Snapchat Reported Me for Child Safety: What They Preserve and Hand Over.

No, and this is a key aspect of how these cases work. Once Snap Inc. concludes its review and believes that the material in question meets the requirements of 18 U.S.C. § 2258A, it files a report with NCMEC and may also preserve the content. If a preservation request is sent to Snap Inc., it will preserve the evidence (if it has not done so already) pending law enforcement’s subsequent request for a warrant. It won’t be until the FBI, your local law enforcement agencies, or the federal prosecutors decide to present criminal charges that you will find out about the federal government’s case against you.

Why Did Snapchat Report Me?

Snap Inc. is highly likely to report you for one of two reasons: (i) one of its automated systems has matched the material in question with known-CSAM, or (ii) another Snapchat user has reported a Snap you sent him or her as child sexual abuse material. In either case, the review pipeline begins with the same sequence of events and is triggered based on the exact same standards of review. The review can be initiated both as a result of an internal review or as a result of an in-app report.

You can report a Snap using the application’s in-app reporting mechanism. To start the process, long-press on a Snap or Chat message. From there, select “Report” and then select the reason for reporting from the drop-down menu. If a user reports a Snap as child sexual abuse material, it will undergo a human review by Snapchat’s staff to determine if it should be reported to NCMEC. If the human review determines the content violates Snap Inc.’s policies, it may file a CyberTipline report based on the same legal standards it uses in the case of automated material match detection.

What Happens After Snapchat Files a CyberTipline Report?

Spodek Law Group is one of the nation’s largest law firms in the areas of white-collar crime, including federal investigations into child exploitation allegations. Our lawyers and investigators have a deep understanding of the steps and procedures involved in NCMEC cases, and that is why we rely on the following five-step process to assist our clients.

1. Review by Snapchat’s Trust and Safety Team

All reports filed on Snapchat by users or flagged by the app’s internal systems are handled by Snap Inc.’s Trust and Safety Team. Before they engage NCMEC, they first review the alleged illegal material. If they believe the material meets the statutory definition of child sexual abuse material under 18 U.S.C. § 2258A, then it is reported to the CyberTipline.

2. Review by NCMEC

The CyberTipline is the only way that providers like Snap Inc. can report suspected CSAM to law enforcement. When a provider files a CyberTipline report, it will go through a review process conducted by NCMEC to ensure that the report is not frivolous and that it should be referred to the relevant law enforcement authorities. NCMEC’s CyberTipline does not serve as law enforcement itself. Instead, it serves as a centralized repository for reports from around the globe, each of which triggers an individual investigation of the evidence. This is a high-volume operation, and the level of scrutiny is adjusted accordingly.

3. Law Enforcement Routing

It is not a case of automated redirection. When NCMEC makes the decision to forward a report, it manually routes that report to the relevant federal, state, local, tribal, or foreign agency. Most reports involving child sexual abuse material will be forwarded to the relevant ICAC Task Force. At the federal level, the law enforcement agencies can include the FBI, the U.S. Marshals Service, Homeland Security Investigations (HSI), or the Drug Enforcement Administration (DEA), among others.

4. Assignment to a Case Agent or Detective

Once a report has been routed to the relevant agency, it will undergo a further administrative process of assignment. In the case of an ICAC Task Force, this usually involves assigning the report to the lead agency and then to the specific agency (and specific detective) tasked with handling the area in question. The file will be routed through multiple levels of administration before it is assigned to an agent or detective for investigation. This process will result in months or even years of delay between Snapchat’s CyberTipline submission and the first contact with a suspect.

5. “Red Flag” Triggers

Three main “red flags” can trigger a human review by the Snapchat Trust and Safety Team:

• PhotoDNA and Hash Matching. A lot of the material flagged as child sexual abuse material is referred to as known-CSAM. This is because a hash of a known-CSAM photo was used to identify the image during the transmission of a Snap.
• Automated Content Classifiers. PhotoDNA hashes cannot detect imagery that has not been previously hashed. For new content, a separate set of algorithms known as content classifiers is used to identify imagery that might meet the legal requirements for reporting as CSAM.
• In-App User Reporting. As mentioned above, if another user reports you in the application, the report will trigger the human review process.

What can police get from Snapchat and when?

What Information Can Law Enforcement Obtain via a Subpoena?

Under the Stored Communications Act (SCA), a subpoena issued by law enforcement or a grand jury can only be used to obtain “basic subscriber information” from providers like Snap Inc. Basic subscriber information typically includes:

• Name, address, and contact information (email, phone number, other)
• Length of service
• Financial information (billing address, last payment method, last payment date)
• The device identifiers used to access the account

What Information Can Law Enforcement Obtain via a 2703(d) Order?

