Microsoft Closed My Account After a PhotoDNA Match: What Happens Next.

Microsoft Closed My Account After a PhotoDNA Match: What Happens Next If Microsoft

(or another platform that uses PhotoDNA) detects a match, this will ordinarily trigger a report to the National Center for Missing and Exploited Children’s (NCMEC) “CyberTipline.” This CyberTipline report will contain the information that the platform has, and that the platform has chosen to share. Here, too, the key question is whether Microsoft is in possession of any content that is (or is not) prohibited under the law, and what it can do about it. When Microsoft detects a PhotoDNA match, it will disable the associated account. This happens regardless of whether the account holder (or anyone else) is aware of the match. When this occurs, the individual who lost access to their account typically cannot access the files or information that resulted in the ban. As a result, it can be extremely difficult for individuals to determine why their account was closed in the first place. But, as noted above, the problem is not to get access to the account, the problem is what to do with a potential CyberTipline report. A CyberTipline report from Microsoft will trigger the same steps as a CyberTipline report from any other platform: it is neither an indictment nor a conviction. At this stage, Microsoft’s investigation is complete. The next steps, as detailed below, involve Law Enforcement, not Microsoft. We want to emphasize two important points: (i) a Microsoft account restriction does not necessarily mean that a CyberTipline report has been filed, and (ii) a Microsoft account restriction does not necessarily mean that any human being at Microsoft (or anywhere else) has viewed a flagged file. As with many other platforms, the automated system can disable the account and ban the user before an employee reviews the flagged files. Also, even if it is determined that the PhotoDNA system flagged an innocent file, Microsoft will not automatically restore the ban.

Does a closed Microsoft account mean NCMEC reported me?

Yes. As a possibility, this is a concern. The fact that Microsoft has not yet provided access to its suspected illicit content repository (and has not yet confirmed that it is providing access to its records) makes this fact difficult to determine. However, successful appeal of a suspension or account reinstatement does not establish the fact that Microsoft (or Microsoft’s contracting partner) has not filed a CyberTip, and filing a CyberTip does not establish the fact that the account will not be reinstated (or will not be reinstated for other reasons). Here, too, the two stages need to be considered separately.

Will Microsoft disclose the records and evidence to NCMEC or Law Enforcement?

This is entirely a matter of how the law applies to Microsoft’s specific situation, and as a result, this will be a specific issue in any CyberTipline-related investigation. This question is not about whether the image (or images) is (are) prohibited under the law; this question is about whether Microsoft has preserved the relevant information and how much of Microsoft’s investigation it is legally required to share with the authorities.

The law requires providers like Microsoft to do both, but, as we noted, Microsoft may not have’s preserved the information it was required to preserve. Microsoft can also use all of the factual and legal defenses available to Microsoft to minimize the amount of information it is required to provide.

This is an issue we frequently see in cases involving other forms of online content enforcement, and it is an issue that is important to get right. In fact, it will be important to get right regardless of whether Microsoft, Google, Amazon, or another service provider is involved.

What should I do if I have been detained by law enforcement in connection with my Microsoft account?

If you (or your spouse, partner, child, or family member) have been detained by law enforcement in connection with a Microsoft account, you should contact a member of our legal team. We will be able to give you an initial assessment based on what you tell us, and if necessary, we will be able to quickly get to work on your case.

What information will be available to NCMEC and law enforcement from a Microsoft CyberTip?

We noted above that “a CyberTipline report from Microsoft will contain the information that the platform has, and that the platform has chosen to share.” Here, too, this means that “the information that the platform has” is a subject of inquiry. If the platform had (or should have had) the information, and that information is pertinent, it is very possible that the information could be compelled. Can I request my account records from Microsoft or any other platform in order to clear up misunderstandings before filing a CyberTipline report? The law does not require providers like Microsoft to share their information with users who have raised concerns, and the law specifically imposes a duty of confidence in the case of suspected illicit content.

If a problem arises out of Microsoft’s use of PhotoDNA (or any other detection tool), you should focus your efforts on the next steps in the process.

How long can a CyberTipline investigation take?

The CyberTipline is an initiative by the National Center for Missing & Exploited Children (NCMEC). Under 18 U.S.C. § 2258A, NCMEC operates a “CyberTipline” dedicated to receiving reports of apparent violations of federal child pornography laws by “electronic communication service providers and remote computing service providers.” Providers like Microsoft, Google, and Amazon have an obligation to report suspected violations of these laws to the CyberTipline. NCMEC reviews these CyberTipline reports and forwards them to the relevant law enforcement authorities, generally the agencies in the person’s (or the device’s) jurisdiction. This referral process typically goes through an Internet Crimes Against Children (ICAC) task force or sometimes the Internet Crime Complaint Center (IC3), with files eventually making their way to the relevant district attorney’s office or the U.S. Attorney’s Office (USAO). Once received by law enforcement, CyberTipline reports are typically used to initiate a criminal investigation.

How long does this take?

