How we identify, document, and report.

1. Identification

Cases reach our attention through two pathways: public submissions via our reporting form, and ongoing observation by our research volunteers. Public submissions undergo initial triage to determine whether they meet our scope and the threshold for further investigation.

Our research focus is determined by patterns of harm rather than individual incidents. We prioritize cases where coordinated networks, large subscriber bases, or systemic exploitation of platform features create scaled harm to users — particularly minors and vulnerable populations.

2. Verification

Before any notice is prepared, the underlying evidence is verified. This includes:

• Confirming that reported entities are actively operational at the time of review
• Cross-referencing claimed activity against observable behavior
• Documenting subscriber counts, public profiles, and operational signatures
• Identifying connected actors, payment infrastructure, and operational patterns

Cases where evidence is insufficient or where the activity does not clearly violate applicable law are documented but not advanced to formal notice.

3. Documentation

Each verified case generates a structured record containing:

• Unique reference number and timestamp
• Entity identifiers (URLs, IDs, usernames)
• Visual evidence (screenshots with metadata)
• Behavioral analysis and modus operandi description
• Risk assessment and population exposure metrics
• Applicable legal framework and basis for action

Records are maintained in a secure system accessible only to authorized volunteers. They serve both as the basis for outgoing notices and as our internal audit trail.

4. Notification

Formal notices are issued under EU DSA Article 16 — the standard mechanism for notifying online platforms of illegal content. Each notice includes:

• Clear identification of the content and its location
• Statement of the legal basis (DSA, applicable national law, platform terms)
• Supporting evidence in structured form
• A good-faith declaration confirming accuracy and proper purpose
• Specific requested actions and contact for follow-up

Notices are submitted through official platform channels (e.g., abuse@telegram.org, dmca@telegram.org) or through trusted-flagger pathways where available.

5. Follow-up

We track platform responses to each notice. Where action is taken, we document the outcome. Where no response is received within a reasonable period, we issue follow-up correspondence. In cases involving immediate risk to public safety, we also coordinate with relevant law enforcement agencies in addition to platform notifications.

6. Audit and improvement

Our methodology is reviewed periodically to incorporate lessons learned. Cases where notices were rejected or where platforms requested additional information feed back into our documentation standards. This iterative refinement ensures our work becomes more effective over time.

Standards we apply

In addition to legal frameworks, our work is informed by best-practice standards developed by the broader digital safety community, including:

• INHOPE network procedures for hotline operations
• EU DSA implementation guidelines
• Tech industry trust & safety standards (e.g., Tech Coalition principles)
• Privacy and data protection requirements under GDPR