NCMEC Cybertip Report Ontology (US Extension)
type: Ontology
comment: An ontology for representing concepts specific to NCMEC Cybertip reports as an extension to the core CAC ontology. Version 3.1.0.
version IRI: https://cacontology.projectvic.org/us/ncmec/3.1.0
version info: 3.1.0
creator: CAC Ontology Team
issued: 2024-03-20
modified: 2026-08-09
imports: https://cacontology.projectvic.org/3.1.0

NCMEC Cybertip Report
type: Class
comment: A report submitted to NCMEC's CyberTipline. This class represents the root structure of a NCMEC report as defined in the NCMEC Cybertip API documentation.
subclass of: ObservableObject

NCMEC Incident Type
type: Class
comment: Types of incidents as defined by NCMEC Cybertip API (Section B.1.1). This class represents the standardized incident categories used in NCMEC reporting.
subclass of: EnduringEntity

Child Sex Trafficking Incident
type: Class
comment: Incidents involving child sex trafficking. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Child Sex Trafficking'.
subclass of: NCMEC Incident Type
incident code: CST

Child Sex Tourism Incident
type: Class
comment: Incidents involving child sex tourism. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Child Sex Tourism'.
subclass of: NCMEC Incident Type
incident code: CST

Online Enticement Incident
type: Class
comment: Incidents involving online enticement of children for sexual acts. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Online Enticement of Children for Sexual Acts'.
subclass of: NCMEC Incident Type
incident code: OE

NCMEC Report Annotation
type: Class
comment: Tags to describe the NCMEC report. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations element.
subclass of: EnduringEntity

Sextortion Annotation
type: Class
comment: Annotation indicating the report is associated with sextortion. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/sextortion element.
subclass of: NCMEC Report Annotation

CSAM Solicitation Annotation
type: Class
comment: Annotation indicating the report is associated with solicitation of CSAM. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/csamSolicitation element.
subclass of: NCMEC Report Annotation

Minor to Minor Interaction Annotation
type: Class
comment: Annotation indicating the report is associated with an interaction between minors. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/minorToMinorInteraction element.
subclass of: NCMEC Report Annotation

Spam Annotation
type: Class
comment: Annotation indicating the report is associated with spam. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/spam element.
subclass of: NCMEC Report Annotation

has NCMEC incident type
type: ObjectProperty
comment: Links a NCMEC report to its incident type. Source: NCMEC Cybertip API Section B.1.1, incidentType element.
domain: NCMEC Cybertip Report
range: NCMEC Incident Type

has NCMEC report annotation
type: ObjectProperty
comment: Links a NCMEC report to its annotations. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations element.
domain: NCMEC Cybertip Report
range: NCMEC Report Annotation

incident code
type: DatatypeProperty
comment: The official NCMEC incident type code. Source: NCMEC Cybertip API Section B.1.1, incidentType element.
domain: NCMEC Incident Type
range: string

CyberTip Analysis
type: Class
comment: Analytical processing and assessment of NCMEC CyberTip reports by law enforcement.
subclass of: ObservableObject

Possession Indicator
type: Class
comment: Evidence or indicators suggesting possession of child sexual abuse material.
subclass of: CyberTip Analysis

Transfer Detection
type: Class
comment: Detection of transfer or sharing of child sexual abuse material.
subclass of: CyberTip Analysis

Account Linking
type: Class
comment: Process of linking digital accounts to suspects through NCMEC tip analysis.
subclass of: CyberTip Analysis

Phone Number Trace
type: Class
comment: Tracing of phone numbers linked to accounts in NCMEC tips.
subclass of: CyberTip Analysis

Content Identification
type: Class
comment: Identification and classification of illegal content in NCMEC tips.
subclass of: CyberTip Analysis

Platform Cooperation
type: Class
comment: Cooperation from digital platforms in providing information for NCMEC tips.
subclass of: ObservableObject

Investigation Trigger
type: Class
comment: Event or information that triggers law enforcement investigation based on NCMEC tip.
subclass of: ObservableObject

Task Force Referral
type: Class
comment: Referral of NCMEC tip to appropriate CAC task force for investigation.
subclass of: Investigation Trigger