As to how long it takes for a CyberTipline report to trigger an investigation by law enforcement (and potentially an indictment), it can be extremely difficult to determine. Federal law does not establish a deadline for investigating CyberTipline referrals, and there is a wide range of reasons why investigations could move quickly or take more time. A few of the factors determining the time between an investigation referral and an indictment or criminal prosecution include: - (i) when the law enforcement agency receives the referral from NCMEC

• (ii) urgency
• (iii) date of discovery vs. date of activity
• (iv) the volume of other referrals
• (v) other investigative priority

  What obligations do electronic service providers have under U.S.C. § 2258A?

  Along with the duty to report “apparent violations,” electronic communication service providers and remote computing service providers have a duty under 18 U.S.C. § 2258A to “make best efforts to preserve” all applicable information. This is a mandatory duty that is triggered automatically by the provider& #x27;s own completed submission of a CyberTipline report, which the statute treats as a request to preserve the contents provided in that report. Originally, this preservation obligation was limited to a 90-day period. However, the REPORT Act (and related statutes) extended this period to one year. This extended preservation window allows law enforcement authorities to review the initial reports from NCMEC and determine if further information, search warrants, or other law enforcement interventions are necessary to pursue an investigation. Do police need a warrant after a PhotoDNA match

  Will the police seek a search warrant from Microsoft before filing charges?

  Not necessarily. In many cases, investigators will first issue a subpoena for the subscriber record associated with the account. If an image was uploaded, agents will likely obtain a search warrant for the image (and potentially a search warrant for other stored files) later in the investigation. While receiving a CyberTipline report does not authorize agents to enter someone’s home, receiving a search warrant does.

  How do agents establish probable cause in order to obtain a search warrant?

  To obtain a search warrant, agents must establish probable cause by demonstrating a significant likelihood that a law-violating image (or images) will be found in the specified location. Along with establishing the likelihood that the image (or images) exists, agents must also show that the location to be searched is connected to the image (or images) in question.

  Can investigators’ delayed application for a search warrant lead to a successful challenge to the warrant’s validity?

  Yes. Because the probable cause for an image search is often predicated on the detection of a law-violating image, any significant delay between detection and application for a search warrant can create the problem of staleness. This is an issue that we routinely raise when defending targets of CyberTipline investigations.

  Does PhotoDNA’s scanning of a user’s files constitute a “search” under the Fourth Amendment?

  Generally, the Fourth Amendment does not apply. The Fourth Amendment regulates government searches, and the private search conducted by Microsoft (or other service providers using the PhotoDNA detection tool) is conducted independently. Because Microsoft is not conducting its PhotoDNA scan for law enforcement, it is not subject to constitutional restraints.

  Can law enforcement present evidence to a court without a warrant if it was originally uncovered by a private search?

  Generally, yes. In United States v. Jacobsen, 466 U.S. 109 (1984), the Supreme Court held that “the Fourth Amendment does not prohibit a government agent from relying on a private search conducted independently.” However, the search conducted by the government agent can only extend so far. With regard to the private search doctrine, “a governmental search that goes beyond the scope of the private search may independently violate the Fourth Amendment.”

  Do law enforcement agents need a warrant to search a user’s computer for matched images?

  In most cases, yes. Obtaining a warrant to search a home is one thing; obtaining a warrant to search the home’s computer equipment for specific files is another. However, the extent to which law enforcement must obtain a warrant to search the computer for specific files is a complex issue, and the answer will depend, in part, on whether the search occurs within federal jurisdiction or not.

  Can the content of a CyberTipline

  report be used as evidence in a criminal case, and can a report establish probable cause to support a search warrant? Yes. The contents of a CyberTipline report from a service provider can constitute evidence (and this evidence can be admissible at trial), and this evidence can be used to support probable cause to seek a search warrant. Along with establishing probable cause for a search warrant, CyberTipline reports can establish probable cause for other law enforcement interventions.

  What should I do if agents contact me?

  If agents contact you about a potential PhotoDNA match, you have two options:

• (i) Agree to assist the investigation by voluntarily consenting to a device search or providing a statement.
• (ii) Politely decline to consent and ask to speak with your lawyer. Both of these options are, in certain circumstances, legitimate and strategic choices, but each carries its own set of risks and potential consequences. If agents are seeking a voluntary device search, you can refuse the request. If agents have a search warrant, then their search does not depend on your consent, and you have no reason to refuse. If agents are seeking a voluntary interview, you can decline substantive questioning about an accusation. You can consult with your lawyer before deciding whether to proceed.

  What if agents don’t have the support of a search warrant?

  If agents seek to search a device in your possession, they will likely either (i) seek your voluntary consent or (ii) present a search warrant. If they do not have a search warrant, and they are seeking your consent to search your device, you can refuse to consent. While it will be true that “they’ll get a warrant anyway,” you can make it clear that you are not prepared to volunteer anything that could lead to the issuance of a warrant.

  What if agents have a search warrant?

  As we discussed above, if agents present a search warrant, they have legal authority to execute that search regardless of your consent.

