♦ School administrations aware and apathetical 
♦ Authorities to bring new legislation
♦ Police facing uphill battle

The local racket involving the trade of pictures of schoolgirls   in various stages of undress or intimacy, also known as nudes, amongst schoolboys and the sale of them to online porn sites, involving 70 reported cases including of related attempts of blackmail and/or extortion, masterminded and orchestrated in an extremely organized manner by schoolboys as young as 14 years of age, has come to light.

Hans Billimoria of The Grassrooted Trust said that the said trade which even included an instance where a nude, which in modern day romances is considered as a symbol of trust and fidelity, depicting the naked upper torso of a Muslim schoolgirl had been sold to an online porn site for Rs 20,000, takes place in most schools across the country, even in schools in rural areas between Vavuniya and Padawiya, and also the Vanni, where even though phones with cameras are available, access to the internet is however limited.
Administrations of schools are aware of this, he noted.

There is also a sense of grooming of the schoolgirls taking place in that the said girls are gradually influenced and coerced in a subtle manner to reveal themselves, he added.
Schoolgirls and even adult females/women whose nude pictures are leaked would immediately be bombarded with solicitations for sex, he noted, adding that sometimes fake accounts would be set up depicting the girl or woman as a porn star or sex worker (sometimes the images show the female in question fully clothed) and would in turn be linked to porn sites, he mentioned, adding that this also amounted to identity theft.
In 2014 alone, there have been four suicides in relation to such incidents, he remarked.
“Cyber exploitation and violence was earlier termed revenge porn due to the fact that estranged ex-boyfriends would similarly leak their ex-girlfriends nudes subsequent to a breakup of the relationship. This is also a question of respect. Apart from all this, we have received anecdotal information that the suspected schoolboys are targeting girls who do not possess mobile phones, especially smart phones. There is also a black market trade in relation to subscriber identity/identification module cards. When schoolgirls receive mobile phones in such a manner, there is also a sense of obligation on the part of the girls to send such images of themselves to those who gave them the phones. This is a red flag. This takes place in school vans, in Sunday school and at coffee shops. Very clear open lines of communication between parents and children are necessary. There are reasons why children who become victims do not go to their parents with this. The Cyber Crime Unit (CCU) of the Criminal Investigation Department (CID) and the National Child Protection Authority (NCPA) are the ones handling this. The sexualization of the internet also has a role in that the first things schoolchildren seek to see on the internet when they use it is porn. The online world is a very real world. The celebrity culture also plays a role with regards to body pride, self-esteem, self-worth, body image and nudes. Attempts to infiltrate the said network via the creation of dummy accounts have hitherto proven unsuccessful. The schoolboys including minors behind this are operating with a sense of impunity,” Billimoria observed.


Owing to the fact that victims are reluctant to come forward, the civil society further highlighted the urgent need for legal reform which would allow for the CCU of the CID and the NCPA to proceed in instituting cases in Courts without necessarily having the victim as the complainant or plaintiff. This would allow for Court orders to be sent to Instagram (an online mobile photo-sharing, video sharing, social networking service) and other such service providers and to look into Internet Protocol Addresses (IPAs). The security and privacy settings of such services and applications should be looked at in light of incidents of hacking.

Solicitor General and Acting Chairman of the National Authority for the Protection of Victims and Witnesses of Crime, President’s Counsel Suhada Gamalath explained that with regards to tackling the said issue, such had to be seen within the specific prism of the Assistance to and Protection of Victims of Crime and Witnesses Act, No. 4 of 2015, which he said should be expanded and amended in consonance with international best practices and in keeping with international standards, and be activated.

“The said law must be revisited. More arrangements must be made, specifically to expand provisions for the protection of children, who are an extremely vulnerable segment. The Act at present does not have stand alone provisions with regards to children. Elsewhere, there must be the dissemination of information about the National Authority for the Protection of Victims and Witnesses of Crime and public awareness must be created with regards to important facilities available in the Authority,” he emphasized.

Chairperson of the NCPA, Dr. Natasha Balendra informed that shortly, legislation would be suggested to tackle cyber/online bullying, harassment and blackmail, adding that new laws needed to be introduced to strengthen online safety.

