Recovering Your Data After a CSAM Termination: What's Actually Possible.

In almost all cases, the provider has sent a report to NCMEC before sending the account-disabled notice to the user.

The statements you submit as part of your appeal can be used as evidence against you in federal prosecution. While this may seem surprising, Google’s appeal process and the law enforcement investigation proceed on separate tracks. Prosecutors can subpoena Google and obtain copies of any communications or appeal statements you provide.

Unlike other account content, CSAM evidence cannot be freely exported. While it may be possible to recover ordinary documents, photos, videos, and emails, you cannot request a copy of files categorized as CSAM.

Also, deleting files after you suspect you may be under investigation can create additional federal obstruction of justice exposure.

If your account content has triggered a CyberTip, what exactly will you be accused of is another matter.

While CyberTips can include various types of information, they do not always include an IP address, device information, a device’s GPS coordinates, and/or other device-specific identifiers.

Once CyberTips are received, they will be reviewed by federal authorities. In most cases, this review will lead to an investigation being opened.

But, the scope of the investigation, the types of evidence that have been preserved by the provider, and the evidence you need to defend yourself are all critical issues.

At Spodek Law Group, we can help you determine these questions and develop your defense strategies based on the facts.

Why Did the Termination Become a Criminal Investigation?

Under 18 U.S.C. § 2258A, providers have a statutory duty to report “apparent violations” of federal child protection laws to the National Center for Missing & Exploited Children (NCMEC). While providers have a reporting obligation under Section 2258A, they are not required to actively search their accounts. This means that a provider’s reporting obligation is generally triggered in one of two ways: either by detecting an “apparent violation” during a system scan or receiving an “apparent violation” in response to a request from law enforcement.

NCMEC is a non-profit clearinghouse that operates the CyberTipline. Although it is not a law enforcement agency and does not have the power to investigate, it is a clearinghouse that forwards CyberTipline reports to federal and state agencies that have investigative jurisdiction. The information that a provider includes in its report can vary greatly, and this information can include everything from (but not limited to) IP addresses, account identifiers, timestamps, filenames, file hashes, and other device-specific identifiers.

The duty to report under Section 2258A attaches when a provider has “actual knowledge” of an apparent violation. If, for example, a provider discovers an apparent violation as a result of a user’s account content appearing in a data loss prevention (DLP) match, it must then submit a report.

Depending on the case, reports received by NCMEC may be forwarded to the U.S. Secret Service, the Federal Bureau of Investigation (FBI), the Department of Homeland Security (DHS), and other agencies. These reports can also be forwarded to state and local authorities, including Internet Crimes Against Children (ICAC) task forces. All of this information is important when determining your potential exposures. If you are facing federal prosecution for child pornography, a key part of your defense will be challenging the information included in your CyberTip. We can help you do so, and help you convince the government to decline or dismiss charges.

What Recovery Paths Are Realistic After a Child-Safety Termination?

Reports suggest that users generally receive two opportunities to appeal child-safety-related account terminations. However, these reports are based on anecdotal experience and are not supported by any specific statements or policies from Google. While Google may (or may not) limit appeals to two, there is no statute or regulation that currently fixes the number of appeals that a service provider must allow, and Google’s documentation is silent as to the number of times a user may attempt to appeal an account termination. In one instance, an account termination in 2021 due to medical photos that appeared to be CSAM ended with the police determining that the photos were not CSAM. However, Google still refused to reinstate the user’s account. This instance illustrates that, although police clearance may sometimes be obtained, this alone will not guarantee that a user will be able to access their account.

If you sync your cloud data to your computer or mobile device, then locally synced copies of any files you stored on a cloud service will still be on your device(s) after the termination of your account. Similarly, recipients, collaborators, and the owners of shared drives will also retain their own copies of any files you have shared with them.

For users whose accounts are managed under Google Workspace, Google Workspace administrators (not individual users) are the ones who control data exports. For most Google Workspace users, requesting an account export directly from Google will not work.

Many state laws give users a right of access to their personal data (and, in many cases, right of modification and right of deletion). However, these laws almost all have exceptions for fraud prevention, cybersecurity and safety purposes, and legal compliance, three exceptions that a service provider is likely to assert when it declines a user’s right of access request after a child-safety termination. While it is possible that a request for access would allow for the recovery of data, the success of a request will depend on the specific circumstances of the case.

The General Data Protection Regulation (GDPR) is a European Union regulation that applies to companies that target EU-based users. Article 15 of the GDPR generally gives individuals the right to access and receive copies of their personal data (this is in addition to having a right to request a file transfer under Article 20). For users who reside in the European Union, this data access right can be invoked, and, again, the success of such a request will depend on the specific circumstances of the case.

Where Can Lawful Files Survive Outside the Account?

