Which FBI Field Office Gets Your NCMEC Report and Why Your IP Decides.

Your home address does not necessarily control the routing of a CyberTipline report to a specific FBI field office, federal prosecutor, or local law enforcement agency. Instead, the information available to NCMEC at the time of the report’s upload, or the information included with the report, plays a much larger role. In a CyberTipline report based on your IP address, your upload-time IP information may be used to determine jurisdiction. An IP address by itself, however, does not dictate which FBI field office, US Attorney’s Office (USAO), or local law enforcement agency is assigned to investigate your case. When a report is submitted to NCMEC, if there is enough jurisdictional information included to warrant referral to a specific field office, that report is routed to the relevant authorities. If there is not enough information, the report is referred to a field office as necessary.

Similarly, being listed as “available” within NCMEC’s Case Management Tool does not mean the case has been assigned to a named FBI field office. It just means that NCMEC has determined that referral to an FBI field office is appropriate. The same, again, is true of referrals to local law enforcement. If there isn’t enough jurisdictional information for NCMEC to refer a report to a specific agency, the report is assigned at a later date if and when the assigned FBI agent or USAO decides that appropriate.

NCMEC launched the CyberTipline in 1998 as a means for members of the public to report suspected child sexual exploitation and other similar crimes. It serves both as a means of receiving, reviewing, and analyzing reports by the public and reporting mechanisms by electronic service providers (ESPs), such as Microsoft, Google, Meta, and others. Today, most CyberTipline reports come from ESPs.

Which IP address in a CyberTipline report determines the location?

A report submitted to NCMEC by an electronic service provider (ESP), such as Microsoft or Google, will often contain multiple IP addresses. Each IP address will be associated with a separate event such as:

• Creating the account;
• Logging into the account;
• Uploading the files at issue; and
• Messaging and other account activity.

NCMEC passes all of this information along to the FBI. FBI investigators then rely on commercial IP geolocation services, which are notoriously inaccurate. These services often identify a location associated with a provider gateway, a corporate office, a network hub, or the location of a server rather than a particular physical residence. Commercial geolocation data can be stale, it can be an approximation, or it can be limited to the city of a network hub. These factors make commercial geolocation tools incapable of pinpointing a suspect’s physical address, and can easily lead to the misrouting of a report.

Traffic from mobile phones, T-1 lines, VPNs, and TOR nodes is even more difficult (if not impossible) to geolocate. In these cases, the FBI’s routing decision is driven by whatever information is available. For example, if an IP address is not listed, or if it does not lead to a specific city, the report will go to the provider’s head office. From there, the FBI will use the provider’s information to send the report to the appropriate regional office.

Once the FBI receives a report, identifying a person using an IP address requires more than just a geolocation tool. Finding a suspect’s physical address requires more information and the issuance of a legal process (such as a subpoena).

The FBI will seek to identify a suspect’s IP address from the report. Once they have it, they will then seek to identify the owner of that IP address from the provider that provided the IP. With that in hand, a federal prosecutor will issue a subpoena to the provider to identify the physical address of the person associated with the IP. This subpoena must reference the exact IP address, the exact date, the exact time, and the correct time zone (UTC or otherwise) during which the suspected activity occurred.

Providers only retain their logs for a limited amount of time. This means that if the investigation does not proceed quickly enough, the log entries needed to confirm a user’s physical address may no longer exist. In that case, identifying a specific user or location associated with an IP address becomes impossible.

The FBI’s determination of an IP address’s location can only be refined after the subpoena is served. At that point, the FBI will use the subscriber information obtained through the subpoena to determine the physical location of the user at the time of the upload. If the location is in a different jurisdiction than the FBI had previously determined, the FBI can then reroute the report to the appropriate office.

The FBI also routinely subpoenas providers for the location, time zone, and other metadata of the IP addresses and the physical location of the routers involved. When this metadata is combined with the IP geolocation data, the FBI can be more certain about the specific user and physical location involved in the alleged crime.

Can a VPN or shared IP address misroute my NCMEC report?

VPNs, Tor, and proxy services, as well as mobile devices, T-1 lines, and home-based wireless routers, all have the ability to obscure an IP address. These technologies will often place apparent activity far from the actual user, and an FBI field office’s initial attempt to identify the location of an IP address using a commercial geolocation tool is likely to be inaccurate.

Carrier-grade NAT (CGNAT) allows many subscribers to share a single public IP address simultaneously. As a result, although an IP address in a CyberTipline report might resolve to a particular city or network hub, the FBI will need the source-port to narrow it down to a specific subscriber.

Many IP addresses are also dynamic, and an IP address that was assigned to one subscriber can be reassigned to a different one over time. Again, this makes geolocation a difficult and unreliable process, and an FBI agent will likely need more than just a suspected IP address to pinpoint a location.

