Spam, phishing, and even non-consensual imagery still attract some argument about free speech or personal responsibility. But child exploitation is the one area of online abuse that everyone can agree is unacceptable. So when it keeps happening at scale, the problem isn’t consensus; it’s how it’s handled at the point of reporting.

That’s the argument Abusix’s Founder & CEO, Tobias Knecht, will make at the INHOPE Summit on 6–7 October 2026 in Dublin. The panel he is joining will discuss open standards, shared infrastructure, the classification of abuse, and the reporting formats (XARF and INHOPE’s CPORT) that determine whether a report actually gets acted on. The panel sits alongside law enforcement and EU policymakers, which is exactly the audience this argument needs.

INHOPE’s data shows this isn’t hypothetical: their network processed 4.78 million records across 57 hotlines in 52 countries and confirmed 3.2 million as illegal.

Websites hosting non-consensual AI and deepfake imagery are taken down days, not hours, after a report. This can be partially attributed to the lack of a universal format for reporting abuse. Today, every registrar and host has its own reporting format. INHOPE’s own data proves the pattern: content hosted in a country with an INHOPE hotline comes down in an average of 1.4 days. Outside the network, it takes 41 days. The only difference is whether a structured reporting pathway exists.

Companies that built their business on internet infrastructure can’t treat abuse handling as a line item to defer. If your platform or your network carries the traffic, you carry some responsibility for what crosses it.

The mismatch shows up first in the abuse mailbox. ISPs and hosting providers receive enormous complaint volumes daily, and a report about child exploitation material arrives in the same queue as a spam complaint, sitting in free-text email that nobody’s reading in real time. Volume isn’t the enemy here. Invisibility is. As Tobias puts it: “If you receive 100,000 spam reports a day and you do not have automation and do not have proper tooling and proper things in place, you will miss child exploitation reports. You need to take care of your abuse mailbox. Everything that comes in is important.”

Abusix’s open, structured format for reporting internet abuse exists to fix that. XARF is a standardized, machine-readable report format that lets a system prioritize and route automatically, rather than a person scrolling through an inbox hoping to spot the report that matters. Under XARF, that finding is a field the receiving system reads the instant the report lands, so it jumps the queue before a human ever opens the email. For a lot of abuse desks, that’s just always been the rhythm, not a decision anyone made on purpose. Standardizing the format is what changes it: less time spent parsing free text, more of it spent actually taking content down.

XARF and CPORT do two different jobs that work together rather than compete. Classifying material as abusive rather than innocent is a law enforcement judgment call, and CPORT, INHOPE’s law enforcement access portal, routes that decision quickly between hotlines, INTERPOL, and national agencies. XARF picks up from there: because a trusted sender like INHOPE has already classified the report, XARF carries that classification forward as structured data, so the abuse desk agent handling it never has to open the material or make that call themselves. That shields the person doing the triage from having to verify traumatic content firsthand, and removes the extra step of a human having to prioritize the reports’ place in the queue.

The good news is that some ISP’s and Telecom providers are already treating abuse as a governance issue, not just another inbox to clear. Organizations leading the way review security KPIs at board level monthly, not quarterly or “when something breaks”. Regulation is starting to catch up too. The EU’s Digital Services Act already pushes larger platforms toward disclosing abuse volumes, which at least makes the scale of the problem visible instead of optional to report.

The liability question is the uncomfortable one, and Tobias doesn’t hedge on it: “If an ISP and hosting provider has knowledge that bad stuff is happening in their network that is harming other people in any way or form, abuse, fraud, child exploitation in any way or form, and they’re not reacting and they’re not doing anything about it, then they should be held liable.” Singapore’s shared-liability model, splitting responsibility across the mobile operator, the hosting provider and, controversially, the victim, is one attempt to force that question into the open, and it’s fair to disagree with where it lands. But the underlying premise, that liability shouldn’t stop at “we didn’t know,” is hard to argue against.

Child exploitation is a particularly heinous version of this problem, not the only one. The same discipline (structured reporting, no excuse for invisibility, accountability that survives staff changes) applies just as much to spam, phishing, and non-consensual imagery as it does to deepfake sites. The reason to start here is that nobody’s defending the status quo, and everyone attending the INHOPE summit agrees the situation today is unacceptable; however, nobody has agreed yet on what replaces it. That’s a rare position to build from, and it shouldn’t be wasted on one category of abuse while the rest get forgotten. What participants learn and carry back into their workplaces will help inform how the industry reports all abusive content going forward.

The best outcome for a summit like this would be that it stops being necessary in five years, because the problem it exists to discuss has actually been solved. “There is no excuse anymore,” Tobias says. “None whatsoever.” He’ll be making that case in Dublin on 6 October, and the session is livestreamed, so you don’t need to be in the room to hear it.

INHOPE puts it simply: every pathway into this problem (technical, legal, operational) leads to the same place, a safer online space for young people, and that only happens if everyone works together.

Register to watch the summit online.

In the meantime, the question worth asking is the one every provider should be asking themselves: if a report like this landed in your queue today, would it get lost, or would it get handled?