Can a CyberTipline Report Be Removed From Federal Databases??

Can a CyberTipline Report Be Removed From Federal Databases?

To be clear, the fact that a CyberTipline report exists does not mean you are guilty of a federal crime. Federal law does not provide any express procedure for deleting a filed CyberTipline report. At this point, your goal is not to pursue the removal of a report, but to make it clear to federal law enforcement that a valid report does not establish guilt beyond a reasonable doubt.

A CyberTipline report is not an indictment, and it is not a conviction. Even if a provider mistakenly reported you for having CSAM, the report itself does not establish guilt.

NCMEC publishes no general procedure under which report subjects can request that NCMEC delete reports it receives. If NCMEC were to delete a copy of a report for some reason, this would be of minimal benefit because changing one record holder’s record would not automatically alter separately held copies. Federal law enforcement agencies and private technology firms may also maintain their own records of the report.

In all federal cases, a convincing and effective defense strategy is one that makes sense to a trier of fact. If you are facing a criminal charge in federal court, our goal is to use our experience to build a defense that can protect you even in the face of a reported or confirmed event. If you have not been charged, our goal is to use our experience to protect you before federal prosecutors open the file, and to keep them from opening the file, if possible.

Spodek Law Group is a federal defense law firm. Our criminal defense attorneys are available to discuss your case immediately.

What does removal from federal databases actually mean?

NCMEC is a non-profit organization, and it is not a federal law-enforcement agency. However, NCMEC’s function is to receive and disseminate CyberTipline reports to federal law enforcement. As a result, all CyberTipline reports become available to federal law enforcement. NCMEC’s Case Management Tool is an online system that helps NCMEC process CyberTipline reports. The Case Management Tool supports receiving and triage of reports. It also supports the transfer of reports to the federal authorities that have oversight of the report subjects’ respective geographical areas. Every Internet Crimes Against Children (ICAC) task force in the country has access to the Case Management Tool, as well as the federal agents and prosecutors at the FBI and Homeland Security Investigations.

A CyberTipline report is transmitted to NCMEC, processed using NCMEC’s Case Management Tool, and then transmitted to the federal law enforcement agents who are responsible for the report subject’s area. These agents can also forward the CyberTipline report (or copies thereof) to local and state law enforcement. Consequently, a single CyberTipline report can generate a multitude of copies that are separately governed by private, federal, task-force, and local systems. The lack of clear statutory and regulatory language addressing the deletion of CyberTipline reports is indicative of the lack of a mechanism for removing them. Federal law does not speak of deleting, removing, or expunging CyberTipline reports because deleting, removing, or expunging reports simply does not happen. If it were possible to remove a CyberTipline report, it would leave little of a legal basis for a criminal defense. In fact, if it were possible to remove a CyberTipline report, it would make much less sense to mount a defense against criminal charges when criminal charges would no longer have any record to support them. Because no mechanism for removing a CyberTipline report exists, a criminal defense must target the way the report was made and the way that the report is being used by law enforcement. If a provider’s CyberTipline report is flawed, this will not justify the removal of the report, but it can effectively protect you against a criminal charge. An expert federal defense attorney can also help a report subject defend against law enforcement’s use of flawed information to open a file, launch a criminal investigation, and pursue federal prosecution. Spodek Law Group is a federal defense law firm. At Spodek Law Group, our goal is to use our experience to protect you. We are available to discuss your case immediately.

Why do takedowns, bans, or case endings not erase a CyberTipline report?

Dismissal of charges or acquittal in court Dismissal

of charges does not erase a filed CyberTipline report. An acquittal in court does not erase a filed CyberTipline report. No federal law or regulation provides for the automatic erasure of a filed CyberTipline report, and no judge has the authority to order NCMEC to erase a filed CyberTipline report.

Deletion of content by the provider Deletion

of reported content by the provider does not retract a previously submitted CyberTipline report. If a provider previously and mistakenly took down an image or other content that it had mistakenly flagged as CSAM, the provider’s subsequent deletion of content will not effectuate a retraction of the previously submitted report.