Local Law Enforcement Referral
type: Class
comment: Referral of NCMEC tip to local law enforcement agency.
subclass of: Investigation Trigger

Federal Referral
type: Class
comment: Referral of NCMEC tip to federal law enforcement agencies.
subclass of: Investigation Trigger

Tip Processing
type: Class
comment: Processing workflow for NCMEC tips from receipt to investigation referral.
subclass of: ObservableObject

Tip Prioritization
type: Class
comment: Priority assessment and ranking of NCMEC tips for investigation.
subclass of: Tip Processing

Tip Validation
type: Class
comment: Validation and verification of information in NCMEC tips.
subclass of: Tip Processing

Tip Enrichment
type: Class
comment: Enhancement of NCMEC tips with additional investigative information.
subclass of: Tip Processing

analysis confidence
type: DatatypeProperty
comment: Confidence level in tip analysis (high, medium, low).
domain: CyberTip Analysis
range: string

indicator strength
type: DatatypeProperty
comment: Strength of possession or transfer indicators (strong, moderate, weak).
domain: Possession Indicator
range: string

transfer volume
type: DatatypeProperty
comment: Volume of material transferred in megabytes.
domain: Transfer Detection
range: decimal

transfer frequency
type: DatatypeProperty
comment: Frequency of transfer activity (single, multiple, ongoing).
domain: Transfer Detection
range: string

account confidence
type: DatatypeProperty
comment: Confidence level in account linking (verified, probable, possible).
domain: Account Linking
range: string

phone verification status
type: DatatypeProperty
comment: Status of phone number verification (verified, unverified, disconnected).
domain: Phone Number Trace
range: string

processing time
type: DatatypeProperty
comment: Time taken to process tip in hours.
domain: Tip Processing
range: decimal

priority level
type: DatatypeProperty
comment: Priority level assigned to tip (critical, high, medium, low).
domain: Tip Prioritization
range: string

validation status
type: DatatypeProperty
comment: Validation status of tip (validated, partially_validated, not_validated).
domain: Tip Validation
range: string

enrichment type
type: DatatypeProperty
comment: Type of enrichment added (geographic, demographic, technical, behavioral).
domain: Tip Enrichment
range: string

trigger criteria
type: DatatypeProperty
comment: Criteria that triggered investigation (content_volume, suspect_profile, victim_age, repeat_offender).
domain: Investigation Trigger
range: string

urgency level
type: DatatypeProperty
comment: Urgency level for investigation (immediate, urgent, routine).
domain: Investigation Trigger
range: string

referral jurisdiction
type: DatatypeProperty
comment: Jurisdiction to which tip is referred (federal, state, local).
domain: Investigation Trigger
range: string

platform response time
type: DatatypeProperty
comment: Time taken by platform to respond to information request in hours.
domain: Platform Cooperation
range: decimal

cooperation level
type: DatatypeProperty
comment: Level of platform cooperation (full, partial, limited, none).
domain: Platform Cooperation
range: string

data provided
type: DatatypeProperty
comment: Type of data provided by platform (account_info, user_data, content, metadata).
domain: Platform Cooperation
range: string

CyberTip Identifier Extraction Action
type: Class
comment: A CAC-domain action that extracts structured identifiers (screen names, phone numbers, IP addresses, email addresses) from a CyberTipline report document, including by OCR or document parsing.
subclass of: Action

CyberTip Extracted Identifier Set
type: Class
comment: An information artifact representing the set of identifiers extracted from a CyberTipline report, used to support triage, enrichment, and routing.
subclass of: ObservableObject

