@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix cac-core: <https://cacontology.projectvic.org/core#> .
@prefix cacontology: <https://cacontology.projectvic.org#> .
@prefix cacontology-us-ncmec: <https://cacontology.projectvic.org/us/ncmec#> .

# Ontology Declaration
<https://cacontology.projectvic.org/us/ncmec/3.0.0> rdf:type owl:Ontology ;
    rdfs:label "NCMEC Cybertip Report Ontology (US Extension)"@en ;
    rdfs:comment "An ontology for representing concepts specific to NCMEC Cybertip reports as an extension to the core CAC ontology. Version 3.0.0."@en ;
    owl:versionIRI <https://cacontology.projectvic.org/us/ncmec/3.0.0> ;
    owl:versionInfo "3.0.0" ;
    dcterms:creator "CAC Ontology Team" ;
    dcterms:issued "2024-03-20"^^xsd:date ;
    dcterms:modified "2025-11-18"^^xsd:date ;
    owl:imports <https://cacontology.projectvic.org/3.0.0> .

# NCMEC Report Structure
cacontology-us-ncmec:NCMECCybertipReport rdf:type owl:Class ;
    rdfs:label "NCMEC Cybertip Report"@en ;
    rdfs:comment "A report submitted to NCMEC's CyberTipline. This class represents the root structure of a NCMEC report as defined in the NCMEC Cybertip API documentation."@en ;
    rdfs:subClassOf uco-observable:ObservableObject .

# NCMEC Incident Types
cacontology-us-ncmec:NCMECIncidentType rdf:type owl:Class ;
    rdfs:label "NCMEC Incident Type"@en ;
    rdfs:comment "Types of incidents as defined by NCMEC Cybertip API (Section B.1.1). This class represents the standardized incident categories used in NCMEC reporting."@en ;
    rdfs:subClassOf cac-core:EnduringEntity .

cacontology-us-ncmec:ChildSexTraffickingIncident rdf:type owl:Class ;
    rdfs:label "Child Sex Trafficking Incident"@en ;
    rdfs:comment "Incidents involving child sex trafficking. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Child Sex Trafficking'."@en ;
    rdfs:subClassOf cacontology-us-ncmec:NCMECIncidentType ;
    skos:exactMatch "CST" ;
    cacontology-us-ncmec:incidentCode "CST" .

cacontology-us-ncmec:ChildSexTourismIncident rdf:type owl:Class ;
    rdfs:label "Child Sex Tourism Incident"@en ;
    rdfs:comment "Incidents involving child sex tourism. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Child Sex Tourism'."@en ;
    rdfs:subClassOf cacontology-us-ncmec:NCMECIncidentType ;
    skos:exactMatch "CST" ;
    cacontology-us-ncmec:incidentCode "CST" .

cacontology-us-ncmec:OnlineEnticementIncident rdf:type owl:Class ;
    rdfs:label "Online Enticement Incident"@en ;
    rdfs:comment "Incidents involving online enticement of children for sexual acts. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Online Enticement of Children for Sexual Acts'."@en ;
    rdfs:subClassOf cacontology-us-ncmec:NCMECIncidentType ;
    skos:exactMatch "OE" ;
    cacontology-us-ncmec:incidentCode "OE" .

# NCMEC Report Annotations
cacontology-us-ncmec:NCMECReportAnnotation rdf:type owl:Class ;
    rdfs:label "NCMEC Report Annotation"@en ;
    rdfs:comment "Tags to describe the NCMEC report. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations element."@en ;
    rdfs:subClassOf cac-core:EnduringEntity .

cacontology-us-ncmec:SextortionAnnotation rdf:type owl:Class ;
    rdfs:label "Sextortion Annotation"@en ;
    rdfs:comment "Annotation indicating the report is associated with sextortion. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/sextortion element."@en ;
    rdfs:subClassOf cacontology-us-ncmec:NCMECReportAnnotation .

