Italy breaks up New Saga, a paid Telegram child abuse network, from the inside

Italian police have taken down New Saga, a private Telegram community of more than 1,000 members that sold access to child sexual abuse material for cryptocurrency, and the arrests are now spreading abroad. Operation Fly Trap, run by the Postal Police's national centre against online child abuse (CNCPO) under the Rome prosecutor's anti-mafia directorate, ended on 17 September with 17 arrests in Italy and Switzerland, 23 searches and about 200 seized devices; on 19 September the Singapore Police Force said it had arrested two men, aged 27 and 33, on information passed by the Italians. The method that broke the network was not a decrypted message. An undercover officer spent about a year winning the administrators' trust until they made him a co-administrator, which gave the police the member list, the payment records and the private "Hall of Kings" channel where the leadership ran the operation. Investigators identified 996 accounts from 98 countries and have handed them to police forces around the world.

How the police got in

According to the Rome prosecutor's office and the Postal Police, New Saga was organised like a business: administrators with defined roles, entry rules, a paying membership and a technical support desk for hiding files. The tip from HSI in 2024 named the community; the first identification came from following the cryptocurrency payments that members made to keep their place, which pointed to a 24-year-old in Campania. When his home was searched in May 2024, investigators used what they found to begin an undercover approach. Over roughly a year an officer moved up the hierarchy until the administrators granted him co-administrator rights across the network's groups, including the reserved channel the leadership called "La Sala dei Re", the Hall of Kings. From there the police watched the network rebuild itself every time Telegram closed a group, under names designed to be recognisable to regulars, and catalogued who was uploading, who was paying and where the archives lived: cloud storage and virtual servers outside Telegram, with bots to restore chats and instructions to members on encrypting and hiding what they downloaded. Chief prosecutor Francesco Lo Voi called it "an organisation with a structure comparable to a multinational company" engaged in "an unworthy trade in minors". Deputy prosecutor Maria Teresa Gerace said several of the administrators, aged 22 to 28, had entered these circles through online gaming communities before setting up groups of their own.

• 2024Homeland Security Investigations tips off Italy about the New Saga community on Telegram.
• May 2024Crypto tracing identifies a 24-year-old administrator in Campania; his home is searched and the undercover approach begins.
• 2025The undercover officer rises through the hierarchy and is made co-administrator, gaining access to the Hall of Kings channel.
• 17 September 2026Operation Fly Trap: 23 searches, 17 arrests in Italy and Switzerland, about 200 devices seized.
• 19 September 2026Singapore police arrest two men, 27 and 33, on information passed by Italy; 996 accounts from 98 countries are with foreign forces.

What this says about "encrypted" messengers

Every few months a government argues that end-to-end encryption shields child abusers and must be weakened, and every few months a case like this shows how such networks are actually broken. New Saga ran on Telegram groups, which are not end-to-end encrypted in the first place, but that is not what mattered: the police did not ask Telegram for the messages and did not need to. They followed the money, found one administrator, and then did what police have done since before computers existed: they got someone inside. Once an officer holds administrator rights, encryption of the transport layer is irrelevant, because he is one of the recipients. The same is true of the network's own defences. Members were told to encrypt their archives and hide them in cloud storage; the ten arrests in flagrante happened when officers found exactly those encrypted and hidden folders on devices during the searches, which means the files were identified by possession, not by scanning traffic. The lesson cuts both ways. For investigators, it is that patience, financial tracing and international cooperation, here HSI, Swiss authorities and now Singapore, do the work that mandatory backdoors are said to be needed for. For everyone else, it is that a private group is only as private as its least trustworthy administrator, and that "invite-only" and "paid access" are marketing, not security. Manhattan prosecutors took down twelve deepfake porn sites this month the same way, by working out who ran them, not by breaking their hosting.

What happens next

The Italian phase is over; the international one is starting. The 996 accounts have gone out through police and judicial cooperation channels, and Singapore's arrests within 48 hours suggest others will follow where local law allows fast action. The 200 seized devices are being analysed, partly to identify the children in the material so that child protection services can be alerted, which prosecutors describe as the most important remaining work. In Italy the six detention orders cover the people investigators regard as organisers and heavy distributors; one has been converted to house arrest on health grounds. For the debate about messaging apps the case is one more data point in a consistent series: the networks that get dismantled are dismantled from the inside and through their payments, and no legislature has yet produced an example where a backdoor into end-to-end encryption did what an undercover officer with a year's patience did here.