What a Supplemental CyberTip Means and Why It Speeds Your Case Up.

Last Updated on: 4th August 2026, 01:33 am

A supplemental CyberTip is a later submission concerning the same online account, incident, or device as an earlier submission. When filling out a CyberTipline report on the National Center for Missing & Exploited Children (NCMEC) website, a reporter can designate the report as a “supplemental” submission by referencing the report number from the original CyberTip.

If NCMEC considers the report a valid supplement, it will link the supplement to the original file rather than treating it as an unrelated CyberTipline intake. As a result, a supplement typically has the effect of prompting renewed NCMEC review and investigative triage of the original report.

In the United States, NCMEC operates the nation’s centralized CyberTipline reporting system. With its network of designated social media, internet service, and other online-service-related reporting partners, the CyberTipline collects information regarding eight categories of suspected child exploitation:

• Online enticement of children for sexual acts
• Child sexual molestation
• Child sexual abuse material
• Child sex tourism
• Child sex trafficking
• Unsolicited obscene materials sent to a child
• Misleading domain names
• Misleading words or digital images on the internet

Once a reporter or online partner submits a CyberTip to the CyberTipline, NCMEC reviews the report before making it available to law enforcement. In addition to reviewing CyberTips, NCMEC also provides crisis assistance, outreach and education for online safety, and other support services, including making local counseling referrals for victims and their families.

What Triggers a Supplemental CyberTip on my Account?

There are five primary ways that a supplemental CyberTip can be generated during the course of an investigation involving the U.S. Department of Justice or other law enforcement authorities:

I. Retrospective Account Review

After the initial CyberTip has been received, the electronic service provider or platform that flagged the account may also conduct a retrospective account review. As explained above, accounts may contain other material and information that trigger supplemental CyberTipline reporting as well, especially if the account has been active for a long time.

II. Later Uploads Matching Known Hashes

The same hash-matching technology that may be used during an initial CyberTip submission may be used by the electronic service provider to identify material uploaded to the account at a later date. This, too, may result in the filing of a supplemental CyberTip submission which is then linked to the original reporting record and made available to law enforcement.

III. Discovery of Linked or Alternate Accounts

The electronic service provider or platform may also discover linked or alternate accounts. If the related account contains content or other information that triggers a CyberTip submission, this information can also lead to the supplemental reporting of additional material and information.

IV. Law-Enforcement Request Routed Through NCMEC

The NCMEC system also processes requests from law enforcement. If law enforcement discovers additional material or information during the course of its investigation, this information may be routed to the relevant electronic service provider via NCMEC. In response, the electronic service provider may submit supplemental information and information concerning other content and communication on the account that are pertinent to the investigation.

V. Platform’s Response to a Preservation Demand

An electronic service provider may also conduct a supplemental investigation of an account in response to a federal preservation demand. With the issuance of the 2024 REPORT Act (i.e., “H.R. 7904”), the statutory authority for this action is found in the updated 18 U.S.C. § 2258A(h), which provides a preservation period of one year rather than the 90 days previously allowed. As result, supplemental CyberTip information frequently arrives during the one-year statutory preservation period.

Who Submits a CyberTip?

In addition to electronic service providers and online platforms, members of the general public and law enforcement authorities are able to submit CyberTips to NCMEC as well. The information submitted to NCMEC will be reviewed and forwarded to the U.S. Department of Justice and other law enforcement agencies if it is determined to be relevant to a law enforcement investigation under the guidelines governing NCMEC’s relationship with the Department of Justice.

What Information About Me Does a CyberTip Report Actually Contain?

In many cases, a CyberTip report received from a platform that conducts content review will refer to a suspected offense without identifying the users involved or describing the conduct that allegedly triggered the submission. In these cases, CyberTip records received by law enforcement will only include the information that the reporting platform may provide (if it provides any). This will include information such as:

• Subscriber names, usernames, email addresses, phone numbers, birthdates, and other contact information that may help to identify the involved account(s)
• IP addresses, timestamps, and port numbers that can be used to connect a device used to communicate or publish content with particular users and service activity
• Message histories that may substantiate alleged enticement, prior conduct, and/or planned offenses
• IP addresses and timestamps that identify when users logged on to and off of a service or other data
• Search queries that may also help to substantiate a user’s knowledge and intent
• User-created content that includes images, videos, and messages

CyberTip records will also distinguish between reporting information that is supplied by the reporting provider and additional information that NCMEC has inserted based on its own research or other reports received from the public or law enforcement.

In light of the fact that federal law does not mandate particular information fields within CyberTipline reports, the extent of a user’s identifiable information on a CyberTip report is at the discretion of the reporting platform and NCMEC. Consequently, while NCMEC cannot control which particular details providers include in the reports it receives from platforms and others, NCMEC must make each report and all supplemental data included in the report available to the law-enforcement agencies identified in 18 U.S.C. § 2258A(c).