We possess methods of tracing users of various online accounts and surveillance in this regard is ongoing, she maintained, adding that several arrests had been made last year of identified persons who engage in such (also through the use of mobile phones), who have since been remanded and are presently awaiting indictment by the Attorney General’s Department.

Even though in many of the cases it is those over 18 years of age that are the perpetrators, when minors are suspects, we speak to the said minor and the minor’s family instead of resorting to taking legal action, she pointed out.

“An online campaign to encourage victims of the above, who are hesitant and unwilling to report, to report such with the assurance of complete confidentiality will be started by us and a special phone hotline will be made available for this, for one month. We will take action then. A formal complaint must be made in the form of a statement by the victim or someone who knows about the incident. During the trial the victim will have to give evidence. We can then take legal action and activate the full force of the criminal justice system. A task force comprised of personnel from the Attorney General’s Department, the Police and the Ministry of Justice is working on this. We are going to work with the Ministry of Education and informational technology teachers, and also with children and parents,” she elaborated.

However, one of the Heads of the Committee replacing the Police Media Unit, Senior Deputy Inspector General of Police Priyantha Jayakody pointed out that the CCU of the CID encountered difficulty in tracing IPAs, adding that they sought the technical assistance of the Sri Lanka Computer Emergency Readiness Team (SLCERT).

Senior Information Security Engineer at the SLCERT, Roshan Chandragupta pointed out that in many of the cases the photographs of the girls were uploaded only on one website and then the main link had been shared on other sites.

The issue could be addressed by tracking down the original website on which the link was uploaded and sending a request to remove it from the said site, which they do, subsequent to which the link would not work on other sites in which it was shared, he noted, adding that the SLCERT possessed no authority to ban or block websites.
On the other hand, the problem would be that someone else would have downloaded the picture or video and would upload it sometime later, he added.

Even though the Sri Lankan law enforcement authorities are equipped to tackle cyber crime, there are certain limitations aside to the reluctance of victims to come forward to complain, such as the fact that many of these websites and proxy servers are being operated from other countries and therefore being outside our legal jurisdiction, he mentioned.

Another stumbling block to addressing the issue, according to Chandragupta is that the possession of pornography is not illegal in certain countries.

“Youngsters need to be cautious when capturing images that could go into the wrong hands even through a trusted person. Exercising common sense can save children from such embarrassing situations. We provide awareness to school children on the risks that they could face due to being careless in sharing personal information, including photographs. The photographs and information might end up in the public domain years later. By that time, the victims would have moved on in life and would be married. Such situations would put their family lives in jeopardy,” he explained.

Cyber Exploitation and Violence in 2015 and 2016
Case study 1: The misuse of feminist and other social campaigns to collect photographs and personal information

This case study involves a situation in which the United Nations Women’s ‘He for She’ campaign, asking the public to show solidarity and support towards fighting for gender equality, encouraging personal confidence and strong opinions, was misused by a suspect to collect photographs from a teenage girl. The game devised by the suspect to legitimize his own interests to obtain photographs involved a case where the girl (who henceforth will be referred to as D) was invited by her friend (who henceforth will be referred to as S) to play a game on Facebook Messenger (Facebook is an online social networking service) that is meant to build trust. It was later found that S’s Facebook account was being misused by the suspect. The series of tasks also involved having to take and send frontal and back view photographs of oneself in one’s underwear. By task 10 as the tasks became more and more explicit, D became suspicious of the nature of the game and the identity of S. S then offered D a deal under the threat that their conversation would be leaked and her photographs would be made public. D refused to discuss the deal.
The issues here are the widespread hacking of Facebook accounts (also includes sending files which upon being downloaded on to a victim’s computer introduces a virus which enables the collecting of personal information) and the confusion of ideas.

Case study 2: Organized system of collecting photographs of minors and young adults
The suspect in this case study was found to have a structured database of his victims including a detailed chart of the schools, age, and the nature of the photographs collected (this latter involves the photographs being arranged in an orderly fashion in folders which have name tags such as ‘girlfriend’ or ‘real girlfriend’). One of the victims set up a support group for the victims of this particular suspect which now consists of 70 girls.