IP addresses from public Wi-Fi, corporate networks, and cloud networking services often resolve to the physical location of the network operator or the location of the cloud hosting service. Also, a compromised account or unauthorized access to a cloud-storage account can produce IP addresses that have nothing to do with the account holder’s actual address or location.

Due to the issues mentioned above, it is quite common for an FBI field office to misroute a CyberTipline report. As a result of these issues, more than 10 percent of all reports filed in 2025 lacked enough jurisdictional data for routing to a local office. Instead, this means that the reports have an unknown U.S. state listed in NCMEC’s Case Management Tool, and these reports are made available to federal law enforcement, including FBI field offices, U.S. Attorney’s Offices, and even some state law enforcement agencies.

In cases where the source IP is known, the FBI will also look for the source-port. If the FBI doesn’t have the source-port information, it will be difficult, if not impossible, to distinguish one subscriber from another among dozens or hundreds of people who might be sharing the same public IP address at the same time.

Does NCMEC choose the FBI field office or does the FBI?

All CyberTipline reports are available to all U.S. federal law enforcement agencies, including the FBI and Homeland Security Investigations. They are also available to ICAC task forces and to state and local law enforcement agencies.

Although reports are available to these agencies, how they identify, triage, and manage them is a very different matter. To make this process easier, NCMEC has made its Case Management Tool available to U.S. federal law enforcement agencies.

The Case Management Tool is an on-line portal that is accessible to the FBI and Homeland Security Investigations via authenticated access and an internet browser. The portal, as well as the underlying database, provides access to the database of all reports available through the CyberTipline.

The tool allows agencies to triage and manage CyberTipline reports in real-time. Agencies can use the portal to quickly determine which reports require a response and which can be pushed to the back burner for future action. The Case Management Tool also allows for efficient forwarding of reports from one agency to another. If, for example, a report for an IP address from one city is assigned to an ICAC task force in a different city, the task force can simply use the tool to forward the report to the appropriate task force and the associated FBI field office, prosecutor, or local law enforcement agency.

The portal also serves to notify law enforcement of high-priority reports as well. Many times, agencies are bombarded with a massive number of reports that are either irrelevant or low-priority. The Case Management Tool provides a means of quickly and easily flagging reports that need the most immediate attention.

While the Case Management Tool is available to all relevant agencies, NCMEC is the entity that refers reports to particular agencies.

When an electronic service provider (ESP) submits a report via the CyberTipline, NCMEC determines the best agency to refer that report to. As NCMEC works with all relevant agencies, it typically determines the jurisdiction and forwards the report to the agency it considers best-positioned to handle it. In many cases, these reports go to the FBI, a US Attorney’s Office, or a local law enforcement agency. While some reports do not get targeted to a specific locality, this doesn’t always mean that they are of little importance or relevance. If this is the case, all relevant agencies can view the reports, and if they find it appropriate, any agency can claim or even transfer the report.

As explained above, the FBI has its own internal protocols for determining which office receives a report. At this stage, these reports are handed to the relevant task force. If the CyberTipline report was misrouted due to a bad IP geolocation, federal prosecutors will determine which office has jurisdiction and will then forward it to the relevant office. When it is then forwarded, the relevant office then informs the prosecutor’s office of any actions taken during the investigation. The relevant office will also routinely inform the DOJ’s Cyber Crimes and Computer Fraud Task Force of any actions taken. The Cyber Crimes and Computer Fraud Task Force then informs NCMEC so that it can update its internal records.

Todd Spodek is the managing partner of Spodek Law Group, a second generation criminal defense firm that has been practicing since 1976.

How do the FBI's 56 field offices divide up territory?

Unfortunately, you cannot choose which FBI field office will receive a CyberTipline report. The FBI is organized with 56 field offices, and each one covers a specific territory. While these territories are typically contained within state lines, that is not always the case. FBI field offices also rely on resident agencies that serve as satellite offices under the parent field office that has jurisdiction over the area.

You may have already heard that the FBI divides the United States into 56-field office jurisdictions. The FBI makes the decision on how each office has a territory, and this determination of field offices’ territorial boundaries is not made by NCMEC. As a result, you will need to speak with an experienced federal law firm about the specific details regarding which field office has jurisdiction over the area in which you reside.

The FBI works very closely with NCMEC to manage the vast number of reports submitted to the CyberTipline. In 2025, NCMEC made available more than 2 million CyberTipline reports that resolved to a location within the United States. Of these reports, about 1.9 million resolved to a specific state.

It is also important to remember that while NCMEC refers reports, the FBI still operates its own internal policies and procedures. In fact, the FBI’s own Criminal Investigative Manual and domestic security manual describe the procedures that FBI agents and personnel must follow, and they must rely on their internal manuals when they are investigating a suspect based on a referral from NCMEC. While 18 U.S.C. 2258A governs the processes of reporting to NCMEC, it does not cover FBI agents’ internal case allocation procedures. The relevant U.S. Attorney’s Office (USAO) and FBI field office will determine how a case is handled after it gets to the relevant field office.

