Operation “Network” - Crackdown on International CSAM Distribution. Following an intelligence referral from the Australian Federal Police (AFP) liaison officer in Belgrade regarding two international criminal networks (“ADRIANA” and “NLPP”), the Cybercrime Department of North Macedonia launched a formal investigation. By analysing IP address data from domestic internet service providers, local users were successfully identified, leading to a coordinated joint operation codenamed “Network”, carried out with the Sectors for Internal Affairs in Bitola, Strumica, and Ohrid.
In April 2026, law enforcement executed searches at seven locations and seized multiple electronic devices for forensic analysis. One individual was placed in custody and faces a criminal complaint. Precautionary measures were imposed on a second individual, while pre-investigation procedures remain ongoing for the remaining suspects.
Operation “Network” illustrates the application of the Budapest Convention in identifying suspects involved in the online distribution of child sexual abuse material through the analysis of digital identifiers. The identification of local users on the basis of IP address data obtained from domestic internet service providers was based on production orders under Article 18, supported by expedited preservation measures under Articles 16 and 17 to ensure that traffic and subscriber-related data were not lost before disclosure. The searches at seven locations and the seizure of electronic devices for forensic analysis represent consistent use of Article 19 powers. The initial intelligence referral from a foreign partner also highlights the importance of international co-operation and information-sharing under Articles 25 and 31 in enabling the domestic investigation to proceed.