Severe harm escalations

1. Step 01

   Set the tiers, and decide who decides

   Severe harm needs its own path, separate from the everyday escalations in chapter 7.

   Write the tiers down before you need them:

   Tier	What it covers	First action	Who is paged
   Life at risk now	A credible threat to kill or seriously hurt someone, a suicide or self-harm attempt in progress, a child in immediate danger, violence being live-streamed	Minutes, around the clock	The on-call lead, who can refer to emergency services
   Child sexual exploitation	Apparent child sexual abuse material (CSAM), enticement or sextortion of a minor, child sex trafficking	Within hours, around the clock	A trained child-safety specialist
   Law-enforcement emergency	A request that claims danger of death or serious injury	Within hours, around the clock	The on-call responder trained on emergency disclosure
   Serious, not urgent	Routine legal process, a threat with no time or place, abuse reported long after it happened	Next business day	Legal, or the specialist queue

   Then write down who decides what, so nobody makes a call they weren't trained for, and nobody waits because they aren't sure they're allowed to act.

   Decision	Who makes it
   Restrict an account and preserve its data	Any trained reviewer, straight away
   Confirm apparent child sexual exploitation and file the report	A trained child-safety specialist
   Ban visibly or restrict quietly	The child-safety lead, with Legal when law enforcement is involved
   Refer to emergency services, or disclose data in an emergency	The on-call lead, following the written procedure
   Respond to subpoenas, court orders and warrants	Legal
   Declare an incident and bring in executives	The on-call lead, using the severity levels in chapter 13

   Automation helps here, but it doesn't decide. My default: where a wrong decision can't be reversed or someone's safety is at risk, a human owns the call. Automation prepares the case (the hash match, the linked accounts, the history) and a trained person closes it.

   Early on, the on-call lead is often the founder or first safety hire, with one named backup, and the whole protocol fits on a page. A growing team adds a rota and specialists. At scale, child-safety investigations and law-enforcement response usually become teams of their own.

2. Step 02

   Staff it around the clock, and test it out of hours

   My default: a trained, named on-call lead can make a law-enforcement referral or an emergency disclosure at 2am without waiting for anyone, and brings Legal in as soon as possible afterwards. When a life is at risk, the decision can't wait for business hours, so train for it and write down what the on-call lead may decide.

   The top two tiers need cover every hour of every day. Set up:

   • An on-call rota with a named lead and a backup for every shift, including holidays.
   • A way for police to reach you: an emergency line you publish and share with agencies in advance.
   • NCMEC registration before your first case, if US law applies to you. NCMEC asks providers to register so they can report through its secure channel and include the content with the report.
   • Trained specialists in a restricted queue. Keep the number of people who can see this material small. US law requires it: providers must minimize the number of employees with access to material provided in a report (18 U.S.C. § 2258B(c)). The people who do this work need exposure limits and support, so see chapter 14.

   Then test it at the worst time. In the tabletop's The post six friends saw, the protocol works only because the head of safety happens to be online at 23:10 on a Saturday. Run your own version on a weekend.

3. Step 03

   Child sexual abuse material and enticement: the first hour

   When a hash match, a reviewer or a user report surfaces apparent CSAM or an adult enticing a child, one thing overrides the rest: if a child may be in immediate danger, contact law enforcement straight away and file the CyberTipline report at the same time, flagged as urgent. A call to the police never replaces the report. Then work through the same steps every time, in this order:

   1. Stop the harm. Take the content down by hiding or quarantining it, never by deleting it before it's preserved. Block it by hash so it can't be re-uploaded, and stop the account reaching children.
   2. Preserve. Keep the content, the account data and the related material before anything is deleted.
   3. Confirm. A trained specialist confirms it. A hash match against a trusted list can be confirmed quickly. New, never-seen material needs expert review and is often more urgent.
   4. Report. File the report, and log the time and the report ID.
   5. Record. Write down who did what and when, in the case record described in step 7.

