Getting the Full NCMEC Report in Discovery.

A complete NCMEC file includes the original CyberTipline submission, not just a generated PDF. While a CyberTip PDF summary may include basic information about the ESP submission, it is not necessarily the complete NCMEC file. For example, a prosecutor may produce a PDF summary of the submission in discovery while attachments still remain undisclosed.

We demand a complete and unredacted production of all materials in the NCMEC file. A complete report will reveal whether any attachments were added or omitted, and whether the materials were altered in any way. We use these records to assess the weight and credibility of the government’s evidence and to determine if the government’s evidence was tainted during the investigative process.

After the NCMEC portal routes a CyberTip to a local ICAC task force, the ICAC task force must conduct a preliminary investigation before pursuing a federal case. Again, while a prosecutor may produce a PDF summary of the CyberTip, portal records regarding the CyberTip’s routing to the local ICAC task force can remain undisclosed. We demand production of all portal records and any other information, documents, or other materials that are in the possession or control of the U.S. Attorney’s Office or the NCMEC.

Using the internet grants federal investigators jurisdiction over CSAM cases, but this does not require a federal charge. While federal authorities have the discretion to keep a case in the federal system, they also have the discretion to decline the case and refer it to state authorities. The allocation of CSAM cases between federal and state authorities remains discretionary, and we explore state-level diversion and resolution opportunities in appropriate circumstances.

What is included in the complete NCMEC file?

A complete NCMEC file can include supplemental reports tied to the same CyberTip number. A complete NCMEC file can include notes from NCMEC analysts who have reviewed the submission. A complete NCMEC file can include internal categorization and other records generated by NCMEC in response to the submission. A complete NCMEC file can include portal metadata that reflects status changes and access events. A complete NCMEC file can include logs that provide information about when the submission was accessed. A complete NCMEC file can include information that is not reflected in the CyberTip PDF summary. A complete NCMEC file can include download records generated by law enforcement when downloading attachments from the portal. A complete NCMEC file can include routing history and information about the recipient agency or agencies. A complete NCMEC file can include records that track how long a submission remains in the portal before the case is diverted to federal authorities. A complete NCMEC file can include provider-supplied IP logs and other technical data that may not be fully reflected in the visible fields of the CyberTip.

When constructing a comprehensive discovery request, it is important to distinguish between records created by the ESP, records created by NCMEC, and records created by law enforcement. For example, records reflecting a CyberTip’s routing to the federal government differ from records created by an ESP in response to child abuse materials hosted on its platforms. Likewise, download logs created by law enforcement when accessing NCMEC data differ from NCMEC portal records and records of original data reception. We rely on these distinctions to make informed decisions about the scope of our discovery requests and to effectively assess the materials that the U.S. Attorney’s Office produces. This meticulous approach enables our defense team to efficiently identify any areas where the government’s production is insufficient, which can then lead to targeted motions and inquiries aimed at uncovering critical evidence. Ultimately, this attention to detail is paramount in protecting our clients’ constitutional rights and ensuring that their defense is based on a full and accurate representation of the facts.

When should defense counsel request and preserve CyberTip records?

A discovery motion is the starting point. The primary goal is to obtain a complete copy of all relevant evidence, and the motion should explicitly seek a range of information. For example, a discovery motion may request: “Any and all examiner notes, logs, statements, and all reports concerning the forensic examination, and the complete reports relating to any and all referrals made by the National Center for Missing and Exploited Children (NCMEC) related to any and all CyberTip report numbers…” The reference to the CyberTip report number allows the government to identify the specific referral in question.

In addition to the discovery motion, it will be important to issue preservation requests to all relevant third parties. This will include requests to the Internet Service Provider (ISP) and NCMEC. The preservation request should refer to the CyberTip report number and request the retention of all relevant information. This includes, but is not limited to: “All available information and records pertaining to the account, subscriber information, and connection logs… including but not limited to logs that are about to reach the end of their retention window or for which the relevant account has been deleted, information that refers back to attachments that have been expired from the portal, copies of the attachments and any other pertinent records maintained by NCMEC, etc.”

There are two primary reasons why defense counsel should request this information as soon as possible. First, identifying a need to suppress evidence can take time. Obtaining the CyberTip records early leaves plenty of time to file a motion to suppress the evidence. Second, the CyberTip records can be critical when deciding whether to enter a guilty plea. Entering a guilty plea based on a PDF summary from the NCMEC is ill-advised. With a complete NCMEC file, defense counsel can make informed decisions with all relevant information.

