respect of CSEAM. ................................................................... 77 D. Penalties for persistent failures by Intermediaries in complying with the requirements of IT Rules. .................................................... 83 i. Need to rethink and move beyond Section 79 of the IT Act. . 83 ii.
Exemplary Monetary Fines and Penalties. ................................. 87 iii. Scrutiny and Disgorgement of “Profits” from Paywalled Content. ............................................................................................. 96 E. Article 21 and the Right to Access Internet. ................................... 100 F. Awareness on Digital Safety, Sex Education and Measures to support Wellbeing of Children. ....................................................... 108 III.
SUMMARY OF OUR CONCLUSION ............................................... 122 M.A. Nos. 2553-2554 of 2026 Page 3 of 136 I. BACKGROUND 1. We heard the learned counsel appearing for the applicants and Mr. Tushar Mehta, the learned Solicitor General appearing for the Union of India.
2. In our previous order dated 14.08.2026, we had expressed concerns over certain serious lapses on the part of various social media intermediaries and platforms, particularly in complying with the directions that were issued in our judgment dated 23.09.2024 in Just Rights for Children Alliance & Anr. v.
S. Harish & Ors. reported in 2024 INSC 716.
3. In Just Rights (supra) we had taken note of an alarming increase in child sexual exploitation and abuse material (“CSEAM”) that were being circulated on social media platforms.
4. At that time, we had flagged how indirect links to such harmful material were being promoted and shared through social media algorithms to bypass the rigours of the special penal provisions M.A.
Nos. 2553-2554 of 2026 Page 4 of 136 designed for the protection of children within the cyberspace, namely Section(s) 15 and 67B of the POCSO Act1 and the IT Act2, respectively.
5. In our judgment, more particularly at paragraph 109, we had this to say: - “109. During the course of hearing, our attention was also drawn to a recent news article that reported how on social media, links to view child pornography were being circulated and sold for anywhere between Rs. 40 to Rs. 5,000.
The news report indicates, how social media platforms are rife with child sexual abuse, and gave certain insight about the modus operandi of the distribution of such material on these platforms. It explained how the sellers and distributors of child pornographic material rather than sharing any downloads to such material, would ingeniously only share links to such material instead in lieu of money, so as to circumvent the penal provisions of the POCSO and IT Act, which criminalized only the storage of such material.
By indefinitely forwarding links, they completely bypass the requirement of first storing such material onto any device, and similarly those who view such material also only use the links, without ever downloading such material onto their device.” (Emphasis supplied) 6. We had further taken note of the disquieting failure on part of the social media platforms in reporting such harmful activities to the Special Juvenile Police Unit, as required by the law. 1 The Protection of Children from Sexual Offences Act, 2012 (for short, the “POCSO Act”). 2 The Information Technology Act, 2000 (for short, the “IT Act”).
M.A. Nos. 2553-2554 of 2026 Page 5 of 136 7. In this regard we had this to say: - “256. It has been brought to the notice of this Court that social media intermediaries do not report such cases of child abuse and exploitation to the local authorities specified under POCSO and rather only comply with the requirements stipulated in the MOU. In view of the salutary object and the mandatory character of the provisions of Sections 19 and 20 of the POCSO read with Rule 11 of the POCSO Rules, we are of the considered view, that an intermediary cannot claim exemption from the liability under Section 79 of the IT Act for any third-party information, data, or communication link made available or hosted by it, unless due diligence is conducted by it and compliance is made of these provisions of the POCSO.
We are also of the view that such due diligence includes not only removal of child pornographic content but also making an immediate report of such content to the concerned police units in the manner specified under the POCSO Act and the Rules thereunder. xxx xxx xxx 258. In view of the overriding effect of the POCSO Act and the rules thereunder, merely because an intermediary is in compliance of the requirements specified under Section 79 of the IT Act, will not absolve it of any liability under the POCSO, unless it duly complies with the requirements and procedure set out under it, particularly Section 20 of POCSO Act and Rule 11 of the POCSO Rules.
It is a settled position of law, that when a statute describes or requires a thing to be done in a particular manner; it should be done in that manner or not at all. Thus, social media intermediaries in addition to reporting the commission or the likely apprehension of commission of any offence under POCSO to the National Centre for Missing & Exploited Children (NCMEC) is also obligated to report the same to authorities specified under Section 19 of POCSO i.e., the Special Juvenile Police Unit (SJPU) or the local police.” (Emphasis supplied) M.A.