Suppression of the report Even

if a report has been suppressed in court, this does not mean that the CyberTipline report is gone from federal databases. Even if you are facing trial and successfully get a report suppressed on a procedural or substantive ground, suppression will limit the use of the report in court, but the underlying record will remain available in federal databases. Request to remove an image hash from the stop list Even if you are able to remove an image hash from a stop list, this does not grant you the right to delete the CyberTipline report that was submitted. The data-preservation rules in the U.S. that govern content on the internet do not create any right for the subject of a CyberTipline report to delete a CyberTipline report. If you are able to remove an image hash from a detection list, this will limit the ability of the image to be automatically flagged by providers in the future, but this will have no effect on the previously filed CyberTipline report.

use of “Take It Down”

or other analogous service Take It Down is a free service that helps individuals prevent images of themselves from circulating on the internet. It helps people create a hash of an image on their own device, and NCMEC then adds that hash to a secure list shared with participating online platforms, which use it to detect and remove the image from their public or unencrypted services. Adding a hash to that detection list does not remove a previously filed CyberTipline report. Law enforcement officer’s decision to decline to open a case file If you are able to convince a federal law enforcement investigator to not pursue criminal charges based on a CyberTipline report, this does not mean the CyberTipline report is erased. Even if the investigator declines to even open a case file based on the report, the report will still exist in federal databases. Reversal of a platform ban Similar to a situation involving an image hash, reversing a ban from a provider’s platform after reporting the content to NCMEC does not delete the CyberTipline report. A provider may reverse a ban after a user appeals or provides additional evidence showing that the content was not CSAM. However, this decision to reverse a ban will have no bearing on a CyberTipline report that has already been submitted.

Do records requests or retention rules require CyberTipline reports to be removed?

The Privacy Act The Privacy Act

provides procedures for accessing and amending “records” that contain identifiable individuals’ information. 5 U.S.C. § 552a(d). The Act also reaches systems of records operated under contract: when an agency provides by a contract for the operation by or on behalf of the agency of a system of records to accomplish an agency function, the agency must cause the requirements of the Act to be applied to that system. 5 U.S.C. § 552a(m)(1). Federal agencies may exempt qualifying law-enforcement systems under the Privacy Act’s provisions, and the federal agencies that receive CyberTipline reports have done so for their own criminal law-enforcement systems. NCMEC’s Case Management Tool is operated by NCMEC itself, a private non-profit, so it is not a federal system of records subject to the Privacy Act in the first place.

Furthermore, the Privacy Act’s amendment procedures specifically apply to “records that are maintained in a system of records under the control of an agency.” A request based on the Privacy Act will only address records that are filed with and held by federal agencies. It will not address records held solely by NCMEC.

Freedom of Information Act (FOIA) FOIA

provides a mechanism for individuals to seek access to agency records, but FOIA is not an amendment or correction mechanism. FOIA requests may be used to find out what records that have been filed with a federal agency or agencies concerning you. However, FOIA does not create a remedy for the deletion of a CyberTipline report, and a FOIA request will not suffice to protect you if you have been identified as an alleged sex offender. Separate requests to multiple record holders Because copies of CyberTipline reports are held by various record holders, they may each have their own policies, procedures, and retention schedules. This means that you would need to file separate requests to address copies of the report held by various record holders. Even then, no single records request can reach every potential record holder. Retention period and evidence preservation Retention of CyberTipline reports also may separately depend on various other considerations. These include:

• Federal agencies’ records schedules
• Litigation holds
• Court-ordered evidence preservation rules
• Database and content-backup practices
• Database backup and audit practices
• Provider-side evidence preservation policies
• Law enforcement agency evidence preservation policies

  Section 2258A of the United States Code Section 2258A of the United States Code

  provides the procedures for providers to preserve imagery and other content that is flagged as CSAM. The preservation period required by Section 2258A is the amount of time providers must hold a record before the request expires. This will not necessarily be the same amount of time that NCMEC or the government retains the same record. NCMEC’s transparency reporting NCMEC publishes transparency reporting information to help parents and other interested parties learn about how CyberTipline reports are filed. However, NCMEC’s transparency reporting does not publish individualized procedures for access, correction, appeal, or deletion of reports, and it does not publish any individualized retention policy.

