NCMEC Cybertip Report Ontology (US Extension)
An ontology for representing concepts specific to NCMEC Cybertip reports as an extension to the core CAC ontology. Version 3.1.0.
NCMEC Cybertip Report
A report submitted to NCMEC's CyberTipline. This class represents the root structure of a NCMEC report as defined in the NCMEC Cybertip API documentation.
NCMEC Incident Type
Types of incidents as defined by NCMEC Cybertip API (Section B.1.1). This class represents the standardized incident categories used in NCMEC reporting.
Child Sex Trafficking Incident
Incidents involving child sex trafficking. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Child Sex Trafficking'.
Child Sex Tourism Incident
Incidents involving child sex tourism. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Child Sex Tourism'.
Online Enticement Incident
Incidents involving online enticement of children for sexual acts. Source: NCMEC Cybertip API Section B.1.1, incidentType 'Online Enticement of Children for Sexual Acts'.
NCMEC Report Annotation
Tags to describe the NCMEC report. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations element.
Sextortion Annotation
Annotation indicating the report is associated with sextortion. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/sextortion element.
CSAM Solicitation Annotation
Annotation indicating the report is associated with solicitation of CSAM. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/csamSolicitation element.
Minor to Minor Interaction Annotation
Annotation indicating the report is associated with an interaction between minors. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/minorToMinorInteraction element.
Spam Annotation
Annotation indicating the report is associated with spam. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations/spam element.
has NCMEC incident type
Links a NCMEC report to its incident type. Source: NCMEC Cybertip API Section B.1.1, incidentType element.
has NCMEC report annotation
Links a NCMEC report to its annotations. Source: NCMEC Cybertip API Section B.1.1, reportAnnotations element.
incident code
The official NCMEC incident type code. Source: NCMEC Cybertip API Section B.1.1, incidentType element.
CyberTip Analysis
Analytical processing and assessment of NCMEC CyberTip reports by law enforcement.
Possession Indicator
Evidence or indicators suggesting possession of child sexual abuse material.
Transfer Detection
Detection of transfer or sharing of child sexual abuse material.
Account Linking
Process of linking digital accounts to suspects through NCMEC tip analysis.
Phone Number Trace
Tracing of phone numbers linked to accounts in NCMEC tips.
Content Identification
Identification and classification of illegal content in NCMEC tips.
Platform Cooperation
Cooperation from digital platforms in providing information for NCMEC tips.
Investigation Trigger
Event or information that triggers law enforcement investigation based on NCMEC tip.
Task Force Referral
Referral of NCMEC tip to appropriate CAC task force for investigation.
Local Law Enforcement Referral
Referral of NCMEC tip to local law enforcement agency.
Federal Referral
Referral of NCMEC tip to federal law enforcement agencies.
Tip Processing
Processing workflow for NCMEC tips from receipt to investigation referral.
Tip Prioritization
Priority assessment and ranking of NCMEC tips for investigation.
Tip Validation
Validation and verification of information in NCMEC tips.
Tip Enrichment
Enhancement of NCMEC tips with additional investigative information.
analysis confidence
Confidence level in tip analysis (high, medium, low).
indicator strength
Strength of possession or transfer indicators (strong, moderate, weak).
transfer volume
Volume of material transferred in megabytes.
transfer frequency
Frequency of transfer activity (single, multiple, ongoing).
account confidence
Confidence level in account linking (verified, probable, possible).
phone verification status
Status of phone number verification (verified, unverified, disconnected).
processing time
Time taken to process tip in hours.
priority level
Priority level assigned to tip (critical, high, medium, low).
validation status
Validation status of tip (validated, partially_validated, not_validated).
enrichment type
Type of enrichment added (geographic, demographic, technical, behavioral).
trigger criteria
Criteria that triggered investigation (content_volume, suspect_profile, victim_age, repeat_offender).
urgency level
Urgency level for investigation (immediate, urgent, routine).
referral jurisdiction
Jurisdiction to which tip is referred (federal, state, local).
platform response time
Time taken by platform to respond to information request in hours.
cooperation level
Level of platform cooperation (full, partial, limited, none).
data provided
Type of data provided by platform (account_info, user_data, content, metadata).
CyberTip Identifier Extraction Action
A CAC-domain action that extracts structured identifiers (screen names, phone numbers, IP addresses, email addresses) from a CyberTipline report document, including by OCR or document parsing.
CyberTip Extracted Identifier Set
An information artifact representing the set of identifiers extracted from a CyberTipline report, used to support triage, enrichment, and routing.
CyberTip Jurisdiction Routing Assessment
A triage assessment that uses extracted identifiers and enrichment results to recommend or determine the responsible jurisdiction or agency for routing or investigation.
extracts identifier from cybertip
Links an extraction action to the CyberTip report or report document it processes.
produced identifier set
Links an extraction action to the identifier set it produced.
has extracted screen name
Links an extracted identifier set to a screen name / account handle observable (e.g., a DigitalAccount or ApplicationAccount).
has extracted phone number
Links an extracted identifier set to a phone number observable.
has extracted IP address
Links an extracted identifier set to an IP address observable.
uses extracted identifier set
Links a jurisdiction routing assessment to the extracted identifier set (and enrichment results) it relies on.
recommended jurisdiction
Links a routing assessment to the jurisdiction or agency recommended for follow-up (e.g., a cacontology-multi:Jurisdiction instance or an Organization).
Aggregate Report Statistic
A single published aggregate statistic about CyberTipline reporting or related NCMEC program activity (e.g., annual report volume, category growth rate, cumulative hash counts), as stated in NCMEC public transparency data. Each instance carries exactly one primary numeric value; compound published claims should be decomposed into one instance per value. Instances are statistical claims about report populations, not individual report instances.
statistic value
The primary numeric value of the published statistic.
statistic unit
The unit of the statistic value (e.g., 'reports', 'files', 'percent', 'hashes', 'days', 'organizations', 'reports per day').
statistic qualifier
Qualifier applied to the statistic value in the published source (e.g., 'more than', 'approximately', 'just over', 'average').
reporting period
The reporting period the statistic covers, as stated in the published source (e.g., '2025', 'as of 2025-12-31', '2023-2025 cumulative').
percent change from prior period
Published percentage change of this statistic relative to the prior reporting period (positive for increase, negative for decrease).
statistic topic
Links an aggregate statistic to the reporting category, program, or concept it describes (e.g., an online enticement category node or the Take It Down service).
analysis of
Links analysis to the NCMEC tip being analyzed.
linked to account
Links account linking to digital account.
traced to phone
Links phone trace to specific phone number.
identified content
Links content identification to identified digital content.
processed tip
Links processing activity to the tip being processed.
triggered by
Links investigation trigger to the tip that triggered it.
resulted in investigation
Links investigation trigger to the investigation it initiated.
involves platform
Links platform cooperation to the digital platform involved.
supported by
Links tip analysis to platform cooperation that supported it.