Nos. 2553-2554 of 2026 Page 6 of 136 8. We had clarified in no uncertain terms that such failures would strip the social media platforms of the “Safe Harbour” protection provided by Section 79 of the IT Act.
9. We had hoped that the above inter-alia directions would bring a quietus to the disturbing widespread circulation of CSEAM on the internet.
10. We had hoped that we would not have to, once again, be confronted with the same sad state of affairs.
11.
Despite more than two years having gone by since our judgment, it appears that there has been no progress worth the name. If anything, the recent news reports instead reveal an even more unsettling reality when it comes to the safety and wellbeing of our children.
12. We are deeply saddened to note that the news reports placed before us by the applicants flagging alleged incidents of paid promotions of CSEAM on social media platforms through redirect links and websites is only one rare instance of such harmful activities being discovered and brought to light.
M.A. Nos. 2553-2554 of 2026 Page 7 of 136 13. There are millions of more such incidents freely available on social media platforms that may never come to the knowledge of the proper authorities, if no collective action is taken today by all stakeholders.
14. There comes a time when we must ask ourselves, how many more victims of such harmful content must continue to suffer, before our conscience is stirred into making collective effort in the right direction.
15.
We are afraid that we cannot afford to wait any longer for an answer. Due to the lack of any earnest initiative shown on the part of either the regulatory authorities or the social media intermediaries for all these years, we are left with no choice but to take matters in our own hands.
16. We cannot emphasize this enough, that there can be no space for non- consensual sexually exploitative and abusive material on the internet, particularly on platforms that are readily accessible to the most impressionable and vulnerable of our society.
17.
Thus, with the assistance from the Union of India through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, respectively, we propose to take the strictest of actions by M.A. Nos. 2553-2554 of 2026 Page 8 of 136 putting in place a workable framework for a safer future of our children.
18. In this regard, there are certain aspects which we must point out that merit a considered response, and we would like to hear the Union of India on the same.
II. FRAMEWORK FOR THE DETECTION AND REMOVAL OF CSEAM. A. Advanced Mechanisms for the Detection and Removal of CSEAM i. Some Problems in the Existing Mechanism.
19. As far as we understand, the current mechanism for the detection and removal of CSEAM relies heavily on individual instances of content being reported and subsequently removed. These reports originate either at the behest of the authorities or the users themselves.
20.
Although, various social media intermediaries have deployed their own safeguards for a seamless continued detection and removal of such content, yet what is missing is any form of synergy insofar as detection and removal is concerned, across the internet. M.A. Nos. 2553-2554 of 2026 Page 9 of 136 21. When one social media platform detects and removes CSEAM, that detection does not automatically result in the same content being flagged and removed from all other social media platforms.
22.
It is only when such content is also found by the other platforms, through their own mechanisms and safeguards that, the same comes to be removed.
23. This isolated mechanism of detection delays the removal of CSEAM across different platforms, delays which enable the continued circulation of such content to the various corners of the internet.
24. Even if some social media platforms are coordinating their efforts for the simultaneous removal of CSEAM once so detected by either of one of them, such arrangements are only informal, dependent entirely on which platforms choose to undertake such initiative and for how long. ii.
Matching and Listing of Hash & URL of CSEAM.
25. From what we have been able to understand, the practice that is globally in vogue for the seamless detection and removal of CSEAM is a process termed as “Hash and URL Data Matching & Listing”. M.A. Nos. 2553-2554 of 2026 Page 10 of 136 26. The process works on a simple principle. Every component of a CSEAM content, be it the video frame or image or multiples of both, carries a unique digital data print identifier in alphanumeric form, which is known as the “Hash” identifier of that material.
The hash identifier of any particular content remains unique to it, irrespective of where it is uploaded or by whom.
27. When any content is identified as CSEAM, specialised software is used to extract and generate the hash identifier and the same is added to a consolidated database known as a “Hash List”.
28. This Hash List can then be used to crosscheck all other content, whether on the very same platform or on another.
Where a match is found against a particular hash identifier, the algorithm automatically flags and removes that content without the need to rely on the conventional means of detection.
