Is NCMEC a Government Agent? The Ackerman Question and Your Fourth Amendment Rights.

The Tenth Circuit classified NCMEC as governmental or, alternatively, a government agent. A government follow-up that exceeds a provider’s private search can require Fourth Amendment justification. While this is the Tenth Circuit’s holding, it is also a relatively recent holding. As such, only other federal courts in the Tenth Circuit are bound by Ackerman. While other courts will look at Ackerman for guidance, they are not bound by the decision.

Currently, federal courts haven’t applied one uniform rule to NCMEC’s Fourth Amendment status. A provider’s private search is generally valid, even if it turns out to be flawed, as long as the federal government does not step in and a private search by a provider does not violate the Fourth Amendment.

In Ackerman, the district court initially thought that NCMEC was neither the government nor the government’s agent. The court noted that NCMEC’s staff include former law enforcement agents and this status gives NCMEC “special power” as the same one that gives them its authority to demand copies of the materials from ISPs and Social Media Platforms, among others. However, this did not stop them from thinking that this “special power” does not mean NCMEC is part of the federal government.

But, when the district court’s decision was appealed to the Tenth Circuit, that court wrote: “The district court incorrectly decided that NCMEC is not ‘governmental’ in nature. As mentioned above, NCMEC has the characteristics of a government agent: it is entitled to receive reports and ‘referral information’ as a matter of right from Internet Service Providers, it employs former law enforcement officers as “Senior Law Enforcement Consultants,” and it has been described as “the government’s investigative arm.”

When Does a Private Nonprofit Become a Government Agent?

The Fourth Amendment restricts “unreasonable searches and seizures” by governmental actors. As a result, “government agents are fully subject to the protections of the Fourth Amendment, while independent searches by purely private parties generally escape scrutiny under the amendment’s protections.” A private organization, however, can trigger Fourth Amendment protections if it acts as a “government agent.” The fact that a government principal has no legal power to conduct a search does not justify delegating that search to a private party. As the United States Supreme Court explained, “governmental principals cannot escape the constraints of the Bill of Rights” by delegating their investigative functions to private entities whose status as government agents is recognized.

Circuit also explained that “the Fourth Amendment applies to a non-governmental entity if it acts under color of federal authority.” Additionally, a private nonprofit entity acts under color of federal authority if “it is designated by statute as the central clearinghouse for reports of child exploitation on the internet.” This applies even if the nonprofit has no legal authority to conduct criminal investigations. Such a statutory designation is sufficient for a government-actor finding.

The Seventh Circuit similarly ruled that the “Fourth Amendment applies to a private entity if it is so closely integrated into the government’s law-enforcement operations that it should be considered a government agent.” In a case involving a private entity, the court found that the entity had “all the characteristics of a government agent, although it is not governmentally operated,” and that it was so close to the federal government’s law-enforcement activities that it had “become a government agent.” The government cannot evade Fourth Amendment scrutiny by delegating search and seizure functions to a private agency acting as its agent.

How Does a CyberTip Move from Providers to Police?

The CyberTipline investigation process is a three-step process involving three separate entities: (i) a provider that detects CSAM and files a report; (ii) NCMEC, which receives the report, triages the content, and then refers it to law enforcement; and, (iii) law enforcement, which then decides whether to initiate a criminal case.

The role of providers in the process is a combination of voluntary and mandatory efforts. Providers are covered by 18 U.S.C. § 2258A, which applies to: (i) electronic communication service providers (i.e., providers that offer, at least in part, the ability to send or receive electronic communication, such as Facebook, Instagram, Discord, Reddit, and various messaging services), and, (ii) remote computing service providers (i.e., providers that offer the capability for the storage and transmission of information, such as Google Drive, Dropbox, iCloud, Microsoft OneDrive, and various messaging services).

Under Section 2258A(a), providers are required to report the existence of CSAM to NCMEC when they have “actual knowledge” of it. Section 2258A(a) provides:

“In order to reduce the proliferation of online child sexual exploitation and to prevent the online sexual exploitation of children, a provider, (i) shall, as soon as reasonably possible after obtaining actual knowledge of any facts or circumstances described in paragraph (2)(A), take the actions described in subparagraph (B)... The facts or circumstances described in this subparagraph are any facts or circumstances from which there is an apparent violation of section 2251, 2251A, 2252, 2252A, 2252B, or 2260 that involves child pornography.”

While providers are required to report apparent CSAM, section 2258A generally does not require providers to proactively scan all user-hosted files to generate actual knowledge. As a result, providers can flag a file, send the hash to NCMEC, and send all other relevant data to the federal government without an employee ever opening the flagged file. This means that a human does not necessarily have to view the file, and the provider may not have viewed it, even when it is reported to NCMEC.