Finally, a thorough comparison of the CyberTip records against other forms of evidence in the government’s possession can reveal gaps in the prosecution’s case. Comparing the CyberTip records to the agent’s affidavit can expose cases where the agent omitted an attachment that contains evidence for the defense, while comparing a CyberTip’s time- and date-stamps to those found in an affidavit can expose conflicts. Similarly, comparing the CyberTip records to the records created during the forensic examination can reveal missing source files or mismatched hashes.

Should counsel move to compel or issue subpoenas?

If the complete CyberTip materials are not produced with the government’s initial disclosure, the defense team will need to determine the appropriate method of obtaining the information. Federal Rule 16 reaches documents that are in the possession, custody, or control of the U.S. Attorney’s Office or the U.S. Department of Justice. This may include documents that the U.S. Attorney’s Office is able to obtain. However, the NCMEC is a private nonprofit organization, and this presents a potential challenge when trying to maintain that the government “controls” a complete CyberTip file that remains in the NCMEC’s possession. When this challenge is raised, it may be necessary for defense counsel to issue a subpoena to a nonparty pursuant to Federal Rule 17(c). For example, defense counsel could issue a subpoena to NCMEC to compel production of a complete CyberTip file and all other relevant materials in NCMEC’s possession. A subpoena could also be used to seek records from the electronic service provider that reported the CyberTip.

In addition to using a subpoena, the defense team can also pursue a motion to compel if appropriate. A motion to compel should target either (i) insufficient disclosures under Rule 16 or (ii) failures to meet constitutional obligations.

A single CyberTip can trigger multiple constitutional obligations for the government. This includes disclosure of favorable evidence material to a defendant’s guilt or punishment (Brady), disclosure of evidence that would impeach the credibility of a government witness (Giglio), and other information that constitutes a violation of due process. For example, if the government has not disclosed any and all information that the NCMEC has regarding a CyberTip, and the relevant data source was deleted by an electronic service provider, this may constitute a due-process violation.

In these scenarios, a motion to compel can be an effective tool for enforcing the government’s constitutional obligations. When crafting a motion to compel or an associated subpoena, defense counsel should carefully craft the specific records and information sought, including any and all information about:

• Any and all records created in response to and in reference to the CyberTip
• All attachments, images, links, or other evidence
• All portal logs that track and reflect access to, routing of, and communications about the CyberTip
• Any and all records referring to and created in reference to the CyberTip that was routed to a nonparty

All of these records, documents, and information are vital to the defense of a CSAM case. Defense counsel must ensure that a complete copy of the NCMEC file is produced promptly. While not all CyberTip material will be pertinent to every case, it is the fact-finder’s role, not the government’s role, to determine what is relevant.

If any of this describes your situation, it is worth talking it through with counsel. Spodek Law Group can be reached at 212-300-5196.

Does federal law block production of CyberTip evidence?

Along with blocking the production of a complete CyberTip report, the government will often rely on the Adam Walsh Act to attempt to block the production of other types of evidence. Specifically, the government will often refer to Section 504 of the Adam Walsh Act, which prohibits the reproduction of any image that is in the government’s possession or control when the image is “contraband” as defined by 18 U.S.C. § 2252, 2252A, 2253, or 2254A. In other words, if the evidence is child sexual abuse material that is stored on the NCMEC portal or with an electronic service provider, Section 504 will prohibit the government from providing the image to the defense unless it is in government custody or in a court of law.

Section 504 also provides that the material shall remain in the care, custody, and control of either the Government or the court, and that a defendant’s request to reproduce it must be denied so long as the Government makes the material “reasonably available to the defendant.” In United States v. O’Rourke, 470 F. Supp. 2d 1049 (D. Ariz. 2007), the First Circuit court clarified what it means to be “reasonably available.” Specifically, O’Rourke found that the government must afford “meaningful access” to the evidence at issue in the prosecution’s case. It also found that the prosecution must provide a defendant’s expert enough time to “conduct an adequate examination of the computer files.” Despite these findings, in many cases, government agencies will restrict defense reviews to a limited government facility. These restrictions can make it impossible to afford a defendant’s expert a meaningful opportunity to properly examine any and all available evidence. For example, a restriction may prevent an expert from using a specific forensic tool or program, limiting the examination time. In most cases, however, logs, metadata, analyst notes, and other records from the CyberTip report do not contain contraband and cannot be barred under Section 504.