Can a Supplemental CyberTip Revive an Informational Report Months Later?

When NCMEC receives a CyberTip, it will label the report either as a referral for investigative consideration or as informational. A referral for investigative consideration is a report that is determined to have sufficient actionable information to warrant an investigation. A report that is not determined to have sufficient actionable information to warrant an investigation will receive an informational designation.

When police agencies receive informational reports, this designation will serve as a warning to investigators that the report may not currently have sufficient information to support an investigative response. This typically occurs in one of two scenarios:

• There is no evidence of an association between the user of a device and a nexus to specific child exploitation offenses.
• The jurisdictional identity of the user cannot currently be determined and the report is not associated with a referral that has already been sent to an ICAC Task Force and/or law enforcement agency.

NCMEC also designates reports received for material that has been widely circulated on the internet as informational. This is because it is not possible to distinguish users who shared material with the intent to harass or bully, commit a child exploitation offense, or share it for the sake of outrage or humor. This includes material shared to alert others to the issue or in an effort to combat child sexual abuse.

How Does This Affect ICAC Triage?

With their review of CyberTip cases, an ICAC investigator or other law enforcement official will give particular attention to the triage process. When an informational CyberTip that is queued will be associated with a supplemental CyberTip, if the supplemental CyberTip adds any new actionable information, this new information will raise the original report’s priority during triage.

This process will take priority in the following scenarios:

• Identification of a suspect or user
• Identification of the suspect’s location
• Identification of an actionable investigative lead
• Discovery of an associate or other information that may identify an associate’s location
• Identification of a child and/or adult in a situation involving exploitation or victimization
• Identification of an incident or other situational evidence
• Identification of content or other information that may point toward an investigative lead or a potential suspect or user
• Identification of a new device that is being used to share content or communicate with others
• Identification of other content or other relevant information

When an informational CyberTip is associated with a supplemental CyberTip that makes it possible for an ICAC investigator or other law enforcement official to take the informational report out of the queue and designate it as an investigative referral, this is common.

Todd Spodek is the managing partner of Spodek Law Group, a second generation criminal defense firm that has been practicing since 1976.

How Does a Supplemental CyberTip Speed Up a Federal Investigation?

A CyberTip is typically routed to state ICAC affiliates and the FBI’s field offices, or Homeland Security Investigations (HSI), depending on the specific type of suspected offense. In many cases, it is then routed to federal authorities that are working together in local and regional task forces. Once the referring agency receives a referred CyberTip, it will assign the CyberTip to an individual investigator who will begin an inquiry to ascertain whether the information in the referral is actionable and can be supplemented by other information gathered from sources both within and outside the United States.

In many cases, a supplemental CyberTip provides information and data that would otherwise require the issuance of subpoenas. For example, providing the subscriber’s name, email address, phone number, username, and account records allows an investigator to proceed without first issuing a subpoena to the platform that provided the information. Similarly, providing the assigned IP address and the timestamp, the timestamp of use, and the port may allow an investigator to proceed without first issuing a subpoena to the corresponding internet service provider (ISP). The issuance of a subpoena to a platform is only an initial step for federal investigators. Many cases would not proceed to law enforcement investigators unless that information is provided by the user’s ISP as well.

What are the Next Steps for Investigators Who Receive CyberTips?

The use of a supplemental CyberTip accelerates the investigative process because investigators who receive detailed CyberTips will often already have a user’s subscriber records, IP logs, relevant messages, and other pertinent records. Once an investigator has these records, he or she will then take any steps that are necessary to identify the subject’s device, determine the subject’s location, and begin to build a case against that individual.

In the case of reporting providers, NCMEC analysts will try to provide a user’s location to the appropriate police agency. In addition to providing CyberTips to law-enforcement agencies in the United States, NCMEC may also provide CyberTips to law-enforcement agencies outside the United States, as well. This may be done when the information on a CyberTip, the data on a supplemental CyberTip, or the data from the internet service provider points toward an international investigation. In such cases, this information will then be routed to the U.S. Department of Justice (DOJ), the FBI, and other agencies to be used in conjunction with investigations involving foreign counterparts.

Can a Supplemental CyberTip Lead to More Serious Federal Charges?

Pursuant to 18 U.S.C. § 2258A, online service providers in the United States have a reporting duty to NCMEC. The statute states, “A provider shall, as soon as reasonably possible after obtaining actual knowledge of any facts or circumstances from which there is an apparent violation of section 2251, 2251A, 2252, 2252A, 2252B, or 2260 that involves child pornography, or an apparent violation of section 1591 (if the violation involves a minor) or 2422(b), submit a report to the CyberTipline of the National Center for Missing and Exploited Children....” The statute further identifies specific offenses that trigger an online provider’s reporting duty: “The term “provider” means an electronic communication service provider or remote computing service....” The 2024 REPORT Act modified the statute to include online enticement and child sex trafficking.

