KUALA LUMPUR: In the first major enforcement action since the Online Safety Act (ONSA) 2025 came into effect on Jan 1 this year, authorities have dismantled what investigators describe as a structured digital ecosystem for the distribution and trade of child sexual abuse material (CSAM).
Op Cyber Guardian 2026, carried out nationwide from April 6 to 8 and regionally from March 23 to April 17, led to the arrest of 69 individuals, aged 15 to 66, including government servants, in one of the most sweeping operations of its kind.
The operation was jointly coordinated by the Royal Malaysian Police (PDRM) and Malaysian Communications and Multimedia Commission (MCMC), with support from partner nations including Singapore, Thailand, Brunei, Hong Kong, South Korea and Japan.
A total of 339 police personnel were deployed alongside 24 officers from MCMC.
In total, 101 locations were raided and 124 devices were seized, yielding 498,694 digital files – of which 204,934 were confirmed as CSAM, with a further 293,760 files classified as adult pornography.
67 investigation papers were opened under a range of legislation, including the Sexual Offences Against Children Act 2017, Communications and Multimedia Act 1998, National Registration Regulations 1990 and Penal Code.
So far, 62 suspects have been charged, facing a combined 81 counts, with two individuals sentenced to between three and seven months’ imprisonment, while another received a six-month sentence and an RM3,500 fine.
29 more individuals were also fined between RM1,700 and RM7,000.
Dismantling networks
Among the most alarming findings was evidence of a monetised and organised criminal ecosystem operating beneath the surface of mainstream social media.
The operations found that suspects – operating both individually and in groups – used social media applications to distribute and sell the material, with some acting as group administrators, offering paid access to CSAM via e-wallet transactions and QR codes.
Inspector-General of Police Datuk Seri Mohd Khalid Ismail, who recently announced the report at a press conference in Kuala Lumpur, was unequivocal in his stance, stating there will be no quarter for those who violate a child’s digital safety.
“The crime is no longer isolated but has evolved into an organised, profit-driven activity. PDRM will not compromise with those who trade on the safety of children,” he said.
“We are still determining whether any individuals in Malaysia are producing such content. So far, the seized material is believed to have been sourced abroad and later sold for profit. Further investigations are ongoing to identify the networks involved.”
Pattern of escalation
Op Cyber Guardian 2026 is not a standalone initiative.
Since 2024, four extensive operations have been conducted, including three previous operations: Op Pedo 1.0 (Dec 2024), Op Cyber Guardian 2025 (March 2025) and Op Pedo 2.0 (Sept 2025).
Placed in the context of prior operations, the cumulative scale of the CSAM problem is striking.
Across all four operations, authorities have made a combined 117 arrests, conducted raids at 162 locations, seized over 272 devices and recovered in excess of 1.47 million digital files.
At least 204,934 files have been confirmed as CSAM and 113 investigation papers have been opened, with at least 101 individuals charged.
The trajectory is notable, from 13 arrests in Op Pedo 1.0 to 69 in Op Cyber Guardian 2026, each successive operation has uncovered a larger network.
The number of digital files seized has surged dramatically from over 40,000 in the first operation to nearly half a million in the latest one – an increase of more than 1,000% in under two years.
This is a pattern that enforcement authorities and digital safety advocates say reflects both the scale of the problem and the growing sophistication of investigative tools.
Prioritising online safety
The timing of this year’s operation also carries significance beyond its operational results.
Under ONSA, CSAM is classified as “priority harmful content”, the most severe category of online harm, which must be blocked as swiftly as possible given the severe risks it poses.
The Act establishes a legal framework that outlines the responsibilities and obligations of licensed platforms to address online harm, including implementing risk-based security measures, providing specific protections for children and establishing enhanced user reporting and assistance mechanisms.
Data from MCMC showed that between January 2024 and November 2025, the regulator identified 957 cases of harmful content involving children, achieving a 94% compliance rate among platforms in responding to takedown requests.
Yet, compliance rates tell only part of the story. While high compliance may reflect cooperation, it says little about whether harm was prevented from spreading in the first place.
And this is exactly what ONSA aims to address by highlighting the need to prioritise proactive safety measures instead of reactive enforcement.
Age verification, experts argue, is not about restricting children from technology but about ensuring platforms take meaningful responsibility for who accesses what, and when.
Since the Act came into force, platforms have been updating and expanding safety features and elements to prioritise child safety.
In mid-April, Meta announced the expansion of Instagram’s age-appropriate 13+ content rating and “Limited Content” setting to Malaysia, which will be fully rolled out in the coming months.
This means that teens will now see content that’s similar to what they would in an age-appropriate movie by default. Those under the age of 18 will automatically be placed in an updated 13+ setting and can only opt out with parental permission.
Justice for victims
The crackdown also coincides with significant legal shifts in how the nation handles such crimes.
The Dewan Negara recently passed the Sexual Offences Against Children (Amendment) Bill 2023 on April 6, which officially replaces the term “child pornography” with the more accurate CSAM.
More importantly, the amendment introduces new powers under Sections 26A and 26B, allowing the courts to order convicted perpetrators to pay compensation directly to victims.
Minister in the Prime Minister’s Department (Law and Institutional Reform) Datuk Seri Azalina Othman Said explained that the amendments take into account the sophistication of criminal cases and technological progress, which require expanded definitions or interpretations of such crimes.
This move toward restorative justice aims to better protect children against all forms of sexual exploitation and abuse.
It also ensures that the law is not only focused on incarceration but also on the long-term recovery of those affected.
By aligning these legal amendments with ONSA’s platform-level accountability, the government is creating a dual-layered system of protection: one that punishes the crime at its source while providing a path for the victim’s rehabilitation.
However, even with age-gating and platform-level safeguards, the responsibility of a child’s online safety remains an ecosystem-wide effort involving parents, schools and platforms.
Parents must stay engaged in their children’s digital lives, schools need to build digital literacy from an early age and platforms must go beyond minimum compliance to design safety into their products by default.
While laws and legislations like ONSA set the floor, protecting children online requires everyone to raise the ceiling.