An order issued pursuant to 18 U.S.C. § 2703(d) provides law enforcement the authority to obtain non-content transactional and log records from Snap Inc. This is more than what can be obtained with a subpoena, but this falls short of authorizing the disclosure of content. With a 2703(d) order, law enforcement can obtain:

• IP addresses, timestamps for each session, and session duration
• Communication logs (dates, times, recipients)
• Geolocation data (at login, logout, or otherwise)
• Any other non-content information stored with the account

What Information Can Law Enforcement Obtain via a Search Warrant?

A search warrant is the most intrusive tool in law enforcement’s toolkit, and it is the only tool that can be used to compel Snap Inc. to turn over the contents of your messages, photos, and videos. With a search warrant, law enforcement can obtain a copy of your entire account.

A search warrant requires a judge or magistrate to find “probable cause” to believe that you committed a crime and that a search warrant will help to uncover new evidence. The evidence that is typically presented to a judge to establish “probable cause” in the case of suspected CSAM is the complaint received via NCMEC’s CyberTipline.

How Long Does Snap Inc. Preserve Records After It Receives a Preservation Request?

Snap Inc. will preserve all records it has on file when it receives a preservation request under 18 U.S.C. § 2703(f). Once Snap Inc. receives a request, it will move those records into an offline file. The preservation period is 90 days. If law enforcement cannot secure a search warrant or a 2703(d) court order during those 90 days, it can send a formal request to Snap Inc. to extend the preservation period for another 90 days.

If a preservation request is issued, this will not be a “freezing” of the data. The account user can still access and use the account. The request only ensures that the data the account holder had when the request was filed is kept safe while law enforcement continues its investigation.

Will Law Enforcement or Snapchat Notify Me If They Receive a Search Warrant?

Snap Inc. may notify a user in the case of a search warrant, but it is not required to do so. Under the federal Electronic Communications Privacy Act (ECPA), Snap Inc. has the discretion to provide notice to the user. However, if law enforcement determines that providing notice will risk the destruction of evidence or risk interference with an ongoing investigation, it can request that Snap Inc. skip providing notice. In the case of a child exploitation investigation, this happens frequently.

Which Snapchat Data is Recoverable from Snap Servers?

• Opened One-to-One Snaps. According to Snapchat’s app-specific information, after you open one-to-one Snaps and any associated messages, Snapchat’s servers delete the Snap and associated message. This means that this type of content is generally not available unless it is preserved in the case of a child safety report or user report.
• Unopened Snaps. In the case of unopened Snaps, the image or video remains on Snapchat’s servers for 31 days before it is automatically deleted.
• My Stories. My Story uploads are also subject to automatic deletion. However, this happens after 24 hours.
• My Eyes Only. As noted above, if a user has stored an image in a “My Eyes Only” folder, it is protected by a passcode and encryption. This type of image/video cannot be retrieved from Snap Inc. servers.
• Snapchat Memories. Unlike ephemeral messages, Snapchat Memories are stored indefinitely unless the user deletes them. Memories are stored on Snap Inc.'s own servers and remain available indefinitely unless the user deletes them, in which case Snap's servers are designed to erase the Snap as soon as possible.
• Saved Chats. As Snapchat’s in-app messaging feature allows for both ephemeral and permanent messaging, saved chats are subject to similar storage policies to Snapchat Memories. As a result, it is common for content from saved chats to remain accessible on Snapchat’s servers even after the underlying content is deleted by Snapchat or the user.
• Snapchat Spotlight. Similar to Snapchat Memories, Spotlight is a platform for sharing images and videos that can be seen by the public and saved to the app’s servers.
• All other data types stored on Snapchat’s servers. Along with images and videos, Snapchat servers contain a wealth of information such as metadata, logs, and other records. This information will often remain on Snapchat’s servers even when the underlying content is not.

How Long is Metadata Preserved After the Underlying Image or Video is Deleted?

When it comes to content such as a one-to-one Snap, a group Snap, or a My Story upload, law enforcement may only be able to see a metadata record after a time interval that elapsed. That is, while the image or video itself is automatically deleted from the servers, information like who sent it, to whom, when, and how may be preserved on the account holders’ server records. As a result, law enforcement may be able to prove who sent what, to whom, and when, even without the underlying content being available for review.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

What Evidence Survives Outside Snapchat’s Servers?

Even if a search warrant reveals nothing (which happens more often than most people realize), there are still several ways that evidence can be recovered to prove your guilt. Some of these methods are more common than others, but they all pose substantial risks in cases involving suspected child exploitation.

