Google Drive Flagged a File for Child Safety: Who Received the Report.

The CyberTipline is maintained by the National Center for Missing & Exploited Children (NCMEC). Under 18 U.S.C. § 2258A, the NCMEC is the “designated reporting center” for electronic service providers that “obtain knowledge of facts or circumstances that indicate a violation of the laws relating to child pornography.” If Google scans your Drive file, detects CSAM, and believes this indicates a violation of these laws, Google may submit a CyberTipline report (and potentially additional reports) to the NCMEC.

It is entirely possible that the CyberTipline report was submitted before you received a notice that your account had been disabled. At the same time, the fact that your Google account has been disabled does not alone prove that Google has submitted a CyberTipline report.

If NCMEC received a report from Google but determined that it did not involve actual CSAM or that it did not present sufficient evidence of a crime, NCMEC would have resolved the report without referring it to any law enforcement agency. This would mean that no federal agent investigated you.

How many people know about Google’s CyberTipline report from my Drive?

The CyberTipline is not exclusively for Google. According to NCMEC, “a substantial portion of CyberTipline reports come from cloud service providers such as Dropbox, and social media providers such as Meta and Apple.”

While not all reports result in federal investigations, CyberTipline reports have spiked in recent years, likely due to providers like Google improving the scope and efficiency of their scanning practices. According to NCMEC:

• About 20.5 million reports were received in 2024
• Over 36 million reports were received in 2023
• Over 32 million reports were received in 2022

Does every Google Drive flag trigger a federal report?

Yes, potentially. As stated in the section below, the duty under Section 2258A only applies to providers with actual knowledge of what appear to be exploitation offenses. As Section 2258A does not impose duties based on a user’s intent, context, or self-assessment (or lack thereof) of any flagged content, Google’s only relevant obligation is to report the apparent violation to NCMEC’s CyberTipline as soon as reasonably possible after obtaining actual knowledge of the facts or circumstances described in the statute.

While Section 2258A does not impose a duty on providers to proactively monitor user-uploaded content, providers may do so, and Google Drive does. If Google identifies a file containing material which “constitutes or is equivalent to child pornography” through hash matching or the use of classifiers, Google’s only responsibility under Section 2258A is to report the file to the NCMEC. Since providers may generate CyberTipline reports before a user can make any appeal, this means that Google can send a CyberTipline report before the user is aware that a flagged file exists.

How does Google identify suspected CSAM on Google Drive?

To date, Google does not explain in detail how it identifies suspected CSAM on Google Drive. However, Google does state that it uses hash matching, classifiers, and other detection and prevention mechanisms to identify CSAM across its platforms.

Hash matching is a process that involves using an algorithm to assign a unique digit string, a file hash, to a file. When a file is uploaded to Google Drive, Google’s algorithm calculates the hash and checks to see if it matches an existing hash on a “blacklist” of known CSAM. If the hashes match, Google knows that the file is CSAM (or that the uploader believes the file is CSAM), and it may then disable the user’s account.

A classifier is an algorithm that has been trained to “predict the category of” an image. For example, a classifier trained to identify images of nude children will flag images containing images of nude children. Since classifiers can identify CSAM without the aid of a hash blacklist, Google can also use classifiers to identify the content of uploaded files.

Google also uses “specialized reviewers” to examine the content of flagged files in some cases. According to Google, these reviewers identify “content that violates child safety policies” while also respecting “privacy and confidentiality.”

How is a Google Drive scan different from a Section 2258A report?

Four distinct steps are involved in Google’s detection, removal, and reporting of CSAM. These steps are separate and do not have any requirements or restrictions that limit one step from resulting in another:

1. An automated tool flags a file on a user’s account for violating a child safety policy.

2. A human reviewer affirms the automated tool’s determination.

3. Google removes the file and disables the user’s account.

4. Google sends a CyberTipline report to the NCMEC (and the NCMEC forwards the report to an appropriate law enforcement agency).

What information did Google include in the CyberTipline report?

A CyberTipline report by Google typically includes the flagged image, video, link, or file that triggered the reporting requirement.

If a CyberTipline report includes any account identifiers, these could include the user’s email address, recovery email address, phone number, linked social media account, or other personal information associated with a Google account.

Under 18 U.S.C. § 2258A(b)(3), a provider’s report to the NCMEC must include all information pertaining to the flagged “exploitation material,” which includes information such as:

• The date and time that the file was uploaded, and the time zone that the server’s timestamp represents
• The record of transmission of the file from the sender’s IP address
• The location (country, state, zip code) or IP address of the reported incident
• The identity of the device that sent the file
• The filename, the file’s creation date, and the file’s modification date

These are only five examples of the types of information that providers may include when the information is within their custody or control, and they are not an exhaustive list. Many other pieces of information pertaining to “exploitation material” may also be included when applicable.

Do I only lose access to my Google account if Google sent a CyberTipline report?

