Opinion ID: 811893
Heading Depth: 2
Heading Rank: 2

Heading: Yahoo! Reports to NCMEC

Text: On March 15, 2007, Yahoo! received an anonymous report that child pornography images were contained in a Yahoo! Photo account belonging to a user with the username lilhottyohh. The record does not indicate that Yahoo! knew, or ever attempted to find out, who made the anonymous report. In response to the anonymous tip, Yahoo! personnel searched the lilhottyohh account -5- and discovered images that they believed to be child pornography. It is not known which Yahoo! employee conducted the search. Yahoo! had an established process for dealing with reports of child pornography. If Yahoo! learned of child pornography in an account, an employee in Yahoo!'s Customer Care Department temporarily removed the content from public view and reviewed it. If he or she determined that the account contained child pornography, Yahoo! deactivated the account and notified the Legal Department. Meanwhile, the Customer Care Department created an archive of all the images associated with the account, including the date and time each image was uploaded and the IP address from which it was uploaded. If the Legal Department agreed that any images were child pornography, it then sent an electronic report to NCMEC via the CyberTipline. Each report (Yahoo! CP Report or CP Report) listed a Suspect Screen Name, a Suspect Email Address, a Suspect URL,2 and a Suspect IP Address. The Suspect IP Address was the IP address that Yahoo! associated with the user; it is not clear from the record whether this IP address was the Registration IP Address stored in the Account Management Tool, or 2 For the purposes of this case, we understand a Uniform Resource Locator (URL) to be the string of characters that specifies the location of a document on the Internet. For example, the URL for the First Circuit's website (at the time of this writing) is http://www.ca1.uscourts.gov. URLs are distinct from IP addresses. An IP address identifies a particular computer on the Internet, but that computer might host multiple documents, each of which might have their own URL. -6- if it was some other IP address. One could argue, as the government seemed to do at trial, that it is the IP address from which the last image was uploaded onto the account, as in some CP Reports the Suspect IP Address is different from the Registration IP Address contained in the Account Management Tool for the same account. The Suspect Email Address was the Yahoo! email address of the Yahoo! user the CP Report pertained to, and the Suspect URL was the Internet location where the user's photos could be found. Each CP Report also included a table listing the child pornography images being sent with the report. Yahoo! attached to each report the suspected child pornography images. For each child pornography image, Yahoo! listed the date and time at which the image was uploaded and the IP address from which it was uploaded (Image Upload Data). In addition, Yahoo attached data from the Account Management Tool and Login Tracker to each CP Report. Whenever Yahoo! sent a CP Report to NCMEC, Yahoo! automatically stored a receipt. The receipt included a unique number assigned to the report by NCMEC and a record of what Yahoo! reported to NCMEC, including the attachments to the CP Report. In this case, Yahoo! sent a CP Report of the child pornography in the lilhottyohh account to NCMEC. Subsequently, Yahoo! sent additional CP Reports to NCMEC of child pornography found in the accounts of the users lilhottee0000 and -7- harddude0000. All three CP Reports listed the same Suspect IP Address: 76.179.26.185.