29. However, the above mechanism is not without limitations. Expert insights indicate that a new modus operandi has emerged for circumventing the hash list detection process. This is usually done by manipulating the video frame or imagery of the content, or a M.A.
Nos. 2553-2554 of 2026 Page 11 of 136 combination of both, either by way of resizing it or reformatting it, so as to avoid detection.
30. It is for this reason that “Perceptual Hashing”, an improved process of recent vintage assumes significance. Shorn of the details, this process, from what we understand, combines the original technique of extracting the hash identifier with an additional step of generating the audio-visual characteristics of the content.
Characteristics such as colour-coding, object composition, audio cues, etc., are also used to generate the hash identifier for a content detected as CSEAM, which remains unique dehors any manipulation.
31. One another technological measure of similar significance that has caught our attention is URL Listing, which targets indirect links to CSEAM and other harmful content that are merely shared or exchanged on social media platforms without uploading or storing the same on the platform.
32.
The news report that has been placed before us by the applicant herein reveals the prevalence of this very practice. It highlighted the circulation and promotion of CSEAM through links which would then M.A. Nos. 2553-2554 of 2026 Page 12 of 136 redirect users to other websites and platforms where such materials were offered for monetary considerations.
33. “URL Listing” thus, assumes significance. Unlike Hash Listing that generates a unique identifier for the CSEAM content, URL Listing proceeds by generating an identifier for the external location where the CSEAM content is hosted.
It extracts all possible unique web- addresses where the CSEAM has been confirmed to have been uploaded, and then uses that data to block any future attempts to access it.
34. Various jurisdictions across the world have, in some form or manner, called for the deployment of one, or a combination of the aforesaid measures, with a view to ensure the effective detection and removal of CSEAM. Country Measures Provision United States Hash Matching 18 U.S.C. § 2258C(a)(2) "The elements authorized under paragraph (1) may include hash values or other unique identifiers associated with a specific visual depiction, including an Internet location and any other elements provided in a CyberTipline report that can be used to identify, prevent, curtail, or stop the transmission of child pornography and prevent the online sexual exploitation of children." URL Listing M.A.
Nos. 2553-2554 of 2026 Page 13 of 136 United Kingdom Hash Matching Ofcom, Illegal Content Codes of Practice for User-to-User Services, Recommendation ICU C9 "ICU C9.3 The provider should ensure that, where technically feasible, perceptual hash matching technology is used effectively to analyse relevant content to assess whether it is CSAM. ICU C9.4 The provider should ensure that appropriate measures are taken to swiftly take down (or prevent from being generated, uploaded or shared) detected content that is CSAM [...]" URL Listing South Korea Hash Matching Enforcement Decree of the Telecommunications Business Act, Article 30- 6(2) “2.
Measures to restrict the transmission of search results, such as deleting search results by identifying whether the information the user is searching for corresponds to illegal footage, etc. that has previously been requested for reporting or deletion pursuant to Article 22-5(1) of the Act, by comparing the search term entered by the user with the title, name, etc. of the illegal footage;
3. Measures to restrict the posting of the information after analyzing the characteristics of the information that the user wishes to post, comparing and identifying whether it corresponds to information that has been reviewed and decided by the [Korea Communications Standards Commission] as illegally filmed material, etc.
In this case, comparison and identification must be made using any of the following technologies:
(a) Technology developed and provided by national organizations;
(b) Technology that has passed a performance evaluation conducted within the last two years by an institution or organization determined and notified by the Korea Communications Commission” URL Listing Australia Hash Matching Online Safety (Relevant Electronic Services— Class 1A and Class 1B Material) Industry Standard 2024 “19 Detecting and removing known child sexual abuse material (1) This section applies to the following:
(a) a pre-assessed relevant electronic service;
(b) a Tier 1 relevant electronic service. (2) The provider of a service must implement appropriate systems, appropriate processes and appropriate technologies to:
(a) detect and identify known child sexual abuse material that: M.A.
Nos. 2553-2554 of 2026 Page 14 of 136 (i) is stored on the service; or (ii) is accessible by an end-user in Australia using the service; or (iii) is being or has been accessed or distributed in Australia using the service; and (b) remove known child sexual abuse material from the service as soon as practicable after the provider becomes aware of it. Note 1: The technologies that the provider may use include hashing technologies and machine learning.” iii.
