Arrests over online child pornography; 34,000 images and 22,000 videos discovered. The prosecutor: a horrific criminal phenomenon

To be more specific, gthanks to the investigative work, which continued uninterrupted from 2024 to 2025 with the collaboration of the US agency HSI and in coordination with the competent public prosecutor’s office, specialist staff from the C.N.C.P.O managed, over time, to build a relationship of trust with the administrators, eventually gaining the status of ‘co-administrator’ within the various child pornography groups – often created in different versions, after they were shut down, with imaginative names to ensure their anonymity and recognisability only to participants (New Saga-La Zanzara 2, with versions 3 and 4 – renew).

To avert the risk of surveillance by law enforcement agencies, the administrators used ‘exclusive private channels’ for the exchange of information and organisational matters; one of these was named ‘La Sala dei Re’ (The Hall of Kings), to emphasise the context of power within which the administrators of the Telegram groups believed they were operating. The investigations have documented in detail the existence of a complex organisation comprising various administrators tasked with managing and promoting the various groups created for the distribution of child sexual abuse material, as well as setting up related services to ensure anonymity and encrypt the content, including cloud storage and virtual servers, content moderation, and the creation of bots – automated programmes capable of managing the large number of users – to ensure the continuity of the community even in the event of groups being shut down or accounts being lost.

The investigation revealed the existence of a private, structured and organised online community, governed by strict rules, comprising over 1,009 participants, accessible via a dedicated link posted to attract more users, whose membership was granted upon payment of small sums of money in cryptocurrency (referred to as ‘donations’) or the sharing of new child pornography material.

Members received direct and constant support from the organisers, including the sharing of IT resources necessary to ensure anonymity and safeguard the illicit material being circulated – including in encrypted form – to prevent its loss. The methods employed by the administrators had led to an increase in the volume of child sexual abuse material available in the databases. During the undercover operation alone, investigators seized approximately 282.9 gigabytes of illegal material, comprising over 22,000 videos and 34,000 images.

The investigations, carried out using advanced and innovative de-anonymisation techniques, made it possible to identify the individuals involved and gather circumstantial evidence to support the Rome Public Prosecutor’s Office’s request for six pre-trial detention orders, which were issued by the Rome Investigating Magistrate, one of which was replaced with house arrest due to the suspect’s state of health. These orders were executed on 15 September against three Italian directors, resident in the province of Naples, Barletta and Verona, and a Swiss national, as organisers/promoters; and against two individuals, resident in the provinces of Messina and Genoa, as accomplices, for having shared and stored a substantial quantity of child sexual abuse material in a digital archive.

The 22 Italian users, 10 of whom were also actively sharing material, were subject to searches of their premises, personal belongings and computer systems. The operations, carried out on the same day, culminated in the arrest of 10 individuals caught in the act of committing an offence, as they were found in possession of a substantial quantity of child sexual abuse material, videos and images of children, some of very young age; the illegal material had been skilfully concealed, was difficult to access, and protected in folders—some of which were encrypted—to prevent its discovery; the exact quantity is still being quantified. Among those arrested in the act were six individuals resident in the provinces of Turin, Milan and Padua, and one each from the provinces of Fermo, Cagliari, Palermo and Treviso; few of them had specific criminal records, whilst others were perpetrators who appeared above suspicion.

The enforcement of these measures involved over 100 specialist officers from the Postal and Cyber Security Police, drawn from the Operational Centres and the respective Operational Sections in Ancona, Bari, Bologna, Cagliari, Catania, Florence, Milan, Naples, Palermo, Rome, Turin, Trento and Venice, with the collaboration of staff from the relevant regional forensic police units, as well as the presence, in an observational capacity, of HSI officers at locations deemed to be of particular operational interest.

A substantial amount of IT equipment was seized, comprising around 200 devices (smartphones, tablets, PCs, hard drives), along with illicit child pornography material confiscated from international markets and trading platforms. The judicial cooperation initiated to carry out the detention order and the search of the premises, personal effects and electronic devices, conducted by the Cantonal Police against the Swiss national, with the participation of two officers from the CNCPO and in collaboration with staff from the International Police Cooperation Service, has enabled the acquisition of further investigative evidence leading to the identification of another administrator, whose profile had already come to light due to his active involvement – as also noted in the evidential documentation underpinning the detention order.

On the night of 16 September, the suspect, a 26-year-old man with no previous criminal record, who was located in the Province of Cremona following a search carried out by officers from the Lombardy Cybercrime Police, was taken into custody on suspicion of a criminal offence pursuant to an order issued very swiftly by the judicial authorities in Rome. During the course of the investigation, 996 accounts linked to foreign countries were also identified; the findings of this investigation were shared by the C.N.C.P.Either to the competent authorities, via international cooperation channels, with operational and intelligence support from Europol and the collaboration of Interpol, to initiate procedures for identifying victims and ensuring their safety in accordance with cooperation protocols. Several countries have engaged in international cooperation with the C.N.C.P.O. to exchange information, leading to the arrest of individuals identified on the ‘New Saga’ group, which is no longer active.