CyberTip Jurisdiction Routing Assessment
type: Class
comment: A triage assessment that uses extracted identifiers and enrichment results to recommend or determine the responsible jurisdiction or agency for routing or investigation.
subclass of: CyberTip Analysis

extracts identifier from cybertip
type: ObjectProperty
comment: Links an extraction action to the CyberTip report or report document it processes.
domain: CyberTip Identifier Extraction Action
range: NCMEC Cybertip Report

produced identifier set
type: ObjectProperty
comment: Links an extraction action to the identifier set it produced.
domain: CyberTip Identifier Extraction Action
range: CyberTip Extracted Identifier Set

has extracted screen name
type: ObjectProperty
comment: Links an extracted identifier set to a screen name / account handle observable (e.g., a DigitalAccount or ApplicationAccount).
domain: CyberTip Extracted Identifier Set
range: ObservableObject

has extracted phone number
type: ObjectProperty
comment: Links an extracted identifier set to a phone number observable.
domain: CyberTip Extracted Identifier Set
range: ObservableObject

has extracted IP address
type: ObjectProperty
comment: Links an extracted identifier set to an IP address observable.
domain: CyberTip Extracted Identifier Set
range: ObservableObject

uses extracted identifier set
type: ObjectProperty
comment: Links a jurisdiction routing assessment to the extracted identifier set (and enrichment results) it relies on.
domain: CyberTip Jurisdiction Routing Assessment
range: CyberTip Extracted Identifier Set

recommended jurisdiction
type: ObjectProperty
comment: Links a routing assessment to the jurisdiction or agency recommended for follow-up (e.g., a cacontology-multi:Jurisdiction instance or an Organization).
domain: CyberTip Jurisdiction Routing Assessment
range: UcoObject

Aggregate Report Statistic
type: Class
comment: A single published aggregate statistic about CyberTipline reporting or related NCMEC program activity (e.g., annual report volume, category growth rate, cumulative hash counts), as stated in NCMEC public transparency data. Each instance carries exactly one primary numeric value; compound published claims should be decomposed into one instance per value. Instances are statistical claims about report populations, not individual report instances.
subclass of: Assertion

statistic value
type: DatatypeProperty
comment: The primary numeric value of the published statistic.
domain: Aggregate Report Statistic
range: decimal

statistic unit
type: DatatypeProperty
comment: The unit of the statistic value (e.g., 'reports', 'files', 'percent', 'hashes', 'days', 'organizations', 'reports per day').
domain: Aggregate Report Statistic
range: string

statistic qualifier
type: DatatypeProperty
comment: Qualifier applied to the statistic value in the published source (e.g., 'more than', 'approximately', 'just over', 'average').
domain: Aggregate Report Statistic
range: string

reporting period
type: DatatypeProperty
comment: The reporting period the statistic covers, as stated in the published source (e.g., '2025', 'as of 2025-12-31', '2023-2025 cumulative').
domain: Aggregate Report Statistic
range: string

percent change from prior period
type: DatatypeProperty
comment: Published percentage change of this statistic relative to the prior reporting period (positive for increase, negative for decrease).
domain: Aggregate Report Statistic
range: decimal

statistic topic
type: ObjectProperty
comment: Links an aggregate statistic to the reporting category, program, or concept it describes (e.g., an online enticement category node or the Take It Down service).
domain: Aggregate Report Statistic
range: UcoObject

analysis of
type: ObjectProperty
comment: Links analysis to the NCMEC tip being analyzed.
domain: CyberTip Analysis
range: NCMEC Cybertip Report

linked to account
type: ObjectProperty
comment: Links account linking to digital account.
domain: Account Linking
range: DigitalAccount

traced to phone
type: ObjectProperty
comment: Links phone trace to specific phone number.
domain: Phone Number Trace
range: PhoneNumber

identified content
type: ObjectProperty
comment: Links content identification to identified digital content.
domain: Content Identification
range: DigitalArtifact

processed tip
type: ObjectProperty
comment: Links processing activity to the tip being processed.
domain: Tip Processing
range: NCMEC Cybertip Report

triggered by
type: ObjectProperty
comment: Links investigation trigger to the tip that triggered it.
domain: Investigation Trigger
range: NCMEC Cybertip Report

resulted in investigation
type: ObjectProperty
comment: Links investigation trigger to the investigation it initiated.
domain: Investigation Trigger
range: CACInvestigation

involves platform
type: ObjectProperty
comment: Links platform cooperation to the digital platform involved.
domain: Platform Cooperation
range: DigitalService

supported by
type: ObjectProperty
comment: Links tip analysis to platform cooperation that supported it.
domain: CyberTip Analysis
range: Platform Cooperation