Opinion ID: 811893
Heading Depth: 2
Heading Rank: 1

Heading: Business and Regulatory Background

Text: Before delving into the particular facts of Cameron's case, we recite some background facts regarding the technologies, business practices, and regulations at issue here. During 2006 and 2007, Yahoo!, Inc. (Yahoo!) offered a service (which has since been discontinued) called Yahoo! Photo that allowed users to upload photographs to the Internet. Users could then share photographs with other Yahoo! Photo users. Each Yahoo! Photo album was linked to a particular Yahoo! user or account. In turn, each account was designated by a Login Name (sometimes referred to as a username or screen name), such as lilhottee00000, one of the screen names at issue in this case. A Yahoo! user might use multiple other Yahoo! services in addition to Yahoo! Photo, such as email. Whenever a person created a Yahoo! account, Yahoo! recorded certain information, some of which was captured automatically and some of which was entered by the person who created the account. One piece of information that was automatically collected was the Registration IP Address, which was the Internet Protocol (IP) address from which the account was -3- created.1 Yahoo! also automatically recorded the date and time at which the account was created. Yahoo! recorded this information in an Account Management Tool, which it maintained for the life of a Yahoo! account. Further, whenever a user logged into a Yahoo! account, Yahoo! automatically recorded the date and time of the login as well as the IP address from which the login occurred. Yahoo! stored this information in a Login Tracker. The record indicates that, during the relevant time period, Yahoo! kept login records in its Login Tracker for sixty days. During the same time period, Google, Inc. (Google) provided a service (also since discontinued) called Google Hello. Google Hello allowed users to sign in with a username and then chat and trade photos with other users over the Internet. Google automatically maintained records indicating the times at which a user logged into and out of Google Hello, as well as the IP address from which the user accessed the service (Google Hello Connection Logs). At the relevant time, businesses such as Google and Yahoo! had (and still have to this day) a duty to report any apparent violation of federal child pornography laws to the National Center for Missing and Exploited Children (NCMEC). See 1 An IP address is the unique address assigned to every machine on the internet. An IP address consists of four numbers separated by dots, e.g., 166.132.78.215. United States v. Kearney, 672 F.3d 81, 84 n.1 (1st Cir. 2012) (quoting United States v. Vázquez-Rivera, 665 F.3d 351, 354 n.5 (1st Cir. 2011)). -4- 42 U.S.C. § 13032(b)(1) (1998) (creating a reporting duty for any entity engaged in providing an electronic communication service or a remote computing service to the public, through a facility or means of interstate or foreign commerce) (current version at 18 U.S.C. § 2258A(a)(1) (2012)). NCMEC is a non-profit organization that receives an annual grant from Congress to perform various functions related to preventing the exploitation of children. See 42 U.S.C. § 5773(b) (2012). Among these functions is the operation of a cyber tipline to provide . . . electronic service providers an effective means of reporting child pornography and other Internet-related crimes targeting children. Id. § 5773(b)(1)(P). NCMEC's cyber tipline is called the CyberTipline. Once NCMEC receives a report of a possible child pornography crime via the CyberTipline, it determines the appropriate international, Federal, State or local law enforcement agency for investigation and forwards the report to that agency. Id.