18 U.S.C. § 3509(m) also applies in federal cases involving the possession and dissemination of CSAM evidence. Section 3509(m) governs the procedures by which a defendant may access property or material that constitutes CSAM, including digital media such as hard drives and image files. Along with the Adam Walsh Act, the government’s reliance on this statute can result in the failure to produce CyberTip evidence. Section 3509(m) does not bar the production of any and all non-contraband business records created by NCMEC and other entities involved in routing a CyberTip. The restriction to controlled review procedures when examining contraband attachments to a CyberTip should not hinder a complete and unredacted production of any and all producible metadata and logs in NCMEC’s possession.

How can the complete report undermine a search warrant?

Underlying the Fourth Amendment is the rule against warrantless searches and seizures, which applies to government actors and not to purely private conduct. While private parties’ searches are not subject to the Fourth Amendment, if an entity is acting as an instrument of the government, then the search is subject to the Fourth Amendment. Thus, when an electronic service provider flags files and reviews the flagged files for CSAM, it is essential for defense counsel to determine if the electronic service provider was acting as an instrument of the government when it received the search warrant.

The complete CyberTip report can be used to identify evidence for which the provider has a reason to believe is CSAM and for which the provider has not reviewed it in response to a legitimate concern. If the provider is acting as an instrument of the government, then this search could be subject to the Fourth Amendment. For example, a report’s descriptions of flagged files could rely on descriptions generated by a hash database rather than the results of a firsthand review. In this case, any review of any flagged file that is in the reporting provider’s possession or control would fall outside the scope of a private search and would therefore constitute a government search.

If a report indicates a government search in response to a legitimate concern, the same report may also indicate that the search exceeded the scope of any legitimate concern. This may occur in cases where a provider flags a file that triggers a CyberTip but then omits certain attachments when communicating with law enforcement. Opening the attachments that have been omitted may exceed the scope of the provider’s private search. Again, this search could be subject to the Fourth Amendment.

In many cases, the information presented in a search warrant’s affidavit regarding the NCMEC portal content may have the following characteristics:

• The affidavit describes files that were supposed to be flags in a CyberTip’s files, although the investigating officer has not yet personally reviewed them.
• The affidavit identifies a difference in the amount of data involved in a CyberTip compared to the amount of data that an investigating officer has analyzed.
• The affidavit has a mismatch in the files listed in the CyberTip report and those found during the search.

A complete NCMEC report is essential for identifying these inconsistencies and allowing defense counsel to challenge the government’s search warrant. If the prosecution’s search warrant’s affidavit contains relevant material falsehoods or material omissions, the defense team may be able to file a motion to suppress. A successful Franks v. Delaware motion can exclude unlawfully obtained search warrant evidence.

Who authenticates NCMEC records and challenges redactions?

If you are hoping to use CyberTip records in your defense, then your defense counsel will have to be prepared to lay the necessary foundations. To do so, they will need to authenticate the evidence, and this may involve subpoenas for:

• Custodians of the electronic service provider who can authenticate records related to the defendant’s account and platform logs generated by the ESP.
• Custodians of NCMEC who can authenticate records related to the CyberTip, portal logs, and documents demonstrating how the CyberTip was routed from the ESP to the pertinent law-enforcement agency.
• Relevant law enforcement witnesses who can authenticate records pertaining to the downloading of files from the NCMEC portal and other matters related to the handling of the electronic evidence in accordance with standard law-enforcement protocols.

When making a discovery request, it will be important to seek unredacted copies of all pertinent materials in the NCMEC file. In some cases, redactions may protect victim-identifying information. The government can also argue that redactions are necessary to protect the identity of a reporter or to protect materials that have been referred to in unrelated CyberTipline reports. If you’re facing allegations of possessing, sending, or receiving child abuse materials, then you should not take a request for redaction at face value.

In cases where a judge finds the redactions potentially exculpatory or otherwise discoverable, in camera review of the unredacted materials will be permitted. This can lead to the production of a redacted version of the unredacted records without the same protections applied to the unredacted version. It may also lead to a protective order that allows the defense team to access the unredacted record, while still maintaining the confidentiality of the protected information. With a protective order, unredacted evidence may be shared with the defense team and their expert witness without exposing the protected information publicly.

Lastly, if law enforcement agencies identify NCMEC’s data logs, portal routing records, or analysts as sources of information, it will be important for defense counsel to seek a witness for every individual or entity involved in the processing of the referral. NCMEC is a private nonprofit organization and is not a law-enforcement agency. Therefore, the information contained in the NCMEC records and the testimony of NCMEC employees must be treated as that of a non-governmental source.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.