cacontology-us-ncmec:CSAMSolicitationAnnotation rdf:type owl:Class ;
    rdfs:label "CSAM Solicitation Annotation"@en ;
    rdfs:comment "Annotation indicating the report is associated with solicitation of CSAM. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/csamSolicitation element."@en ;
    rdfs:subClassOf cacontology-us-ncmec:NCMECReportAnnotation .

cacontology-us-ncmec:MinorToMinorInteractionAnnotation rdf:type owl:Class ;
    rdfs:label "Minor to Minor Interaction Annotation"@en ;
    rdfs:comment "Annotation indicating the report is associated with an interaction between minors. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/minorToMinorInteraction element."@en ;
    rdfs:subClassOf cacontology-us-ncmec:NCMECReportAnnotation .

cacontology-us-ncmec:SpamAnnotation rdf:type owl:Class ;
    rdfs:label "Spam Annotation"@en ;
    rdfs:comment "Annotation indicating the report is associated with spam. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/spam element."@en ;
    rdfs:subClassOf cacontology-us-ncmec:NCMECReportAnnotation .

# NCMEC Report Properties
cacontology-us-ncmec:hasNCMECIncidentType rdf:type owl:ObjectProperty ;
    rdfs:label "has NCMEC incident type"@en ;
    rdfs:comment "Links a NCMEC report to its incident type. Source: NCMEC Cybertip API Section B.1.1, incidentType element."@en ;
    rdfs:domain cacontology-us-ncmec:NCMECCybertipReport ;
    rdfs:range cacontology-us-ncmec:NCMECIncidentType .

cacontology-us-ncmec:hasNCMECReportAnnotation rdf:type owl:ObjectProperty ;
    rdfs:label "has NCMEC report annotation"@en ;
    rdfs:comment "Links a NCMEC report to its annotations. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations element."@en ;
    rdfs:domain cacontology-us-ncmec:NCMECCybertipReport ;
    rdfs:range cacontology-us-ncmec:NCMECReportAnnotation .

# NCMEC Incident Code Property
cacontology-us-ncmec:incidentCode rdf:type owl:DatatypeProperty ;
    rdfs:label "incident code"@en ;
    rdfs:comment "The official NCMEC incident type code. Source: NCMEC Cybertip API Section B.1.1, incidentType element."@en ;
    rdfs:domain cacontology-us-ncmec:NCMECIncidentType ;
    rdfs:range xsd:string .

# =============================================================================
# ENHANCED NCMEC TIP ANALYSIS CLASSES
# =============================================================================

cacontology-us-ncmec:CyberTipAnalysis rdf:type owl:Class ;
    rdfs:label "CyberTip Analysis"@en ;
    rdfs:comment "Analytical processing and assessment of NCMEC CyberTip reports by law enforcement."@en ;
    rdfs:subClassOf uco-observable:ObservableObject .

cacontology-us-ncmec:PossessionIndicator rdf:type owl:Class ;
    rdfs:label "Possession Indicator"@en ;
    rdfs:comment "Evidence or indicators suggesting possession of child sexual abuse material."@en ;
    rdfs:subClassOf cacontology-us-ncmec:CyberTipAnalysis .

cacontology-us-ncmec:TransferDetection rdf:type owl:Class ;
    rdfs:label "Transfer Detection"@en ;
    rdfs:comment "Detection of transfer or sharing of child sexual abuse material."@en ;
    rdfs:subClassOf cacontology-us-ncmec:CyberTipAnalysis .

cacontology-us-ncmec:AccountLinking rdf:type owl:Class ;
    rdfs:label "Account Linking"@en ;
    rdfs:comment "Process of linking digital accounts to suspects through NCMEC tip analysis."@en ;
    rdfs:subClassOf cacontology-us-ncmec:CyberTipAnalysis .

cacontology-us-ncmec:PhoneNumberTrace rdf:type owl:Class ;
    rdfs:label "Phone Number Trace"@en ;
    rdfs:comment "Tracing of phone numbers linked to accounts in NCMEC tips."@en ;
    rdfs:subClassOf cacontology-us-ncmec:CyberTipAnalysis .

cacontology-us-ncmec:ContentIdentification rdf:type owl:Class ;
    rdfs:label "Content Identification"@en ;
    rdfs:comment "Identification and classification of illegal content in NCMEC tips."@en ;
    rdfs:subClassOf cacontology-us-ncmec:CyberTipAnalysis .

cacontology-us-ncmec:PlatformCooperation rdf:type owl:Class ;
    rdfs:label "Platform Cooperation"@en ;
    rdfs:comment "Cooperation from digital platforms in providing information for NCMEC tips."@en ;
    rdfs:subClassOf uco-observable:ObservableObject .

