Briefly: Organizational processes, policies, and practices

What is it?

Protecting children from online sexual exploitation is challenging work that involves interacting with sensitive materials that often relate to personal information concerning potential victims and information relating to criminal proceedings. Organizations engaged in this work benefit from organizational structures and practices that promote professionalism, high ethical standards, and the well-being of both staff and survivors. The specific needs of each organization may vary based on its mission, legal or regulatory obligations, and authority. However, some broadly applicable principles, include:

• Specialized screening and training for staff engaging with sensitive information and materials;
• Clear policies that define authority, responsibilities, expectations, and restrictions regarding staff interactions with sensitive information and materials;
• Audit capabilities and enforcement practices to ensure policy compliance, promote staff and survivor well-being, and mitigate risks of unauthorized or improper engagement with sensitive information and materials.

NCMEC's Position:

Why does it matter?

Across sectors, individuals and organizations dedicated to protecting children from online harms are frequently exposed to sensitive information and materials. This includes CSAM images and videos, explicit text communications, survivor disclosures, offender admissions, and other details related to child sexual abuse and exploitation. In the absence of clearly articulated rules, expectations, and accountability measures, even well-intentioned individuals can inadvertently cause or experience harm in the course of performing this sensitive work.

Organizations should implement appropriate processes, policies, and practices to ensure positive outcomes, including:

• Compliance with legal restrictions on access to sensitive information and materials;
• Effective job performance and service delivery by thoroughly screened, highly qualified, and well-trained professionals deploying best practices in their respective disciplines;
• Staff resilience and wellness through successful management of secondary traumatic stress, thereby minimizing burnout;
• Professional longevity, for the development of subject matter expertise over time, which further enhances effectiveness and impact;
• Protection of victims and survivors through practices that secure and limit access to sensitive information and materials to the fewest number of people necessary to achieve legitimate objectives.

What context is relevant?

Almost any organization can access resources to identify gaps and develop solutions related to processes, policies, and practices that support professional, ethical, and sustainable efforts against online child sexual exploitation. Each organization will have distinct needs, and networking among stakeholders—particularly to share expertise—can advance efforts to make appropriate changes.

There are several examples of coalitions and associations—some sector-specific and some cross-sector—that focus on sharing expertise and best practices relating to organizational efforts to combat online child sexual exploitation. The Technology Coalition, an industry association focused on combating online child sexual exploitation and abuse, collaborates with its member companies to develop and share best practices and subject matter expertise. NCMEC was one of the earliest members of INHOPE, an international association of internet reporting hotlines that includes members in 50 countries as of 2024. Through INHOPE, members gain access to globally diverse expertise and “best practice policies” relevant to hotline operations. Law enforcement agencies engage the U.S. Internet Crimes Against Children Task Force Program, network through INTERPOL’s Specialists Group on Crimes Against Children, and participate in various conferences and training events around the world to develop and share expertise and best practices.

Membership in the WeProtect Global Alliance—an organization connecting government agencies, technology companies, non-governmental organizations, and others—is available even to very small or localized organizations working to counter online child sexual exploitation. Networking through the Alliance can facilitate connections between members to share expertise and best practices.

Similar to a safety by design approach to product development, organizations should regularly review and consider updates to relevant processes, policies, and practices as needed to effectively counter online child sexual exploitation. Various components of an organization have relevant roles to play, including personnel/human resources, legal departments, operational teams, and technology experts. Ultimately, executive leaders need to be responsible for and committed to sustainable, professional, and ethical practices.

NCMEC has implemented a variety of relevant measures as part of its organizational efforts to combat online child sexual exploitation, including the following:

• Tailored screening processes for employment candidates to assess their suitability for specific job functions, particularly in relation to the stressors associated with exposure to CSAM.
• Controlled access to CSAM reported to the CyberTipline or submitted to the Child Victim Identification Program, which is limited to employees responsible for processing reports or conducting victim identification analysis.
• Mental health support services provided by contracted professionals available to all staff to help them manage the emotional toll of their work.
• Robust physical and electronic security systems designed to protect sensitive information from unauthorized access and to enable audit capabilities relating to sensitive materials.
• Approved documented policies on how information and imagery is shared with law enforcement and other partner organizations.

What have survivors said about it?

Survivors appreciate the efforts of those working in the child protection space and recognize the risks associated with exposure to CSAM and other sensitive information. They express concerns about the proper handling and security of CSAM to minimize exposure and maximize protection for survivors. Organizations of all types should articulate and enforce policies and act decisively and transparently if misconduct occurs.

Adopting relevant processes, policies, and practices is also crucial to ensure organizational processes are more trauma-informed. These measures can help organizations minimize the risk of re-traumatizing survivors as they navigate legal systems, interact with organizational staff, and access supportive services.

The resilience of our community heroes who help keep our children safe should be recognized and celebrated but should not be expected without appropriate ways to cope. We need to prioritize the mental health and wellbeing of these heroes so that they can continue in their resilience and protect our kids.

- Survivor

Organizations have a responsibility to care for their employees, volunteers, etc. who are working in situations that expose them to high probability of vicarious trauma.

- Survivor

What drives opposing viewpoints?

While there is no prominent opposition to these ideas, some conflicting perspectives may arise from concerns that strict policies and practices could hinder organizations and individuals from fuller measures to combat online child sexual exploitation. Those who operate in contexts where such structures do not seem necessary—due to local social, cultural, or legal circumstances—may view them as burdensome to effective and proactive measures to protect children. Additionally, intervention-focused individuals may believe that the urgent need to “rescue” a victim in some circumstances outweighs—or justifies overlooking—other important considerations.