Before We Begin — Where We Left Off
Part Eleven went looking for the half of the population nobody had studied. The rules in this series are aimed at women, the research is done on women, and the surveys that would let anyone ask the same questions about men were, over and over, never designed to.
What came out of it was a spine that runs into this part. The rule is asymmetric, and I had assumed that meant the underlying fact was asymmetric. It does not follow. A rule can fall where it falls because that is where it can be enforced. A household can reach a daughter. It cannot reach a son who has moved to another city, and it has never seriously tried. Chapter Nine of that part scored the traditionalist’s own stated goals and found that four of the six pointed at male conduct rather than female — including the one about disease, where a woman’s risk is set as much by her husband’s history as by her own.
The other finding was about who does the enforcing. The daily work of it is done by women, on women. The lethal end of it is delegated to whichever male relative is most legally expendable. Nobody designed that; it is what a system does when it has to produce compliance cheaply.
Enforcement was the answer to almost everything in Part Eleven. So this part asks the obvious next question: what happens to an enforcement system when the thing it depends on stops existing?
Because it did. Every mechanism in the last eleven parts assumed a community — a bounded group of people who knew each other, whose opinion mattered, who would find out and who would remember. That is what izzat was denominated in. And in one generation, roughly the length of time it took a smartphone to reach an Indian village, the community stopped having edges.
This is also where the series comes back to where it started. Part One opened with a woman photographed at a protest and attacked online with a claim about how she earns money. Eleven parts later, this is the part about the machinery that did that to her.
How this document is built
Six kinds of box, each doing one job, each looking different so you can see at a glance what you are about to read.
The first explains a hard word the moment it appears, so you never carry an unexplained term forward.
Intermediary: in Indian law, any service that stores or transmits something on someone else’s behalf. A social media platform, a messaging app, a web host, a search engine, an internet provider.
Why it matters: almost everything a government can do about online harm, it does by putting obligations on intermediaries rather than on the people causing the harm. That single design choice shapes every remedy in this part, and Chapter Eight is about what it costs.
The second takes a number too big or too abstract to picture and turns it into something with a body.
A village of two thousand people is an audience of two thousand. If every one of them heard something about you and told two others, you have been discussed by six thousand people, and it took weeks.
A post that reaches six thousand people has done the same work in about ninety seconds, to an audience that never met you, and it is still there tomorrow. That is the entire subject of this part in one comparison.
The third shows the actual evidence behind a claim, and then says what that evidence cannot show.
Most Indian numbers in this part come from the National Crime Records Bureau, which compiles crime statistics from police records across the country and publishes them annually.
What it is good at: consistency and coverage. The same categories, every state, every year.
What it is bad at, and this matters more here than anywhere else in the series: it can only count what was reported, recorded, and fitted into an existing category. Chapter Seven shows what that leaves out, and the shape of the omission is not random.
The fourth is for places where informed people genuinely disagree. Each side gets its best case.
A question, then the sides, then a verdict that does not claim more certainty than exists.
Its strongest case, put the way its best advocate would put it, with the evidence it actually has.
The same, with equal care. If a position sounds foolish here, I have failed to understand it, not proved it wrong.
What would settle it: the evidence that would decide it. Sometimes the honest answer is that nothing available would.
The fifth is the signature of this series. It digs out what both sides are assuming without noticing.
Not caveats. Unexamined premises sitting underneath an argument everybody is having. There are five in this part, and the last one is turned on this series and on me.
The sixth closes every chapter in the plainest words available.
Six boxes. Word explains. In Real Terms converts. How We Actually Know This shows the evidence. The Argument gives every side its best shot. The Hidden Assumption digs underneath. Remember This closes the chapter.
Simple words, serious content, nothing left out.
Two warnings specific to this part
The first is about content. This part deals with image-based sexual abuse, extortion and the suicides that follow them. I describe how these things work, because you cannot understand an enforcement system without understanding its instruments, and because the people running them already know. I do not describe any individual case in detail, I do not name private individuals, and where a well-known incident matters only for what it caused, I give the consequence and leave the person out of it. If you are reading this having been through any of it yourself, Chapter Eight has the practical parts — takedown routes and how the hash systems work — and you can go straight there.
The second is about speed. This is the most time-sensitive part of the series. The law changed while I was writing it: India’s amended intermediary rules came into force in February 2026 and cut the removal deadline for non-consensual intimate images to two hours. Anything I write about the legal position is a snapshot. The mechanisms underneath it — what reputation is, who enforces it, what an audience does — change on a scale of centuries, and those are what this part is really about.
1What the Village Was For
Before you can see what changed, you have to see what reputation actually was — not a feeling about a person, but a working piece of social machinery with three specific properties. All three have gone.
1.1 — Reputation is a technology
We talk about reputation as though it were a mood: what people think of you. That is not what it did. In a village, reputation was a system for storing information about a person so that strangers could decide whether to deal with them, and it worked because it had a particular shape.
Think about the problem it solved. You want to arrange your daughter’s marriage into a family forty kilometres away. You cannot investigate them. There are no records. What you can do is ask around, and what you are asking for is the accumulated judgement of everyone who has dealt with them. Reputation is a credit rating built by gossip, and for most of human history it was the only one available.
Izzat: introduced in Part Eight, and it belongs here again. Usually translated as honour, but closer to standing — a family’s public credit, held collectively, which determines the marriages it can arrange and the deals it can make.
The property that matters in this part: izzat is not a fact about a person. It is a fact about what a specific group of people believe. Change the group and you change the thing itself.
1.2 — The three properties
That system depended on three features, and none of them was a design choice. They were consequences of how far a human voice carries and how long a human memory lasts.
The audience was bounded. The people whose opinion could hurt you were the people who might deal with you: your village, your caste network, the families your family might marry into. A few thousand people at most. Outside that circle, nobody knew and nobody cared.
The memory faded. Gossip decays. A story about a girl told in 1974 was thinner in 1979 and mostly gone by 1990, unless someone kept refreshing it. And it did not travel well: a family could move, and the story usually did not follow.
The enforcer was known. If a rumour ruined your prospects, you knew whose mouth it came out of. That person lived nearby, had their own standing to protect, and could be confronted, appeased, married into or bought off. Enforcement had a return address.
Consider what those three properties bought a family in 1970 whose daughter had been the subject of talk.
They could wait — three or four years and the story was thin. They could move — a transfer to another town and the story mostly stayed behind. Or they could negotiate, because the two or three people spreading it were people they knew, whose own daughters were also on the market.
Waiting, moving, negotiating. Every one of those three remedies has been removed by a device that costs eight thousand rupees, and no replacement has been supplied.
1.3 — What each one became
Now run the same three properties forward.
The bounded audience is gone. A photograph posted anywhere can be seen by anyone, and the people who see it are not the people who might deal with you — they are strangers with no stake, no obligation and nothing to lose by passing it on. The audience that could hurt you used to be the audience you needed. Those two groups have come apart completely.
The fading memory is gone. Text does not decay. A search engine will return a nine-year-old post as readily as a nine-hour-old one. There is no equivalent of the story getting thinner.
The known enforcer is gone. The account that posted the claim about you may be anonymous, may be automated, may be in another country, may be one of four hundred accounts posting the same thing. There is nobody to appease.
This is the question underneath the whole part, and getting it wrong in either direction produces bad policy and bad advice.
Every communication technology has produced a moral panic about young women. Printing, the novel, the telephone, the bicycle, the cinema — each was going to destroy female virtue and each did not. Gossip has always ruined lives; the village was not a gentle place, and a rumour in 1920 could and did end a woman’s prospects permanently. What has changed is throughput, not nature. Treating a quantitative change as a new phenomenon is how societies talk themselves into restricting the people they were already restricting, and the restrictions arrive faster than the evidence for them.
A quantitative change large enough stops being quantitative. All three properties broke at once, and each removed one of the three remedies a family had. Nothing about the printing press or the bicycle removed a person’s ability to move away and start again; the searchable archive does exactly that. And the asymmetry is new in a way that has no precedent: one person with an evening free can now impose a cost on a stranger that would previously have required organising a village. When the cost of attacking falls to nearly zero and the cost of defending stays where it was, you have a different system, whatever the underlying motive.
What would settle it: long-run data on outcomes rather than incidents — whether the number of women whose lives are materially damaged by reputational attack has risen, fallen or stayed flat since 2010. Nobody has this, and Chapter Seven explains why the statistics are built in a way that cannot produce it.
Why people care so much: because “different in kind” licenses emergency measures — new powers, new rules, new restrictions on daughters — and “only in degree” licenses doing nothing. Both of those are conclusions people arrive at first.
There is a premise sitting under both of those positions, and it is the one this whole part is built to expose.
Listen to how this subject gets discussed from any direction. “The internet destroyed our children.” “Social media is doing terrible harm to young women.” “Phones are ruining this generation.” The traditionalist says it and the child-safety campaigner says it, and they mean opposite things by it, and they are making the same move: treating the technology as the thing doing the damage.
It is not. Consider what actually happens when an intimate image of a woman is leaked. The image travels; that is the technology. Then a set of people decide what it means about her, and a marriage is called off, or a job is lost, or a family withdraws support, or she is beaten. Every one of those is done by a person, using a judgement they held before the phone existed.
You can test this directly. Take the same leaked image and put it in two societies. In one, it ends a life. In the other, it is humiliating for a fortnight and then it is over. The technology performed identically in both cases. The outcome differed by a factor of everything, and what differed was the penalty waiting on the other side.
The general form: attributing to a change in distribution what belongs to the thing being distributed. It runs everywhere. Blaming the road for where the traffic goes. Blaming a ledger for a debt. In each case the new infrastructure is real and does change outcomes — but it changes them by making an existing process cheaper, not by introducing a new one.