Online enticement generally involves adults communicating with children for sexual purposes, including but not limited to sexual images, files, and chat logs. If a platform provider submits a CyberTip with content as evidence that suggests the production, possession, or distribution of CSAM, but further material that is subsequently shared in a supplemental CyberTip submission supports a charge for the receipt, distribution, production, or enticement of CSAM, federal investigators will rely on these additional allegations during prosecution.

According to data compiled by NCMEC, online enticement accounted for 44,155 reports in 2021, a small fraction of the roughly 29.3 million reports of child sexual abuse material received that year. The number of online enticement reports increased from 2021 to 186,819 reports in 2023. For the first time in the CyberTipline’s history, reports for online enticement exceeded 546,000 reports during 2024, which represents a 192% increase from 2023. This may suggest that parents and other adults are more vigilant online or that platforms have enhanced content review and enforcement policies.

Can a CyberTip Identify the Wrong Person in a Household?

A VPN is a tool used to encrypt and anonymize a user’s IP address. When a user activates a VPN, it connects to a remote server that assigns the user a new IP address. This allows the user’s device to communicate and share data in a single and anonymous tunnel, concealing the user’s activity and location from third parties. When a VPN user engages with an online account or platform, the IP address logged on the account will match the VPN’s exit node address. Unless the law enforcement agency can obtain the VPN service’s logs, the user’s location will remain unknown and anonymous. Similarly, a CyberTip that contains a shared household or business IP address will not be able to identify the individual user. A compromise of the account, or the transferring of the account’s control to another user or device, may lead to the misidentification of the person responsible for the reported activity.

When Is a CyberTip Sufficient on Its Own?

A single CyberTip does not necessarily represent a single victim, a single offense, or a single suspect. While some CyberTips are highly detailed and sufficient on their own to help police identify a victim, suspected offender, or other pertinent details, some others only contain the type of hash used to identify a file. The hash of a file is a string of characters that functions as a digital fingerprint and can identify who accessed, controlled, or shared the file. In some cases, however, the hash match alone will be insufficient to identify who controlled a particular account or device. Because of this, police and prosecutors are required to independently verify all information that is contained in any CyberTip before concluding an investigation or pursuing criminal charges against an individual.

Can My Lawyer Get Every Supplemental CyberTip in Discovery?

With the CyberTipline, if the review conducted by a government agency exceeds the review that was conducted by the electronic service provider that filed a private search report, it may violate the Fourth Amendment. While some federal appellate courts have stated that a reporting platform’s private search report that lists a covered file or specific information cannot be further investigated by federal law enforcement, others have stated that federal agents can use a CyberTip report for any type of further investigation and analysis.

For CyberTip reports involving a supplemental submission, the issue arises when the federal agent or other law-enforcement official determines whether the information provided on the supplemental CyberTip was also provided on the report that triggered the original investigation. When NCMEC adds supplemental information to a CyberTip, the issue arises when the information is supplied by the NCMEC analyst and if NCMEC has, or has partially been acting as a government agent in the collection and reporting of the information on behalf of the agency that is conducting the investigation.

Do I Receive a Copy of My CyberTip Report?

No, you will not automatically receive a copy of the report on which you are suspected to have participated in a crime or civil wrong. Unlike a criminal arrest record, a CyberTip record is not public, and as such, is not subject to a Freedom of Information Act (FOIA) or Privacy Act request. Instead, defense counsel generally obtain CyberTips through the prosecution’s production of these records in discovery, and not directly from NCMEC.

Defense counsel can identify all linked supplemental CyberTip reports by the report number. Each CyberTip report has a report number and, if filed as a supplemental submission, it will have the report number cross-referenced. Defense counsel should also look for fresh timestamps on the supplemental CyberTip, as a fresh timestamp may diminish the staleness of the CyberTip’s content in the subject’s warrant affidavit.

Does NCMEC Need to Make Every CyberTip Available to Law Enforcement?

Yes, the law is clear in this regard, and NCMEC makes every report available. The statute that creates NCMEC as a repository of CyberTips, 18 U.S.C. § 2258A(c)(2), states:

“In performing its duties under subsection (b), National Center for Missing and Exploited Children shall make all reports it receives available to law enforcement and shall disseminate them in accordance with the policies of the Department of Justice and other relevant federal authorities.”

As the statute also states, this duty of making CyberTip records available for law enforcement includes disclosing the content, subscriber names, usernames, email addresses, phone numbers, IP addresses, and timestamps of use, along with any other identifying information which the reporting platform provides on the CyberTip report.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.