# =============================================================================
# INVESTIGATION TRIGGER CLASSES
# =============================================================================

cacontology-us-ncmec:InvestigationTrigger rdf:type owl:Class ;
    rdfs:label "Investigation Trigger"@en ;
    rdfs:comment "Event or information that triggers law enforcement investigation based on NCMEC tip."@en ;
    rdfs:subClassOf uco-observable:ObservableObject .

cacontology-us-ncmec:TaskForceReferral rdf:type owl:Class ;
    rdfs:label "Task Force Referral"@en ;
    rdfs:comment "Referral of NCMEC tip to appropriate CAC task force for investigation."@en ;
    rdfs:subClassOf cacontology-us-ncmec:InvestigationTrigger .

cacontology-us-ncmec:LocalLawEnforcementReferral rdf:type owl:Class ;
    rdfs:label "Local Law Enforcement Referral"@en ;
    rdfs:comment "Referral of NCMEC tip to local law enforcement agency."@en ;
    rdfs:subClassOf cacontology-us-ncmec:InvestigationTrigger .

cacontology-us-ncmec:FederalReferral rdf:type owl:Class ;
    rdfs:label "Federal Referral"@en ;
    rdfs:comment "Referral of NCMEC tip to federal law enforcement agencies."@en ;
    rdfs:subClassOf cacontology-us-ncmec:InvestigationTrigger .

# =============================================================================
# TIP PROCESSING CLASSES
# =============================================================================

cacontology-us-ncmec:TipProcessing rdf:type owl:Class ;
    rdfs:label "Tip Processing"@en ;
    rdfs:comment "Processing workflow for NCMEC tips from receipt to investigation referral."@en ;
    rdfs:subClassOf uco-observable:ObservableObject .

cacontology-us-ncmec:TipPrioritization rdf:type owl:Class ;
    rdfs:label "Tip Prioritization"@en ;
    rdfs:comment "Priority assessment and ranking of NCMEC tips for investigation."@en ;
    rdfs:subClassOf cacontology-us-ncmec:TipProcessing .

cacontology-us-ncmec:TipValidation rdf:type owl:Class ;
    rdfs:label "Tip Validation"@en ;
    rdfs:comment "Validation and verification of information in NCMEC tips."@en ;
    rdfs:subClassOf cacontology-us-ncmec:TipProcessing .

cacontology-us-ncmec:TipEnrichment rdf:type owl:Class ;
    rdfs:label "Tip Enrichment"@en ;
    rdfs:comment "Enhancement of NCMEC tips with additional investigative information."@en ;
    rdfs:subClassOf cacontology-us-ncmec:TipProcessing .

# =============================================================================
# ENHANCED NCMEC PROPERTIES
# =============================================================================

# Analysis Properties
cacontology-us-ncmec:analysisConfidence rdf:type owl:DatatypeProperty ;
    rdfs:label "analysis confidence"@en ;
    rdfs:comment "Confidence level in tip analysis (high, medium, low)."@en ;
    rdfs:domain cacontology-us-ncmec:CyberTipAnalysis ;
    rdfs:range xsd:string .

cacontology-us-ncmec:indicatorStrength rdf:type owl:DatatypeProperty ;
    rdfs:label "indicator strength"@en ;
    rdfs:comment "Strength of possession or transfer indicators (strong, moderate, weak)."@en ;
    rdfs:domain cacontology-us-ncmec:PossessionIndicator ;
    rdfs:range xsd:string .