If you use a feature like Google Photos Back up, this feature automatically puts images on your phone into cloud storage. While this may be convenient, this feature also means that images you never intentionally stored on Google will make their way to the cloud in silence.

Similarly, while viewing images on a computer, your web browser may create a locally stored copy of the image that is cached to your computer’s storage. Your browser does this automatically so it can load the page more quickly the next time you open it.

Many mobile messaging apps do something similar, automatically caching copies of images, videos, and thumbnails on your device. And, if you have cloud synchronization enabled for your devices, files on the cloud will be copied onto devices not only that you have manually opened the file, but also that you have not. This includes images and videos that arrive on your phone from group chat media, including media sent without your consent.

Outside of your account, files that can appear from a mobile device’s SQLite databases include, but are not limited to:

• Messages,
• Messages that reference media content,
• Media that refers to content, attachments, images, thumbnails, and app-specific activity.

On iOS devices, the KnowledgeC records are one of the primary sources for reconstructing a timeline of how an app was used. KnowledgeC records include information about application usage, screen-shot captures, and events of other types, and so for an expert, these files can be invaluable for reconstruction purposes.

On Android devices, there are various types of UsageStats, that provide similar information to a KnowledgeC report in that they are an account of what was used when.

For those who are facing accusations involving child sexual abuse material (CSAM), the best defense is a custom-tailored defense that takes into account the fact that files in the cloud and files on computers and phones are not necessarily mirrors of each other. When defending against federal criminal prosecution, the evidence retrieved from your device, the evidence that has been preserved on the cloud, and the evidence that may (or may not) still be available to you, can all be used to defend yourself.

What Should I Avoid Changing While Trying to Save Files?

If federal authorities ask for your files, you do not have a free pass to delete them. Under 18 U.S.C. § 1519, destruction of records in connection with a federal investigation is punishable. If you learn that you are under investigation, changing your account’s deletion settings or copying data to a new storage device can make it look like you are trying to alter files, and these actions can change metadata as well. Similarly, if you perform a factory reset of your computer or phone, it won’t necessarily result in secure erasure of stored data, and it certainly won’t protect against federal charges for destruction of evidence under 18 U.S.C. § 1519.

If you reused a drive that has been involved in a federal investigation or one that you may have used to copy files to prevent them from being deleted during the investigation, this can also lead to liability. This is because it could breach your evidence-retention and chain-of-custody obligations.

Never lie to the federal government, and never lie to your defense counsel. Don’t lie about which devices you have used or about the files you know are in their possession. Your lawyer needs to know the facts in order to defend you effectively.

If a federal agent asks you about your account usage, statements like “my partner uses the account as well” can provide investigators with knowledge about potential intent to share or distribute prohibited content. Also, if you are being questioned, invoke your right to speak with your lawyer as soon as possible. Once this has happened, the investigator should stop the voluntary interview.

Lastly, do not voluntarily consent to the search of your device unless you first consult with your attorney. Consent searches generally leave no room to fight against the evidence retrieved, and, even if you suspect you may be guilty, an investigation still requires evidence that is legally obtained.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

Can Hashes, Caches, or Fragments Restore Missing Files?

A hash value is a unique numerical identifier (similar to a fingerprint) based on the content of a file. Even a minor change to a file, including rotating an image or changing its format, will result in a completely different hash value. However, many hashing algorithms, including PhotoDNA, are designed for perceptual matching to recognize the underlying content. While the underlying file content can change, for example, by resizing, cropping, changing brightness, or adding other image effects, the perceptual hash will remain the same. As a result, perceptual hashing algorithms have very different false-positive and false-negative characteristics than exact hashing algorithms.

While a hash value is created from a file’s content, it is a one-way hash, meaning it cannot be reversed. Even for exact hashing, having a hash value does not allow one to recreate the file from which it was generated. The same applies for partial file fragments. While some fragments may be identifiable as content, a partial fragment generally will not match the complete file’s exact hash, and having that match will not help recover the rest of the file.

These fragments are not necessarily recovered from caches, though. With the file recovery process, one of the challenges is to identify the remnants of deleted files. Deleted files can remain on a storage device indefinitely, or, they may be permanently lost once they have been overwritten. Because overwriting occurs when a user writes a file to a specific location on the drive, one cannot manually control which files get overwritten. This is why the success of recovering deleted files is unpredictable, it all depends on what the computer, mobile device, or cloud storage service has done since the files were deleted. In summary, recovering an original file from a hash is not possible, and recovering data from fragments and remnants can only happen when there is something to be recovered.

Can a Lawyer Make the Provider Preserve or Produce Data?

The Stored Communications Act prohibits service providers from disclosing the contents of communications to anyone who obtains a subpoena. This means, even with a subpoena, defense counsel cannot force a service provider to disclose account content. This is a significant disadvantage in many cases. In most cases, defense counsel will need to make discovery requests through the U.S. Attorney’s Office or a federal judge, and even then, this may require demonstrating specific need.