Why this matters practically, and it is not a debating point: if the technology is the enforcer, the remedies are technological — bans, filters, takedowns, keeping girls off phones. If the penalty is the enforcer, those remedies are palliative at best, and the lever is somewhere else entirely. Chapter Nine is where that fork gets taken, and almost every rupee currently being spent is being spent on the first branch.
1.4 — What is genuinely new
Having said all that, I do not want to leave the impression that nothing changed. Three things are genuinely new, and they are not the ones usually named.
The cost of enforcing collapsed. Ruining a woman’s standing used to require effort, presence and social capital. It now requires an account and twenty minutes. When the price of an activity falls by three orders of magnitude, you get more of it, and you get it from people who would never have bothered before.
The enforcer stopped needing standing of their own. In a village, spreading a story cost you something: you could be known as a gossip, your own family’s credit was in play. An anonymous account has no credit to lose. The system used to be self-limiting because the enforcers were also inside it.
The penalty became detachable from the community that imposed it. A woman could always be shamed by her own people. She can now be shamed by people who have never heard of her caste, her town or her family, and whose judgement she has no relationship with and no way to satisfy.
Reputation was not a feeling. It was a working technology — a way of storing information about people so that strangers could decide whether to deal with them. Izzat was the Indian version, held by households rather than persons.
It depended on three properties: a bounded audience, a fading memory, and a known enforcer. Those were not choices. They followed from how far a voice carries and how long a memory lasts.
All three broke at once, and each of them was one of a family’s three remedies: wait, move, or negotiate. None of the three works now.
But the technology is not the enforcer. The same leaked image ends a life in one society and is forgotten in another. What differs is the penalty waiting on the other side of it, and the penalty is administered by people.
What is genuinely new is the price: ruining a woman’s standing used to cost effort, presence and social capital. It now costs twenty minutes and an anonymous account.
2The Archive That Does Not Forget
Of the three properties that broke, the loss of forgetting is the least discussed and probably the most important. Human societies have always run on the assumption that information decays. It does not any more.
2.1 — Forgetting was a feature
Every system for handling wrongdoing that humans have built has a forgetting mechanism inside it, and we mostly do not notice them because they look like separate rules rather than one principle.
Criminal records are sealed or spent after a period. Bankruptcies fall off a credit file. Juvenile offences are not carried into adult life. Debts become unenforceable after a limitation period. Even in societies with no formal law, the equivalent existed: you moved, you married into another village, you grew old and the people who remembered died.
None of this was softness. It was structural. A society in which every mistake is permanent is a society in which a large share of the population is permanently disqualified, and no society can afford that. Forgetting is how a community recycles its members.
Practical obscurity: a legal idea describing information that is technically public but effectively hidden because finding it takes real effort.
A court file in a district registry was public. Anyone could read it. But to read it you had to know it existed, travel there, and ask — so in practice almost nobody ever did.
Why it matters: an enormous amount of the privacy people used to have was not legal protection. It was friction. Digitisation removes friction without changing a single law, which means privacy can collapse completely while every rule stays exactly where it was.
2.2 — What replaced it
Four things happened at once, and together they abolished practical obscurity for anything that touches a screen.
Storage became free. There is no longer any economic reason to delete anything. The default flipped from discarding to keeping.
Search became universal. Information that exists can be found by name, which is the specific capability that matters — because reputation attaches to a name.
Copying became perfect and instant. A takedown removes one copy. The screenshot was taken before you asked.
Context became detachable. A photograph carries none of the circumstances in which it was made. A sentence said in one room appears in another with the room removed.
A woman is nineteen. Something happens — a relationship, a photograph, a rumour, a video that was never meant to leave one phone.
In 1985, the half-life of that is about four years and its radius is about thirty kilometres. At twenty-six she is teaching in another district and nobody there has heard anything.
In 2026, it is on the first page of results for her name. At twenty-six the school checks. At thirty-four the in-laws check. At forty-one a colleague she has annoyed goes looking. The event has a half-life longer than she does.
That is not a difference in the severity of the punishment. It is a difference in its duration, and the duration is now unbounded — which makes it a different punishment.
2.3 — The screenshot
One small artefact deserves its own section, because it has quietly become the central instrument of enforcement in Indian family life and almost nothing has been written about it.
A screenshot is a copy of something on a screen. It cannot be recalled, cannot be deleted at source, and carries no indication of what surrounded it. It is trivially easy to make and impossible to prevent.
What this produced is a completely new evidentiary object in a very old system. A caste council, a family elder or a prospective in-law now has access to something the village never had: a durable, transferable, apparently self-authenticating record of a woman’s private communications. Messages between two people are now potentially messages to everyone, at the discretion of whichever of the two decides so later — or of anyone who gets hold of either phone.
There is very little formal research on this, and I want to be honest that most of what is known comes from three weaker sources rather than from good survey data: reports from organisations that run helplines for women, court records where screenshots appear as evidence, and journalism.
What those sources are good at: establishing that a pattern exists and describing its mechanics. When helpline workers in different states independently describe the same sequence — a private exchange surfaces, a family confronts the woman, a marriage is called off — that convergence is meaningful.
What they are bad at: scale. Everything reaching a helpline or a courtroom is a selected sample of the worst cases that someone was willing to report. There is no basis in any of it for saying how common this is, and I am not going to pretend otherwise.
Why the gap exists: nobody has funded a large representative survey asking Indian women whether their private messages have been used against them. That study would be straightforward to run.
2.4 — Does permanence actually change outcomes?
There is a real counter-argument here and it deserves a proper hearing, because the case I have just made is intuitive rather than measured.
Everything above assumes that permanent availability translates into permanent consequences. That step is not automatic.
The archive is permanent; interest is not. Content that circulates furiously for a week is unfindable in practice a year later, because nobody is looking and the platforms that carried it have reorganised around whatever is current. Most people are not searched for by name by anyone. And societies adapt: as it becomes normal for everyone to have an embarrassing digital past, the informational value of finding one collapses — a scandal only works if it distinguishes you from other people. The generation now in their twenties has grown up assuming everything is recorded and appears to discount it accordingly.
What matters is not whether anybody is looking now. It is whether anybody can look at the moment it counts — and there are exactly three or four such moments in an Indian woman’s life, each of them scheduled and each of them adversarial. A marriage negotiation is precisely an occasion on which someone is paid attention to look. So is a background check. The archive does not need continuous attention to do its work; it needs to be there on the day the in-laws sit down with a phone. And the adaptation argument cuts the wrong way in a society where the standard applied to women is not the same standard applied to everyone.
What would settle it: following a cohort of women over twenty years and recording whether digitally archived material actually surfaced at consequential moments. Entirely doable, never done.
Why people care so much: because if the archive is mostly inert, the correct response is to calm down and wait for norms to adjust. If it is live at exactly the moments that matter, then waiting means a generation absorbs the cost while the norms take their time.
2.5 — The right that was invented for this
Some legal systems have tried to rebuild forgetting deliberately. The European Union recognises a right to have certain search results about a person removed once the information is outdated or no longer relevant, and India’s Supreme Court has acknowledged that something similar flows from the right to privacy, though what it amounts to in practice is still being worked out through individual cases rather than a general rule.
It is worth understanding what this can and cannot do. Delisting removes a result from a search engine. It does not remove the page. It does not remove copies. It does not reach a screenshot on a relative’s phone, and the relative’s phone is where the damage is actually done in most of the cases this part is about.
So the legal instrument built to restore forgetting operates on the layer that matters least for the harm described here. That is not a criticism of the people who built it — it was designed for a different problem, in societies where the search engine really is the main route. It is a warning about assuming the remedy fits.
Forgetting was a feature, not a kindness. Spent convictions, limitation periods, sealed juvenile records, moving to another town — every society builds a way to let people stop being their worst moment, because a society where every mistake is permanent disqualifies too many of its members.
Most of the privacy people used to have was not law. It was friction — information that was technically public and practically impossible to find. Digitisation removes friction without changing a single rule.
Four things replaced it: free storage, universal search by name, perfect copying, and detachable context. The first page of results does not care what year it is.
The screenshot gave a very old system a new instrument: a durable, transferable, apparently self-authenticating record of a woman’s private conversations, releasable later by either party or by anyone who gets a phone.
Attention decays; availability does not. And the moments that decide an Indian woman’s life — the marriage negotiation, the background check — are exactly the moments when somebody is deliberately looking.
3The Two Phones
The same device is the best escape route Indian women have ever been handed and the most effective surveillance instrument their families have ever had. It is not two technologies. It is one, and both descriptions are correct.
3.1 — Why the bans are not stupid
At intervals over the last fifteen years, village councils across Gujarat, Uttar Pradesh, Bihar and Rajasthan have banned unmarried girls from owning or using mobile phones, sometimes with fines attached for families who allow it. The reporting on these decisions is usually written as comedy — backward elders, futile rules, the march of progress.
I want to start from the opposite end, because the councils are not confused about what they are doing. They have identified, correctly, the single technology most likely to end their control over who their daughters marry.
Consider the mechanism. The system described across this whole series depends on marriages being arranged between families. Its most serious failure mode — the one that produces the violence at the far end — is a woman choosing a partner herself, especially outside her caste or religion. For that to happen she needs a way to meet someone, and to keep talking to him, without any of it passing through her family.
That is precisely and exactly what a phone is.
Before the phone, a young woman in a village had a contact list consisting of: people in her house, people in her lane, people at her school if she attended one, and relatives. Every one of those channels ran past an adult who could see it.
A phone gives her a channel that runs past nobody. Not a better channel — the first one.
The councils banning phones understand this perfectly. They are not worried about screen time. They are worried about the one thing that has ever seriously threatened arranged marriage, and they are right that it is in her hand.
3.2 — Who actually has one
Before going further, the distribution matters, because “Indian women have phones now” is doing a lot of work in arguments on both sides.
India’s National Family Health Survey asks women directly whether they have a mobile phone that they themselves use — not one in the household, one that is theirs. In the most recent full round, covering 2019 to 2021, roughly half said yes, with enormous variation between states, and among those who had one, around seven in ten could read a text message.