   In the US, 18 U.S.C. § 2258A sets the rules. A provider must report to NCMEC's CyberTipline as soon as reasonably possible after it obtains actual knowledge of apparent CSAM, and, since the REPORT Act, apparent child sex trafficking and online enticement of a minor (§ 2258A(a)). The law doesn't require you to scan or monitor for it (§ 2258A(f)). Once you know, you must report. A provider that knowingly and willfully fails to report can be fined up to $850,000 for a first failure and $1 million after that if it has 100 million or more monthly active users, and up to $600,000 and $850,000 if it has fewer (§ 2258A(e)).

   Most of a report's contents are left to the provider's discretion (§ 2258A(b)). Make it complete anyway, including the full conversation for enticement. NCMEC passes reports to law enforcement, and a fast, thin report helps nobody.

   Preservation has rules too (§ 2258A(h)):

   • A completed report counts as a request to preserve what you reported for one year.
   • You must also preserve related files and data that are reasonably accessible and may give context about the material or the person.
   • Keep it in a secure location, with staff access limited to what compliance needs, and store it in line with the current NIST Cybersecurity Framework (§ 2258A(h)(6)).
   • You may keep it longer than a year to reduce or prevent online child sexual exploitation, or where legal process requires it. If law enforcement asks you to destroy the images, do so (§ 2258B(c)(2)).

   Never make your own copies or pass the material around. The only copies are the preserved one and the one sent with your report, or one Legal directs. The law protects providers and their staff for reporting and preserving under these sections (§ 2258B(a)). Passing the material around isn't part of either, and possessing or distributing it is a serious federal crime (18 U.S.C. § 2252A). So don't download it, screenshot it, paste it into a ticket or chat, or send it by ordinary email to anyone, including a colleague, a lawyer or the police. Escalate with a link to the case in the restricted tool. Law enforcement gets the material through NCMEC, through legal process, or through a direct disclosure that Legal approves under § 2258A(g)(4), sent over a secure channel.

   Other markets have their own duties. Since 7 April 2026, the UK's Online Safety Act has required user-to-user services to report child sexual exploitation and abuse content they detect from that date to the National Crime Agency, unless it's already covered by arrangements to report it to an equivalent foreign agency such as NCMEC: all such content for UK providers, and only UK-linked content for others (sections 66 and 70). Work out with Legal which duties apply in each market you serve. In the US, the duty to report apparent CSAM doesn't depend on the age of the person who shared it. If a reviewer is unsure because the sharer is also a minor, take it to Legal straight away, and don't hold the report past "as soon as reasonably possible".

4. Step 04

   Make the account decision on purpose

   The content decision is fixed: it comes down, gets preserved and gets reported. The account is the judgment call, and chapter 6 explains why. You can act immediately and visibly, or restrict the account quietly while investigators map linked accounts and law enforcement decides what it needs.

   Defaulting to the ban looks like success on a dashboard. But the offender comes back on a fresh account with none of the history that flagged them, and the child is still reachable wherever the conversation already moved.

   Either way, the first move is the same: the account can no longer reach children. Then choose.

   	Ban visibly now	Restrict quietly while you map the network
   Fits when	The account acts alone, with no linked accounts; the content is public and spreading; or a restriction can't reliably cut off contact	Signals point to linked accounts or a network; law enforcement is interested; and the restriction cuts every path to minors
   What it costs	Tells the offender they've been found, so they may move the child elsewhere, destroy evidence or return on new accounts	Investigator time, and an owner and an end date so the restriction isn't forgotten

   A quiet restriction still means no messages, friend requests, gifts or new private channels with minors, and no uploads. It isn't leaving the account as it was.

   Mapping the network means following the signals: shared devices, payment details, sign-up patterns, gift history and who the account contacted. In the tabletop's The gifts that weren't gifts, one parent's report leads to 40 other child accounts and six linked adult accounts. The strongest response reviews all of them and reaches the other families through their parent accounts. Offenders work across services too, so share signals through programs such as the Tech Coalition's Lantern where you're eligible.

   If law enforcement asks you not to alert the account holder, Legal handles the request and records it. Some court orders forbid you from telling anyone about a request (18 U.S.C. § 2705(b)). Nothing about a quiet restriction should leave a child exposed while you wait.

   A banned account is not a closed case. The standard isn't speed. It's a safe child and a fully mapped network.