We cannot provide legal advice based on the information provided, and this is not meant to be accepted as legal advice. If you are worried about being arrested or prosecuted due to a report submitted through the CyberTipline, please call our office for a free and confidential case consultation with an experienced federal criminal defense attorney. During this consultation, we will be able to answer your questions and provide you with advice on the best way to proceed under the circumstances. We strongly advise against waiting.

What if the IP, billing address, and victim are in different states?

As we noted above, the routing of a report through the CyberTipline is provisional and is based on available information. This means that the routing decision can change with the issuance of subpoenas or search warrants, and it can certainly change with a physical analysis of any devices that have been seized during a CyberTipline investigation. It is also possible for a single report to identify a suspect IP, the suspect’s billing address, and the presumed location of the victim, each located in three different districts. In this scenario, any of these districts would have an investigative nexus to the report, and the report could end up in the hands of an FBI agent, the U.S. Attorney’s Office (USAO) in that area, or any other federal agency with jurisdiction. This scenario could lead to three separate federal law enforcement agencies investigating the same report, though this is not common. If this is the case, these agencies will try to avoid duplicative efforts.

While most CyberTipline reports are routed based on geolocation data provided by providers, there are also cases where a CyberTipline report may be routed based on other information. In some cases, this information will be a victim’s location or a specific phone number tied to a suspect. While this is more common with reporting through the National Center for Missing & Exploited Children’s online reporting tool for members of the public, this can also occur in cases involving reports from electronic service providers (ESPs), especially in cases involving imminent danger.

In these cases, providers will forward the report directly to emergency dispatch or to the relevant FBI field office, which will initiate immediate contact with local law enforcement. Similarly, while IP geolocation may resolve to one state, reports may be routed to other states in the interest of child safety. This includes cases in which a provider believes that it is essential for a prompt response that the report go to law enforcement agencies who are closer to the child than the FBI’s geolocation indicates.

Many reports are made available to law enforcement agents via NCMEC’s Case Management Tool and this could be viewed as accessing a report without it being officially referred. However, accessing a report is a very different matter than initiating a formal investigation. This should never be interpreted as evidence that an agent has viewed the report and concluded that an investigation was necessary. For example, access by registered providers may be conducted by the FBI. When agents log into the tool, this may make it seem as if a report has been accessed, even if the agent never viewed a specific report in detail.

In addition, 23 percent of registered providers that work closely with NCMEC are non-United States voluntary reporters. As a result, it is estimated that more than 77 percent of all reports submitted to the CyberTipline are referred to authorities outside the United States.

Does an NCMEC referral decide where federal charges are filed?

Under 18 U.S.C. 2258A, “electronic communication service providers” (ECSPs) and “remote computing service providers” (RCSPs) operating in the U.S. are required to refer reports of CSAM to NCMEC. The 2024 REPORT Act expanded the statutory scope for these referrals to include not only CSAM but also reports of child sex trafficking and online child sexual exploitation. As a result, reports submitted to NCMEC by these providers are no longer just about CSAM, but could include allegations of all these crimes.

This statutory mandate gives NCMEC the ability to refer a report to federal law enforcement agencies while keeping the provider anonymous. This means, if your IP address in a report resolves to an FBI field office, that FBI field office will be able to access your identity even though your provider did not voluntarily disclose it to law enforcement.

An NCMEC referral to the FBI is an administrative step and doesn’t give a federal prosecutor the authority to file criminal charges or a judge the authority to issue a search warrant. Federal prosecutors and judges must follow the same rules and procedures as in any other case, including those involving child sex crimes.

Even though NCMEC’s Case Management Tool refers the reports to a particular jurisdiction, the district that has authority to prosecute the alleged crimes is established by law. The fact that your internet provider reported suspected CSAM to the FBI’s Office in New Orleans, Louisiana, doesn’t mean that you will be prosecuted in the Eastern District of Louisiana, or that the Eastern District of Louisiana is the same district that granted the judge authority to issue the search warrant for your devices.

These are very important differences that the courts have recognized. In United States v. Ghafoor, 2023 12th Circuit, the 12th Circuit Court of Appeals held that “A federal court lacks subject matter jurisdiction, and its judgment void, if it does not have jurisdiction to adjudicate the offense.”

This means that just because an FBI agent accessed your report via NCMEC, the court may not have the authority to take action against you. In fact, 2025 reports from the FBI Cyber Crimes and Computer Fraud Task Force and ICAC highlight that generative-AI (GAI) exploitation has become a la major problem in the field of child sexual abuse material. More than 400,000 reports showed generative-AI (GAI) content, 182,000 reports involved generating, possessing, or attempting GAI CSAM, and 157,000 reports involved AI-created GAI CSAM that the creators alleged were based on real images or videos of the victims.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.