Pakistan’s cybercrime investigators have arrested two men accused of recording and circulating videos showing the sexual abuse of children, in a case that began with an alert from the United States and has now reached an Islamabad court. The National Cyber Crime Investigation Agency, known as the NCCIA, says the material included children as young as one year old, and investigators are still working to identify other people who may have been part of the alleged network.
The investigation started when a social media platform detected suspected child sexual abuse material and reported it to the National Center for Missing and Exploited Children, the American organisation known as NCMEC. That organisation runs a reporting system through which technology companies pass on suspected cases of online child exploitation, and the information is then forwarded to law enforcement in the country concerned. In this case, the alert reached the Pakistani authorities, who opened an inquiry that led to two arrests.
The first man arrested was Sajid Ali, a resident of Skardu, who was taken into custody on October 26. Investigators say they recovered suspected child sexual abuse material from his mobile phones, including videos involving children in Pakistan and material said to have come from other countries. The discovery pointed to activity that went beyond a single device or a single victim, and it set off a wider effort to trace the people with whom he had been in contact online.
During questioning, Sajid Ali allegedly gave investigators information that led them to a second suspect, arrested on October 29. Officials allege that the second man had recorded abuse of his own young child and shared the footage with Sajid Ali in exchange for money, with investigators saying that Rs. 7,000 was paid for one video. The second suspect reportedly told investigators that he had recorded the footage at Sajid Ali’s request. Neither man has been convicted, and the allegations remain to be tested in court.
Investigators also allege that Sajid Ali was active in groups on Telegram used to circulate child sexual abuse material. Officials said he contacted members of those groups, claimed to have further videos, and encouraged others to share similar content. During interrogation, he reportedly described his motivation as mental satisfaction. The NCCIA has also asked for bank statements so that it can examine financial transactions linked to the suspects, including possible payments from abroad, because money trails can reveal connections that messages alone do not show.
The case was registered on October 26 at the NCCIA’s Cyber Crime Reporting Centre in Islamabad, under the relevant provisions of Pakistan’s cybercrime law and the Pakistan Penal Code. That step matters because it turns an intelligence alert into a formal criminal case, built on evidence rather than suspicion alone. Phones, accounts and payment records now become central, as officers try to establish who created material, who received it, who paid for it and who else may have taken part.
The matter has since come before an Islamabad court, which must decide how much longer the two suspects should remain in police custody. Investigating Officer Sub-Inspector Muhammad Waseem Khan asked for eight more days of physical remand, to examine the suspects’ devices and social media accounts and to identify possible accomplices. The court was told that Sajid Ali had already spent six days on physical remand, while the second suspect had been remanded for three days. The Judicial Magistrate (West) granted four additional days for each suspect, and directed the NCCIA to produce both men again on November 6.
What makes this case instructive is not only the arrests but the chain through which they happened. A platform detected suspected material, reported it through an established channel, and the report travelled across borders to investigators in Pakistan who acted on it within days. That chain is now routine in such investigations, because material can be created in one country, shared in another and stored in a third, and no single agency can follow it alone.
Pakistan has also been building its own capacity to deal with this crime. In January 2026, the NCCIA launched an artificial intelligence tool called Katalyst, developed with support from the UK-Pakistan Serious Crime and Law Enforcement programme, to help investigators sort and prioritise the large volume of referrals they receive. The aim was to let investigators focus first on cases where children may still be at risk. Separately, the National Commission on the Rights of the Child has urged the government to strengthen the NCCIA’s capacity for investigating online child exploitation.
Those wider efforts do not change the facts of this case, but they explain why investigators are treating it as more than a two-person matter. The immediate task is forensic: examining phones, tracing accounts, following payments and identifying victims, so that children who may still be at risk can be protected. The longer task is to show, in court, that the evidence supports the charges, and to disrupt whatever network the suspects are alleged to have used. Until the suspects are produced again on November 6, the investigation remains open.