  Can a judge order a CyberTipline report to be destroyed?

  When someone refers to a CyberTipline report as having been “removed” or “erased,” they may mean a variety of different things. This includes correction, annotation, access restriction, sealing, expungement, or permanent deletion, each of which has different legal effects. However, there is no federal law that permits any of these outcomes in response to a CyberTipline report.

If you are facing a criminal charge, you may need to file a motion under Federal Rule of Criminal Procedure 41(g) in federal district court. This rule addresses property seized by federal law enforcement officers during a search. While a judge could order federal law enforcement officers to stop searching your device, destroying the content it contained, or erasing the computer it was searched, this does not have the effect of erasing a previously filed CyberTipline report.

Likewise, if you are facing charges in federal court, a judge could order that a record containing a CyberTipline report be sealed. Sealing a record restricts access to the record by individuals outside of the court. It does not, however, have the effect of removing the CyberTipline report from federal databases, or from any other record holder’s database.

If you are facing criminal charges, you may also be able to convince a judge to expunge the indictment and the records of a conviction. But expungement is typically limited to the criminal charge, and any separate record of a conviction. A federal judge’s authority to expunge records is in fact narrow. Absent specific statutory authorization, most circuits hold that federal courts lack ancillary jurisdiction to expunge a valid arrest or conviction record on purely equitable grounds, and their authority over records held by the federal executive branch (e.g., by the DOJ or FBI) is more limited still.

Ultimately, even if you are facing criminal charges, a judge does not have the authority to order a CyberTipline report to be destroyed. This includes due to the government’s sovereign immunity, which precludes the government from being sued unless it grants a waiver, or a record holder consents, which is rare in matters of national security or criminal justice enforcement.

What should the defense attack instead of deletion?

If a CyberTipline report cannot be deleted or erased, what does that mean for your defense strategy?

At Spodek Law Group, our criminal defense attorneys are available to discuss the legal challenges and the circumstances that you face, and we can help you determine what constitutes an effective defense in your case. In the meantime, we can also discuss the challenges with mounting a successful criminal defense. These include, among others:

You should be aware that a filed CyberTipline report will continue to exist. Any defense strategy that you pursue must target the way that the report was made and the way that law enforcement is utilizing that report, and not its existence, because a properly informed and prepared federal criminal defense attorney knows that a properly informed federal law enforcement agent or prosecutor has not yet proven your guilt beyond a reasonable doubt.

Issues with the substance of the report Under Section 2258A of the United States Code,

“as soon as reasonably possible” after a provider discovers that it has content that contains any visual depiction of sexually explicit conduct where “(A) the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct; (B) such visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct; or (C) such visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct” the provider must file a report. A CyberTipline report may include:

• The images or videos that a provider flagged as CSAM
• Details about the account
• Information about the user
• Device or other location data
• Upload timestamps
• Filenames or other information
• IP addresses
• Recovery email addresses or other recovery accounts

  Issues with the accuracy and reliability of the report While a CyberTipline

  report provides the basic framework for NCMEC to track and disseminate records of CyberTipline reports to law enforcement, NCMEC’s Case Management Tool also allows for the enrichment of CyberTipline reports. For example, if a CyberTipline report contains information that allows NCMEC to track down additional information about the user using public sources, then NCMEC can add this information to the CyberTipline report in its Case Management Tool, which can then flow down to federal law enforcement agencies and prosecutors. This means that there are multiple opportunities for erroneous or misleading information to get added to CyberTipline reports, creating additional opportunities for defense attorneys to challenge the accuracy and reliability of these reports. Issues with the means of detection used by the provider With content moderation and security efforts becoming increasingly concentrated among a small number of technology companies, there is significant variation in reporting practices among different platforms. This is true for how different platforms identify flagged content. For example, many providers (e.g., Google and Meta) use “hash matching” to identify images or other content that has been previously flagged. While hash matching identifies a correspondence between the image reported and an image that previously triggered a CyberTipline report, hash matching does not identify the user responsible for uploading the image, nor does it identify the user responsible for possession of the image on the provider’s platform.

