Does NCMEC Investigate You? What the Clearinghouse Actually Does.

NCMEC is a private non-profit organization. It is not a police department. It is not a law enforcement agency. Its role is to process submissions from technology providers, such as the one that initiated the report against you, and to refer those submissions to the appropriate law enforcement agencies. NCMEC does not conduct the actual law enforcement investigation itself, and it does not prosecute defendants.

Importantly, NCMEC does not independently investigate every allegation made in a CyberTipline report. The reports that get sent to law enforcement are referrals, which provide an investigative lead, but which do not constitute a criminal judgment. Again, this is an important point to understand. A CyberTipline referral to the DOJ does not mean that a federal agent thinks you are guilty. It means that the DOJ now has an investigative lead.

That said, the fact that it’s “just an investigative lead” doesn’t make it unimportant. There are several ways that a CyberTipline report (and any subsequent referral) can lead to an investigation into you. These include, but are not limited to, the issuance of a subpoena for your cell phone or other electronic device records (or your internet service provider or your email provider), the issuance of a warrant for seizure of your cell phone, computer, or other electronics, a warrant search, a warrant for forensic review of the media contained on your device, or forensic review of your device media after it has been seized under a warrant. Any or all of these could be the result of a CyberTipline report.

So, while the report itself doesn’t make you guilty, the outcome of your report could put you in jeopardy. If you have received a CyberTipline report, it is extremely important that you consult with an experienced defense lawyer right away.

What Happens After a Provider Sends a CyberTipline Report?

A CyberTipline report may contain a wide range of information, including IP addresses, image file hashes, images, videos, and other files, as well as user data. In all cases, NCMEC takes these reports extremely seriously.

NCMEC reviews the information provided by providers and submits similar reports. At this time, it screens the report for any child safety concerns that need to be addressed urgently. It then classifies the report as either a referral or an informational submission. For more information on the distinction between these two classifications, you can see the CyberTipline FAQ.

A referral is a CyberTipline report that “contains information from which child exploitation can potentially be reasonably identified.” According to NCMEC, referrals “may also contain information that may assist law enforcement in preventing the continued or future commission of child sexual exploitation offenses.” The majority of CyberTipline reports are classified as referrals, and each referral is promptly transmitted to the appropriate law enforcement agency.

Informational submissions, by contrast, are classified as:

• “reports that contain information that cannot be readily attributed to an individual, or that contain images or videos that, though the image or video is alleged to be a piece of CSAM, the image or video appears to be one of many copies of the same image or video, or where, although the image or video is viral in nature, there is no indication of any child sexual exploitation other than simply possessing the image or video”

In a referral, law enforcement agencies can do what they do with any other lead in a criminal investigation: they can decide that the lead does not warrant pursuing; they can decide to investigate the lead, but not pursue it, for various reasons; or they can decide to pursue the lead. They may also forward the referral to another law enforcement agency that may be better able to pursue the lead. If, however, law enforcement decides to pursue the lead, this can lead to a criminal prosecution.

If the report is classified as an informational submission, it is still made available to law enforcement, but it is not referred to a particular agency for investigative follow-up. NCMEC is legally obligated to make all CyberTipline reports available to law enforcement, though some agencies choose not to receive informational reports at all. Instead, it will be retained by NCMEC in order to “assist in future investigations” and potentially “help to build a picture of the scope and extent of the activity on the Internet.” NCMEC states that, “informational submissions do not have investigative value on their own, but in the long run, they could help to facilitate future enforcement.”

What Can NCMEC Legally Do to a Reported Person?

As discussed above, NCMEC does not conduct independent investigations, it does not issue subpoenas, execute search warrants, or seize devices. NCMEC does not have the authority to arrest suspects. Finally, NCMEC does not have the authority to initiate a criminal prosecution.

The decision as to whether there are reasonable grounds for pursuing an investigation with respect to a reported person falls to the receiving law enforcement agency. It will be up to a federal judge (or state court judge) and a federal prosecutor (or district attorney) to determine whether a warrant should be issued and whether charges should be filed. If charges are filed, it will be up to a jury or a judge to determine if the case presents proof beyond a reasonable doubt. That is, NCMEC will not be determining whether a person has committed a criminal act.

What can NCMEC legally do in the scenario where a company, corporate employee, or individual reports the use of its services to disseminate child sexually abuse material (CSAM), commit child sexual abuse, child trafficking, or child prostitution, or contact a child sexually?