The Position in India.
35. From what we can discern, no such provision exists in India, requiring social media intermediaries to employ tools for Hash or URL Listing, at least to the same extent as found in other jurisdictions.
36. The closest analogue to any such statutory requirement in India can be found in some parts of Rule(s) 3 and 4 of the IT Rules3. The same reads as under: - “3. (1) Due diligence by an intermediary:
(b) the intermediary shall inform its rules and regulations, privacy policy and user agreement to the user in English or any language specified in the Eighth Schedule to the Constitution in the language of his choice and shall make reasonable efforts by itself, and to cause the users of its computer resource to not host, display, upload, modify, publish, transmit, store, update or share any information that,— (i) is obscene, pornographic, paedophilic, invasive of another’s privacy including bodily privacy, insulting 3 The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (for short, the “IT Rules”) M.A.
Nos. 2553-2554 of 2026 Page 15 of 136 or harassing on the basis of gender, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or an online game that causes user harm,] or promoting enmity between different groups on the grounds of religion or caste with the intent to incite violence;
(ii) is harmful to child; xxx xxx xxx 3. (3) Due diligence in relation to synthetically generated information:
(a) Where an intermediary offers a computer resource which may enable, permit, or facilitate the creation, generation, modification, alteration, publication, transmission, sharing, or dissemination of information as synthetically generated information, it shall ensure that,— (i) it deploys reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to not allow any user to create, generate, modify, alter, publish, transmit, share, or disseminate, as the case may be, any such synthetically generated information that violates any law for the time being in force, including the Act, Bharatiya Nyaya Sanhita, 2023 (45 of 2023), Protection of Children from Sexual Offences Act, 2012 (32 of 2012), Explosive Substances Act, 1908 (6 of 1908), and includes any such synthetically generated information that,— (I) contains child sexual exploitative and abuse material, non-consensual intimate imagery content, or is obscene, pornographic, paedophilic, invasive of another person’s privacy, including bodily privacy, vulgar, indecent or sexually explicit; or 4.
Additional due diligence to be observed by significant social media intermediary and online gaming intermediary. (4) A significant social media intermediary shall deploy appropriate technical measures, including automated tools or M.A. Nos. 2553-2554 of 2026 Page 16 of 136 other suitable mechanisms to proactively identify information that depicts any act or simulation in any form depicting rape, child sexual abuse or conduct, whether explicit or implicit, or any information which is exactly identical in content to information that has previously been removed or access to which has been disabled on the computer resource of such intermediary under clause (d) of sub-rule (1) of rule 3, and shall display a notice to any user attempting to access such information stating that such information has been identified by the intermediary under the categories referred to in this sub- rule: Provided that the measures taken by the intermediary under this sub-rule shall be proportionate having regard to the interests of free speech and expression, privacy of users on the computer resource of such intermediary, including interests protected through the appropriate use of technical measures: Provided further that such intermediary shall implement mechanisms for appropriate human oversight of measures deployed under this sub-rule, including a periodic review of any automated tools deployed by such intermediary: Provided also that the review of automated tools under this sub-rule shall evaluate the automated tools having regard to the accuracy and fairness of such tools, the propensity of bias and discrimination in such tools and the impact on privacy and security of such tools.” (Emphasis supplied) 37.
These rules which came to be inserted by the Information Technology Amendment Rules, 2026, although a step in the right direction, yet, fall short as they do not speak of the specific tools and measures a social media intermediary must adopt. M.A. Nos. 2553-2554 of 2026 Page 17 of 136 38. Rule 3(1) sub-clause (b), inter-alia, requires that intermediaries make reasonable efforts to ensure that their users do not host, upload or disseminate any CSEAM and other non-consensual sexually exploitative and abuse material, including those generated artificially, and to further remove such material under sub-clause (c).
39.
Whereas Rule 4(4), inter-alia, requires a “significant social media intermediary” to also deploy “appropriate technical measures” for the detection and removal of CSEAM, including materials which are identical in content to any material that was previously flagged and deleted “on the computer resource of such intermediary”.
40. We would be remiss not to point out that the expression “on the computer resource of such intermediary” used in Rule 4 sub-rule (4) admits of certain ambiguities which need to be addressed.