cacontology-us-ncmec:transferVolume rdf:type owl:DatatypeProperty ;
    rdfs:label "transfer volume"@en ;
    rdfs:comment "Volume of material transferred in megabytes."@en ;
    rdfs:domain cacontology-us-ncmec:TransferDetection ;
    rdfs:range xsd:decimal .

cacontology-us-ncmec:transferFrequency rdf:type owl:DatatypeProperty ;
    rdfs:label "transfer frequency"@en ;
    rdfs:comment "Frequency of transfer activity (single, multiple, ongoing)."@en ;
    rdfs:domain cacontology-us-ncmec:TransferDetection ;
    rdfs:range xsd:string .

cacontology-us-ncmec:accountConfidence rdf:type owl:DatatypeProperty ;
    rdfs:label "account confidence"@en ;
    rdfs:comment "Confidence level in account linking (verified, probable, possible)."@en ;
    rdfs:domain cacontology-us-ncmec:AccountLinking ;
    rdfs:range xsd:string .

cacontology-us-ncmec:phoneVerificationStatus rdf:type owl:DatatypeProperty ;
    rdfs:label "phone verification status"@en ;
    rdfs:comment "Status of phone number verification (verified, unverified, disconnected)."@en ;
    rdfs:domain cacontology-us-ncmec:PhoneNumberTrace ;
    rdfs:range xsd:string .

# Processing Properties
cacontology-us-ncmec:processingTime rdf:type owl:DatatypeProperty ;
    rdfs:label "processing time"@en ;
    rdfs:comment "Time taken to process tip in hours."@en ;
    rdfs:domain cacontology-us-ncmec:TipProcessing ;
    rdfs:range xsd:decimal .

cacontology-us-ncmec:priorityLevel rdf:type owl:DatatypeProperty ;
    rdfs:label "priority level"@en ;
    rdfs:comment "Priority level assigned to tip (critical, high, medium, low)."@en ;
    rdfs:domain cacontology-us-ncmec:TipPrioritization ;
    rdfs:range xsd:string .

cacontology-us-ncmec:validationStatus rdf:type owl:DatatypeProperty ;
    rdfs:label "validation status"@en ;
    rdfs:comment "Validation status of tip (validated, partially_validated, not_validated)."@en ;
    rdfs:domain cacontology-us-ncmec:TipValidation ;
    rdfs:range xsd:string .

cacontology-us-ncmec:enrichmentType rdf:type owl:DatatypeProperty ;
    rdfs:label "enrichment type"@en ;
    rdfs:comment "Type of enrichment added (geographic, demographic, technical, behavioral)."@en ;
    rdfs:domain cacontology-us-ncmec:TipEnrichment ;
    rdfs:range xsd:string .

# Trigger Properties
cacontology-us-ncmec:triggerCriteria rdf:type owl:DatatypeProperty ;
    rdfs:label "trigger criteria"@en ;
    rdfs:comment "Criteria that triggered investigation (content_volume, suspect_profile, victim_age, repeat_offender)."@en ;
    rdfs:domain cacontology-us-ncmec:InvestigationTrigger ;
    rdfs:range xsd:string .

cacontology-us-ncmec:urgencyLevel rdf:type owl:DatatypeProperty ;
    rdfs:label "urgency level"@en ;
    rdfs:comment "Urgency level for investigation (immediate, urgent, routine)."@en ;
    rdfs:domain cacontology-us-ncmec:InvestigationTrigger ;
    rdfs:range xsd:string .

cacontology-us-ncmec:referralJurisdiction rdf:type owl:DatatypeProperty ;
    rdfs:label "referral jurisdiction"@en ;
    rdfs:comment "Jurisdiction to which tip is referred (federal, state, local)."@en ;
    rdfs:domain cacontology-us-ncmec:InvestigationTrigger ;
    rdfs:range xsd:string .

