How an ICAC Task Force Investigation Works After a CyberTip.

Last Updated on: 4th August 2026, 01:33 am

CyberTips Are Not Proof of Guilt A CyberTip is an investigative lead. It is not evidence of illegal conduct. It does not prove guilt in any form. Instead, a CyberTip provides the necessary justification for the ICAC Task Force to start an investigation.

CyberTips Are Not Proof of a Specific Person’s Guilt

A CyberTip includes an IP address. The IP address identifies a connection to the Internet, but not necessarily the user of the IP address. So, while a CyberTip might establish that certain illegal content was accessed or shared on a specific connection, it does not prove who accessed or shared the content.

Most CyberTips Are Insufficient to Establish Liability

In most ICAC cases, the evidence that triggers an investigation is insufficient to establish liability. At Spodek Law Group, we handle ICAC investigations. When our federal criminal defense attorneys intervene, they may argue that the government does not have enough evidence to support its case.

Identifying a Person Behind a CyberTip

To pursue an investigation, the ICAC Task Force must identify the individual responsible for the alleged offense. They begin this process by issuing subpoenas to Internet Service Providers (ISPs) in order to find the subscriber information associated with the IP address listed in the CyberTip.

Using Evidence to Confirm the Suspect’s Guilt

Once the Task Force identifies the subscriber and the subscriber’s location, the Task Force must use additional investigative techniques to confirm the subscriber’s guilt. After identifying a suspect and gathering additional evidence of the alleged offense, the Task Force may refer the matter for charging.

The ICAC Task Force Program

The National ICAC Task Force Program is the nation’s most extensive effort to combat online child exploitation. Since starting in 1998, the program has grown to include 61 coordinated task forces. Today, the national program encompasses more than 6,200 federal, state, local law enforcement, and prosecutorial agencies.

Who Sends a CyberTip, and What Does the ICAC Task Force Receive?

What Is a CyberTip?

A CyberTip is a report of suspected online child exploitation sent to the National Center for Missing and Exploited Children (NCMEC). ICAC task forces receive CyberTips routed from NCMEC.

What Information Is Included in a CyberTip?

CyberTip reports can include various pieces of information, including: - IP addresses tied to alleged illegal activity;

• Identification of the involved electronic service provider;
• A description of the suspected offense, as well as any additional information provided.

Who Sends CyberTips?

U.S.C. § 2258A requires covered providers to report apparent violations of “specified child-exploitation laws” to NCMEC. Members of the public can submit suspected child-exploitation reports directly to NCMEC’s CyberTipline as well.

What Happens When ICAC Receives a CyberTip?

ICAC task forces receive CyberTips in the form of PDF reports that require review. Some reports may provide enough information to justify criminal charges immediately. However, in most cases, the information in a CyberTip report only serves as the lead that triggers the investigation.

What Information Is Included in a CyberTip Report?

Under 18 U.S.C. § 2258A(b), a CyberTip report may, at the sole discretion of the provider, include: - A reasonably specific description of the apparent violation of the specified child-exploitation law;

• The time and date of the transmission of the apparent violation;
• The IP address associated with the apparent violation (and the date and time of the communication) or a description of the apparent violation; and
• Information necessary to allow NCMEC to identify the service provider involved. Under 18 U.S.C. § 2258E, a “provider” subject to these reporting requirements is an electronic communication service provider or a remote computing service. The term “electronic communication service” takes its meaning from 18 U.S.C. § 2510(15), which defines it as “any service which provides to users thereof the ability to send or receive wire or electronic communications.”

How Does ICAC Decide Which CyberTips to Investigate First?

Triage of CyberTips

Since the volume of CyberTips exceeds the resources available to most ICAC task forces and their affiliates, investigators generally triage CyberTips before promoting a CyberTip into an active case. This initial triage process can include: - Validating that the CyberTip is not an obvious error or duplicate of a prior report.

• Determining that the receiving task force is in the right jurisdiction to receive the CyberTip.
• Assessing the risk of an identifiable child victim and identifying the child’s location.
• Assessing whether any victims are at risk of imminent bodily harm.

Indicators of Urgency

Once the ICAC Task Force has sorted CyberTips into a queue based on urgency, investigative priority for an individual CyberTip can increase if: - An identifiable child victim exists or there is risk of imminent bodily harm.

• The CyberTip involves any of the following factors: - Recent uploads of suspected child sexual abuse material (CSAM) and other online child exploitation material. - Indicators that the person responsible is producing illegal content. - Enticement of minors. - Online financial extortion using a minor’s image. - Live-streaming of abuse. - Prior history of CSAM-related offenses. - Access to the suspected perpetrator’s location.

Reasons for CyberTip Disposition

While many CyberTips are used to launch ICAC investigations, some can be immediately dispositioned as not qualifying for an active investigation. This can happen if: - The information is duplicative of a prior report.

• The report is incomplete, or the information it contains is insufficient to support the launch of an active investigation.
• The task force or an affiliated agency received the report due to misrouting.
• The suspected conduct is not a crime or does not constitute a specified child-exploitation violation under U.S.C. § 2258A.
• The investigation falls outside the receiving task force’s or affiliate agency’s jurisdiction.

