Denmark, Bosnia and Herzegovina and others: Operation “Cumberland”, on AI-generated child sexual abuse material

2026 marks the 25^th anniversary of the Convention on Cybercrime (also known as the Budapest Convention ).

H ere are 25 selected real cases and operations against cybercrime that speak for themselves on the usefulness and relevance of the Convention and its framework in the daily work of criminal justice authorities worldwide, working on fighting against cybercrime and protecting you and your rights in cyberspace.

Back to the main page

Retour Denmark, Bosnia and Herzegovina and others: Operation “Cumberland”, on AI-generated child sexual abuse material

Operation “Cumberland” was coordinated by Europol and involved over 20 law enforcement agencies across Europe and beyond, including the Ministry of Interior of the Republika Srpska (Bosnia and Herzegovina). The operation resulted in the arrest of 25 individuals suspected of distributing AI-generated child sexual abuse material. It was led by the Danish National Special Crime Unit.

Following information received from Europol, the Unit for Combating Cyber Crime identified and arrested an individual, S.T., in Banja Luka. During searches at locations linked to the suspect, police seized evidence relevant to the ongoing criminal proceedings. A criminal report will be submitted to the District Public Prosecutor’s Office in Banja Luka for the offence of “Exploitation of Children for Pornography.”

The investigation established that the suspect had accessed an online platform hosting AI-generated child sexual abuse content, with subscription payments processed via PayPal. Operation “Cumberland” is particularly significant as one of the first international investigations addressing the misuse of artificial intelligence to generate child sexual abuse material.

In addition to Denmark, Europol, and the Ministry of Interior of the Republika Srpska, participating countries included Australia, Austria, Belgium, the Czech Republic, Canada, Finland, France, Hungary, Germany, Iceland, the Netherlands, New Zealand, Norway, Poland, Spain, Sweden, Switzerland, and the United Kingdom.

Operation “Cumberland” demonstrates the use of the Budapest Convention’s procedural framework in a complex international child sexual abuse investigation involving digital platforms and online payment mechanisms. The search of premises and seizure of evidence in Bosnia and Herzegovina indicate to the use of Article 19 powers. The identification of the suspect through platform access and PayPal-related subscription activity required the use of production orders under Article 18 to obtain subscriber, account, and transaction-related data, potentially combined with preservation measures under Articles 16 and 17. Given the involvement of more than 20 jurisdictions, the case also underscores the importance of the Convention’s mutual assistance and international co-operation provisions under Articles 25 and 31 in preserving and exchanging electronic evidence in a timely manner.

Cybercriminalité