Bengaluru: India may need to negotiate a formal data-sharing arrangement with the United States to strengthen investigations into online child sexual abuse material (CSAM), rather than relying primarily on notices and criminal proceedings against technology companies’ local subsidiaries, multiple experts and stakeholders told ET.
Two years after the Supreme Court clarified that reporting suspected CSAM to a foreign organisation does not absolve a platform of criminal liability under Indian laws for failing to notify local authorities, US social media platforms such as Instagram, Facebook, WhatsApp, YouTube, X and Snap continue to send such reports only to US-based National Centre for Missing and Exploited Children (NCMEC), the sources said.
The platforms argue that US law constrains them from directly sharing automated CSAM detection data with foreign authorities, requiring such reports to be routed through NCMEC.
This conflict between Indian reporting requirements and US laws makes the case for a formal data-sharing agreement, experts said. There is also disagreement over how quickly NCMEC sends its CyberTipline reports to the Indian Cybercrime Coordination Centre (I4C), the designated body to receive these reports in India.
“Reports are made available to the appropriate law enforcement agency in, on average, less than 15 minutes from the time we receive it,” NCMEC said in response to ET’s queries. But people close to I4C said there may be delays of months. Resolving that inconsistency would require a joint discussion involving platforms, NCMEC and I4C, experts said. The issue was raised in a recent Parliamentary Standing Committee meeting.
“In our view, the discussion did not fully reflect the legal and operational realities that platforms and I4C have been discussing privately,” one of the sources said.
One proposal is to provide supplementary tips: platforms would not send the actual content directly to local law enforcement or I4C, but could share metadata relating to reports from India that were submitted to NCMEC.
“Our legal advisers have identified a red line where we cannot violate the US Stored Communications Act. They are also aware of Indian law,” a platform executive told ET on condition of anonymity. “We have, therefore, tried to focus on the underlying objective, which is supporting investigations, through supplementary tips and by seeking clarity on NCMEC-to-I4C response times. Those proposals have not yet produced an agreed solution.”
I4C, Meta, X and Snap did not respond to ET’s queries until press time Friday.
Google told ET its teams use “a combination of industry-leading automated detection tools and specially-trained reviewers” to identify and remove CSAM.