What that question is good at: it separates household access from personal access, which is the distinction that matters here. A phone in the house that a woman may use when someone hands it to her is not an escape route.
What it does not capture: whether she controls it. A phone she owns but whose messages are read by her husband or mother-in-law is, for the purposes of this chapter, closer to a monitored line than to a private one, and no survey asks that.
The second gap is bigger than the first. Owning a handset and having private use of it are treated as the same thing in nearly all of the data, and they are not.
So the picture is not “women now have phones”. It is: about half of Indian women have a handset of their own, an unknown share of those have private use of it, and both figures are far lower in exactly the districts where the penalties described in this series are most severe.
3.3 — What it gives her
The case for the phone as a liberating instrument is strong and it is not only about romance.
It gives her information that does not come through her family — about her rights, about what is normal elsewhere, about how to leave, about whether what is happening to her happens to others.
It gives her money she can hold. A bank account with a phone attached is money that does not have to pass through a husband’s hands, and government payments made directly into women’s accounts only function as autonomy if she can actually reach the account.
It gives her contact with people outside the house — a sister in another city, a friend, a helpline, a lawyer, a police number.
And it gives her a record. This is the underrated one. The same permanence that Chapter Two treated as a threat works in her favour when the thing being recorded is a threat made against her.
Handset sharing: the very common arrangement in which one phone in a household is used by several people, usually with the male head of the household as the nominal owner.
Why it matters: almost every benefit listed above requires private use, not access. A woman who can borrow the family phone can look things up. She cannot have a conversation nobody knows about, keep a record of a threat, or receive a call she does not want explained. The gap between access and control is where most of the autonomy lives, and it is the gap that nobody measures.
3.4 — What it gives them
Now the other side of the same device, which is at least as powerful and much less discussed.
A phone is a continuous location beacon, a complete log of who a person talks to and when, a record of everything they have looked at, and a container for every private message they have ever sent. All of that sits behind a passcode which a family member can simply demand.
That last point is the one that breaks the technical arguments. Encryption, disappearing messages and private browsing all defend against a stranger. None of them defends against a father who says: unlock it.
What this produces is a form of household surveillance with no historical precedent. A family in 1975 could restrict where a daughter went. It could not read her thoughts, her friendships and her whereabouts for the past year in ten minutes. And crucially, the demand to see the phone is not experienced as surveillance by the person making it — it is experienced as ordinary parental concern, which is exactly why it meets no resistance.
This is a genuine empirical question with a real literature, and the two sides are looking at different populations rather than disagreeing about facts.
Studies across South Asia and Africa consistently associate women’s personal mobile access with greater mobility, more independent decision-making, better health information and, in some settings, reduced acceptance of domestic violence. The mechanism is not mysterious: information and outside contact are what control depends on withholding. And look at revealed preference — women want phones, spend scarce money on them, and hide them when they are banned. The people whose interests are supposedly at stake are unanimous. The councils that ban them are not confused, they are correct: the phone is a threat to their control, which is precisely why it is good for the women they control.
The studies showing autonomy gains are largely done where women already have personal handsets — which selects for households that permitted it, in regions where the penalty structure is weaker. In the districts where this series’ subject matter bites hardest, the phone arrives as a monitored device or does not arrive at all, and its main effect is to give the household a surveillance capability it never had. The phone did not create the demand to control her; it handed over a tool that makes the control cheaper and more total. And the escape route argument has a hard edge: the phone is also what makes her locatable after she runs.
What would settle it: a survey question that distinguishes owning a phone from having private use of one, asked at national scale. It does not exist. That is a one-line addition to an instrument that already reaches hundreds of thousands of Indian households.
Why people care so much: because “give girls phones” is a cheap, popular development intervention that lets everybody feel they have done something, and “make sure she controls it” is a demand about power inside households that no programme wants to make.
3.5 — The device is not the variable
The thing to take out of this chapter is that the phone does not have a politics of its own. It amplifies whoever is holding it, and in most Indian households more than one person is holding it.
Which means every policy question in this part that takes the form “should she have a phone” is the wrong question. The right one is: who else can see it, and what happens to her if they do not like what they find. The first half of that is a technology question. The second half is Chapter Nine, and it is the same second half as every other part of this series.
Village councils that ban unmarried girls’ phones are not confused. They have correctly identified the one technology that seriously threatens arranged marriage: the first communication channel in history that does not run past an adult in her house.
About half of Indian women have a mobile phone they themselves use. Nobody measures the more important number, which is how many have private use of one — and that gap is where the autonomy actually lives.
What it gives her: information outside the family, money she can hold, contact she can initiate, and a record of threats made against her.
What it gives the household: location, a full contact log, browsing history and every private message — all behind a passcode that a relative can simply demand. Encryption defends against strangers. It does not defend against a father who says unlock it.
The phone has no politics of its own. It amplifies whoever is holding it, and in most Indian households that is more than one person.
4Image-Based Abuse
The instrument at the centre of modern enforcement. What it is, who does it and why, whether it matters that she took the photograph herself — and why calling it a privacy violation sends every remedy to the wrong address.
4.1 — Getting the name right first
The popular term is “revenge porn”, and it is wrong twice over in ways that shape how the whole subject is handled.
Non-consensual intimate imagery (NCII), also called image-based sexual abuse: sexual or intimate images or recordings of a person, distributed without that person’s agreement.
Why the popular name is misleading: “revenge” names one motive among several and quietly frames the act as a response to something she did, which puts her conduct into the description of the crime. “Porn” implies material made for an audience, when most of it was made privately or was never consented to at all.
The terms above are clumsier and they describe the act rather than a story about the act. That is why researchers and, increasingly, legislators use them.
The naming matters practically, not just politically. If you believe this is mostly bitter ex-partners taking revenge, you design remedies aimed at ex-partners. That belief turns out to be wrong.
4.2 — Who does it
The motives that show up when people study this, rather than assume it, are at least five.
Revenge and control — an ex-partner, or a current one, using an image as leverage or as punishment for leaving. This is the version everyone pictures and it is real.
Status inside a peer group — images passed between friends, in groups, as currency. The woman is not the audience and often not the point.
Money — extortion, or distribution as a commodity on sites that exist for it. Chapter Six is about the extortion version, which has become the largest category by volume in some countries.
Enforcement — and this is the one that belongs to this series. An image released deliberately to trigger the community penalty described in Part Eight: to end an engagement, to punish a woman who refused someone, to destroy a family’s standing, or to force a woman out of public life.
Nothing in particular — sharing because it was there and sharing costs nothing.
Prevalence estimates come from population surveys in several countries that ask adults directly whether an intimate image of them has ever been shared without their consent. The answers land somewhere in the range of one in twenty to one in ten, varying a great deal with how the question is worded and which behaviours are included.
What those surveys are good at: showing that this is not a rare event affecting a handful of unlucky people. Even the low end of that range is an enormous number.
What they are bad at: comparison. Different studies define the act differently — some include threats, some include images obtained by hacking, some only cover partners — so the numbers are not measuring quite the same thing.
For India specifically, there is no equivalent figure, and Chapter Seven explains why: the national crime statistics record the category so narrowly that the count that exists cannot be used for this at all.
4.3 — “But she sent it herself”
This is the argument that does most of the work in defending the practice, in family arguments, in police stations and in comment sections. It deserves to be taken seriously rather than dismissed, because a great many people find it obviously decisive.
Set aside for a moment what you already think and look at what each position actually claims.
She created a permanent record of something private and handed it to another person. Everyone over the age of twelve knows that a digital file can be copied, that relationships end, and that phones are lost, stolen and read by other people. Taking the photograph was a choice with foreseeable risks. That does not make the person who spread it innocent — but it does mean this is not something that simply happened to her, and adults are generally expected to bear some responsibility for foreseeable consequences of their own decisions. Refusing to say so does not protect anyone; it just makes the advice useless to the next girl.
Agreeing that one person may see something is not agreeing that everyone may. This is not a special rule invented for this situation; it is how consent works everywhere else without controversy. Telling a doctor about your health is not publishing it. Undressing for a partner is not undressing for a street. Handing your bank details to a bank is not agreeing that the clerk may post them. In every one of those cases we locate the wrong entirely with the person who moved the information, and nobody argues that the patient should have anticipated the leak. American federal law now states this explicitly: prior consent to create an image, or to share it with one person, is not consent to publish it.
What would settle it: nothing empirical; this is a question about how responsibility is allocated, not about facts. What can be observed is that the prudential argument is applied to women at a strength it is almost never applied to anyone else, which is itself evidence about what it is for.
Why people care so much: because “she sent it herself” is the sentence that converts a crime into a lesson, and once it is a lesson, the person who has to change their behaviour is her.
Underneath that argument — and underneath every takedown law, every platform policy and every remedy in Chapter Eight — is a shared description of what actually went wrong, and it is not quite right.
Everyone treats this as a privacy harm. The laws sit in privacy statutes. The remedies are removal and delisting. The campaign language is about control over one’s own image. Both sides of the argument above accept the frame: something private got out.
But run the test from Part Ten. Take the identical image, released identically, and put it in two places. In one, the woman is humiliated for a fortnight, her friends are unpleasant about it, and in a year it is a bad memory. In the other, her engagement is cancelled, her family withdraws support, her employment ends and in the worst cases she is beaten or she dies.
The privacy violation was the same in both. The harm was not, and what differed was the penalty waiting on the other side of the disclosure. Which means privacy is the trigger, and the penalty is the mechanism.
This is not word-play, because the two descriptions send you to different places. If the harm is the disclosure, the remedy is removal — get the image down, fast, everywhere. If the harm is the penalty, then removal is damage limitation and the actual lever is the set of people who decide what the image means about her. Notice that the second group is not in any of the legislation. There is no law anywhere addressed to the in-laws.