One of the critical questions that arises in most cases is: Who accessed the account and accessed the allegedly illicit images? We will obtain documentation concerning Microsoft account access, including Microsoft account notices, billing records, security logs, and computer security logs.

What if I just throw away my device?

Obviously, if you throw away the device that agents are looking for, this will be taken as evidence of guilt in many cases. Throwing away the device will also destroy potentially crucial evidence that you would need in order to provide a compelling attribution defense.

What does a PhotoDNA match actually prove?

A PhotoDNA match proves that a hash match occurred. A PhotoDNA match identifies the identity (or the similarity) of the content that was present in a user’s account (or connected device). Along with these findings, a PhotoDNA match (and any associated CyberTipline report from a service provider) does not identify the user (or users) responsible for uploading the content, nor does it establish a user’s knowledge, intent, or control.

What is the difference between an ordinary hash match and a PhotoDNA match?

An ordinary (exact-file) hash is an ordinary digital signature. If you change one pixel, one bit, or one byte in a file, an ordinary hash changes. Microsoft’s PhotoDNA creates a “perceptual hash.” This hash is a “perceptual signature” that is designed to be “nonreversible.” The nonreversibility of the perceptual signature allows PhotoDNA to recognize known images even if they have been resized, compressed, or other minor alterations.

Can PhotoDNA detect entirely new types of known illicit content?

No. PhotoDNA detects known illicit content. Its sole function is to recognize known content that has already been identified.

Does the fact that a user’s content matched a PhotoDNA hash prove that the user is guilty of possessing illicit material?

No. As noted above, a hash match (whether it is an ordinary hash match or a PhotoDNA match) does not identify the person responsible for the upload, and it can’t independently establish this person’s knowledge, intent, or control.

Our team handle matters reviewing the types of records that come from PhotoDNA matches. This includes everything from exact hashes, PhotoDNA scores, and other “classifier” scores to evidence of human review. In all cases, we can assess the probative value of these records, and we can use this experience to formulate appropriate challenges when necessary.

How reliable are PhotoDNA (and other perceptual hashing) results?

Whether a perceptual-hash match can be considered reliable, this depends, in particular, on the threshold set by the provider, how the provider implemented the PhotoDNA detection tool, and what reference database (if any) the provider is using.

PhotoDNA was originally developed at Dartmouth College. In 2009, Microsoft adopted PhotoDNA for use in its own content detection system and donated the rights for other technology companies to use PhotoDNA free of charge. Microsoft continues to support the project, and PhotoDNA is currently used by almost all major online service providers in the United States.

How do lawyers fight attribution and charges?

As we noted above, a hash match does not establish the user’s knowledge, intent, or control over the image(s) that matched. But an IP address does not identify the person responsible for the upload; rather, an IP address identifies a connection made through the network.

How often can a device’s owner be exonerated, even if the device was used to upload illicit content?

Possessing the device does not establish that you knowingly controlled the file that produced the match. As noted above, device ownership is not necessarily sufficient to establish that you uploaded the image (or images) in question. A computer, phone, or another device in a home may be shared, and if multiple people have access credentials, this creates attribution problems for the government.

Another possibility is a remote computer access scenario, where malware or another form of remote-access software makes it possible for someone else to upload images to your computer. In this situation, also, the device owner’s role is likely far less significant than the person who downloaded the malware, the person who controls it remotely, and the person who utilized the connection to upload the illicit content.

Does accessing an illicit image on a computer a times establish possession?

Another common issue is the automatic synchronizing of cloud-storage accounts. If the image is stored in a user’s account, the synchronizing software will typically automatically copy that image to every device the user has registered in the account, and this can take place without the user’s deliberate act of downloading the image.

What does “possession” mean for purposes of civil or criminal liability?

Generally, civil and criminal liability require possession. Possession of illicit content is typically determined by showing (i) a user’s practical ability to access (or a user’s practical ability to access and destroy) the illicit content and (ii) the user’s knowledge that the illicit content exists in his or her possession.

If you do not have a practical ability to access or control the image (or images) and/or you do not have knowledge of the image (or images), then you have not established possession, and this is a complete defense.

What is the difference between the receipt, distribution, and production of illicit content?

Receipt, distribution, possession, and production are all separate offenses with different elements. As a result, each of these offenses requires a unique mental state, and the government must prove the appropriate statutory mental state in each case.

How can this information be used to fight the charges against me?

As noted above, an attribution defense can establish (i) lack of possession and (ii) lack of a criminal mental state. We will be able to use the documentation concerning Microsoft account access and device access that we can obtain from providers and from forensic analysis to formulate a compelling attribution defense for our clients as the specific facts and circumstances dictate.

Talk to Spodek Law Group

Every case turns on its own facts, and general information is no substitute for advice about yours. Todd Spodek, managing partner of Spodek Law Group, and the firm& #x27;s attorneys defend federal criminal and white collar matters nationwide. Reach the firm at 212-300-5196.