The arrest followed an intelligence-based investigation. According to a press release issued by the office of the Additional Director General of Police, Maharashtra Cyber. The operation was carried out after continuous monitoring of the digital space by three specialised units of Maharashtra Cyber: the Cyber Crime Prevention Against Women and Children (CCPWC) unit, the Online Crimes Against Women and Children (OCWC) unit, and the Tactical Response Against Child Exploitation (TRACE) unit.
During surveillance, the cyber teams received intelligence about Saifuddin downloading and storing CSEAM. Using technical analysis and cyber intelligence tools, investigators traced the suspected activity to Saifuddin and established his identity. He was subsequently apprehended from Malad (West).
49 YO Saifuddin Jamir Uddin Malik of Malad West, Mumbai, had over 20,000 child sexual abuse images and videos on his phone. Maharashtra Cyber received intel and arrested him under BNS 294, POCSO 15 and IT Act 67(B). Forensic examination is under way. https://t.co/rFpO5I4GTO
— Treeni (@treeni) November 9, 2026
An FIR (No. 88/2026) has been registered at the nodal cyber police station of Maharashtra Cyber under Section 294 of the Bharatiya Nyaya Sanhita (BNS), Section 15 of the Protection of Children from Sexual Offences (POCSO) Act, 2012, and Section 67(B) of the Information Technology Act, 2000. Under the POCSO Act, possessing or storing pornographic material involving children carries graded punishments, with Section 15 specifically addressing the possession and storage of such content.
More than 20,000 objectionable images and videos were recovered from him during the investigation. Police seized the device and undertook an extensive forensic examination. Police are now working to establish the origin of the material, determine how it was downloaded, and ascertain whether it was further shared or circulated through any online platform. Investigators are also examining the possibility of other individuals being involved in the case.
Maharashtra Cyber has reiterated that downloading, possessing, storing, sharing, or circulating CSEAM constitutes a serious criminal offence and has urged citizens to report any suspicious activity involving child exploitation.
Such incidents can be reported through the National Cyber Crime Reporting Portal (www.cybercrime.gov.in) or by calling the cybercrime helpline 1930. According to the agency, it has so far acted on 5.67 lakh cyber tipline reports and 31,000 online child exploitation complaints.
How India Investigates CSAM Reports
India receives suspected Child Sexual Abuse Material (CSAM) leads mainly through NCMEC’s CyberTipline, which are routed via the Ministry of Home Affairs, NCRB and I4C to state and UT police. A CyberTip is not a complaint; it is a digital lead containing identifiers such as email addresses, screen names, IP addresses, account details or mobile numbers. The local police must then convert that lead into an FIR and a criminal investigation.
The investigative chain typically moves from digital identifier to subscriber, device, actual user and alleged act. Police trace accounts and mobile numbers, obtain subscriber details, identify jurisdiction, register an FIR, seize phones or computers, and send them for forensic examination. They must also establish whether the material depicts a child and whether the accused downloaded, possessed, stored, transmitted or uploaded it. This attribution stage is critical: a mobile number or IP address may be shared, and an account may be misused.
Court records show uneven outcomes. In Chennai, a CyberTip led to an FIR, device seizure, chargesheet and a Supreme Court ruling that POCSO Section 15 covers possession and storage. In Rupnagar, the accused was acquitted because the CyberTip CD was not exhibited and the Section 65B certificate was missing.
Two Bengaluru cases ended in acquittal over weak proof linking seized phones to the alleged activity. Karnataka bail cases showed that IP or handset links did not prove who uploaded the material. Bilaspur used IP location to register an FIR; Delhi identified account holders but still had to establish origin and creation. CBI’s Hisar and Aizawl cases used CSAM to identify and rescue children whose abuse had not been reported.