The general form: naming a harm after its trigger rather than its mechanism. It appears whenever a remedy is built around the visible event. Treating a leaked medical record as an information problem rather than a discrimination problem. Treating a leaked salary as a privacy issue rather than a pay-equity one. In each case the framing is not false, and it routes the entire remedial effort to the layer where it can do the least.
And there is a specific cost to getting this wrong here. A successful takedown, achieved quickly, removes the file. It does not remove the belief held by the four hundred people who already saw it — and in the cases this series is about, those four hundred people are the entire mechanism. Chapter Eight is a chapter about instruments that work exactly as designed and address the wrong layer.
4.4 — What it costs, and where
One last observation before leaving this chapter.
Because the harm is the penalty rather than the disclosure, the same act is not the same crime in different places, and treating it as a single global phenomenon produces bad reasoning in both directions.
In a society with a weak penalty, image-based abuse is a serious violation with mostly psychological consequences, and the research literature on it — which is largely from those societies — reflects that. It documents distress, anxiety, withdrawal from public life, and career damage.
In a society with a strong penalty, the same act is a weapon that can remove a woman from her family, her marriage prospects and occasionally her life. There is almost no research on that version, because the countries with the strongest penalties have the weakest research infrastructure on exactly this question, and because the women it happens to have overwhelming reasons not to report it.
So the honest position is that the version of this crime that does the most damage is the version we know least about, and the gap is not accidental.
“Revenge porn” is the wrong name twice: revenge is only one motive among five, and naming it puts her conduct inside the description of the crime.
The motives are revenge, status inside a peer group, money, deliberate enforcement of the community penalty, and nothing in particular. Surveys put the share of adults affected somewhere between one in twenty and one in ten.
“She sent it herself” and “consent does not transfer” are answering different questions — one about prudence, one about wrongdoing. Both can be true. The argument is bitter because the first is nearly always used to shrink the second, which does not follow.
Calling this a privacy harm is naming it after its trigger. The same image released in two societies produces two completely different outcomes, and what differs is the penalty, not the disclosure.
Which is why a fast, successful takedown removes the file and leaves the mechanism intact — the four hundred people who already saw it are the entire machine, and no law anywhere is addressed to them.
5The Machines That Make It Up
Until recently, the enforcement system needed something to have happened. It does not any more. And the change is not that fakes became possible — it is that the last piece of practical advice anyone could give a woman stopped working.
5.1 — What actually changed
Manipulated images are as old as photography. What changed is not possibility but price. Producing a convincing fake used to require skill, software, hours and a reason. It now requires an ordinary photograph and an app, and the app is free.
Synthetically generated information (SGI): the term India’s law adopted in February 2026. It covers any audio, image or video created or altered by an algorithm so that it appears to be real.
Why the term matters: it deliberately avoids the word “deepfake”, which had come to mean video specifically. The legal category covers a still image, a voice on a phone call, and a video, because all three do the same work.
Now the consequence, which is the whole reason this chapter exists.
Every piece of practical advice anyone has ever given a woman about this rests on one assumption: that the material has to come from her. Do not take the photograph. Do not send it. Do not let anyone film you. All of it is advice about controlling her own output, and all of it was reasonable while an image had to originate with her.
The input is now an ordinary clothed photograph of her face. A graduation picture. A wedding photo. A profile image. Something a relative posted.
Work out what “do not take the photograph” now protects against, in a country where a woman’s face appears in a school group photo, on a college noticeboard, on a company website, at a family wedding, and in the background of two hundred other people’s pictures.
The answer is: nothing. To be safe under the old advice she would have to have never been photographed by anybody, at any point, in a society where photographs are how people organise their lives.
An entire tradition of caution, taught by mothers to daughters for a generation, was rendered inoperative by a software change, and almost nobody has told the mothers.
5.2 — Does it help that it is fake?
Intuitively it should. A false accusation can be disproved; a true one cannot. So a fake image ought to be a lesser harm than a real one, and the natural remedy ought to be demonstrating that it is fake.
Both of those turn out to be wrong, and the reason is the mechanism from Chapter Four.
This matters for law as well as for comfort. Several legal systems initially treated fakes as a lesser offence, or as no offence at all.
Nothing private was exposed, because there was nothing private. No trust was broken. The image can, in principle, be shown to be false, and as public awareness of synthetic media rises the default assumption about any shocking image shifts towards scepticism. Twenty years ago a photograph was evidence; now everyone knows images can be made, and that knowledge is itself a defence that grows over time. Treating a fabrication as identical to a genuine exposure also flattens a real moral distinction — the person who leaks a partner’s private image has betrayed a specific trust, which the fabricator never had.
The damage is not done by the file. It is done by what a community concludes about her, and a community that acts on rumour has never needed evidence. Part Eight established that a rumour alone can end an engagement — no photograph was ever required. So a synthetic image is not a new capability; it is the old false accusation with production values. Worse: a real image involves an event that happened, which at least is bounded and past. A fabricated one can depict anything, be produced in unlimited quantity, and be aimed at a woman who did nothing at all — which removes the last thing a woman could do to protect herself.
What would settle it: outcome studies comparing women targeted with genuine and fabricated material on the things that matter — marriage, employment, family support. Nobody has run one.
Why people care so much: because “it is not really her” is the sentence that lets everybody else off. It lets the platform treat it as less urgent, the police treat it as less serious, and the viewer keep watching.
5.3 — Who it is aimed at
Early surveys of synthetic video circulating online found that the overwhelming majority of it — one widely cited count put the figure at over ninety per cent — was non-consensual sexual imagery, almost entirely of women. That study is now several years old and the landscape has broadened considerably as the tools spread into political and fraudulent uses. But the finding matters historically: the first mass application of this technology was not political disinformation. It was this.
The Indian policy story followed the same pattern. Regulation moved when a manipulated video of a well-known Indian actor circulated very widely in late 2023, prompting government advisories to platforms, and eventually the rules discussed in Chapter Eight. I am deliberately not naming her. She has had enough of her name attached to this, and the analytically relevant fact is the policy consequence rather than the person.
That sequence is worth noticing on its own terms. The technology had been used against ordinary women for years. It became a regulatory priority when it was used against someone whose visibility made it a national story. That is not a criticism of her; it is an observation about whose harm gets counted, and it is the same observation Part Eight made about which deaths get recorded.
The counts of what synthetic video is used for come from companies and researchers who crawl the sites hosting it and classify what they find. That method has a specific strength and a specific blind spot, and both matter for how much weight the figure can bear.
What it is good at: it counts what is actually there rather than what people report, so it is immune to the reporting problems that affect everything else in this part.
What it is bad at: it can only see material that is published somewhere findable. Anything made and circulated privately — in a messaging group, or sent directly to a woman’s family, which is precisely the use this series is about — is invisible to it. The published corpus is a sample of the public use, not of the use.
So treat the figure as establishing what the technology was mostly built and sold for, and not as a measurement of how it is mostly used.
5.4 — The other direction
There is a second-order effect here that cuts against exactly the people the technology already hurts most.
The liar’s dividend: the advantage that the existence of convincing fakes gives to a person who is caught by genuine evidence. Once everyone knows images can be fabricated, any real recording can be dismissed as fabricated.
Why it matters here: Chapter Three listed “a record of threats made against her” as one of the phone’s genuine gifts to a woman. That gift depends on a recording being believed. As synthetic media becomes ordinary, the evidentiary value of a photograph, a voice message or a video falls — for everybody, including her.
So the same development does two things at once. It lets an attacker manufacture material that never existed, and it lets an abuser dismiss material that does. A woman documenting a threat and a woman denying a fabrication are now in the same epistemic position, which is: nothing can be settled by showing anyone anything.
That is a serious loss and it is not recoverable by better detection tools, because the problem is not whether a specialist can tell. It is whether a mother-in-law, a village council or a police constable can tell, and whether they have any interest in telling. Chapter Eight’s provenance and labelling requirements are aimed exactly here, and Chapter Eight is also where their limits become visible.
Fakes are not new; the price of making a convincing one collapsed. India’s 2026 law calls the category synthetically generated information, and it covers stills and voice as well as video.
The consequence that matters most: the input is now an ordinary clothed photograph. Every piece of advice ever given — do not take the picture, do not send it — assumed the material had to originate with her. None of it protects anyone any more.
Being fake does not make it a smaller harm, because the damage is done by what the audience concludes, and a community that acts on rumour never needed a photograph. A synthetic image is the oldest instrument in this series — the false accusation — with production values.
The first mass use of the technology was sexual imagery of women, not political disinformation. Indian regulation moved when it reached someone visible enough to make a national story.
And it cuts both ways: the same development that lets an attacker manufacture evidence lets an abuser dismiss it. Her recording of a threat is now deniable too.
6Sextortion
Two versions of the same crime, with two different targets and two different demands. The difference between the demands is the most precise measurement anyone has ever taken of the double standard, and it was taken by criminals.
6.1 — The mechanism
The structure is simple and it has not changed in twenty years. Obtain an intimate image of a person. Threaten to send it to the people whose opinion of them matters. Name a price.
Sextortion: threatening to distribute a person’s intimate images unless they comply with a demand.
The important structural feature: the image is not the product. The threat is the product. The image only has value because of what the victim’s community would do if it arrived, which means a sextortionist is, in the most literal sense, monetising the penalty this series has spent eleven parts describing.
Note what follows from that immediately. If a community would do nothing on receiving the image, the threat is worthless and the crime does not work. Sextortion is a business that runs entirely on other people’s willingness to punish.
6.2 — Two patterns
When researchers actually looked at the reports, they found the crime had split into two distinct forms, targeting different people and demanding different things.
The clearest evidence comes from the United States, where the National Center for Missing and Exploited Children receives reports of child exploitation nationally. A joint analysis with the technology organisation Thorn reviewed sextortion reports made to it between 2020 and 2023.
