NCMEC Is a Governmental Entity for Fourth Amendment Purposes, But ESP Hash-Matching Alone Does Not Make Providers Government Agents

Comprehensive Commentary on United States v. Guard, No. 23-6886 (2d Cir. Sept. 10, 2025)

Introduction

United States v. Guard presented the Second Circuit with a recurring and nationally significant question at the intersection of digital privacy and child-exploitation enforcement: when do searches initiated by electronic service providers (ESPs) and reports routed through the National Center for Missing and Exploited Children (NCMEC) implicate the Fourth Amendment?

The defendant, Wesley Guard, was convicted by a jury of transportation, receipt, and possession of child pornography in violation of 18 U.S.C. § 2252A. He moved to suppress evidence derived from searches Kik Messenger performed using Microsoft’s PhotoDNA hashing technology and then reported via NCMEC’s CyberTipline. Guard argued that NCMEC is a governmental entity, and that Kik acted as NCMEC’s agent or instrument. He also challenged his Miranda waiver, the sufficiency of the evidence, the substantive reasonableness of his sentence, and several supervised-release conditions.

The Second Circuit’s opinion does two especially consequential things. First, it squarely holds—joining the Tenth Circuit and parting ways with some other circuits—that NCMEC is a governmental entity for Fourth Amendment purposes. Second, it holds that Guard failed to carry his burden to show Kik acted as a governmental agent: the use of NCMEC-provided hash values and voluntary PhotoDNA scanning, without more, does not establish the “close nexus” required to attribute Kik’s search to the government. The court affirmed the convictions, rejected the Miranda and sufficiency challenges, upheld a below-Guidelines but lengthy sentence, and vacated and remanded solely to conform certain supervised-release conditions to the district court’s oral pronouncement.

Summary of the Opinion

• Fourth Amendment – State Action:
  • NCMEC is a governmental entity for Fourth Amendment purposes.
  • Guard did not prove Kik acted as a governmental agent or instrument when it scanned for and reviewed suspected CSAM. Kik’s use of NCMEC hash values and voluntary PhotoDNA scanning, standing alone, did not create a “close nexus” to the State.
  • Result: suppression denied.
• Fifth Amendment – Miranda:
  • Guard knowingly and voluntarily waived his Miranda rights; no suppression of statements.
• Sufficiency of the Evidence:
  • Knowledge: circumstantial evidence, including Guard’s admissions, permitted a reasonable jury to find he knew the files were child pornography.
  • Possession “on or about” April 29, 2021: a rational juror could infer continued access (or dominion and control) over his receiving account.
• Sentence:
  • 151 months’ imprisonment and 15 years’ supervised release was not substantively unreasonable, especially given the statutory ranges and a below-Guidelines sentence after a careful § 3553(a) analysis that accounted for concerns associated with U.S.S.G. § 2G2.2 (Jenkins).
• Supervised Release Conditions:
  • Remand to conform the written judgment to the oral pronouncement:
    • Special Conditions 2 and 4 must clarify that Guard may have contact with his own minor children.
    • Special Condition 7 must clarify that any one-device internet-capable limitation is imposed by the court, not by probation alone.
    • No change to Special Condition 3 (places where children congregate); no conflict with oral pronouncement.

Factual and Procedural Background

Kik is a mobile messaging application that supports private and group chats and media sharing. Like many ESPs, Kik deploys Microsoft’s PhotoDNA hashing technology. When users upload images, PhotoDNA computes a hash (a kind of digital fingerprint) and compares it against a NCMEC-populated repository of hashes of known CSAM. If there is a match, a designated Kik employee reviews the file; if it appears to be CSAM, Kik removes it from public view, preserves it for a limited period, and transmits the file and account metadata to NCMEC’s CyberTipline. Federal law mandates reporting when an ESP has actual knowledge of CSAM but does not require ESPs to proactively scan (18 U.S.C. § 2258A).

