Between June and July this year, police in nine European countries spent a fortnight reading the open internet on purpose. They were looking for material produced by, or circulating inside, a network called The Com. At the end of it, Europol's EU Internet Referral Unit and Spain's intelligence centre against terrorism and organised crime referred 4,340 URLs to the platforms hosting them. The Register called them horrific, which for once is not a headline writer reaching.

I want to be precise about that number, because most of the coverage was not. A referral is not a takedown. It is a formal notice to a platform saying: this is on your service, we assess it as violent extremist content, please look at it against your own rules. Whether it comes down is still the platform's decision. So 4,340 is a measure of what nine countries found and flagged in two weeks. It is a floor, not a total, and it says as much about the capacity of the people looking as it does about the volume of what is there.

The nine were Belgium, Finland, Hungary, Ireland, Luxembourg, the Netherlands, Portugal, Spain and Sweden. Britain was not among them.

What was in the 4,340

Europol's own description of the referred material is the part to sit with. Violent videos and images depicting self-harm, suicide, child sexual abuse material, animal cruelty and violent attacks. Alongside them, instructional material: manuals on grooming, on murder, on improvised explosives, and techniques for doxing and swatting.

Now read the label on the operation again. This was a counter-terrorism instrument. The EU Internet Referral Unit sits inside Europol's European Counter Terrorism Centre, and the classification it worked to was nihilistic violent extremism. Much of what it swept up is, in ordinary English, the sexual abuse of children.

That gap between the label and the contents is not bureaucratic trivia. It is the first thing this series has to deal with, because the same gap is what makes the threat almost invisible from a kitchen table. Parents are watching for a pornographer or a paedophile. The thing that is actually recruiting is filed by police as an extremist network, presents to a fourteen-year-old as a friendship group, and does both at once.

What The Com actually is

Europol describes it as a decentralised network with no unified ideology, in which some factions hold violent right-wing extremist and accelerationist beliefs and others simply do not care. It recruits through social media, messaging apps and gaming platforms.

It has recognisable clusters rather than divisions. Offline Com deals in real-world property damage and violence. Cyber Com does network intrusion and ransomware, and is the part the security industry has spent two years writing about. Extortion Com coerces minors into sexual crimes. And 764, the best-known name attached to any of it, specialises in grooming young people into producing sexual and violent material to order.

It is not an organisation in any sense a parent, or a board, would recognise. There is no membership list, no leadership whose arrest ends it, no single platform to block. HOPE not hate counts hundreds of loosely affiliated chat groups across the United States, Europe and South America, splitting and renaming constantly. Researchers at GNET put it well: it functions more as a brand than a hierarchy. Which is why Canada designating 764 as a terrorist entity in December 2025 is both genuinely useful and inherently limited. You can proscribe a name. You cannot proscribe a name that can be re-registered by teatime.

The membership is young. Perpetrators as young as fourteen. British teenagers among those already convicted.

The sentence to read twice

The National Crime Agency has been saying this in domestic terms for well over a year. Reports involving what it calls com networks rose sixfold between 2022 and 2024. The offenders are mostly teenage boys. The victims include girls as young as eleven, pressured into self-harm, into hurting siblings or pets, into producing material that is then used to force them further in. Status inside these groups is earned by the severity of what you can make someone else do.

Then the line from Graeme Biggar, the NCA's director general, which is the reason I am writing this series at all:

These groups are not lurking on the dark web, they exist in the same online world and platforms young people use on a daily basis.

I have spent 29 years explaining threat models to people who have to pay for the defence, and the most expensive error in that work is always the same one. Organisations defend the perimeter they can picture rather than the one they actually have. They buy a firewall and get breached through a supplier. They harden the office and lose a laptop in a taxi.

Households are running exactly that error, and I include my own instincts in this. The mental model most of us carry is that the genuinely dangerous material lives somewhere separate — a dark web, a hidden layer, somewhere you have to deliberately go. It is a comfortable model, because it implies a child who does not go looking will not be found.

It is wrong, and it has been wrong for years. The Com does not need your child to go anywhere. It needs your child to be online, alone, late, and having a bad week.

The numbers this series is built on

I dislike statistics stacked up for effect, so these are only the ones that change what you should do.