However, humans do sometimes view the files in CyberTipline cases. A human viewing can reveal information that an automated flag did not, and a human can also confirm a false-positive flag.

Providers flag CSAM using various techniques. Some providers use hash matching, also known as PhotoDNA, a technology used widely by companies like Facebook and Microsoft. Hash matching works by generating a “fingerprint” (or hash) of a known illegal image. The provider then checks all user files for a matching fingerprint. While hash matching is used to find previously identified CSAM, it cannot find brand-new CSAM because a fingerprint for it does not yet exist. Other providers use AI classifiers to search for “probabilistic” fingerprints, which identifies similarities between images rather than exact matches. These AI classifiers can generate “actual knowledge,” and their use can lead to CyberTip referrals even when the materials are not previously identified.

What Did the Ackerman Court Actually Decide?

In United States v. Ackerman, the facts showed that AOL used software that automatically scanned all user email for malware, computer viruses, and prohibited images, among other things. The software flagged several images that appeared to be illegal. Under federal law, AOL was required to report the apparent existence of this illegal material to NCMEC.

A NCMEC analyst then received the images, opened the user’s emails, and reviewed all four email attachments. The Tenth Circuit treated NCMEC’s opening of private correspondence as a “search.” It also treated the analyst’s review of the email attachments as a “search.”

As a result of those conclusions, the Tenth Circuit remanded Ackerman’s case to the district court for further proceedings. In those proceedings, the district court had to resolve the questions the Tenth Circuit expressly left open, including whether the third-party doctrine applied and whether the good-faith exception to the exclusionary rule barred suppression.

Importantly, United States v. Ackerman did not decide: (i) whether the NCMEC analyst’s actions required a warrant, and, (ii) whether the “searches” were conducted without justification. Consequently, while the Tenth Circuit’s remand left open the possibility that those “searches” should result in suppression, it never finally ordered that those “searches” be suppressed.

The Fourth Amendment has a significant impact when government agents, like NCMEC, act on the basis of a private party’s prior warrantless search. The Fourth Amendment protects your “persons, houses, papers, and effects, against unreasonable searches and seizures.” Digital devices and electronic information are considered “papers, effects, and other property.” As a result, the constitutional protections that the Supreme Court has confirmed apply to your “home and the ‘curtilage immediately surrounding the home’” apply with equal force to your private digital correspondence.

The Tenth Circuit’s treatment of the conduct in United States v. Ackerman is significant. While NCMEC’s analyst was justified in initiating a review based on the providers’ report, the Tenth Circuit correctly determined that going beyond mere triage and actually opening and reading correspondence could implicate the Fourth Amendment.

While the outcome of United States v. Ackerman is less than conclusive, its reasoning provides important guidance for future cases, particularly when NCMEC reviews content. In those cases, determining whether NCMEC is acting as a government agent will be critical. If NCMEC is a government agent, then its warrantless review of email attachments and other content could violate the Fourth Amendment.

Spodek Law Group, led by managing partner Todd Spodek, defends clients in federal criminal and white collar matters.

When Does NCMEC Exceed the Provider’s Private Search?

The private-search doctrine permits the government to repeat a search of files and other data that has already been searched by a private party without learning substantially more. However, as courts have repeatedly stated, “any additional search or seizure that exceeds the scope of the private search triggers Fourth Amendment scrutiny.”

While the private-search doctrine applies in all contexts, its application to digital data is not straightforward. For instance, “various courts have recognized that users have a significant privacy interest in the content of email stored by Internet Service Providers.” When a user has a strong privacy interest, the analysis of whether a subsequent search exceeds the original search is “critical.” In CyberTipline cases, opening only a flagged image is not the same as opening every image in an email message. While the latter may not result in learning substantially more information than the former, opening and reading attachments that the provider did not flag as illegal could easily exceed the scope of the provider’s prior search.

Email Attachments

Similar to opening flagged versus unflagged attachments, reviewing an email body is not the same as reviewing email attachments. In the same way that reviewing a user’s account metadata is not the same as reviewing the content of a user’s messages, it is also not the same to forward unopened material to law enforcement as it is to personally view its contents.

Private Search

In United States v. Ackerman, the private search conducted by AOL did not violate the Fourth Amendment. This private search involved scanning the user’s email account for malware, computer viruses, and CSAM. While AOL’s private automated scan may have triggered some privacy concerns, it fell within the scope of what users agreed to by accepting the service.

The issues in United States v. Ackerman arose when NCMEC, acting as a government agent, conducted a subsequent warrantless search based on the information that AOL provided. NCMEC’s analyst opened the email account holder’s files, reviewed all email attachments, and conducted his own search. When NCMEC performed its subsequent warrantless search, it arguably exceeded the scope of the original private search conducted by AOL.