Although a service provider will not necessarily comply with a defense attorney’s subpoena, a governmental entity can make a request to preserve records under 18 U.S.C. § 2703(f). Such a request, known as a preservation request, asks the provider to store the subject’s records for 90 days, and can be renewed once for an additional 90 days. While a preservation request under Section 2703(f) is available to governmental entities, this is not a remedy that defense counsel has available to them.

If your lawyer subpoenas your friend or acquaintance who may have information relevant to your case, they can be compelled to testify. This does not apply to statements made to your lawyer, which are protected by the attorney-client privilege, unless the request for legal services was made with a viewpoint aimed at facilitating or concealing a fraud, crime, or tort of the client. The latter is known as the crime-fraud exception.

If you need to discuss sensitive information about your account termination and the associated criminal investigation, these should be discussions between you and your lawyer.

If federal authorities seek to seek a warrant or a subpoena to obtain account files and related records, or, if they take possession of files in connection with a search warrant, this is when a case will take shape and the defense strategy will begin to evolve.

If the government or the evidence preservation process leads to the bad-faith destruction of potentially useful evidence, this can lead to claims of a violation of due process. However, it remains extremely difficult to establish liability in these cases.

How Can Seized Devices Be Copied or Returned?

In most child pornography cases, a specific federal statute known as the Adam Walsh Child Protection and Safety Act restricts how CSAM evidence can be made available to a defendant. Under the Act, any evidence that is CSAM must remain in the “possession or control” of the government or a “properly designated repository” while the government maintains custody of the evidence as well.

The Act, however, specifies that the government must allow a defendant “reasonable access” to any material evidence that they wish to maintain for their defense, though the Act does not define what constitutes reasonable access. United States v. O’Rourke (9th Cir. 2005) is one of the cases that discusses this issue. The court held that, in O’Rourke, allowing the defendant’s computer forensics expert to view the files at a government facility satisfied the requirements of the Adam Walsh Child Protection and Safety Act.

If your computer was seized or your phone or tablet was seized, this is something that may be different from the case of files that are cloud-stored. If your device was seized in connection with a federal investigation, you can demand a copy of the seized device, but it is up to the government or court to determine how the evidence can be retained. This means that you should have a lawyer fight for a copy of your device. If you get a copy of your device, then your computer forensics expert can investigate files on the device, including hashes, and other artifacts, without need to receive the CSAM evidence.

The evidence that may be withheld, for example, when it is not designated as CSAM, will be subject to rules such as those in Brady v. Maryland, 373 U.S. 283 (1963). The government cannot suppress any material, exculpatory evidence that is favorable to a defendant. The withholding of any material exculpatory evidence can give rise to a claim for a new trial.

With digital evidence, even withheld files, fragments, and metadata artifacts may be exculpatory or at least probative of an accused person’s lack of culpable mental state. These files may also be used as a comparison or baseline when analyzing other files or artifacts. For example, comparing access logs to time of delivery or possession artifacts can be critical in some cases.

Under Federal Rule of Criminal Procedure 41(g), if the government has not returned a device seized in connection with a criminal investigation or investigation that did not result in a conviction, you can file a motion with the court that ordered the warrant. If the government holds a device after a case has ended, there may be additional arguments for the return of a device.

How Long Can an Investigation Delay Data Recovery?

If you have received a CyberTip, there are several ways in which an investigation can be delayed. First, as with a search warrant, agents or law enforcement can seize your phone or computer or other devices that are in their possession. Also, they can seize your accounts’ passwords, and other similar credentials, along with your cloud accounts. This happens regardless of whether the cloud accounts are the ones that triggered a CyberTip.

With the devices and cloud credentials in hand, the next step is forensic analysis. Depending on the size and type of the device being examined, this will take anywhere from several weeks to several months. In most cases, it is one device. However, it is possible that multiple devices are at issue. This increases the time needed to complete the analysis.

Federal CSAM investigations can range from a few months to several years. In some cases, a case may result in charges, and in some cases, no charges will be filed. While some districts allegedly have more limited capacity and may have a wait time of nine months before an examination even begins, others can complete an examination much more efficiently.

If you are a target of an investigation, it is not necessarily the case that the grand jury proceeding or investigation will eventually lead to charges. However, these proceedings are secret until a federal judge issues a warrant or the prosecutor charges someone. And, remember that with respect to felony offenses under Chapter 110, there are no limitations periods (18 U.S.C. § 3299). This means that, for example, if you may have committed an offense under 18 U.S.C. § 2252A, federal investigators will be able to pursue you as long as they want.

For those interested in the general conviction rate for CSAM cases, the numbers in many reports of aggregate federal conviction rates do not tell us anything useful. As the CyberTips data shows, for each case that is formally filed in court, there are hundreds of additional cases that are not reported.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.