  Issues with the attribution of the content to the individual Along

  with hash matching, the IP address and other identifying information that may trigger a CyberTipline report present challenges with regard to attribution. While the IP address may indicate that an account was accessed from a particular location, an IP address alone does not prove who accessed the account, nor does it prove that the account user did not provide consent for use of the account. Ultimately, establishing criminal liability in a federal case is all about attribution, and the prosecution bears the burden of establishing criminal liability.

  Can police use CyberTipline files without a warrant?

  The issue of whether law enforcement can use CyberTipline files without a warrant is a complicated question, and the answer depends on the specific circumstances at hand. One approach to answering the question is based on the premises that (i) investigators still need lawful authority to conduct searches beyond the scope of the search a provider conducted and (ii) government searches must comply with the Fourth Amendment to be deemed lawful. The distinction between government searches and private searches Under the Fourth Amendment, a government search is conducted by a “governmental agent,” which is defined by the courts as someone who is acting on behalf of the federal government or another government agency. While private investigations generally are not restricted by the Fourth Amendment, investigations that are conducted by government agents must be conducted within the scope of the authority granted by the Fourth Amendment and the statutory protections adopted under federal law. In criminal cases, this includes search warrants. The distinction between repetitions and investigations One exception to the requirement for a search warrant is when the government repeats a private search. In United States v. Jacobsen, 466 U.S. 109 (1984), the Supreme Court held that repetition of a private search does not violate the Fourth Amendment, provided the search does not exceed the scope of the original private search. As in United States v. Jacobsen, the search a provider conducts and the subsequent search conducted by federal law enforcement officers will have differing scopes. As a result, after a provider conducts a search of a user’s account, any subsequent search conducted by federal law enforcement officers that exceeds the scope of the provider’s search may require a search warrant. The distinction between the status of NCMEC as a private organization or a governmental entity Whether the law enforcement agencies and prosecutors that have accessed a CyberTipline report are subject to the Fourth Amendment is another critical consideration. In United States v. Ackerman, 70 F.4th 472 (4th Cir. 2023), the court noted that “ a report submitted to NCMEC is a report submitted to a governmental entity under the Fourth Amendment.” Although the Supreme Court has not yet decided the issue, federal law enforcement investigators generally treat the submission of a report to NCMEC as providing law enforcement access, and a properly prepared defense attorney will seek to determine if, in fact, this constitutes an unlawful search. The distinction between the human and the automated detection of content In Wilson v. United States, No. 20-9171, 2021 WL 4288295 (7th Cir. Oct. 17, 2021), the court distinguished the government’s ability to search reports that users uploaded and reports that users stored, with a finding that reports identifying previously uploaded material to be provided by law enforcement’s investigators did not trigger the Fourth Amendment if Google “already had a look at the image.” The court went on to say, “Even if we don’t need a search warrant under these circumstances, we do need to have some clue that this constitutes a search which exceeds the scope of a search that Google had already conducted.”

Here, “conducted” was taken to mean a search conducted by a human employee of Google.

In the context of modern Internet use, most providers use automated content moderation. This type of automated content moderation triggers a CyberTipline report when the provider’s tools identify a match between content in a user’s account and a known CSAM image hash from the stop list. As a result, content providers may not have previously reviewed the content that triggers a CyberTipline report, meaning that a provider’s submission may be treated as an inchoate search by the United States District Court. The distinction between the provider’s search and the government’s search Lastly, the distinction between a provider’s search and a government investigation is also at the core of the issue. A search may implicate the Fourth Amendment if the search is conducted at the government’s instigation or if the search is sufficiently controlled by the government. Providers can be characterized as acting as “agents” for the government when it is clearly established that the provider’s search was not independent, but rather initiated by the government. In cases involving the submission of a CyberTipline report, it is important to distinguish between the content providers’ independent searches and the law enforcement agencies’ requests for access to data on the content providers’ servers.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.