1. Basic Subscriber Information

If you have been accused of a crime related to Snapchat, the simplest form of evidence is likely your Basic Subscriber Information. This information can be obtained by law enforcement or federal prosecutors with a simple subpoena, and it includes:

• The date you created your Snapchat account
• Your registered email address
• Your registered telephone number
• Your IP address
• Any other identifying information that you provided to Snapchat when you created your account

2. Recipient Screenshots or Saved Copies

As noted above, Snapchat allows recipients to screenshot images and videos that are sent to them. If your Snapchat usage involves a recipient who is willing to cooperate with law enforcement, this means that the material may survive even after it is deleted from Snapchat’s servers. A recipient’s screenshot or a saved copy of your snap is direct evidence of the content, though the law makes no distinction between the weight to be given to direct and circumstantial evidence, it is for the jury to decide how much weight any evidence deserves.

3. Android Devices

For users of Android devices, Snapchat stores some records locally on the device itself. Specifically, the app stores chat records in a database file known as “arroyo.db”. If your phone or device falls into law enforcement’s hands, this may result in your chat history being recovered via a forensic tool like Cellebrite.

4. iPhone Backups

In the case of an iPhone, a cloud or iTunes backup can yield results similar to a full physical phone extraction. This is because encrypted iPhone backups frequently preserve the images and videos that have been deleted from Snapchat’s servers but still remain within the device’s cache.

5. Pseudonymous Accounts

Using a pseudonymous account (i.e., one without your real name) will not necessarily make you harder to track down. If law enforcement can obtain the device identifiers and IP logs associated with the account, these records can then be used to identify the specific device and the user who created the account.

6. Snapchat Account Records

If you have the need to deny or defend against any allegations in a federal case, then it is essential that we contact Snapchat right away to request any available account records. This is because these records can contain device identifiers, advertising identifiers, and other information that can be invaluable in reconstructing a case, even when no image or video evidence is available.

7. Evidence Authentication under Rule 901(b)(4)

In cases of suspected child exploitation, if your Snapchat device or other evidence from your account has been recovered by law enforcement, the federal government may be able to authenticate this evidence by showing it has unique metadata, timestamps, and other identifiers that could only originate from you. This means that even if you deny the image or video is yours, there are various ways that prosecutors can introduce the evidence under Federal Rule of Evidence 901(b)(4).

Can My Lawyer Get the Same Snapchat Records?

Can My Lawyer Get the Same Snapchat Records?

No. Even if you give your consent, Snap Inc. will refuse to disclose your account data to your lawyer. You are still free to download your own account data via Snapchat’s in-app account portal. However, if your account has been suspended or locked, this will not be an option. Furthermore, even if you are able to download your account data, your export will not include any of your deleted content that has been preserved at the request of law enforcement.

What Other Documents Does Law Enforcement Receive from Snap Inc.?

When making a disclosure to police in the United States, the disclosure will also include a signed Certificate of Authenticity.

A lot of clients’ lawyers tell them they will have an expert testifying to the authenticity of your records. While this is an attractive prospect in theory, Snap Inc.’s policy states otherwise, and it forbids providing expert testimony in any proceeding.

Can Your Lawyer Subpoena Snap Inc. and Other Providers?

Under the Stored Communications Act (SCA), providers like Snap Inc. are barred from disclosing communication content in response to a subpoena from defense counsel. In federal court, the government must turn over any communications it has obtained via a search warrant or other means as a result of the discovery process. This is how records pertaining to defendants will typically come to light in federal cases involving suspects.

Can Police Reopen Reported Files or Search My Phone?

Can the police open a reported file on the CyberTipline?

In United States v. Ackerman, the court found that NCMEC was acting as a governmental agent. Later, in United States v. Miller, the court found that when the government reviews files reported by a provider, this is a private search. Under the private search doctrine, the scope of the government’s warrantless review is limited to the scope of the provider’s review. As a result, agents can reopen a file if they have a reason to believe that the content has not been fully viewed by a provider. However, federal courts are split on whether agents can reopen provider-reviewed files without a warrant. For instance, some courts have stated that a hash match alone is not enough to justify opening the file, even if it already underwent review by the provider.

What happens if the police ask to look through my phone?

As an account holder, you have no obligation to allow the police to search your phone without a warrant. Consent to search your phone is voluntary, and you can decline the search. However, if you consent to a search, you risk allowing law enforcement to discover evidence that would have been otherwise unrecoverable. While a search pursuant to a search warrant allows law enforcement access to your device regardless of your consent, if they do not have a warrant, they cannot search your phone unless you allow them to.

If the police are knocking on my door right now, and if they haven’t got a warrant, should I try to delete the content?

Under no circumstances should you destroy anything that may be relevant to an ongoing federal investigation. Destroying records with the intent to “impede, obstruct, or influence” a federal investigation is a crime under 18 U.S.C. § 1519. Destroying potential evidence not only triggers an additional criminal charge but can also serve as evidence of your consciousness of guilt. Instead, you should insist that the police obtain a warrant before accessing your phone. This will give you time to consult with your defense counsel and allow your lawyers to review the government’s case against you before it becomes a criminal matter.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.