5. Step 05

   Threats to life and self-harm emergencies

   Two kinds of case land here: a person at risk of hurting themselves, and a threat to someone else, such as a home address posted with a threat or a planned swatting (a hoax emergency call meant to send armed police to someone's home).

   When someone is at risk of self-harm:

   • Reach the person first. Show crisis resources (in the US, the 988 Suicide & Crisis Lifeline), and where you can, have a trained person message them directly. An automated message that reads like a rule warning can make things worse.
   • Refer to emergency services with the information you hold when the risk is imminent. Location to city level is still worth passing on.
   • Don't suspend the person at risk. Remove content that breaks your rules if you must, but keep them connected to the friends reaching out. Suspension removes help, not harm.

   When someone else is threatened: remove the content, preserve it, warn the police where the target lives, and tell the target. In The swatting threat, a warning to local police means a hoax call that night is handled calmly.

   Deciding whether a threat is credible is a human call. The same words can be a real threat, a joke between friends or a survivor describing what happened to them.

   The law in the US lets you act. A provider may disclose the contents of communications, or records about a user, to a government entity if it believes in good faith that an emergency involving danger of death or serious physical injury requires disclosure without delay (18 U.S.C. § 2702(b)(8) and (c)(4)). It's permission, not a duty, so the decision is yours, and it needs a trained person and a written procedure. In the EU, the Digital Services Act goes further for criminal offences: a hosting service that becomes aware of information giving rise to a suspicion of a criminal offence involving a threat to someone's life or safety must promptly inform the law enforcement or judicial authorities of the Member State concerned, with all the relevant information it has. If it can't tell which Member State, it informs the one where it's established or has its legal representative, or Europol (Article 18). The GDPR lists protecting someone's vital interests, theirs or another person's, as a lawful basis for processing personal data (Article 6(1)(d)). Information about suicide risk is health data, which also needs a condition under Article 9, such as protecting vital interests when the person can't give consent (Article 9(2)(c)). Have Legal set this out in your procedure before you need it.

   Laws that mandate "detect and intervene" are easy to write. Identifying and helping a child at risk of self-harm at 2am is hard. That's why the protocol has to be staffed, trained and tested, not just written down.

6. Step 06

   Handle law-enforcement requests: verify, then share only what's covered

   Every request comes in through one place and gets logged: type, agency, country, time received. Routine requests go to Legal. Emergency requests go to the on-call responder, with a target measured in hours.

   Check that it's genuine. In November 2024 the FBI warned that criminals were using compromised US and foreign government email accounts to send fraudulent emergency data requests to US companies, and urged them to apply critical thinking to emergency requests (FBI, Private Industry Notification). Urgency is the attack. So, for every emergency request:

   • Call the agency back on a number you found yourself, not the one in the request.
   • Check that the sender's address and the officer's details match a real agency.
   • Ask what the emergency is and why it can't wait for legal process.
   • Send data only to an official agency channel, never to a personal address.
   • If anything doesn't fit, escalate to Legal before you disclose.

   Match what you disclose to the legal process. In the US, the Stored Communications Act sets out what each kind of process can require (18 U.S.C. § 2703). A subpoena reaches basic subscriber records such as name, address, session times, length of service and means of payment. A court order under § 2703(d), which requires specific and articulable facts, reaches other records. Contents generally need a warrant. A preservation request means keeping the records for 90 days while the agency gets process, extendable by another 90 days on a renewed request (§ 2703(f)). Legal reviews every routine request for validity and scope, narrows the ones that ask for too much, and records the outcome: disclosed, narrowed or rejected.

   In an emergency, share the minimum. In The post six friends saw, police ask for the account's phone number, IP address and recent location, and the account holds four years of private messages. The strongest call verifies the officer, shares only what's needed to find the person, and documents the decision. Anything more can wait for legal process.

   Requests from other countries go to Legal. What you can disclose depends on where the data is held and which country's law applies.

   Be open about it. Publish guidelines that tell police how to reach you and what you need. Decide when you tell users about requests, with exceptions when an order forbids it or telling them would put someone at risk. Publish requests by type, country and outcome. The EU's Digital Services Act requires transparency reports to include the number of orders received from Member States' authorities (Article 15), and chapter 17 covers the report.