41.
In our considered view, the said expression narrowly confines the extent to which the technical measures must be deployed for the detection and removal of CSEAM.
42. The emphasis placed by Rule 4(4) on only that CSEAM content, which has been either detected or previously removed from the M.A. Nos. 2553-2554 of 2026 Page 18 of 136 intermediary’s own computer resource, leaves unresolved two possible scenarios.
First, the possibility of simultaneous flagging and removal of CSEAM content that was already removed on some other platform. Secondly, CSEAM content that is hosted on an external source and merely circulated on a particular platform via indirect links.
43. To state plainly, under this rule, even if a particular CSEAM was previously detected and removed by one intermediary, there is no corresponding obligation cast upon other intermediaries to automatically look for and remove the same, at least not until, such material happens to also be detected by them in due course of time.
44.
This, in our view, confines the entire obligation of detection and removal of CSEAM exclusively to material that has been uploaded, circulated and detected on one intermediary’s own resources.
45. We, prima facie, find this to be a matter of some concern, particularly when there are reported instances of CSEAM being indirectly circulated, and a less than ideal rate at which such material is currently being detected and removed.
It is needless to reiterate that every M.A. Nos. 2553-2554 of 2026 Page 19 of 136 moment of delay in removing such harmful content only serves to add to the certain likelihood of further circulation to other platforms.
46. Even otherwise, the cumulative effect of the above rules is that social media intermediaries are only required to “make reasonable efforts” and “deploy appropriate technical measures” for the proactive detection and removal of CSEAM and other non-consensual sexually exploitative and abusive material from their platforms.
47.
We are conscious of the fact that, at the current pace of advancement in technology, it is impractical to statutorily prescribe any particular set of tools and measures for a thriving, safe, and secure cyberspace. That being said, we see no reason why widely used tools and measures of proven mettle cannot be stipulated in the form of periodically revisable guidelines to ensure their uniform and proper adoption by one and all.
48.
We do not, for a moment, doubt that certain social media intermediaries may already have employed one or more of the aforementioned tools and measures, or even a combination of all of them. However, the efficacy of such tools depends not only on their M.A. Nos. 2553-2554 of 2026 Page 20 of 136 deployment by some, but on their proper and uniform adoption by all, and that is precisely what specific guidelines in this regard can ensure.
49.
All that we are trying to say is that while a rigid statutory prescription may not be the appropriate course, yet the same does not, however, mean that no guidelines should be put in place.
50. We would, therefore, like to hear from the Union of India on the tools and technological measures that have been put in place by intermediaries for the detection and removal of CSEAM from their platforms, including the use of perceptual hash-matching and URL listing.
This is because, in the absence of such information, it would be difficult for us to assess whether the obligation to "make reasonable efforts" is, in practice, being discharged in any meaningful manner. We would further like to hear on the feasibility of a industry-wide use and deployment of such tools, if not already in use. Lastly, we would like the Union of India to come up with some comprehensive guidelines on the tools and technological measures that every intermediary would be expected to deploy for the detection and removal of CSEAM.
M.A. Nos. 2553-2554 of 2026 Page 21 of 136 B. Comprehensive National Database for the Detection and Removal of CSEAM. i. Need for a National Database for Hash & URL Lists of CSEAM.
51. We must, however, point out that the deployment of these tools cannot be the end of the matter. Unless the hashes and URLs of CSEAM identified by one intermediary are made accessible to all others, the very process of simultaneous flagging and removal of such material across platforms would remain illusory.
52.
It is in this context that a national “Hash and URL List Database” assumes significance. As the name suggests, it is a common repository or pool of the hash identifiers and URL lists of all material which has been flagged and confirmed to be CSEAM across all platforms. The database is continuously updated in real time, and made accessible to all intermediaries and law enforcement agencies, to enable a seamless process of detection and removal of CSEAM on a rolling basis.
53.
The significance of such a database may best be appreciated by contrasting it with the current state of affairs. At present, each intermediary, at best, maintains its own list of known CSEAM, compiled from what it has encountered on its own platform. The M.A. Nos. 2553-2554 of 2026 Page 22 of 136 result is a multitude of fragmented lists, each incomplete in itself. The multiplicity in efforts in the detection and removal of CSEAM that we seek to avoid cannot take place without such a database.