NCMEC will:

• Analyze the images, video, audio, or other content contained in the report. It will try to find any information in the report that can help with identifying the alleged offender or locating the child or children involved. It will look for location clues, hash clues, and any signs that indicate the child or children are in immediate danger or that other children are in danger.
• Analyze the reported person’s account data, which may include email addresses, phone numbers, login information, other user data, IP addresses, and other information that can be used to trace the report back to the reported person.
• Try to find matching hashes that would indicate whether the content is already known to be CSAM.
• Use information about the reported person’s location if available, or use IP address information, account data, and other clues to try and find any location information that can help with identifying the reported person.
• Triage the report based on the level of child safety concerns.
• Classify the report as either a referral or an informational submission.
• Transmit the report to the appropriate law enforcement agency if it has been classified as a referral.

If you have been referred by NCMEC, you will want to talk to an experienced defense lawyer as soon as possible.

The investigation that follows a NCMEC referral can have a wide range of potential outcomes. It may be a situation that does not need to deal with. On the other hand, it could be a situation that ends up with charges being filed. You need to talk to an experienced defense lawyer to know what you need to do.

Is your company facing a CyberTipline report investigation? Or has the DOJ issued a subpoena or warrant? You need to speak with an experienced federal defense lawyer as soon as possible. With this in mind, if you have any questions about your situation or your concerns, please reach out to us.

What Does a Hash Match Actually Prove About You?

As discussed above, hash matching compares the unique digital fingerprint of an image file against a database of fingerprints known to represent CSAM. While this identifies the file as CSAM, it doesn’t prove who possessed the file, when they possessed it, or that they knowingly possessed it.

Perceptual Hashing and PhotoDNA

PhotoDNA uses “perceptual hashing” to identify images and videos regardless of how they have been resized or otherwise modified. Perceptual hashing doesn’t generate a fingerprint that represents a byte-for-byte copy of a file. Instead, it generates a fingerprint that represents the image itself and its visual content. This allows PhotoDNA (and perceptual hashing in general) to identify images that have been altered.

Cryptographic Hashes

Cryptographic hashes (the kind that technology providers typically use) ordinarily match if two files are byte-for-byte identical. If a cryptographic hash matches a database of known-CSAM image file hashes, then the reported file is a copy of the known-CSAM file. That is, it contains the same byte-for-byte image content. However, this still doesn’t prove that the reported person knowingly possessed a copy of the CSAM image.

What a Perceptual-Hash Match Proves

A match based on a perceptual hash indicates visual similarity, but not byte-for-byte identity. As we discussed above, that doesn’t prove the reported person knowingly possessed it. However, the visual similarity of a perceptual-hash match alone (even without PhotoDNA) can still be a very strong indicator that a file is CSAM.

AI Classifiers

While not a form of hashing, technology companies are using AI to better identify CSAM. At this time, the best AI classifiers determine the category of the content of an image or video, like CSAM, rather than matching the image itself to other, known copies of the image. This has similar-but-not-identical implications for defendants.

If you are facing this situation, Spodek Law Group handles federal criminal defense matters nationwide, from offices in New York and Los Angeles.

Can a CyberTipline Report Establish Probable Cause by Itself?

An investigator will normally need to use legal process to obtain the additional account information that is needed to conduct an investigation. A search warrant also needs to establish probable cause for the location it will search. So, even when investigators have a CyberTipline report that includes a suspect’s name or address, this is not enough by itself to get a search warrant. It will need to establish that there is good reason to believe that the suspect’s device is stored at that address or that the suspect’s device will be stored at that address at the time of the search.

Even if the reported person is identified, this also doesn’t establish probable cause for the search. Identifying the IP address used to upload a reported file is often insufficient on its own to provide a good reason to believe that the account owner is the uploader. This may provide a reason to investigate the account owner’s device, but on its own, this can be a difficult-to-overcome argument.

The account owner’s name also doesn’t prove that the account owner uploaded the reported file. The subscriber’s name doesn’t establish who is using a particular device. The name of a customer registered to a particular account or at a particular IP address does not identify which person in the residence or customer’s company, if any, uploaded a reported file.

Again, a substantial amount of time must have passed. If an investigator has a search warrant, it may not establish probable cause for the information they need to collect at the time of the search. If the investigation is ongoing, this is less of a concern. But, given the lack of a clear explanation as to why the person suspected of uploading a reported file still possesses the file, there is a point where the fact that the report is stale will weaken the probable cause for the search warrant. Finally, investigators need to have a reasonable basis to believe the uploader is the same person they are trying to establish probable cause against. If they don’t have this, they may need to establish a substantial amount of evidence that the uploader is the same person.

