Internal · Draft for team review
Child Safety (CSAM) Response SOP
⬇ Download the SOP (.md)
Why this exists (and why Google does not cover it)
Greenlight hosts user photos and in-app chat, which makes it an Electronic Communication Service provider under 18 U.S.C. Section 2258A. That law puts a reporting-and-preservation duty on the operator — on us — that no vendor discharges for us:
- Google Vision SafeSearch (already wired up) screens uploads for general adult/racy content. It is not CSAM detection: it does not match against known child-abuse image databases and it does not report anything to NCMEC.
- Google Cloud Storage simply stores the files. Storage is not reporting.
The duty triggers when a person on the team gets actual knowledge of apparent child sexual abuse material — typically from a user report or from seeing it during moderation. There is no requirement to proactively scan for it, but once you know, you must act.
One-time prep (do before or around launch)
- Register Greenlight as an ESP with the NCMEC CyberTipline reporting system (report.cybertip.org, "for Electronic Service Providers"). Registering ahead of time means you can actually file the moment you need to, instead of scrambling.
- Decide who holds this SOP (primary + backup) and make sure both can reach the admin tools.
- Have the account-lock / preserve capability ready in the admin panel (see "gap" note at the bottom) so step 1 below is one click, not a code change under pressure.
The procedure — when you get actual knowledge
Move quickly and calmly. Do the steps in order. Do not investigate beyond what you already saw.
1. Do NOT delete or alter anything. Lock the account.
- Immediately lock the offending account so the content cannot be deleted, edited, or the account removed (by the user or by an accidental admin action). Deleting evidence is itself a serious problem.
- Do not download, copy, forward, or "keep a copy" of the material anywhere outside the locked system. Possessing or transmitting it, even to "prove" the report, is unlawful.
2. Report to NCMEC as soon as reasonably possible.
- File a CyberTipline report at report.cybertip.org.
- Include what the law asks for and what you have: the account identifiers, the material's location in your system, timestamps, and any user report that surfaced it. NCMEC's form guides you.
- The statute requires reporting as soon as reasonably possible after obtaining actual knowledge. (Counsel-verify the exact timing language and any per-day penalty exposure.)
3. Preserve the report-related data.
- Preserve the account, the material, and related records (messages, metadata, upload logs) in place, ideally moved to a restricted cold-preservation bucket that ordinary admins cannot reach.
- Preservation period: the REPORT Act (2024) extended the required preservation window to one year (previously 90 days). (Counsel-verify the one-year figure.)
4. Keep it confidential.
- Do not notify or tip off the user. 18 U.S.C. Section 2258A restricts disclosing the existence of a report except to law enforcement and NCMEC. (Counsel-verify the disclosure limits.)
- Do not discuss specifics outside the team members handling it and counsel.
5. After the preservation period, purge.
- Once the one-year window closes and no law-enforcement legal-hold instructs otherwise, securely delete the preserved material and close out the record.
- If law enforcement has contacted you or issued a preservation request, do not purge — follow their instructions and keep counsel in the loop.
6. Log it.
- Record (in a restricted internal log, not the public system): date of knowledge, who handled it, the NCMEC report number, actions taken, and the scheduled purge date. Keep it minimal and access-controlled.
Quick reference
| Step | Action | Where |
|---|
| 1 | Lock account, preserve, do not delete or copy out | Admin panel |
| 2 | File CyberTipline report ASAP | report.cybertip.org |
| 3 | Move to cold-preservation, hold 1 year (verify) | Restricted GCS bucket |
| 4 | Do not tip off the user; keep confidential | — |
| 5 | Purge after 1 year unless legal hold | Restricted GCS bucket |
| 6 | Log knowledge date, report #, purge date | Internal restricted log |
Known gap to close (engineering)
The SOP assumes an admin can lock an account so it cannot be deleted or altered, and move its data to a preservation area. Confirm the admin panel actually supports a hard lock today; if it does not, add it (small, non-urgent, but it is what makes step 1 executable under pressure). This is separate from the routine account-delete flow and should override it.
Legal basis (for counsel to confirm): 18 U.S.C. Section 2258A; REPORT Act of 2024. This document is an internal operational procedure, not legal advice.