A British man linked to what authorities describe as a “Com” group has been sentenced to two years in prison after an investigation involving 117 girls aged 13 to 17.

Justin Swaddle, from Leeds, pleaded guilty to multiple child sexual abuse offenses and blackmail.

According to the UK National Crime Agency, he used platforms including Snapchat, Telegram, and Discord to manipulate and threaten victims. Authorities said the conduct was driven in part by status within the online community rather than purely by financial gain.

The wider context around “Com” groups is probably the more important security story here.

British authorities describe them as loosely organized online communities where offenders and victims can occupy the same spaces, and where members may gain status by sharing increasingly extreme material or carrying out harmful acts.

The FBI has previously warned about overlapping communities involving mostly English-speaking minors and young adults engaged in activities ranging from extortion and exploitation to swatting, SIM swapping, cryptocurrency theft, and ransomware.

That makes the ecosystem difficult to treat as a single type of cybercrime group.

The same social structure can connect coercion, account compromise, harassment, fraud, and other forms of online abuse.

Eight of the victims identified in this case were in the UK. The NCA worked with law enforcement in the U.S., Canada, Australia, Norway, and New Zealand to identify and safeguard victims elsewhere.

Swaddle will also be subject to a 10-year Sexual Harm Prevention Order and must register as a sex offender.

For trust-and-safety and cybercrime teams, the challenge seems less like detecting one criminal technique and more like identifying when an online community is creating incentives for members to escalate across different forms of abuse.

How should platforms distinguish between ordinary high-risk communities and groups where status is being built through coercion, exploitation, or coordinated cybercrime?