No, it is not possible to determine whether Google has referred a user to law enforcement by looking at their Google account status. Google accounts will be disabled under both circumstances, and the reports that triggered account disablements may or may not have been forwarded by NCMEC to law enforcement.

Even if the flagged content was transmitted as part of an apparent exploitation offense, a provider’s report of the material may not necessarily result in a criminal investigation. Many providers report thousands of images and videos to the NCMEC, and NCMEC has noted that “nearly half of all refered cases were closed without any law enforcement action taken.”

Once a report is referred by the NCMEC, law enforcement agents can use this information to open investigations and seek search warrants. According to the U.S. Department of Justice, “these CyberTipline reports are the primary tool for identifying and locating child sexual abusers and pedophiles.” When law enforcement opens an investigation, they can also subpoena Google, requesting the user’s identity, IP address, and other information that is available in the provider’s records.

Who decides what information Google will include in a CyberTipline report?

Section 2258A(b) provides that the facts and circumstances in a report “may, at the sole discretion of the provider,” include certain categories of information, identifying information about the involved individual, historical reference, geographic location information, the visual depictions themselves, and the complete communication, to the extent that information is within the provider’s custody or control. However, Section 2258A does not specify what types of information providers “can” include in a CyberTipline report. This means that providers determine what information they include in their reports based on (i) what information they have available to them, and (ii) what information is legally permitted to be disclosed to the NCMEC.

Which police agency received the report after NCMEC?

The NCMEC does not operate as a police agency. Instead, it serves as a “clearinghouse” for all of the reports that are submitted through the CyberTipline. As the CyberTipline’s website explains, “The analysts at the CyberTipline review all reports received, and then route these reports to a wide range of investigators and prosecutors as appropriate.”

According to the NCMEC’s press release, the authorities to whom it routinely refers CyberTipline reports include “the Federal Bureau of Investigation (FBI), Homeland Security Investigations (HSI), members of the prosecutor’s offices at federal, state, local and international law enforcement, the Internet Crimes Against Children (ICAC) Task Force, among others.”

Does NCMEC route cases geographically or by crime?

NCMEC routes CyberTipline reports to investigative agencies by both geographic location and crime. For instance, the NCMEC says that “when a child exploitation case is referred by CyberTipline, local law enforcement agencies will conduct the criminal investigation with the support of the United States Department of Justice.”

This means that if your Google account was referred to the FBI and your home is in Miami, the Miami FBI field office would investigate your identity and IP address. At the same time, your IP address and other location data will determine whether the FBI directs your case to the Internet Crimes Against Children (ICAC) Task Force.

As detailed below, a referral to the ICAC Task Force can result in a joint investigation with the FBI, the local United States Attorney’s Office, and local police, among others. In most cases, multiple agencies will have received your case.

What is the role of the ICAC Task Force in these investigations?

The ICAC Task Force is a national network of federal, state, and local authorities focused on investigating and prosecuting online child sexual exploitation. The CyberTipline’s website states that “the ICAC program is the United States’ primary law enforcement response to online child sexual exploitation.”

When NCMEC sends a referral to the ICAC Task Force, the Task Force forwards the information to the appropriate investigative agency or agencies. As a result, when NCMEC sends a referral to the ICAC Task Force, a member agency (including the FBI, the local U.S. Attorney’s Office, and local police) may receive your case, or, in some cases, multiple agencies may work together to investigate your potential involvement.

What is the role of Homeland Security Investigations (HSI)?

Homeland Security Investigations (HSI) is the criminal investigative arm of the Department of Homeland Security. HSI has the authority to investigate “all criminal laws within the United States,” including those related to the production or distribution of illegal child safety material and material that enters the U.S. from overseas.

As a result, the NCMEC routinely refers cases to HSI when the facts and circumstances of the CyberTipline report suggest that a crime was committed overseas or that the reported file involves material generated in a foreign country.

Does NCMEC route reports to international authorities?

Yes. As noted on the CyberTipline’s website, the NCMEC will refer reports to “the appropriate foreign authorities if the facts in a report indicate a potential for foreign jurisdiction.”

If you are facing this situation, Spodek Law Group handles federal criminal defense matters nationwide, from offices in New York and Los Angeles.

How can I find my report number and receiving agency?

If law enforcement pursues an investigation after receiving a referral from NCMEC, federal agents may send requests to Google seeking additional information from the user’s account. In most cases, law enforcement agents send subpoenas, court orders, and search warrants to request this information. If the investigation leads to charges, the U.S. Attorney’s Office will then be entitled to a copies of the user’s files, IP address and other identifiers.

In some cases, a U.S. Attorney’s Office may send a target letter. A target letter identifies the contemplated criminal charges and informs the recipient that their account has been flagged and referred to federal law enforcement. Target letters also provide contact information to a prosecutor who can provide more details about the investigation.

