# Child Safety (CSAM) Response SOP

**Status:** DRAFT for team review. Not legal advice — have counsel confirm the statutory figures
(flagged below) before you rely on them.
**Owner:** Jude / Remy (this is a 2-person-team procedure)
**Read this once now, keep it findable. It runs only if the situation ever happens.**

---

## Why this exists (and why Google does not cover it)

Greenlight hosts user photos and in-app chat, which makes it an Electronic Communication Service
provider under **18 U.S.C. Section 2258A**. That law puts a reporting-and-preservation duty on **the
operator** — on us — that no vendor discharges for us:

- Google Vision **SafeSearch** (already wired up) screens uploads for general adult/racy content. It is
  **not** CSAM detection: it does not match against known child-abuse image databases and it does **not**
  report anything to NCMEC.
- Google Cloud Storage simply stores the files. Storage is not reporting.

The duty triggers when **a person on the team gets actual knowledge** of apparent child sexual abuse
material — typically from a user report or from seeing it during moderation. There is no requirement to
proactively scan for it, but once you know, you must act.

---

## One-time prep (do before or around launch)

- [ ] Register Greenlight as an ESP with the **NCMEC CyberTipline reporting system**
      (https://report.cybertip.org, "for Electronic Service Providers"). Registering ahead of time means
      you can actually file the moment you need to, instead of scrambling.
- [ ] Decide who holds this SOP (primary + backup) and make sure both can reach the admin tools.
- [ ] Have the **account-lock / preserve** capability ready in the admin panel (see "gap" note at the
      bottom) so step 2 below is one click, not a code change under pressure.

---

## The procedure — when you get actual knowledge

Move quickly and calmly. Do the steps in order. Do not investigate beyond what you already saw.

### 1. Do NOT delete or alter anything. Lock the account.
- Immediately lock the offending account so the content **cannot be deleted, edited, or the account
  removed** (by the user or by an accidental admin action). Deleting evidence is itself a serious problem.
- Do not download, copy, forward, or "keep a copy" of the material anywhere outside the locked system.
  Possessing or transmitting it, even to "prove" the report, is unlawful.

### 2. Report to NCMEC as soon as reasonably possible.
- File a CyberTipline report at **https://report.cybertip.org**.
- Include what the law asks for and what you have: the account identifiers, the material's location in
  your system, timestamps, and any user report that surfaced it. NCMEC's form guides you.
- The statute requires reporting **as soon as reasonably possible** after obtaining actual knowledge.
  *(Counsel-verify the exact timing language and any per-day penalty exposure.)*

### 3. Preserve the report-related data.
- Preserve the account, the material, and related records (messages, metadata, upload logs) in place,
  ideally moved to a restricted **cold-preservation bucket** that ordinary admins cannot reach.
- Preservation period: the **REPORT Act (2024)** extended the required preservation window to **one
  year** (previously 90 days). *(Counsel-verify the one-year figure.)*

### 4. Keep it confidential.
- Do **not** notify or tip off the user. 18 U.S.C. Section 2258A restricts disclosing the existence of a
  report except to law enforcement and NCMEC. *(Counsel-verify the disclosure limits.)*
- Do not discuss specifics outside the team members handling it and counsel.

### 5. After the preservation period, purge.
- Once the one-year window closes and no law-enforcement legal-hold instructs otherwise, securely delete
  the preserved material and close out the record.
- If law enforcement has contacted you or issued a preservation request, **do not purge** — follow their
  instructions and keep counsel in the loop.

### 6. Log it.
- Record (in a restricted internal log, not the public system): date of knowledge, who handled it, the
  NCMEC report number, actions taken, and the scheduled purge date. Keep it minimal and access-controlled.

---

## Quick reference

| Step | Action | Where |
|---|---|---|
| 1 | Lock account, preserve, do not delete or copy out | Admin panel |
| 2 | File CyberTipline report ASAP | report.cybertip.org |
| 3 | Move to cold-preservation, hold **1 year** *(verify)* | Restricted GCS bucket |
| 4 | Do not tip off the user; keep confidential | — |
| 5 | Purge after 1 year unless legal hold | Restricted GCS bucket |
| 6 | Log knowledge date, report #, purge date | Internal restricted log |

---

## Known gap to close (engineering)

The SOP assumes an admin can **lock an account so it cannot be deleted or altered**, and move its data to
a preservation area. Confirm the admin panel actually supports a hard lock today; if it does not, add it
(small, non-urgent, but it is what makes step 1 executable under pressure). This is separate from the
routine account-delete flow and should override it.

---

*Legal basis (for counsel to confirm): 18 U.S.C. Section 2258A; REPORT Act of 2024. This document is an
internal operational procedure, not legal advice.*