Again, this only holds true if the investigation was not based on a subpoena or another legal process that may provide additional information. If you received a CyberTipline report, you need to speak to an experienced defense lawyer as soon as possible. To avoid potentially incriminating yourself, your best chance of avoiding charges or jail time is to start working with an experienced defense lawyer as soon as possible.

How Can You Know Whether a CyberTipline Report Exists?

If you’ve been banned from your online account, this may be a sign that you have been reported to the CyberTipline. However, this would only happen if the company that banned you determined you violate their terms of service (ToS). Even if they’ve sent your information to NCMEC, that doesn’t mean that criminal charges will result from the report. It could be several weeks, months, or years before the police take action based on a CyberTipline report.

When Will I Hear from the Police?

If the police determine that you have been reported to the CyberTipline, there is no standard timeline as to when they will contact you. This will depend on a variety of factors, including the law enforcement agency involved and the type of report you have been accused of filing. With these factors in mind, in order to fully protect yourself and your loved ones, you should not wait to hear from the police in order to hire a defense lawyer.

If My Account was Closed, Does This Mean that a CyberTipline Report was Filed?

An account closure is not definitive evidence of a CyberTipline report. While a company can take this action if it has received a report about an account holder, this is a very general form of a disciplinary action that it can take. It doesn’t necessarily mean that the company has filed a report with NCMEC based on that account holder’s conduct.

If Law Enforcement contacted Me, How Do I Know If This Is Related to a CyberTipline Report?

As we discussed above, a CyberTipline report alone is insufficient for establishing probable cause for a search warrant. That search warrant, however, allows law enforcement agents to review the reported person’s account. If you have recently had your account banned or if you’ve recently been contacted by federal law enforcement, you should talk to an experienced defense lawyer right away.

Can NCMEC Release Information About a CyberTipline Report to Me?

NCMEC does not release information to reported individuals; only to law enforcement agencies, prosecutors, or by court order. This is a fact of NCMEC’s classification as a “clearinghouse.”

If you are represented by experienced defense counsel, then your lawyer will typically be able to access the CyberTipline reports and records through the prosecutor in charge of the case. Your lawyer will need to access the records by either:

• Requesting access to the evidence through the prosecutor;
• Requesting a copy of the record from the technology provider that filed the report;
• Requesting a copy of the record from NCMEC via a court order.

Can Police Open CyberTipline Files Without Getting a Warrant?

This issue is currently unresolved, and it remains an open question that will be addressed in courts in the near future. The U.S. Supreme Court, in United States v. Ackerman, described NCMEC as a governmental agent for the purposes of the Fourth Amendment. In this case, a federal law enforcement agent of the U.S. Attorney’s Office (DAO) contacted NCMEC to find records of the accused. NCMEC’s records indicated that the accused provided files to a social media platform. The information given by the platform was a “private search,” and because of this, a search warrant was not needed to allow the DAO access to the information contained in the reported file.

Importantly, however, Ackerman did not address what the consequences would be for a defendant if his or her CyberTipline report were not filed in response to a company-sanctioned scan of its servers. As we will see shortly, this makes a difference under both the voluntary-private-search doctrine and the “reasonable-expectation-of-privacy” doctrine.

The Voluntary-Private-Search Exception

Courts have determined that consensual searches conducted by private parties, like corporate security personnel or corporate IT departments, are generally exempt from the Fourth Amendment warrant requirement. In other words, unless the government is involved, then the Fourth Amendment doesn’t apply.

Again, this is a general rule. As the Ninth Circuit Court of Appeals found in U.S. v. Holmes, just because police view a copy of a reported file that the provider reviewed before giving it to police, doesn’t automatically mean that police have conducted a valid search. In other words, the fact that the police have a copy of the file doesn’t automatically make the file admissible as evidence against a suspect in criminal court. The Ninth Circuit suppressed the evidence because the police accessed a version of the reported file that was altered, and because of the fact that the file was not reviewed by the company’s CSAM team before it was reviewed by federal law enforcement agents.

The “Reasonable-Expectation-of-Privacy” Exception

Another question is whether individuals who voluntarily share files with technology providers (on social media platforms or via email or other forms of file transfer) have a “reasonable-expectation-of-privacy” under the Fourth Amendment.

If the defendant believes his or her file will only be scanned using automated means for the purposes of preventing child exploitation, then the defendant will likely still have a reasonable-expectation-of-privacy in that file. Again, this means a search warrant will be needed. However, this requirement can be overcome if a provider’s employee viewed the file before handing it over to law enforcement.

When assessing the reasonableness of an expectation-of-privacy, courts look to the scope of the private search, a warrant requirement for the police opening a CyberTipline file, and the possibility that the government review exceeded the scope of the private search.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.