In September 2020 and January 2021, Kik submitted two CyberTipline reports identifying accounts “ski18taco” and “ski118taco,” associated IP addresses in Queensbury, NY, and multiple files that NCMEC categorized as hash matches and apparent child pornography. Law enforcement traced the IP addresses to Guard and confirmed his residence. An HSI agent reviewed the files and concluded that many depicted child pornography under 18 U.S.C. § 2256(8). A warrant issued for Guard’s residence was executed on April 29, 2021. Before the search, agents interviewed Guard after administering Miranda warnings; Guard signed a waiver, admitted to using the relevant Kik accounts, and to viewing and sharing child pornography. A later warrant to Kik yielded extensive account records.

A jury acquitted Guard of two distribution counts and convicted him of transportation, receipt, and possession. The district court denied Guard’s suppression motion (both Fourth and Fifth Amendment grounds) and post-trial motions. It imposed 151 months’ imprisonment and 15 years’ supervised release. Guard appealed.

Detailed Analysis

Precedents and Authorities Cited and Their Influence

• Fourth Amendment State Action and Private Search Doctrine:
  • United States v. Jacobsen (1984): The Fourth Amendment restrains governmental action; purely private searches are not covered.
  • Norwood v. Harrison (1973), Lebron v. Amtrak (1995), Brentwood Academy v. TSSAA (2001), Lugar v. Edmondson Oil (1982), Jackson v. Metropolitan Edison (1974): A suite of Supreme Court state-action cases. The court draws on these to identify multiple analytical lenses—public function, compulsion, and close nexus/entwinement.
  • United States v. DiTomasso (2d Cir. 2019): Applying the close nexus test in the ESP context; acquiescence or approval isn’t enough—there must be significant encouragement, coercion, or entwinement.
  • United States v. Hines (2d Cir. 2025): Confirms the movant’s burden to establish state action; clarifies the “close nexus” standard and what counts as significant encouragement or coercion.
  • United States v. Miller (6th Cir. 2020), United States v. Rosenow (9th Cir. 2022): Both concluded that providers’ scanning and reporting generally do not transform them into state actors; Rosenow also treated NCMEC as non-governmental. Guard departs from Rosenow on NCMEC’s status.
  • United States v. Ackerman (10th Cir. 2016): Found NCMEC to be a governmental entity/actor when it exceeded a private party’s search by opening attachments not previously viewed by AOL. Guard adopts Ackerman’s core premise about NCMEC’s status.
• Statutes Structuring NCMEC:
  • 34 U.S.C. § 11293: Designates NCMEC as the official national resource center/clearinghouse and assigns extensive law-enforcement collaboration duties.
  • 18 U.S.C. § 2258A: Requires ESPs to report apparent CSAM to NCMEC and affords NCMEC statutory immunity to receive, view, and distribute otherwise illegal contraband to law enforcement (subsection (g)(3)).
• Child Pornography Elements and Sufficiency:
  • United States v. Colavito (2d Cir. 1994): Knowledge elements (actual minor; sexually explicit conduct).
  • United States v. Ramos (2d Cir. 2012): Possession can rest on dominion and control; “on or about” language provides temporal flexibility.
  • United States v. Santos (2008) and other sufficiency standards (Aquart, Gu, Jimenez): Emphasize heavy deference to the jury’s reasonable inferences.
• Sentencing:
  • United States v. Jenkins (2d Cir. 2017): Warns that § 2G2.2 must be applied with care due to structural concerns.
  • Gall v. United States (2007), United States v. Muzio (2d Cir. 2020), United States v. Degroate (2d Cir. 2019), United States v. Skys (2d Cir. 2011): Standards for substantive reasonableness and deference to the district court’s weighing of § 3553(a) factors.
• Miranda:
  • Miranda v. Arizona (1966); United States v. Capers (2d Cir. 2010); United States v. Medunjanin (2d Cir. 2014): Accurate conveyance and voluntary, knowing waiver standards.
• Oral vs. Written Sentence:
  • United States v. Washington (2d Cir. 2018), United States v. Peguro (2d Cir. 2022): Oral pronouncement controls over conflicting written judgment; remedy is limited remand to conform.