What it found: the historical pattern of child sextortion had primarily targeted girls, with the offender demanding further images, sexual acts or a continuing relationship. Alongside it, a newer financial pattern had grown very rapidly, and there the victims were overwhelmingly boys — around nine in ten of the financial cases were boys aged roughly fourteen to seventeen. Reports were arriving at a rate of more than eight hundred a week.
What this evidence is good at: it is a large body of contemporaneous reports rather than recollections, gathered by an organisation with no stake in the answer.
What it cannot show: rates in the general population, or anything about India. Reports to an American hotline are shaped by who knows the hotline exists. And the girls’ pattern is systematically under-reported relative to the boys’ — for reasons the rest of this chapter makes clear.
So: girls extorted for more images and for compliance. Boys extorted for money, fast, at scale, by what are frequently organised commercial operations working from outside the victim’s country.
6.3 — Why the demands differ
The obvious explanation is that the two crimes are committed by different people with different appetites, and that is true. But it does not explain why the market sorted this way, and the market explanation is the one worth having.
An extortionist is choosing what to demand based on what the threat is worth. And the threat is worth exactly what the victim’s community will do.
For a teenage boy in most societies, exposure of an intimate image is humiliating. It is not ruinous. His marriage prospects survive it. His family does not disown him. Within a peer group it may even, disgustingly, raise his standing. So the threat has a short shelf life — its value collapses within days as he realises the world has not ended, or tells a parent, or the offender’s bluff becomes visible. An extortionist holding an asset that depreciates that fast has to convert it to cash immediately, and that is precisely what the financial pattern looks like: contact, image, threat, payment demand, all within hours.
For a girl in a society with the penalty structure described in Part Eight, the same threat does not depreciate. It appreciates. It remains valuable next month and next year, and it can be used repeatedly, because what it threatens is not embarrassment but the removal of her marriage, her family and her standing. An asset like that is not sold for a few thousand rupees. It is used to extract compliance, indefinitely.
Put the two side by side as a business decision, which is what it is.
A criminal with an image of a boy has a coupon worth a few hundred dollars that expires in about forty-eight hours. Sell it now, move to the next target, repeat a thousand times. Volume business.
A criminal with an image of a girl in a strict community holds an asset with no expiry that can be redeemed repeatedly for whatever he wants. He does not cash it out. He keeps it.
The demands differ because the penalties differ. Two sets of criminals, working independently, have priced the double standard — and their pricing is more accurate than any survey in this series.
6.4 — What it costs
Both versions kill people, and they kill them differently, which follows from the same logic.
The financial pattern produces deaths that cluster very close to the event — within hours or days, in a state of acute panic, often before the victim has told anybody. Tallies in the United States have connected financial sextortion to at least thirty deaths of teenage boys by suicide since 2021, and that count is certainly low. The specific cruelty is speed: a boy is contacted, panics, and the situation resolves one way or another before any adult knows it began.
The girls’ pattern produces a different shape of harm — prolonged, coercive, and much less visible, because the whole point of the compliance demand is that nothing surfaces. There is no equivalent tally, and there cannot be, because the cases that end are the ones that ended.
This is a heavy subject and I want to state one practical thing rather than only analyse it. The mechanism depends completely on the victim believing they cannot tell anyone. In the financial pattern, telling a parent within the first hour ends it almost every time, because the threat has no value once the audience is warned. Every organisation working on this says the same thing: the disclosure is the defence.
Both answers imply completely different responses, and both are held by serious people working on this.
These are organised criminal operations with identifiable infrastructure — accounts, payment channels, hosting. They respond to enforcement the way any commercial operation does: raise the cost and the volume falls. Platform detection of the standard opening sequence, faster takedown, payment interception and international cooperation are all tractable, and some have already produced measurable drops in reports. Waiting for societies to stop punishing women is not a plan; arresting the people running the operations is.
The business exists because the threat has value, and the threat has value because communities will do the punishing for free. You cannot arrest your way out of a crime whose weapon is supplied by the victim’s own family. Notice the asymmetry the data shows: where the penalty is weak, the crime is a rapid, low-value cash grab that a single conversation defeats. Where the penalty is severe, it becomes indefinite coercion that no arrest reaches, because the victim will never report it. Reduce the penalty and the entire business model loses its collateral.
What would settle it: comparing the coercive pattern’s prevalence across societies with very different penalty structures. That would test the norms claim directly. It is not measurable by reports, for the reason above, so it would take a general population survey — which nobody has run.
Why people care so much: because the policing answer is fundable, announceable and achievable within a political term, and the norms answer is a demand that families change what they do to their daughters.
If any of this is happening to you or to someone you know, the two things that matter are that telling somebody immediately removes most of the threat’s value, and that paying does not end it. In India the national cybercrime helpline and reporting portal exist for exactly this, and reporting does not require you to have done nothing wrong.
In sextortion, the image is not the product. The threat is the product, and the threat is worth exactly what the victim’s community would do on receiving it. It is a business that runs on other people’s willingness to punish.
There are two patterns. Girls are extorted for more images and compliance. Boys are extorted for money, quickly — around nine in ten victims of the financial pattern are boys aged fourteen to seventeen, with reports arriving at over eight hundred a week in the United States alone.
The demands differ because the penalties differ. A threat against a boy depreciates in days, so it must be cashed immediately. A threat against a girl in a strict community does not expire, so it is kept and redeemed repeatedly.
Two independent sets of criminals have therefore priced the double standard, and their pricing is more precise than any survey.
The mechanism depends entirely on the victim believing they cannot tell anyone. In the financial pattern, telling someone in the first hour ends it almost every time — because a threat has no value once the audience has been warned.
7The Mob Is Not the Village
The old enforcers had names, addresses and standing of their own. The new ones have none of those things, and that changes what enforcement is for — because the person being attacked was never the one being addressed.
7.1 — The arithmetic of attack and defence
Start with something purely mechanical, because it explains more than any theory of motive.
Attacking a person online costs the attacker almost nothing per unit. Defending costs the target a great deal per unit. Those two costs used to be roughly symmetrical, and they are not any more.
A man decides to abuse a woman online. In an hour he can send perhaps sixty messages, or post twenty, or reply to everything she has written for a month.
She now has sixty messages. To report each one takes maybe half a minute — read it, tap through the menu, choose a category, confirm. That is thirty minutes of her life to answer one hour of his, and she has to read all sixty to do it.
Now multiply the attacker by four hundred, which is what a coordinated pile-on looks like. He spent an hour. Collectively they have consumed weeks of her attention, and there is no equivalent multiplication available on her side. She cannot hire four hundred people to be attacked on her behalf.
This asymmetry is not incidental to online harassment. It is the whole of it. In a village, abusing someone cost you time, presence and reputation, so there was a natural ceiling on how much of it any one person could do.
That ceiling is gone, and what replaced it has a name.
Brigading: a coordinated attack in which a group agrees, formally or informally, to target one person at the same time.
Why it matters: the individual messages in a brigade are often mild enough that each one, taken alone, would not violate any platform rule or any law. The harm is produced by the volume, which no rule written about individual messages can see. Platforms moderate posts; the weapon is the aggregate.
7.2 — Does anonymity create the mob?
The standard explanation for online cruelty is anonymity: people behave badly when they cannot be identified. It is the premise behind every proposal for real-name registration and behind the traceability provisions in Chapter Eight.
The answer determines whether identification requirements are a solution or a distraction, and India is currently building policy on one of these two assumptions.
Remove the cost of being known and you remove the restraint that made village enforcement self-limiting. Chapter One established that the old system worked partly because the enforcer had standing of their own to lose. An anonymous account has none. The practical evidence is that abuse is worse in anonymous spaces than in identified ones, and that people who are identified moderate themselves visibly. Identity requirements would restore the missing cost.
Look at who actually conducts the worst of this in India and elsewhere: a large share of it is done from accounts with real names, real photographs and real employers, by people who face no consequence because their community approves. The auction apps described below were built and promoted in the open. Real-name policies have been tried and produced modest effects at best, while imposing severe costs on exactly the people who need pseudonymity most — women escaping abusers, and critics of governments. If the restraint were about being identified, being identified would restrain them. It does not, because their audience is not offended.
What would settle it: a natural experiment — a large platform introducing genuine identity verification and measuring targeted harassment of women before and after, disaggregated by whether the attacker’s community approved of the attack. The measurement is feasible; nobody has published it.
Why people care so much: because identity requirements are the one remedy that governments actively want for other reasons, and a genuine harm to women is a very convenient justification for building a capability that has many other uses. Chapter Eight is about that overlap.
7.3 — The industrial version
In July 2021, and again in January 2022, applications appeared on a public code-hosting service purporting to hold “auctions” of Indian Muslim women. The women listed were journalists, activists, academics, students and pilots. Their photographs had been taken from their own public accounts. There was no sexual imagery involved at all. The entire mechanism was the framing — presenting named, identifiable women as goods for sale, with the sexual implication carried by the format rather than by any content.
Arrests followed in the second case. But the thing worth extracting is how little the operation actually required. No hacking. No intimate material. No lie that could be disproved, because nothing factual was asserted. It combined two things this series has described separately — the assertion of sexual availability from Part Eight, and the searchable public index from Chapter Two — and it targeted the point where two penalty structures overlap, because the women were selected for being both women and Muslim.
That is the modern form. It does not need any of the instruments in Chapters Four, Five or Six. It needs a list of names and a frame.
7.4 — What the statistics cannot see
India’s National Crime Records Bureau reported around 86,000 cybercrime cases for 2023, up more than thirty per cent on the previous year, and the 2024 figure crossed one hundred thousand for the first time. Alongside that, recorded crimes against women ran above four and a half lakh — roughly fifty every hour.