The Tenth Circuit agreed in United States v. Ackerman. The Tenth Circuit affirmed that the NCMEC analyst opened the user’s email, viewed all four email attachments, and reviewed the email contents. The district court had concluded the opposite, that even if NCMEC were a government actor, its search did not exceed the scope of AOL's search in a constitutionally significant way, and the Tenth Circuit reversed that conclusion.

Accordingly, the Tenth Circuit held that “AOL never opened the email itself. Only NCMEC did that, and in at least this way exceeded rather than repeated AOL’s private search.” The Tenth Circuit held that the district court erred because NCMEC’s analysis was not just a confirmation of the provider’s automated scan. By viewing the email attachments, the NCMEC analyst, “opened Mr. Ackerman’s email first and did so before and in order to view not just the attachment that was the target of AOL’s private search but three others as well.”

Do Account Termination and Terms of Service Destroy Privacy?

Does the fact that a provider has technical access to its users’ email mean that these users have no email privacy? This is not the case. As a result of this conclusion, the Tenth Circuit found that users have a privacy interest in their email communications even though service providers have the technical ability to review them. In the Tenth Circuit’s words:

“An individual’s email account can store ten years’ worth of personal and professional communication. This constitutes what a person might leave in their house or their safe. So, even though their email service provider had technically the means to review and access their communications, they had reasonable expectation that these communications would remain private.”

Is this different if a user accepts Terms of Service that let the provider view emails? The Terms of Service for many providers have access clauses. For example, Google’s terms may mention that the company accesses emails for various purposes. These clauses can give the provider the legal authority to review email, and they can help the provider show consent to access. However, this does not automatically make it okay to let the government or a government agent view the emails too. The Tenth Circuit found that these Terms of Service did not eliminate the expectation of privacy.

Is the result different if a user violated the Terms of Service or closed the account? The fact that a user violated the Terms of Service by hosting CSAM did not mean that this user’s email account was no longer private. Moreover, the fact that the user closed the account raised the possibility that the account had been abandoned. But this did not, by itself, defeat the user’s Fourth Amendment standing.

Could consent or abandonment defeat a motion to suppress a user’s email content? These issues are very important in Fourth Amendment cases. With that said, even though these issues must be considered in all cases involving government access to email, they only defeat a motion to suppress when appropriate. If an accused, or their attorney, is able to show that a search was conducted without consent and without abandonment, and that this violated the Fourth Amendment, then the user’s email content can be suppressed.

The Supreme Court has stated that “the home is the ‘first among equals’ when it comes to the Fourth Amendment’s privacy protections.” As technology advances and more information is stored electronically, an individual’s email account and cloud storage are becoming part of their “virtual home.” This makes ensuring Fourth Amendment protection in digital cases extremely important.

Can Ackerman get CyberTip evidence suppressed in my case?

Even if we can apply the principles in United States v. Ackerman, this does not necessarily mean that the evidence in your case can be suppressed. In many cases, the good-faith exception prevents the suppression of unlawfully obtained evidence. The federal Supreme Court has not adopted the Tenth Circuit’s analysis of NCMEC, and more importantly, more recent CyberTipline and hash-matching decisions have narrowed, distinguished, or disagreed with the Tenth Circuit’s findings in United States v. Ackerman.

To seek to suppress the evidence in a CyberTipline case, our defense team needs to show:

(i) that the accused person had a protected privacy interest;

(ii) that the review of the accused’s digital account was conducted by NCMEC acting as a government agent;

(iii) that NCMEC’s review exceeded the scope of the provider’s private search; and,

(iv) that neither a Fourth Amendment warrant exception applies, nor is the government entitled to a good-faith objection.

As noted above, the facts in an individual’s case must be considered in light of their constitutional protections, and whether those protections have been violated is an issue that requires experienced counsel to assess. And, even if the defendant’s Fourth Amendment rights were violated, this does not automatically mean that suppression is warranted. However, there is still a substantial chance that the NCMEC search and seizure will be found unreasonable, and the government will be unable to justify the warrant exception under the Fourth Amendment.

A defense attorney needs to carefully review the facts in order to determine if suppression can be sought and a motion to suppress that can survive the government’s legal objections. With this in mind, you should not consider the evidence in your case to be automatically subject to suppression.

If you are facing allegations involving the download, transmission, or possession of CSAM, your first step should be to seek experienced defense counsel. A defense attorney will take a look at the case and determine how to proceed. If necessary, your attorney can seek to suppress the evidence in your case based on the relevant Fourth Amendment principles and the facts at hand. And, in those cases, challenging the government’s warrantless review of digital content and electronic devices will be a high priority.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.