# Platform Properties
cacontology-us-ncmec:platformResponseTime rdf:type owl:DatatypeProperty ;
    rdfs:label "platform response time"@en ;
    rdfs:comment "Time taken by platform to respond to information request in hours."@en ;
    rdfs:domain cacontology-us-ncmec:PlatformCooperation ;
    rdfs:range xsd:decimal .

cacontology-us-ncmec:cooperationLevel rdf:type owl:DatatypeProperty ;
    rdfs:label "cooperation level"@en ;
    rdfs:comment "Level of platform cooperation (full, partial, limited, none)."@en ;
    rdfs:domain cacontology-us-ncmec:PlatformCooperation ;
    rdfs:range xsd:string .

cacontology-us-ncmec:dataProvided rdf:type owl:DatatypeProperty ;
    rdfs:label "data provided"@en ;
    rdfs:comment "Type of data provided by platform (account_info, user_data, content, metadata)."@en ;
    rdfs:domain cacontology-us-ncmec:PlatformCooperation ;
    rdfs:range xsd:string .

# =============================================================================
# ENHANCED NCMEC RELATIONSHIPS
# =============================================================================

# Analysis Relationships
cacontology-us-ncmec:analysisOf rdf:type owl:ObjectProperty ;
    rdfs:label "analysis of"@en ;
    rdfs:comment "Links analysis to the NCMEC tip being analyzed."@en ;
    rdfs:domain cacontology-us-ncmec:CyberTipAnalysis ;
    rdfs:range cacontology-us-ncmec:NCMECCybertipReport .

cacontology-us-ncmec:linkedToAccount rdf:type owl:ObjectProperty ;
    rdfs:label "linked to account"@en ;
    rdfs:comment "Links account linking to digital account."@en ;
    rdfs:domain cacontology-us-ncmec:AccountLinking ;
    rdfs:range uco-observable:DigitalAccount .

cacontology-us-ncmec:tracedToPhone rdf:type owl:ObjectProperty ;
    rdfs:label "traced to phone"@en ;
    rdfs:comment "Links phone trace to specific phone number."@en ;
    rdfs:domain cacontology-us-ncmec:PhoneNumberTrace ;
    rdfs:range uco-observable:PhoneNumber .

cacontology-us-ncmec:identifiedContent rdf:type owl:ObjectProperty ;
    rdfs:label "identified content"@en ;
    rdfs:comment "Links content identification to identified digital content."@en ;
    rdfs:domain cacontology-us-ncmec:ContentIdentification ;
    rdfs:range uco-observable:DigitalArtifact .

# Processing Relationships
cacontology-us-ncmec:processedTip rdf:type owl:ObjectProperty ;
    rdfs:label "processed tip"@en ;
    rdfs:comment "Links processing activity to the tip being processed."@en ;
    rdfs:domain cacontology-us-ncmec:TipProcessing ;
    rdfs:range cacontology-us-ncmec:NCMECCybertipReport .

cacontology-us-ncmec:triggeredBy rdf:type owl:ObjectProperty ;
    rdfs:label "triggered by"@en ;
    rdfs:comment "Links investigation trigger to the tip that triggered it."@en ;
    rdfs:domain cacontology-us-ncmec:InvestigationTrigger ;
    rdfs:range cacontology-us-ncmec:NCMECCybertipReport .

cacontology-us-ncmec:resultedInInvestigation rdf:type owl:ObjectProperty ;
    rdfs:label "resulted in investigation"@en ;
    rdfs:comment "Links investigation trigger to the investigation it initiated."@en ;
    rdfs:domain cacontology-us-ncmec:InvestigationTrigger ;
    rdfs:range cacontology:CACInvestigation .

# Cooperation Relationships
cacontology-us-ncmec:involvesPlatform rdf:type owl:ObjectProperty ;
    rdfs:label "involves platform"@en ;
    rdfs:comment "Links platform cooperation to the digital platform involved."@en ;
    rdfs:domain cacontology-us-ncmec:PlatformCooperation ;
    rdfs:range uco-observable:DigitalService .

cacontology-us-ncmec:supportedBy rdf:type owl:ObjectProperty ;
    rdfs:label "supported by"@en ;
    rdfs:comment "Links tip analysis to platform cooperation that supported it."@en ;
    rdfs:domain cacontology-us-ncmec:CyberTipAnalysis ;
    rdfs:range cacontology-us-ncmec:PlatformCooperation .