Now look at the composition rather than the total. Around two-thirds of the recorded cyber offences were banking or investment fraud. The categories that would capture what this part is about — stalking, bullying, morphing of images — together account for a very small share, with cyberstalking and cyberbullying recorded at around ten thousand seven hundred cases in 2023 for a country of 1.4 billion people. The chargesheet rate across cybercrime as a whole sits under a third.
What this tells you: the statistical system is built around financial loss, which is what an FIR is good at recording, because there is a rupee figure and a complainant with a bank statement. It has no category that fits a coordinated pile-on, and no way to record four hundred accounts as one event.
Treat that as evidence rather than as a gap, exactly as Part Ten did with the honour-killing count. The Indian state can count. It counts fraud to the rupee. What it has not built is a category, and a missing category is a decision about what counts as a crime.
7.5 — Who the attack is actually addressed to
Everything so far has assumed the obvious thing: that an attack on a woman is aimed at that woman. Look closely at how these events are actually conducted and that assumption stops holding.
Both sides of every argument about online abuse treat it as a communication between an attacker and a victim. The remedies follow: block, mute, report, delete your account, do not feed them. All of that advice assumes she is the recipient.
She is usually not. Notice three things about how a pile-on actually runs. Most of it is posted publicly rather than sent to her — if the point were to reach her, direct messages would do. The volume is thousands of times greater than what is needed to communicate anything to one person. And the participants are visibly talking to each other: replying, competing, escalating for approval, quoting each other’s better lines.
Now ask what the operation actually produces. Two things, reliably. Status inside the attacking group, awarded for the most effective contribution. And a demonstration, watched by every other woman with an account, of what happens to a woman who speaks in public.
That second product is the yield. Survey after survey of women in public life — journalists, politicians, academics — records the same response: reduced posting, avoided topics, accounts closed. The attack on one woman is a message to all the others, and it is received. She is not the addressee. She is the medium.
The general form: mistaking the object of an act for its purpose. A public execution was never about the condemned; the crowd was the point. A shop raided to make an example is not about that shopkeeper. In every case the person who suffers is the material, and treating them as the audience makes the whole operation look irrational — which is why observers keep asking, uselessly, why the attackers do not stop when she has clearly got the message.
What follows practically is unwelcome. Nearly all the standard advice is addressed to a recipient who does not exist. Blocking works if the attacker wanted to reach you; it does nothing if he wanted an audience to see him reach for you. Leaving the platform completes the operation rather than escaping it — the demonstration has succeeded, publicly, and the next woman watched it happen.
Which leaves one question. If the file can be removed and the belief cannot, and if the attack was never addressed to her in the first place, what is the law actually able to reach? That is the next chapter.
Attack is cheap per unit and defence is expensive per unit, and they used to be symmetrical. One person can consume weeks of a stranger’s attention in an hour, and she cannot hire four hundred people to be attacked on her behalf.
Brigading works because each individual message may break no rule. Platforms moderate posts; the weapon is the aggregate, and no rule written about single messages can see it.
Anonymity increases casual cruelty and does almost nothing about the organised kind, because those attackers are not hiding from their own side. Identity requirements reduce volume and miss the harm — while building a capability governments want anyway.
The auction apps of 2021 and 2022 needed no hacking and no intimate images. A list of names and a frame implying sexual availability was the entire operation.
And the target is not the audience. The attack is posted publicly, in volumes thousands of times greater than needed to reach one person, by people talking to each other — because what it produces is status for them and a demonstration for every other woman watching.
8What the Law Is Doing
In the last two years the legal position changed more than in the previous twenty. India now requires an intimate image to come down within two hours. This chapter is about what that machinery does, what it cannot reach, and what else it can be pointed at.
8.1 — India’s two-hour rule
On 10 February 2026 the Indian government notified an amendment to the rules governing online platforms, and it came into force ten days later. It is the most significant change to this area of Indian law since the original rules of 2021.
The headline is speed. Where a platform is notified of a non-consensual intimate image, it must act within two hours. For other categories of flagged unlawful content the window is three hours, down from thirty-six. To put that in perspective, thirty-six hours was long enough for material to be copied everywhere; two hours is short enough to matter.
The amendment also does something Indian law had not done before: it defines synthetically generated information as a legal category, requires it to be visibly labelled, requires platforms to retain provenance information, and requires them to be able to identify who uploaded material used in a crime.
Everything in this chapter about Indian law comes from gazette notifications and the text of the rules themselves, which is unusually solid evidence: a notification says what it says, and its date and effect are matters of record rather than interpretation.
One distinction is worth holding on to, because reporting frequently blurs it. The two-hour obligation described above is notified and in force — made on 10 February 2026, effective from the 20th. The further proposals discussed later in this chapter, extending the framework to individual users posting on news and current affairs, are a draft released at the end of March 2026 for consultation.
What that means practically: one of these is law that platforms are already being measured against, and the other is a proposal that may be modified or dropped. I have kept them separate throughout, and you should be suspicious of any account that does not.
Underneath both of them sits one older rule, and it is the rule that gives every content regulation in the world its leverage.
Safe harbour: the rule, in place in India since 2000 and in America since 1996, that a platform is not legally responsible for what its users post — provided it meets certain conditions.
Why it is the hinge of everything: without safe harbour, no platform could allow user posts at all, because it would be liable for every one of them. With unconditional safe harbour, no platform has to do anything about harm.
So every regulatory fight about online content is really a fight about what the conditions are. The 2026 amendment does not abolish safe harbour. It makes it something a platform has to keep earning, continuously, in hours rather than days.
8.2 — The American version, and one sentence in it
The United States moved in the same direction on a slower clock. A federal law signed in May 2025 criminalised publishing — or threatening to publish — non-consensual intimate images, including fabricated ones, and required covered platforms to build a notice-and-removal process by May 2026, with removal within forty-eight hours and reasonable efforts to find and remove known identical copies.
The provision worth extracting is not the deadline. It is a single statutory sentence establishing that a person’s prior consent to the creation of an image, or to sharing it with one person, does not constitute consent to its publication.
That is the argument from Chapter Four, settled by statute in one jurisdiction. It is a small thing on paper and a large thing in a police station, because “she sent it herself” stops being a defence and becomes irrelevant.
8.3 — The mechanism that actually scales
Law sets obligations. The thing that does the work at scale is technical, and it is worth understanding because it is genuinely well designed.
Hash matching: a hash is a short string of characters computed from a file — a fingerprint. The same image always produces the same hash; a different image produces a different one. Crucially, you cannot reconstruct the image from the hash.
How the anti-abuse services use it: the woman’s own device computes the hash of the image. Only the hash is uploaded — the image never leaves her phone. Participating platforms compare it against material being posted and block matches before they appear.
Why this is the right shape: she does not have to send her intimate image to a company, or to the police, or to anyone, in order to be protected from it. Every other remedy in this chapter requires her to hand the material over to somebody. This one does not.
The limitation is that it only catches that exact image, or something close enough. Crop it, re-encode it, add a border, and it may pass. Perceptual matching handles a good deal of that, and an attacker who knows the system can defeat it. It is a filter, not a wall.
Suppose everything above works perfectly. The image is hashed, the platforms block it, India’s two-hour rule is met, and the file is gone from every service within a hundred and twenty minutes.
Now count what the two hours did not touch. The screenshot on the phone of everyone who saw it. The forward in the family group. The relative who has already telephoned. The engagement that was cancelled at minute forty.
The takedown regime is excellent at removing a file and has no purchase whatever on a belief. That is not a failure of the drafting. It is the boundary of what any law addressed to intermediaries can do, and Chapter Four explained why: the file was the trigger, and the people are the mechanism.
8.4 — The practical routes
Three things exist and are worth knowing before the argument resumes.
In India, the national cybercrime reporting portal and the 1930 helpline take complaints of this kind, including anonymously for some categories. Reporting does not require that you have done nothing wrong, and the offences involved sit in the Information Technology Act and in the provisions on voyeurism and stalking.
Every major platform now has a specific reporting route for non-consensual intimate imagery, separate from ordinary abuse reporting, and since February 2026 the Indian deadline attaches to it.
The hash services described above operate for adults and, through the child-protection organisations, for minors. They work on images you hold; they cannot help with material you have never seen.
8.5 — What else the machine can do
This is now a live Indian argument rather than a theoretical one, because a further set of draft rules was released in March 2026.
Before this, a woman whose image was circulating had essentially no timely remedy. Platforms responded in weeks if at all, and the material was permanent within hours. A two-hour obligation with safe harbour at stake changes the incentive completely, and it is the first rule in Indian law written to the actual clock of the harm. The civil-liberties objection is being made largely by people who will never need the remedy, about a capability that is used overwhelmingly for the purpose it was built for. Refusing to build a fire brigade because the ladder could be used to burgle is not a serious position.
The obligation is not “remove intimate images”. It is “detect a defined class of content across your whole service, remove it within hours, and be able to identify who posted it”. That is a general capability, and the class is defined by whoever holds the pen. Draft rules published in March 2026 would extend the ethics framework to individual users posting content “in the nature of news and current affairs” — a term with no precise definition, which digital rights analysts note could reach opinion, satire and political memes. The two-hour NCII rule and a three-hour rule for whatever is designated next run on exactly the same infrastructure, and traceability that identifies a sextortionist identifies a source talking to a journalist.
What would settle it: transparency data — how many removal orders were issued, under which category, by which authority, and how many were challenged. Some of this is published in fragments. A complete public record would let anyone answer the question empirically instead of by intuition, and its absence is the reason the argument is conducted by assertion.
Why people care so much: because a genuine and sympathetic harm is the most effective justification available for building infrastructure that has other uses, and everyone on both sides knows it. That does not mean the harm is a pretext. It means the harm and the pretext are compatible.
Which points at the thing both of those positions are assuming.
The safety advocate argues that we should build the capability. The civil-liberties critic argues that it will be misused. Both are talking as though there were two projects here — a good one and a bad one — that happen to share some plumbing, and as though the task were to get the good one without the bad one.