Factors Affecting ICAC’s Operational Tactics

Operational tactics will depend on whether investigators have legal authority to access the suspected perpetrator’s device or other digital evidence, the risk posed to potential victims, whether arresting suspects in person presents risks to officer safety, and various other pertinent factors.

What Legal Process Can Investigators Use After a CyberTip?

Search Warrants

Investigators have authority to seek search warrants to seize or examine digital devices if they can establish the probable cause required by the Fourth Amendment. While judges must independently assess the likelihood that a search warrant will produce evidence of a crime, a search warrant can be obtained even if a search is unlikely to produce evidence that is admissible at trial. However, the same standard of probable cause applies to search warrants as to seizure warrants, and this search warrant can be challenged if the evidence used to justify the search warrant is wholly inadequate to support the finding of probable cause.

Voluntary Consent

Voluntary consent to answer investigative questions or permit a search is another way that investigators are able to obtain information without utilizing compulsory legal process. However, once an individual revokes consent, the investigator must rely on another method to continue a search or interrogation.

What Do Investigators Call “Compulsory Legal Process”?

Compulsory legal process is a general term that refers to a subpoena, court order, search warrant, or other legal instrument, whereby a recipient must act as instructed. Some forms of compulsory legal process require law enforcement to establish probable cause, while some do not, and different forms of compulsory legal process give investigators different levels of authority.

What Is U.S.C. § 2703?

The federal statute known as the Electronic Communications Privacy Act (ECPA) governs law enforcement’s ability to seek and execute compelled disclosure of stored communications, customer records, or other information held by providers of electronic communication services or remote computing services. Section 2703 of Title 18 is titled “Required disclosure of customer communications or records,” and the law imposes four different scopes of legal authority (subpoena, court order, warrant, or consent).

What Is U.S.C. § 2703(f)?

18 18 18 U.S.C. § 2703(f) provides law enforcement with the ability to seek preservation of the evidence that investigators will seek to compel the disclosure of later through other forms of legal process.

What Is the Difference Between a Subpoena, a Court Order, a Search Warrant, and Consent?

- Subpoenas do not require probable cause.

• Court orders under 18 U.S.C. § 2703(d) do not require probable cause, but they require specific and articulable facts showing reasonable grounds to believe that the information sought is relevant and material to an ongoing criminal investigation.
• Search warrants require a finding of probable cause.
• Consent is voluntary.

When Does the Fourth Amendment Require a Search Warrant?

The Fourth Amendment generally requires law enforcement to obtain a search warrant, and a warrant may issue only upon a showing of probable cause. However, search warrants are not required for all types of searches or seizures. Some disclosures of stored information only require a court order. Some disclosures of provider-held information can be compelled by subpoena, and some searches can be conducted with an individual’s voluntary consent. If any of this describes your situation, it is worth talking it through with counsel. Spodek Law Group can be reached at 212-300-5196.

Can an IP Address and Subscriber Information Identify Who Used the Account?

Identifying the Subscriber

Law enforcement officials can identify an internet subscriber using an IP address. When able, officials will use the subscriber’s name, address, phone number, or other information as a starting point for investigative efforts. However, identifying the subscriber does not establish the subscriber’s liability.

IP Address and Subscriber Liability

Subscriber information alone cannot prove liability. To prove that the subscriber is responsible for the alleged offense, the government must connect the subscriber to the alleged offense, rather than merely to the account or connection. This process is called “attribution.”

Attribution involves:

Dynamic IP Address Attribution

A dynamic IP address is assigned to a device for a limited time. To use a dynamic IP address to identify a subscriber, officials must be able to match the dynamic IP address to a specific date and time. If the CyberTip is dated February 1, then law enforcement must prove that the suspected individual was using that dynamic IP address at the time of the alleged offense. Stale timestamps or misidentifying the time zone of a CyberTip can result in the misidentification of an internet subscriber.

Carrier-Grade NAT Attribution

Carrier-grade NAT is a form of network address translation. When network traffic is routed through a CGN, a dynamic IP address may be shared by hundreds of users. To use a dynamic IP address that is shared via CGN to identify an internet subscriber, law enforcement officials must be able to determine the specific date, time, and source-port used by a particular device.

Identifying Individuals via IP Attribution

Identifying a suspect through IP attribution can also present challenges when: - An individual used a VPN.

• An individual used public Wi-Fi.
• An individual used a mobile device.
• Multiple people shared one internet connection.

Account Names, Device Locations, and Other Types of Identification

As a consequence of these challenges, ICAC investigators rely on evidence other than IP attribution to link a suspect to a crime.

For example:

The Suspect’s Control of an Account

While a suspect’s email account may have been used in an alleged offense, law enforcement officials cannot assume the suspect’s guilt. This is because the suspect’s account may have been accessed or controlled by someone else at the time of the alleged offense.

At Spodek Law Group, our federal criminal defense attorneys are experienced in arguing that our clients did not have control of their accounts at the time that illegal content was uploaded, sent, or downloaded.