The Internet Watch Foundation assessed 451,210 reports in 2025, one every seventy seconds, and confirmed 311,610 as containing child sexual abuse material — up 7% on the year. Category A, the most severe classification, rose 29%. Of the children in the imagery, 77% were girls.

AI has arrived in this properly. The IWF confirmed 3,443 AI-generated child sexual abuse videos in 2025 against a bare handful the year before, a 260-fold increase, and 65% of those videos were Category A. Of AI-generated images, 97% depicted girls. This is no longer a horizon risk.

Sexual extortion, which is where most British families will actually meet this, is climbing hard. The IWF confirmed 397 sextortion cases in 2025, up 127%, and 98% of the victims were boys aged fourteen to seventeen. Report Remove — the Childline and IWF service that lets an under-18 report their own images — took 1,894 reports, up 66%, with sextortion in 34% of the confirmed cases against 23% the year before. That is nine British children a week reporting an extortion attempt through one service alone, and the IWF's own chief executive calls it the tip of the iceberg.

Grooming, meanwhile, is at a record. Forty-four UK police forces recorded 7,263 sexual communication with a child offences in the year to November 2025, close to double the figure when the offence came into force in 2017/18. Where the platform could be identified, Snapchat accounted for 40%. Eighty per cent of the children targeted were girls. The youngest victim in the data was a four-year-old boy.

And the exposure figures, from Ofcom's May 2026 research: 56% of ten-year-olds own a smartphone, rising to 83% at eleven. Nearly three-quarters of 11 to 17-year-olds have encountered harmful content online, a number that has barely moved since the Online Safety Act's duties began to bite. Thirty-five per cent met it while scrolling a feed. One per cent went looking for it.

Hold on to that last pair. One child in a hundred goes looking. The rest are found.

What has genuinely improved

I am not interested in writing a series that only says the sky is falling, so here is the other side of it, and some of it is real.

The law has moved further in twelve months than in the previous ten years. The Crime and Policing Act 2026 makes it an offence carrying five years to possess, supply or adapt an AI model optimised to generate child sexual abuse material. It extends the paedophile manual offence to cover AI-generated material and guidance on producing it. It creates a distinct offence for the moderators and administrators who keep these sites running — the people who write the code and control the doors, who previously sat awkwardly outside the possession offences. And it gives Border Force the power to require devices to be unlocked and scanned against the Child Abuse Image Database in roughly fifteen seconds.

The platforms have moved too, in at least one case seriously. Roblox now requires facial age estimation before a user can access chat anywhere in the world, sorting accounts into age bands so that a thirteen to fifteen-year-old cannot exchange messages with a sixteen to twenty-one-year-old at all. Whatever you think of handing a child's face to an estimation model — and I have reservations about the identity store that builds — it is the most consequential architectural change any large children's platform has made. Ofcom has started issuing fines rather than letters.

None of it has yet shown up in what children report. That is not a reason to sneer at it; regulation and product change take years to appear in the numbers. It is a reason not to sit and wait for it.

What this series is, and what it is not

I have written about children here before, from two different angles. Regulating the Teen Internet is the policy series — bans, curfews, age checks, and whether any of it survives contact with a fifteen-year-old and a VPN. The digital privacy series covers the footprint: what accumulates about a child over years, mostly created by the adults around them.

This one is different, and blunter. It is about the criminal end — the people who are actively looking for your child, the pattern they follow, and what a household does about it. There will be no screen-time lecturing, because screen time is not the threat, and no advice that depends on a statute commencing in 2027.

Over the parts that follow:

If you need something now

Some readers will arrive here mid-crisis, so the routes come first and not buried at the end of part eight.

If any of this is close to home for you personally, Samaritans are on 116 123, and it is worth saying plainly that a young person being coerced by one of these groups has done nothing wrong and is not in trouble.

Four thousand three hundred and forty is the number of doors nine countries got to knock on in a fortnight. It is a real achievement and it is nowhere near the size of the problem. The door that matters in your house is a great deal smaller, and a great deal closer, and nobody else is going to knock on it.

Next in the series: how contact actually starts — the first message is always kind, and everything that follows is designed to make telling you feel impossible.