There is one project. “Identify a class of content across an entire network, remove it within two hours, and produce the identity of whoever posted it” is a single technical system. It has no opinion about which class. The class is a parameter, set later, by whoever holds the authority to set it.
This is why the usual framing of the debate — should we build this? — is the wrong question, and why both sides sound naive to each other. It was always going to be built, in every country, because the harm is real and the pressure is enormous and no government can refuse to act on it. The capability exists now. What has not been decided, in India or anywhere, is who sets the parameter, on what record, subject to what review.
The general form: a capability that does not know what it is for. A national identity database built for benefits delivery. A camera network installed for traffic. A ledger of financial transactions built for tax. In every case the infrastructure is genuinely useful for the stated purpose, works exactly as designed, and can be repointed by an administrative decision that requires no new construction and no new legislation.
What follows is not that the rules are bad. A woman with a two-hour takedown is materially better off than a woman with none, and I am not going to pretend otherwise to make a cleaner argument. What follows is that the fight worth having is not about whether the machine exists. It is about the register: who can point it, at what, and where the record of it is kept. That fight is currently not being had, in either direction, because one side is defending the machine and the other is objecting to it.
So the law can remove a file in two hours and cannot reach the thing that turns a file into a ruined life. That leaves the question this part has been building towards, which is what does.
India’s amended rules came into force on 20 February 2026. A non-consensual intimate image must be acted on within two hours; other flagged unlawful content within three, down from thirty-six. Synthetic content must be labelled and traceable.
American federal law from May 2025 criminalises publishing or threatening to publish such images, including fabricated ones, and states in statute that consent to create or to share privately is not consent to publish.
Hash matching is the mechanism that scales, and it is well designed: her device computes a fingerprint, only the fingerprint is uploaded, platforms block matches. The image never leaves her phone.
But run it perfectly and the file is gone in two hours while the screenshots, the forwards, the phone calls and the cancelled engagement are untouched. The regime removes files and has no purchase on beliefs.
And protection and control are not two programmes sharing plumbing. They are one capability with the target class left as a parameter — so the question is not whether it gets built, but who sets the parameter and who keeps the record.
9What Actually Reduces the Harm
The case for taking the phone away is stronger than people who dislike it admit. Three answers exist, they are addressed to three different people, and the argument is confused because everyone pretends they are addressed to the same one.
9.1 — The case for restriction, put as well as I can put it
Here is the argument for the village council, the strict father and the mother who reads her daughter’s messages. It does not require any appeal to honour or tradition. It uses this part’s own findings.
The threats are real and this part documented them. A permanent searchable archive. An image that can be fabricated from a graduation photograph. A crime whose business model is her family’s willingness to punish her. Coordinated attack that costs the attacker an hour and costs her weeks. None of that is invented and none of it is exaggerated.
The remedies are slow, partial and institutional. A two-hour takedown obligation is worth having, and it depends on a complaint being made, categorised and acted on, by services and police forces that in much of India do not work reliably. Chapter Eight showed that even perfect execution removes a file and leaves the belief.
Restriction is the only lever a parent actually holds. A father in a district town cannot change platform policy, cannot reduce his neighbours’ willingness to punish, and cannot make the archive forget. He can decide what his daughter has in her hand. It works immediately, costs nothing, and requires no one’s cooperation.
And he is not wrong about the penalty. This is the part that critics skip. He is not overestimating what would happen to her. He is one of the people who would have to watch it happen, or apply it. His estimate of the danger is better informed than that of anyone telling him to relax.
That is the case. It is coherent, it is evidence-based, and its conclusion is that a girl should have a smaller life than her brother.
9.2 — Three answers, addressed to three people
All three positions accept every finding in this part. They differ on where to apply pressure.
Shrink the surface area. Fewer photographs, tighter accounts, less public presence, a monitored device or none. It is immediate, it requires nobody’s permission, and it demonstrably works — a woman with no public footprint is harder to attack. Everything else on this list takes a decade and a legislature. She does not have a decade; she has a marriage negotiation in eighteen months.
Fast takedown, hash blocking, criminal liability for distribution and for threats, platform design that interrupts the standard sextortion opening, policing that treats this as a crime rather than as a family matter. This is the branch that has actually moved: two-hour obligations, statutory takedown, federal criminalisation of fabricated material, all inside two years. Unlike restriction it does not cost the woman anything, and unlike changing norms it can be legislated by people who already exist.
Chapter Six proved this one, and it proved it using criminals as the instrument. The threat is worth exactly what the community will do. Where the penalty is weak, the crime degrades into a rapid low-value cash grab that a single conversation defeats. Where it is severe, it becomes indefinite coercion no arrest can reach. Nothing else on this list touches the weapon’s value. Takedowns remove ammunition; this removes the gun.
What would settle it: nothing empirical about their effectiveness, because each is effective at what it does. What is genuinely open, and measurable, is the size of the third effect: comparing the same crimes across communities with very different penalty structures. Chapter Six’s two patterns are the closest thing anyone has to that measurement, and it was produced accidentally.
Why people care so much: because the first answer is available to everyone right now and its whole cost falls on someone who did not choose it, the second is fundable and announceable, and the third asks families to stop doing something they believe is love.
It helps to see the three set out as a ledger, with what each one buys and who settles the bill.
Put the three on a ledger with what each buys and who pays.
Restriction: reduces her risk substantially, today. Cost: her education, her work, her money, her friendships, her ability to call for help, and her chance of choosing who she marries. Paid entirely by her.
Remedies: reduces the duration and spread of an attack. Cost: public money and some liberty questions from Chapter Eight. Paid by everyone, thinly.
Reducing the penalty: makes the weapon worthless. Cost: a community giving up a mechanism it has used for centuries, with no guarantee and no timeline. Paid by the people who currently benefit from it.
Notice the pattern. The cheapest option for everyone else is the one whose entire cost lands on a girl, and it is also the one that gets chosen. That is not a coincidence; it is the definition of the cheapest option.
9.3 — Where I have to be careful
Two admissions, at the point where they apply.
The first is positional. I write in public under my own name, and I am a man. If a coordinated attack came for me tomorrow it would be unpleasant, and it would not end my marriage prospects, remove my family’s support, or make my sisters harder to marry. I have been writing about a weapon that cannot be used against me at anything like the same power setting. That does not disqualify the analysis. It does mean I should be slow to call anybody’s caution excessive, and I have tried to be.
The second is methodological, and I noticed it while writing Chapter Six. I described sextortion as a market — assets, depreciation, pricing, conversion to cash. That framing produced the single sharpest finding in this part, and it also drained the moral content out of what those people are doing to children. Both of those are true at once. Analysis of this kind is useful precisely because it is cold, and the coldness is not free. I am flagging it rather than warming up the prose, because warming it up would have cost the finding.
9.4 — Back to where this started
This series exists because of a specific event. A woman was photographed at a protest, and people online attacked her with a claim about how she earns money. I read it, found I was more interested in the machinery than in the incident, and started writing.
Twelve parts later, here is what I have done with her. I have not named her. I have not written about her. I have not found out what happened to her afterwards, whether the claim was true, whether she wanted any of this discussed, or whether she would consider a research series a defence or another indignity. She appears in each part as a sentence in the front matter — the occasion, the reason we are here, the thing that started it.
I have called that restraint, and it is partly that. Naming her would have put her name next to this material for a second time, which is exactly the harm Chapter Two is about.
But look at the operation honestly. A group of men took a woman who had done something public, detached her from her own circumstances, and used her as material for a project of their own. Then I took the same woman, detached her from her own circumstances, and used her as material for a project of my own. The projects are not morally equivalent and I am not pretending they are. The move is the same move.
And notice the specific form the erasure takes. I decided, on her behalf, that she would prefer not to be named. That is probably correct. It is also a judgement made about a woman, without her, by a man, in her interest as he assessed it — which is the exact structure this series has spent twelve parts describing in other people.
The general form: the abstraction that protects and erases in the same motion. It runs through every field that studies people. The anonymised case study. The composite patient. The representative victim in a policy document. In each the anonymity is genuine protection and the person becomes an illustration of something else, and both happen with one gesture.
I do not have a resolution. I am not going to name her, for the reason above. What I can do is stop pretending the choice was costless, and note that a series about who gets to decide things on a woman’s behalf has been making one such decision on every cover page.
That is where this part ends. The next one stops arguing and goes looking for places where the experiment was actually run.
The case for restricting her is coherent and evidence-based: the threats are real, the remedies are slow and institutional, restriction is the only lever a parent actually holds, and he is not wrong about the penalty. Its conclusion is that she should have a smaller life than her brother.
Three answers exist and they are addressed to three different people: reduce her exposure (a parent, today), build the remedies (a state, over years), reduce the penalty (a community, with no timeline). The argument is incoherent because everyone pretends they are advice to the same person.
Only the third touches the weapon’s value. Takedowns remove ammunition. The penalty is the gun.
The cheapest option for everybody else is the one whose entire cost lands on a girl — and that is not a coincidence. It is what cheapest means.
And this series began with a woman who was used as material for somebody’s project. I have used her as material for mine, decided on her behalf that she would rather not be named, and put that decision on every cover.
10An Honest List of What We Do Not Know
Two lists, as in every part. What is genuinely unknown, with the reason it is unknown. And what is solid enough to build on. This is the shortest chapter and the most useful one.
10.1 — Genuinely unknown
Whether outcomes have actually got worse
This is the largest gap and it sits under everything. We know incidents are reported more. We do not know whether the number of women whose lives are materially damaged by reputational attack has risen, fallen or stayed flat since 2010. Reports rise when reporting gets easier, and reporting has got much easier. The reason we do not know: nobody measures outcomes, only incidents, and the two move for different reasons.
How common any of this is in India
There is no Indian equivalent of the population surveys that give the one-in-twenty to one-in-ten figure for image-based abuse elsewhere. The crime statistics cannot supply it, for the reasons in Chapter Seven. The reason we do not know: the survey has never been commissioned, and it would be straightforward to add to instruments that already reach hundreds of thousands of households.