7. Step 07

   Keep a record that answers "why this account?"

   Every severe case may be questioned one day by a court, a regulator or a parent: why this account, why the wait, why that disclosure? The answer has to be in a record written at the time.

   For every case, record what was found, who decided each step and why, what was reported, preserved and disclosed, and the account decision with its reason. The template below lists the fields. Keep the record under the same access controls as the material.

   That question is only answerable if one person owned the thresholds, each change was written down with the numbers behind it, and the decision to report to law enforcement was made by people trained for it. Chapter 16 covers building a record that holds up across all your duties.

8. Step 08

   Review every severe case afterwards

   Every case in the top two tiers gets a short, blameless review once it closes: what in the system worked and what failed, not who to blame. Ask:

   • When did the first signal appear, and when did anyone act on it?
   • Did the protocol work out of hours, or depend on one person?
   • Was the report complete and on time? Did the account decision hold up?
   • Were requests verified, and was only the minimum shared?
   • Did the people who handled it get support afterwards?
   • What would have stopped it earlier: a default, a detection rule, a limit on new accounts?

   The last question matters most. Severe cases show where your defaults and detection are weakest, so feed every answer back into chapter 5 and chapter 6. When a case grows into a public incident, the review becomes part of crisis response.

   Track time from confirmation to report at p50 and p90, how complete reports are, time from first signal to protective action, and law-enforcement requests by outcome and response time. A median of six hours can hide a p90 of three days because weekend cases wait for a specialist.

1. 01

   Deleting the account and its data

   Remove the content, preserve everything, report, and only then decide what happens to the account.

2. 02

   Forwarding the material to escalate it

   Never email, screenshot or download it, even internally. Escalate with a link to the case in a restricted tool, and let any disclosure to police go through Legal and a secure channel.

3. 03

   Banning by reflex

   Cut off contact with children first, then decide between a visible ban and a quiet restriction while you map the network.

4. 04

   Suspending the person at risk

   Keep them connected to help, and reach them with a trained person and crisis resources.

5. 05

   Trusting a request because it's urgent or comes from a government address

   Call back on a number you found yourself, and check before you disclose.

6. 06

   Handing over everything on the account

   Share what the legal process covers, or in an emergency, the minimum needed to address it.

7. 07

   A protocol that depends on one person being online

   Staff a rota, train it, and test it on a weekend.

From Steven's writing · 1 post

1. Sep 25, 2026Essay

   A banned account is not a closed case

   Online enticement is a pattern of contact, not a file, and is now mandatory to report. The hard call is the account: ban visibly, or restrict quietly while the network is mapped.

   Also in: 6. Child safety and age assurance

Outside sources

• NCMEC CyberTiplinewhere US providers report child sexual exploitation, including enticement and child sex trafficking.
• 18 U.S.C. § 2258Athe US duty to report, what a report contains, and the one-year preservation rule.
• 18 U.S.C. § 2702when US providers may disclose user data voluntarily, including in emergencies.
• FBI: fraudulent emergency data requeststhe November 2024 warning about criminals using compromised government email accounts.
• EU Digital Services ActArticle 18 sets the duty to report suspected offences that threaten life or safety.
• UK Online Safety Act, section 66the duty to report child sexual exploitation and abuse content to the National Crime Agency.

1. Oct 4, 2026
   RevisedWith 18 other chapters

   Practical advice that varies by platform, such as cadences, sample sizes, targets and who owns what, is now set out as options with examples, so each team can choose what fits.

2. Oct 4, 2026
   RevisedWith 14 other chapters

   Added Steven's own calls from an interview: where Trust & Safety should report, what to automate first, the one number to track from day one, who makes the 2am call, and more. Practical choices that vary by platform are now laid out as options.

3. Oct 3, 2026
   DraftedWith 17 other chapters

   First full drafts of the other 18 chapters, built on Steven's posts, the handbook's principles and the Workbench's open content, with every legal and factual claim checked against its source. Stories from Steven's own work come next.

4. Oct 3, 2026
   AddedWith 14 other chapters

   Linked the first 16 posts to the chapters they inform, and set out the ten principles behind the handbook.