54.
In other words, intermediaries would be in a position to crosscheck the content on their own platforms against the entire database, and not merely against what they themselves have encountered in the past. It is of note that such a database would not contain the harmful material itself, but only the hash identifiers and URLs by which it may be recognised.
55. There are outstanding examples of such databases that have played a pivotal role in reducing the circulation of CSEAM.
Various jurisdictions have entrusted the maintenance of such databases to designated bodies and organisations that verify each entry before its inclusion and ensure that the database remains current. Country Database Maintaining Authority United States NCMEC Industry Hash Sharing Platform National Center for Missing & Exploited Children. NCMEC NGO Hash Sharing Platform United Kingdom IWF Image Hash List Internet Watch Foundation and Home Office, Government of United Kingdom.
Child Abuse Image Database Canada Project Arachnid Canadian Centre for Child Protection. M.A. Nos. 2553-2554 of 2026 Page 23 of 136 Korea Illegally Filmed Material Database Korea Communication Standards Commission Netherlands Instant Image Identifier and Hash Check Service Centre for Expertise on Online Sexual Child Abuse (EOKM) and the Dutch National Police. Italy CNCPO "black list" National Center for the Prevention of Child Pornography on the Internet.
New Zealand Digital Child Exploitation Filtering System Department of Internal Affairs. ii. Indian Cyber Crime Coordination Centre’s Sahyog Portal.
56. In this regard, we are given to understand that some progress has taken place in the right direction. The Union of India has already developed and put in place a dedicated platform known as the “Sahyog Portal” to inter-alia streamline and automate the process of reporting and removal of unlawful content including CSEAM.
57.
The Indian Cyber Crime Coordination Centre (I4C), the authority designated to manage and maintain the portal, has been onboarding social media intermediaries onto the same, with a view to coordinate the reporting and removal of CSEAM with the police machinery.
58. We acknowledge that the Sahyog Portal is, no doubt, a step in the right direction. It is also not lost on us that the portal, by virtue of having M.A.
Nos. 2553-2554 of 2026 Page 24 of 136 already onboarded a considerable number of intermediaries, may well be the natural foundation upon which a Hash & URL List Database could be built.
59. That being said, we are mindful of the fact that, the portal, in its current form, functions only as a common platform to route individual reports and takedown notices.
60. Our expectations from the portal, however, are much more than what it is, as of now, capable of doing, and we are hopeful that the Union of India shares the same vision.
61.
We say so because there is a discernible difference between a common portal that routes individual reports and takedown notices, and one which pools together the hash identifiers and URLs of all material confirmed to be CSEAM. The former acts only upon each instance of CSEAM as and when it is reported. Whereas the latter ensures that such material, once identified, is continuously detected and removed across all platforms, without waiting for it to be reported afresh.
62.
We would, therefore, like to know from the Union of India whether it is contemplating the creation of a Hash & URL List Database either M.A. Nos. 2553-2554 of 2026 Page 25 of 136 within the fold of the Sahyog Portal, or as a standalone repository. If the Sahyog Portal is indeed contemplated to serve such a role, we would like to be apprised of the extent to which, it in its existing form is equipped to do so, and the time by which it can begin to fully function in that role. iii.
Safeguards and Standard Operating Procedure for the Maintenance and Use of Hash & URL List Database.
63. The creation of a Hash & URL List Database of the kind indicated above naturally gives rise to certain attendant concerns, particularly the operation and procedural integrity of the same.
64. If the experiences of existing databases in other jurisdictions is any lodestar, the process by which a particular material comes to be entered into the database as CSEAM, and thereby earmarked for detection and removal, is perhaps the most sensitive of all.
65.
From what we have been able to understand, the process by which a hash identifier or URL finds its way into any such database generally unfolds in three distinct stages: - M.A. Nos. 2553-2554 of 2026 Page 26 of 136 (i) The first step of the process begins with the source of the material. The material which is ultimately entered into the database may come from a variety of sources. It may be reported by a member of the public, flagged by an intermediary on its own platform, forwarded by a law enforcement agency, or discovered by the body maintaining the database in the course of its own proactive search.