The Suspect’s Association with a Device

Similarly, law enforcement officials cannot assume the suspect’s guilt just because the suspect is associated with a device. Digital devices, including phones and computers, may have been accessed by multiple people before they were seized. This raises the potential for “device contamination,” or the possibility that content associated with another person was on the suspect’s device at the time that ICAC seized the device.

Suspect Interview Evidence

Many ICAC investigators rely on suspect interviews in order to gather evidence that would support criminal charges in child-exploitation cases. However, suspects can also use an interview to tell their side of the story, clear up misunderstandings, and assert their defenses. ICAC training materials, such as “Law Enforcement Officers’ Interview Guides: ICAC Case Interviews,” focus heavily on the skills required to conduct these interviews.

What Happens After Investigators Seize Suspects’ Phones and Computers?

Digital Forensics

Digital forensics is the science of applying investigative techniques to digital devices. In child-exploitation investigations, investigators use digital forensics to establish the link between a device and its owner and, if possible, to prove that the owner is responsible for the alleged offense.

Device Preservation

Once ICAC obtains a suspect’s phone and computer, the digital forensic investigator will generally preserve the device(s) before conducting forensic examinations. This process involves creating a “forensic image” of the computer hard drive, phone, or other digital media on the device. Once law enforcement has a forensic image, then investigators will work from a copy of the image rather than using the device itself.

Chain-of-Custody

Law enforcement maintains a chain-of-custody record. This record documents everyone who had possession of or handled the seized digital device or its image from the date of seizure until the date of examination. If a chain-of-custody record contains an unexplained gap, the gap may affect the evidence’s weight and may support a challenge to its authenticity.

Scope of Examination

ICAC’s examination of seized devices is generally limited to the scope of a warrant obtained prior to seizure or the scope of an individual’s voluntary consent. If the scope of ICAC’s examination extends beyond the scope of a valid warrant or a valid consent agreement, then the results may not be admissible in court.

Hash Matching for CSAM

One method for identifying CSAM on the suspect’s device is hash matching. A digital “hash” is a unique numerical identifier for a specific file. A hash match occurs when a hash for a file previously classified as CSAM matches the hash of a file on the suspect’s device.

Encryption and Forensic Backlogs

Encryption and forensic backlogs can both result in delays to a forensic examination. Forensic backlogs are a systemic problem within ICAC and throughout federal and state law enforcement. In child-exploitation cases, the government prioritizes cases involving children at risk of harm. The volume of cases waiting to be reviewed by ICAC can lead to delays between the time a suspect is arrested and the time the charges are formally filed.

Victim Safeguarding

Victim safeguarding in child-exploitation cases is an important consideration that is often conducted in parallel with the investigative work. Depending on the circumstances of the case, victim safeguarding may involve child-advocacy centers, protective services, forensic interviewers, victim-service providers, or law enforcement officials.

Who Conducts the Forensic Examinations?

Both state and federal law enforcement agencies perform digital forensic examinations in child-exploitation cases. Because ICAC is a multi-jurisdictional program, many ICAC member agencies work with forensics units in other agencies and laboratories as well.

How Long Does It Take to Resolve an ICAC Investigation?

Interstate and International Cases

Many ICAC investigations require coordination among ICAC affiliates, federal agencies, foreign governments, and other entities. An interstate case involving one of the program’s multiple affiliated task forces requires a level of coordination with federal authorities. An international case involving evidence or suspects outside of the U.S. can be much more complicated and requires significant assistance from federal and foreign authorities.

Referrals and Consolidation

A CyberTip may involve individuals and other entities that are already known to the receiving ICAC task force. For example, if the CyberTip involves one of the laundered images in a law enforcement database, the CyberTip may be consolidated with an existing investigation. In some cases, if the investigation requires resources that the receiving ICAC task force does not possess, investigators may refer the case to an ICAC affiliate in another jurisdiction.

Dispositions of Non-Investigative Cases

Some CyberTips will be dispositioned without an active investigation. For example, if a CyberTip does not contain sufficient information to identify a user, then investigators may close the report. Or, if additional information becomes available that identifies the user, then investigators may reopen the report and seek evidence to support criminal charges.

Providers and Other Third Parties

CyberTip investigations generally require responses from third parties including internet service providers and electronic communication service providers. Provider response times are often unpredictable, and if a provider has deleted the data that the investigator is seeking, the CyberTip may be delayed or permanently stalled.

Other Potential Delays

A long list of potential delays can extend the time it takes to resolve a CyberTip investigation. This list includes: - Review of search warrants and court orders.

• Forensic investigation queues.
• Time zones.
• International mail and crossing borders.
• Obtaining records from a third party.

Status Updates for NCMEC and CyberTip Reporters

CyberTip investigations that are still open may not generate status updates for NCMEC and CyberTip reporters. This is due to active-investigation concerns, and it is not unusual for reporters not to know their CyberTips are under review.

Talk to Spodek Law Group

Every case turns on its own facts, and general information is no substitute for advice about yours. Todd Spodek, managing partner of Spodek Law Group, and the firm's attorneys defend federal criminal and white collar matters nationwide. Reach the firm at 212-300-5196.