In early 2024, NCMEC began monitoring a criminal case in India that drew attention after a defendant accused of possessing CSAM was found not liable for violating India's Protection of Children from Sexual Offences Act, 2012 ("POCSO"). The court ruled that POCSO did not prohibit "mere possession" of CSAM absent other criminal acts, intent, or proof of a culpable mental state.
In September 2024, the Supreme Court of India overturned that decision and ruled that POCSO does indeed prohibit possession of CSAM. This clarification is helpful in light of conflicting cases among various High Courts in India on that subject.
While the Supreme Court provided clarity on the legal issue presented in that case, it also made additional rulings, including one specifically relating to the online platforms' reporting of CSAM to NCMEC. In about 120 non-U.S. jurisdictions, including India, NCMEC makes CyberTipline reports connected to a particular jurisdiction available directly to law enforcement authorities in these jurisdictions. This process complies with U.S. law, which governs relevant conduct by both NCMEC and U.S.-based online platforms. Those platforms are required to report CSAM, online enticement, and child sex trafficking to NCMEC's CyberTipline, and NCMEC is required to make those reports available to U.S. or foreign law enforcement as appropriate.
While that process has been in place for India since 2019, in this case the Supreme Court held:
Social media intermediaries in addition to reporting the commission or the likely apprehension of commission of any offence under POCSO to the National Centre for Missing & Exploited Children (NCMEC) are also obligated to report the same to authorities specified under Section 19 of POCSO[.]
Observers have noted that online platforms are likely to face challenges complying with this newly articulated obligation. Some interpret relevant U.S. laws—particularly 18 U.S.C. § 2258A—as requiring covered online platforms (referred to as "providers" under U.S. law) to report CSAM and other offenses to NCMEC only, not directly to law enforcement. That law details what information providers may disclose and limits disclosure to specified entities. Because the law does not explicitly authorize providers to report information directly to foreign law enforcement, providers might take the position that they are prohibited from doing so. If correct, this would subject providers to potential liability for violating one country's law by complying with another country's law. NCMEC makes this observation without offering legal advice or a legal opinion regarding whether such a conflict between laws actually exists.
Regardless of any legal requirements, dual reporting practices—in which an online platform reports the same unlawful content or conduct to multiple entities—create redundancies in the use of limited financial resources, time, technology, and personnel to duplicate reporting, intake, and triage efforts. Dual reporting also creates the risk that these redundancies will delay the investigation and safeguarding of children in abusive situations.
NCMEC has well-established mechanisms to receive and handle reports from the world's major online platforms and make them available to appropriate law enforcement authorities. Children everywhere would benefit from national investments in building administrative and investigative capacity to effectively access, assess, and act on reports made available by NCMEC for their respective jurisdictions.
Concern for the negative impact of dual reporting was anticipated and addressed in the United Kingdom's Online Safety Act 2023. Section 66 imposes on providers a requirement to report "detected and unreported" child sexual exploitation and abuse (CSEA) content to the National Crime Agency (NCA). According to Section 70,
CSEA content is "unreported", in relation to a provider, if the reporting of that content is not covered by arrangements (mandatory or voluntary)—
- (a) by which the provider reports content relating to child sexual exploitation or abuse to a foreign agency, or
- (b) by which an entity that is a group undertaking in relation to the provider reports content relating to child sexual exploitation or abuse to—
- (i) the NCA, or
- (ii) a foreign agency.
Section 70 further explains,
"foreign agency" means a person exercising functions in a country outside the United Kingdom which correspond to the NCA's functions insofar as they relate to receiving and disseminating reports about CSEA content;
NCMEC, operating within its U.S. legal authority, is clearly a "foreign agency" in this context. Therefore, a provider reporting detected "CSEA content" to NCMEC satisfies its reporting obligations under Section 67. This arrangement requires providers to report to either the NCA or a foreign agency such as NCMEC, without creating redundancies.
As various jurisdictions increasingly consider and enact laws and regulations related to reporting by online platforms, NCMEC recommends approaches that do not create redundancies and instead focus on enhancing efficiencies to improve responses to reports of online child sexual exploitation.
For more information, see:
"Just Rights for Children Alliance & Anr. v. S. Harish & Ors."
Supreme Court of India
Ruling available through https://judgments.ecourts.gov.in/pdfsearch/
"Supreme Court holds that viewing, storing and possessing 'child pornography' is punishable under POCSO Act; overturns Madras HC decision"
Supreme Court Observer
https://www.scobserver.in/journal/supreme-court-holds-that-viewing-storing-and-possessing-child-pornography-is-punishable-under-pocso-act-overturns-madras-hc-decision/
"Complying with SC's POCSO ruling may be hard for social media firms"
Economic Times
https://economictimes.indiatimes.com/tech/technology/social-media-intermediaries-may-not-be-able-to-fully-comply-with-sc-judgement-on-child-porn-sources/printarticle/114225478.cms
"The Protection of Children from Sexual Offenses Act, 2012"
India
https://www.indiacode.nic.in/handle/123456789/2079
"Online Safety Act 2023"
United Kingdom
https://www.legislation.gov.uk/ukpga/2023/50/contents