It is of note, however, that the source of the material, by itself, is of little consequence, except in cases of hash matching, which we shall discuss in the later parts. Irrespective of where it originates, no material is to be mechanically entered into the database merely because it has been reported or flagged as CSEAM.
(ii) The second, and perhaps the most crucial stage, is that of assessment, through multiple tiers of verification.
This begins with a preliminary screening of the material by specialised software, which makes an initial determination, based on certain characteristics of the material, as to whether it is likely to be CSEAM. The software, however, does not have the final word. At the second tier, the material so flagged is assessed by at least three trained human analysts, who would independently M.A. Nos. 2553-2554 of 2026 Page 27 of 136 determine whether the same constitutes CSEAM.
This combination of software and human verification minimises erroneous inclusions and ensures that the database remains reliable to act upon.
(iii) It is only upon such material being confirmed to be CSEAM that the third stage commences, wherein the hash identifier and/or the URL of the material is generated and entered into the database. This entry is then made available to all intermediaries and law enforcement agencies to cross-check against and remove any content matching the same.
66.
The above process is to be carried out on a continuous basis, and the database updated at regular intervals. The entries within the database are to be made through encrypted channels and strictly confined to the hash identifier and/or URL of the material confirmed to be CSEAM. At no point should the CSEAM itself be stored within the database. a. Procedural Difference viz-a-viz CSEAM of ‘Unknown Origin’ and ‘Known Origin’ M.A.
Nos. 2553-2554 of 2026 Page 28 of 136 67. Since the above exercise for the detection and removal of CSEAM through means of ‘Hash Matching’ would be over and above the existing ordinary process of detection and removal, namely by way of due diligence and receipt of reports, certain additional aspects emerge that require clarification.
68. While the object of the above two parallel processes remains the same, that being the removal of CSEAM, yet there are certain differences between the two, which must be reflected in the standard operating procedure that would eventually come to be.
69.
For this, we propose to draw a distinction between removal of CSEAM of “Unknown Origin” and “Known Origin”.
70. CSEAM of “Unknown Origin” would be all such material that has no corresponding match in the Hash & URL List Database but nevertheless was detected and subsequently removed on the basis of the intermediary’s own tools and mechanisms. In other words, that harmful material, which was found to be CSEAM on the basis of either reports received or as a result of the intermediary’s own due diligence.
M.A. Nos. 2553-2554 of 2026 Page 29 of 136 71. Conversely, CSEAM of “Known Origin” would include all such material that is removed by an intermediary pursuant to a match being found against an already existing entry in the Hash & URL List Database.
72. The distinction is not merely one of nomenclature. It carries with it a significant difference in the procedure that an intermediary would be required to follow, as well as in the obligations that would ensue.
73.
Where an intermediary removes CSEAM of “Unknown Origin”, it would be expected that the said decision was preceded by some verification and due diligence on its part.
74. Upon such removal, the intermediary would be required to generate the hash & URL identifiers of such CSEAM for its own internal use, in order to remove all other instances of the material from its platform, pending its verification and inclusion in the national database.
75.
In addition, the intermediary would also be obligated to promptly report the same to the proper authorities under the relevant law, and also to the designated body for the Hash & URL List Database, if not the same. M.A. Nos. 2553-2554 of 2026 Page 30 of 136 76. In the former, this would necessarily entail reporting such CSEAM to the SJPU4, the local police or the cyber-crime portal, as required by Rule 11 of the POCSO Rules5.
While in the latter, the report would be forwarded to the authority entrusted with the maintenance of the Hash & URL List Database.
77. Upon receipt, the authority would, in turn, independently verify the flagged content, in the manner indicated above6, and in accordance with such procedure as may be prescribed.
78. Once the flagged content is confirmed to be CSEAM, the hash and/or URL identifier of the same would be entered into the database and made available to all other intermediaries, who would then detect and remove the same, following the process applicable to CSEAM of “Known Origin” which we shall now discuss.
79.
Where an intermediary finds a match against an entry within the Hash & URL List Database i.e., CSEAM of “Known Origin”, the intermediary 4 The Special Juvenile Police Unit (for short, the “SJPU”). 5 The Protection of Children from Sexual Offences Rules, 2020 (for short, the “POCSO Rules”. 6 The “Three-Step” Process discussed in Paragraph 66. M.A. Nos. 2553-2554 of 2026 Page