How many women have private use of a phone
We know roughly half of Indian women have a handset they themselves use. We have no national figure for how many have use of one that nobody else reads — which Chapter Three argued is where the autonomy actually lives. The reason we do not know: it is a one-line addition to an existing survey question and nobody has added it.
Whether synthetic and genuine images cause the same damage
The reported distress looks similar, which is what the mechanism predicts. Nobody has compared outcomes — marriage, employment, family support — between women targeted with real material and women targeted with fabricated material. The reason we do not know: it would require identifying and following both groups, and both groups have overwhelming reasons not to be identified.
Whether identity requirements would reduce the harm
Anonymity plainly increases casual cruelty. Whether removing it reduces the organised, community-sanctioned attacks that do the serious damage is untested, and the theory says it should not, because those attackers are not hiding from their own side. The reason we do not know: the natural experiment is available — a large platform introducing verification and measuring targeted harassment before and after — and no such analysis has been published.
The scale of the coercive sextortion pattern
The financial pattern is measurable because victims report it. The coercive pattern is defined by nobody reporting it. Every number in this area therefore describes the version we can see. The reason we do not know: the crime’s mechanism is silence, so reports can never measure it and only a general population survey could.
What the two-hour rule actually does
India’s amended rules came into force in February 2026. Whether removal within two hours materially changes outcomes, or whether the copies made in the first two hours are sufficient for the damage, is an open empirical question with a clean answer available in a few years. The reason we do not know: it is too early, and this is the one item on this list where waiting will genuinely resolve it.
One item on that list is unknown for a reason worth stating on its own, because it recurs across this whole series.
Six of the seven gaps above could be closed by adding questions to surveys that already exist and already reach the right people. India runs a national health survey covering hundreds of thousands of households and asking about phone ownership, domestic violence and household decision-making. Adding “do you have private use of it” and “has anyone shared your private messages or images without permission” would cost almost nothing at the margin.
The instruments exist. The sampling exists. The field staff exist. What does not exist is the question.
Treat that the way Part Ten treated the honour-killing count and Chapter Seven treated the crime categories. A statistical system that can measure something and does not has made a choice about what counts as a fact, and the choices keep landing in the same place.
10.2 — Solid
The three properties of reputation broke, and each was a remedy
A bounded audience, a fading memory and a known enforcer were not design features; they followed from physics. Their disappearance removed a family’s three options — wait, move, negotiate. This is descriptive and not seriously disputed by anyone.
Practical obscurity is gone, and no law changed
Information that was public but effectively unfindable is now findable by name in seconds. Every privacy rule stayed where it was; the friction that was doing the work disappeared.
About half of Indian women have a phone of their own
From the national health survey, with wide state variation, and around seven in ten of those able to read a text message. The question about control was not asked.
The input to a fabricated image is now an ordinary photograph
This is a technical fact and it is not contested. It means every piece of traditional advice about not creating material has been rendered inoperative, because the material no longer has to come from her.
Fabricated material is treated as equivalent in law
Both India’s 2026 rules and American federal law from May 2025 cover synthetic intimate imagery on the same footing as genuine. American law also states explicitly that consent to create an image, or to share it with one person, is not consent to publish it.
Sextortion has split into two patterns with different targets and different demands
Girls extorted for further images and compliance; boys extorted for money. Around nine in ten victims of the financial pattern are boys aged fourteen to seventeen, with reports arriving at more than eight hundred a week in the United States. This comes from a large body of contemporaneous reports to a national clearing house.
The demand differs because the penalty differs
A threat that depreciates in days must be cashed immediately; one that does not expire is kept and redeemed. This follows from the reported patterns rather than from theory, and it is the cleanest measurement of the double standard produced anywhere in this series.
India’s crime statistics cannot see this category
Around two-thirds of recorded cyber offences are financial fraud; stalking and bullying together account for roughly ten thousand seven hundred recorded cases in a country of 1.4 billion, and there is no category that fits a coordinated attack by four hundred accounts. The chargesheet rate across cybercrime is under a third.
The takedown regimes remove files and not beliefs
This is not a criticism of their drafting. It is the boundary of what any obligation placed on intermediaries can reach, and it follows directly from the fact that the disclosure is the trigger and the community response is the mechanism.
Unknown: whether outcomes have actually worsened rather than reports rising; how common any of this is in India; how many women have private use of a phone; whether fabricated material damages as much as genuine; whether identity requirements would help; the scale of coercive sextortion; and what the two-hour rule will do.
Solid: the three properties of reputation broke and each was a remedy; practical obscurity ended without any law changing; about half of Indian women have their own handset; a fabricated image now needs only an ordinary photograph; law now treats fabricated and genuine alike; sextortion has split into two patterns whose demands are priced by the penalty; India’s crime statistics have no category for this; and takedown removes files rather than beliefs.
Six of the seven gaps could be closed by adding two questions to a survey that already reaches hundreds of thousands of Indian households. The instruments exist and the question does not.
The honest summary of this part: the machinery is genuinely new, the judgement it delivers is genuinely old, and every remedy anyone has built so far operates on the machinery.
Sources & further reading — Part 12
Timeline
From the first camera phone to the two-hour takedown, with the Indian legal thread running alongside.
| Year | What happened |
|---|---|
| 2000 | India’s Information Technology Act establishes safe harbour: a platform is not liable for what its users post, provided it meets certain conditions. Every later fight is about what those conditions are. |
| 2000–02 | Camera phones reach the mass market. For the first time, most people carry a device that can create a permanent image of anyone at any moment. |
| 2009 | India’s amended IT Act comes into force, adding specific offences for capturing or publishing images of a person’s private areas without consent, and for transmitting sexually explicit material electronically. |
| 2013 | Following the Delhi gang rape and the national response to it, India’s criminal law is amended to make voyeurism and stalking specific offences, with stalking defined to include monitoring a woman’s use of the internet. |
| 2013–14 | The first American state laws against non-consensual distribution of intimate images. The term “revenge porn” enters general use, and researchers begin arguing against it. |
| 2016 | Mobile data prices in India collapse and smartphone use spreads rapidly beyond the cities. In the same period, village councils in several states ban unmarried girls from using mobile phones. |
| 2017 | India’s Supreme Court holds unanimously that privacy is a fundamental right, creating the constitutional basis for everything that follows — including, eventually, arguments for removal of outdated information. |
| 2019 | An early count of synthetic video circulating online finds that the overwhelming majority of it is non-consensual sexual imagery, almost entirely of women. The first mass application of the technology was not political. |
| 2021 | India notifies the Intermediary Guidelines and Digital Media Ethics Code Rules. In July, an application appears on a public code-hosting service purporting to “auction” named Indian Muslim women using photographs taken from their own accounts. |
| 2022 | A second, larger version of the same application appears in January. Arrests follow. No intimate images were involved in either: the mechanism was entirely the framing. |
| 2023 | A manipulated video of a well-known Indian actor circulates very widely, prompting government advisories to platforms. India passes its data protection act, and replaces the colonial-era penal code. A joint analysis of American reports documents the financial sextortion pattern and its overwhelmingly male teenage victims. |
| 2024 | India’s crime statistics for the year — published in 2026 — record cybercrime cases crossing one lakh for the first time, alongside more than four and a half lakh recorded crimes against women. |
| 2025 | American federal law criminalises publishing or threatening to publish non-consensual intimate images, including fabricated ones, and states that consent to create or to share privately is not consent to publish. Platforms are given a year to build removal processes. |
| 2026 | India notifies amended intermediary rules on 10 February, in force from 20 February: synthetically generated information defined in law for the first time, mandatory labelling and traceability, and a two-hour deadline for acting on non-consensual intimate images. In March, draft further amendments propose extending the ethics framework to individual users posting on news and current affairs. |
| Next | Part Thirteen starts here. |
Glossary
Every hard word used in this part, in plain English.
| Term | What it means |
|---|---|
| Brigading | A coordinated attack in which a group targets one person at the same time. Each message may break no rule; the harm is produced by the volume. |
| Financial sextortion | The pattern in which an offender obtains an intimate image and demands money quickly, rather than further images. Victims are overwhelmingly teenage boys. |
| Handset sharing | One phone used by several people in a household, usually owned nominally by the male head. Access without private control. |
| Hash matching | Computing a short fingerprint from an image so platforms can block that exact image without ever holding a copy of it. The image never leaves the owner’s device. |
| Intermediary | Any service that stores or transmits something on someone else’s behalf — a platform, a messaging app, a host, a search engine. Almost all online regulation works by imposing duties on these. |
| Izzat | Usually translated as honour; closer to standing. A household’s collective public credit, which determines the marriages it can arrange. |
| The liar’s dividend | The advantage that convincing fakes give to a person caught by genuine evidence, because any real recording can now be dismissed as fabricated. |
| NCII | Non-consensual intimate imagery. Also called image-based sexual abuse. Preferred to “revenge porn”, which names one motive and implies material made for an audience. |
| NCRB | India’s National Crime Records Bureau, which compiles crime statistics from police records nationally and publishes them each year. |
| Practical obscurity | Information that is technically public but effectively hidden because finding it takes real effort. Most of the privacy people used to have was this rather than law. |
| Safe harbour | The rule that a platform is not liable for user content provided it meets certain conditions. Every content regulation fight is a fight about the conditions. |
| Sextortion | Threatening to distribute a person’s intimate images unless they comply with a demand. The image is not the product; the threat is. |
| Synthetically generated information | India’s legal term, adopted in February 2026, for any audio, image or video created or altered by an algorithm so that it appears real. Broader than “deepfake”, which had come to mean video. |
| Traceability | A requirement that platforms be able to identify who originated a piece of content. Presented as a tool against anonymous abuse; the same capability identifies any source. |