Give the Olympic movement its due first, because the criticism that follows is worthless without it.
At Paris 2024 an AI protection service monitored roughly 20,000 accounts across 45 languages, analysed some 2.4 million posts and comments, flagged 152,000 of them and verified 10,200 as abusive, attributable to 8,900 unique accounts. At Milano Cortina 2026 it covered just over 6,000 accounts in 56 languages and verified 14,500 abusive messages from around 10,000 accounts. Across both Games that is about 4.3 million items analysed and roughly 25,000 verified abusive messages. No other sector protects its people at that scale, and the IOC published the numbers rather than keeping them quiet.
Now the uncomfortable part. Read every public description of that service and the same two words appear: posts and comments.
The most authoritative study in the field says what it left out
This is not an inference drawn from silence. The most substantial dataset in athlete safeguarding is World Athletics’ four-year longitudinal analysis, published in December 2024, spanning Tokyo, Oregon, Budapest and Paris across more than 1.4 million posts and comments and 2,438 athletes.
That study states its own boundary in plain language. It "excluded direct messaging or non-targeted abuse conversation; where the athletes were mentioned but not directly tagged, suggesting the issue is even greater than the study highlights".
Read that last clause again. The field’s flagship research does not merely omit private messaging. It tells you the true scale is larger than anything it reports, and it tells you which surface the missing portion sits on.
Ten days ago the FBI said where the danger actually is
On 10 August 2026 the FBI and the NCAA announced a joint programme on the sexual exploitation of student-athletes. The Bureau’s Internet Crime Complaint Center took more than 75,000 sextortion-related submissions during 2025.
None of that offence happens in a comment thread. The approach is a private message from an account built to look plausible, or a credential lure of the kind the FBI describes in its release: an unsolicited text claiming an account will be disabled without a verification code, an email about a new login with a password reset link. The extortion begins the moment an image arrives.
And it is fast. In the cases documented in ESPN’s reporting on the FBI’s warning, every known victim who died by suicide did so within twenty four hours of first contact. Braden Markus was fifteen, and twenty seven minutes passed between the first message and his death. Australian Institute of Criminology data describes the same compression: of adolescents who had been sexually extorted, 45.9% were threatened less than a day after first contact.
The mismatch, stated plainly
Put the two halves together and the picture is uncomfortable rather than scandalous.
Sport has built genuine capability against abuse that is public, high-volume, and largely reputational in its harm. Racist pile-ons after a missed penalty are real, they damage people, and they deserve the response they are now getting.
The harm that ends careers and lives is none of those things. It is private, low-volume, targeted at one person, and it can conclude between dinner and breakfast. A system counting abusive replies at a rate of thousands per Games is not built to notice a single conversation with one athlete that nobody else can see.
This is not a failure of will or of seriousness. It is a consequence of what the public APIs of social platforms make available. Comments and replies can be read at scale by a third party. A direct message cannot, not without a different architecture and a different relationship with the person being protected. So the sector built what the available surface allowed, and then measured that surface diligently.
What the private layer actually requires
Covering it is not a matter of pointing the same tooling at a new feed. Three things have to change.
Detection has to happen before the athlete reads the message. Where protection begins with a report, the athlete is the sensor, which means they must absorb the abuse to be protected from it. Against an offence that can conclude in twenty seven minutes, a workflow that starts after the target has read, understood and decided to escalate is not on the same clock as the offender.
Reporting must not require re-exposure. If a person has to open the thing that was done to them in order to escalate it, reporting rates measure what victims can bear rather than what happened. That is why volumes in this category are unreliable, and why every figure quoted above is a floor.
And it has to be done without reading anyone’s messages. This is the part that makes the surface hard, and it is the reason it stayed uncovered. A tool that hands an official a transcript of an athlete’s private conversations is surveillance, and athletes will refuse it, correctly. Detection has to establish that a pattern occurred, and produce a record that stands up later, without any human, at the governing body or at the vendor, reading the contents. Integrity without access.
That is a harder engineering problem than counting replies. It is also the only version athletes will consent to, which makes it the only version that works.
The Olympic movement has done the difficult work of measuring what it can see, and published the results honestly. World Athletics went further and named the gap in its own study. The FBI has now put a number and a timeline on what lives inside it. The surface is documented. What remains is covering it.