Email: NCMEC Escalation

Raw text

Transcribed text as recorded, including headers and formatting fragments.

From: Jason @meta.com> Sent: Monday, December 11, 2023 3:50 PM EST To: Fallon McNulty @NCMEC.ORG> Subject: NCMEC Escalation Below are specific items that NCMEC highlighted to us in the meeting as issues: Exploitative Content of CSAM Survivors NCMEC has requested numerous times over the last year for an option to escalate exploitative content of CSAM survivors for takedown requests. This content is not CSAM but exploitative images and content being used to identify the survivors. NCMEC has shared that Meta is one of the only companies that doesn't have a process for these escalations. Compromised accounts NCMEC states that law enforcement is unclear about how Meta CyberTips related to hacked accounts are actually compromised. Specifically: Meta, unlike other industry members, does not include clear enough language in the reports about an account being compromised. The report provides an unclear sequence of events (password changes, new phone numbers and emails added, etc.) to provide signal on a potential account compromise. WhatsApp Spoofing WhatsApp has had a spoofing issue for several years now which involves users being reported for sharing CSAM when in fact they had not shared the reported content. This has led to users being reported to NCMEC and the reports being sent to law enforcement globally for action. WhatsApp CyberTips now removes all PII so NCMEC cannot resolve reports to any specific jurisdiction. Our large volume of reporting complicates this issue and affects NCMEC sending Meta CyberTips around the world. WhatsApp met on this continued issue and decided this could mostly be resolved by implementing franking (source sender traceability) but the WhatsApp eng team reports this solution will not ship until 2025. Mislabeled "Last Seen IP" for WhatsApp CyberTip reports Since 2017, WhatsApp CyberTip reports have mislabeled "last seen IP" as the "upload IP". WhatsApp has never captured "upload IP". NCMEC complained that, after we were aware of this, it took too long (about a month) to fix this issue and also did not provide notice to law enforcement on this mislabeling for that same month. Low credibility with law enforcement agencies Currently, 31 ICAC task forces in the United States (approximately half of the total) are not receiving Meta CyberTip reports after opting out with NCMEC because of quality issues. 5 more ICACs are in discussions now to also not receive Meta's reports. Memes & Tagging - Volume and Actionability side According to NCMEC, Meta is not tagging memes and viral content in most instances: Meta appears to not be tagging items as "severe memes" when they should be tagged this way. Meta reports content classified as meme to NCMEC and in other instances this same content isn't classified as a meme adding to NCMEC and law enforcement confusion. Many times, Meta reports content in error that is not CSAM causing excess volume levels of CyberTip reports sent to an already overloaded NCMEC team. Meta does not mark most content as viewed so NCMEC and US LE are not able to view that content without LE submitting a search warrant to a judge. Meta utilizes hash matching and adds the hashes for previously viewed reported CSAM to reports as a solution. NCMEC and law enforcement have provided feedback that the way in which Meta uploads content to CyberTips causes fidelity issues in hash values and this is not a solution. Specifically: 1. Compression of files causes hash matching issues 1. MD5 hash values seem to be always changing and not matching with pDNA 2. Law enforcement applies for search warrants and then finds out that the content is not CSAM but a meme. 3. This, in turn, puts the credibility of the search warrant at issue PLTF EX-02504_0001 NCMEC has provided samples of severe memes that should have been tagged as such based on previous tagging in reporting. Meta has not provided feedback in most instances based on the examples provided. This has been an agenda item on the bi-weekly sync for months. Since NCMEC sees no progress on this issue they view this constant sample gathering as low value work for their overloaded team. Without human review done at Meta, or accurate tagging as mentioned above, NCMEC can't review these reports. Their only recourse is to send them on to law enforcement which causes investigative issues at those agencies as well. Escalation Tag NCMEC has an escalation tag for industry partners to use for emergencies or imminent cases involving an at risk child. Meta began using this for a large volume of reports that did not fit this description. This tag requires an oncall NCMEC analyst to action what is being reported. This means evenings and weekends. This has led to NCMEC leadership calling analysts into the office on those nights and weekends to clear out these escalations. Spikes of Viral Content NCMEC has requested that Meta provide notice on any spikes in reporting of viral content. This has been a request for several years as some of these spikes have overwhelmed NCMEC's CyberTipline to the point where their system almost crashed. As an example, there was a weekend in January of 2023 that we sent over a 1 million reports on 1 severe meme over one weekend. Meta has been inconsistent with these notifications and this continues to be a regular ask. PLTF EX-02504_0002