One conversation involved the victim being contacted on Instagram Messenger (Instagram is an online mobile photo-sharing, video sharing, social networking service) by the suspect with a photograph of the victim. The suspect claimed to have other photographs of the victim and had tried to enter into a deal where the victim would send the suspect, photographs of other girls in return for her photograph being deleted. Thus a vicious cycle ensues.

Another conversation is similar, but the deal is more pronouncedly discussed. The victim is given a deadline to find pictures of someone else before her photographs are made public, and then made the second offer that he will delete all photographs if the victim sends fresh nudes of herself. The suspect claimed that he only used the photographs of the victim for the purpose of masturbation.

In yet another conversation a screenshot of the conversation between the suspect and a second suspect was sent to a group of other victims. The conversation between the suspect and the second suspect involved trading photographs (“N… are my best nudes”; “I need S if you want N or something better”; “Why no other Bridgatians? I am interested in bridgetians and familians” – note: spelling is as found in the actual conversation), and the first suspect’s attempt to expand the network.

Still another conversation takes place between the victim who began the support group and an anonymous individual who claimed to be another victim, where the victim ends up being further victimized.

There have also been incidents where boyfriends have been contacted by a suspect with an image (sometimes Photoshopped and not real) of a girlfriend or family member and threatened that it would be leaked if he did not send photographs of himself or another individual.

The issues here are that online platforms allow anonymity, multiple user accounts, the use of multiple accounts, suspects using different versions of their names as usernames to contact different victims, all of which thus makes it difficult to discern between the real victims and the perpetrators in what is a complex network of multiple perpetrators and victims.

In early February 2016 a victim sent an additional Instagram link – – that stated that “DM (direct message) me if you want access to my database of lankan nudes”. The page has since been deactivated.
It is suspected that some of these photographs were collected through Snapchat, an image/a photograph messaging and video sharing, multimedia mobile application/app, where the respective photograph or video can only be viewed for a maximum of 10 seconds before it disappears. Victims feel safe sending photographs due to this. The photographs can be saved by taking a screenshot of it, but the sender is then notified that a screenshot has been taken, so an additional application (“SnapSave”) can be used to save the photograph without triggering the mechanism that informs the sender that the photograph has been saved.

Most social media platforms offer modes of messaging, so conversations are not limited to sites where account holders need to supply a certain amount of personal information before setting up an account. Instagram, for an example, allows the username to be changed anytime a user wishes to, and previous activity and correspondence of the former username cannot be connected with the new username.

Lewis Fernando and L F Australia are also two other names that feature as potential perpetrators. Anecdotal accounts include how one or both of these accounts contact boys currently in relationships and also those who have most recently ended relationships, with an offer of a database of nudes in the event they share the pictures of their girlfriends or ex-girlfriends.

Case study 3: Dropbox and sharing links
The victim from case study 2 contacted Dropbox, a website and application and file hosting service used to share documents and folders, often used by corporates’ to share documents among working groups, and by individuals to share albums and documents with other individuals. As it is understood to be secure, a variety of organizations including law chambers use it for its convenience and the large back-up storage.
The victim’s private photographs were stored on Dropbox which a suspect hacked into and obtained, and then shared as a part of the 2500 photographs/70 victims database of case study 2 – the Dropbox link allegedly used for this purpose is – – and appears no longer to be active. In this case the database of pictures could have been shared and exchanged via links sent to various groups of schoolboys such as schoolboy groups comprised of ruggerites and even scrabble players, all of whom possibly attended a common tuition class or classes.

In late January 2016 during the conducting of an awareness programme at a school on cyber exploitation, another link – – was sent. This link when active contained pictures similar to the ones in the link sent previously – – which is no longer active. It is possible to surmise from the evidence that the previous account thought to be compromised was moved to this location.

In addition the victim from case study 2 provided the Facebook link – – which she stated allegedly led to a series of naked pictures of herself and other local girls in Sri Lanka.

If one visits – – directly, it requests one to create a free account in order to access the pictures and videos. The website itself appears to be a pornography site with videos and pictures in Sinhala. It is possible that the pictures in the Dropbox links have been sold/traded with those running the ‘funny tray’ website. Their Facebook page – – claims that they are a sex jokes site.