Generally, when a user receives an account warning, it will not include the CyberTipline report number, the date the report was submitted, the recipient agency, or the case number.

The Privacy Act generally does not apply to requests for information about records that fall under the control of the NCMEC. Although the Privacy Act of 1974 (5 U.S.C. § 552a) requires federal agencies to disclose records and information obtained by or about a target when requested, the NCMEC is a 501(c)(3) nonprofit corporation. As a result, requests filed under the Privacy Act to NCMEC will not trigger a legal duty to disclose records.

The Freedom of Information Act (FOIA) also does not apply to requests for records that the NCMEC itself has created. FOIA reaches only federal agencies: 5 U.S.C. § 552(f)(1) defines an “agency” as “any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government … or any independent regulatory agency,” and NCMEC, as a private nonprofit corporation, is not one.

Criminal defendants can file discovery requests with the court in order to force the prosecution to disclose the defendant’s reports that they intend to use at trial. However, the prosecution will only send these records after criminal charges have been filed against the user.

According to Google’s help page, if you lose access to your Google account, you only have two attempts to request a review. While Google does not explain the reasoning behind this restriction, it leaves users with little hope for a remedy in cases involving apparent exploitation offenses.

How long are Google and NCMEC report records kept?

When users appeal their account suspension, their appeals or explanations to Google become records that investigators may be able to subpoena. This means that investigators can request that Google provide a copy of your appeal and/or explanation, and if you have provided information about the image, video, link, or file, this could become evidence against you.

Section 2258A(h) requires that “the content of the report” be preserved for at least one year. After one year, an extension of 90 days may be requested by the NCMEC, or law enforcement agencies. For this purpose, “an extension shall be granted, unless the content of the report has been previously preserved through means authorized under a court order or applicable law.” With this extension, “ each extension shall be for a period not to exceed 90 days, and this process may be repeated as many times as necessary to ensure that content of the report can be retained until prosecution and sentencing.”

What happens to your CyberTipline record in the future?

Statutory records of report content do not automatically mean that you will have an indefinite record. It is not yet clear how long records that providers submit to the NCMEC will exist in the provider’s files, and it is not yet clear how many of these records will eventually be deleted.

If you have a CyberTipline record, this is not the same as having a criminal-history record. If you have had a criminal conviction related to a CyberTipline referral, you would have a criminal-history record which could appear in your background check.

In some cases, police have retained the only copy of records from a deleted account, which has left them with the only copy of files that triggered the referral to NCMEC.

Can police open every flagged Drive file without a warrant?

In the case of United States v. Lowers (640 F.App’x 519 (4th Cir. 2016)), the Fourth Circuit Court of Appeals considered the question of whether the warrantless viewing of the flagged files in a suspect’s Google Drive was constitutional. Lowers had been accused of viewing and possessing child pornography. According to the facts in the case:

• The files that contained the alleged child pornography were flagged for upload by Google’s automated content moderation software.
• Some of the flagged files had been viewed by Google’s employees.
• When the flagged files were referred to law enforcement, a detective for the Internet Crimes Against Children (ICAC) Task Force viewed all of them, including some that had not been viewed by Google’s employees.
• The detective then took action and obtained a search warrant for the remainder of Lowers’ computer files.
• The FBI arrested Lowers and obtained consent to search his computer.

The Fourth Circuit found that Lowers had not consented to the search, that the information seized in the search of the flagged files was not in public view, and that the detective was not conducting an independent investigation. In its ruling, the Fourth Circuit stated: “When the detective went on to open the files and view their contents, he exceeded the scope of the initial report and his action was no longer a private search. As such, the detective’s warrantless open was unconstitutional, and the information he learned of violated Lowers’ Fourth Amendment rights.”

In Lawers, the court reasoned that even if the police have probable cause to seize a computer, this doesn’t necessarily mean they have probable cause to open all the files that the computer contains, and that they cannot open a file and view its contents without a warrant or valid exception.

As a result, the Federal Bureau of Investigation (FBI) or any other law enforcement agency in the Fourth Circuit will be unable to open your files to review their contents without a warrant. However, other law enforcement agencies in other federal districts can open your files.

Does the government need a warrant to scan your files for child pornography?

The Fourth Circuit found that the police exceeded the scope of their private search in Lowers by opening a new file to view its contents. With this in mind, can they open a flagged file to view its content without a warrant?

In Lowers, the fact that the defendant had already produced hash data for one of his files did not give the government the right to open and view other files in the defendant’s possession. The court found that hash data and an image of a flagged file are not the same thing. Some courts have used this logic to hold that government access to hash data resulting from a private search is a private search. However, others hold that the government must still obtain a search warrant to view the flagged images in a case like Lowers.

As a result, the issue of whether the government needs a warrant to view flagged images in a case like Lowers is a matter of legal dispute. Because Lowers is Fourth Circuit precedent and not a nationwide rule, some federal circuits may accept hash data as evidence.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.