Legal Reasoning

1) NCMEC’s Status: A Governmental Entity

The court undertakes a function-over-form inquiry rooted in Brentwood and Lebron: does the entity exercise sovereign authority or wield “political power”? Congress’s statutory scheme imbues NCMEC with uniquely governmental responsibilities and immunities:

• It is the sole, official national clearinghouse and resource center for missing and exploited children (34 U.S.C. § 11293(b)(1)(B)).
• It coordinates with law enforcement in numerous statutorily prescribed ways (Id. § 11293(b)(1)).
• ESPs must report to NCMEC (and not to a different public agency) when they have actual knowledge of apparent CSAM (18 U.S.C. § 2258A(a)), and failure to report is penalized (§ 2258A(e)).
• Congress confers immunity for receiving, viewing, and distributing contraband to law enforcement (18 U.S.C. § 2258A(g)(3)), a function otherwise unlawful for private actors.

Against this backdrop, the court aligns with Ackerman: whatever NCMEC’s corporate form, its statutory authority and integrated law-enforcement role render it a governmental entity for Fourth Amendment purposes. This resolves an open question in the Second Circuit and contributes to a maturing circuit split.

2) Kik’s Status: No “Close Nexus” on This Record

The dispositive state-action question is whether Kik’s scanning and review can be “fairly attributable” to the government. Applying the close-nexus lens (the only path Guard meaningfully pressed on appeal), the court asks whether the government exercised coercive power, was entwined in management or control, or provided significant encouragement tied to the specific conduct at issue.

The record showed:

• Kik voluntarily deployed PhotoDNA and used a NCMEC-populated hash repository.
• After a match, a Kik employee personally reviewed the file and, upon confirming suspected CSAM, reported through the CyberTipline as required by § 2258A.
• Federal law does not compel ESPs to affirmatively scan for CSAM (§ 2258A(f)(3)).

Critical gaps doomed the claim. There was no evidence that NCMEC compelled Kik to scan, dictated how PhotoDNA was used, controlled access to PhotoDNA, or otherwise significantly encouraged or directed Kik’s scanning beyond providing the hash repository and receiving statutorily required reports. As a result, Kik’s search did not trigger the Fourth Amendment.

Importantly, the opinion is narrow: it does not hold that an ESP can never be a state actor, only that Guard failed to make that showing here. Different facts—e.g., contractual directives, technical control, targeted requests, or extensive operational entwinement—could change the outcome.

3) Miranda Waiver

Guard signed a written waiver. He asked a clarifying question—whether he could obtain a lawyer mid-interview—and agents told him they could “work on that” and that questioning could stop. The court found this exchange sufficient to convey rights reasonably and to support a knowing, voluntary waiver. There was no clear error in the district court’s factual finding that Miranda was administered and understood, nor legal error in upholding the waiver.

4) Sufficiency of the Evidence

The “knowledge” element can be proven circumstantially. Guard admitted he had been looking at child pornography on Kik and that he shared such images. Although he argued thumbnails did not necessarily show CSAM and that he may not have opened files, the jury could draw reasonable inferences about knowledge from his statements and usage patterns.

For possession “on or about” April 29, 2021, the government pointed to the “the18taco” receiving account. Kik testimony indicated accounts used only to receive CSAM were not automatically banned, and law enforcement had not been alerted to that account. Combined with Guard’s admission that he used two other accounts to distribute, a rational juror could infer continued access or dominion and control over contraband on or about the charged date. The standard of review’s deference to the jury carried the day.

5) Sentencing

The district court imposed a below-Guidelines sentence after engaging § 3553(a) factors and explicitly grappling with concerns associated with § 2G2.2, as Jenkins counsels. It declined a requested distribution enhancement, cataloged the offense conduct and its harms (including descriptions of files and contemporaneous chat comments), addressed Guard’s prior sex offense and pretrial violations, and considered personal characteristics and mental health. The 151-month sentence, given statutory minima and maxima (5 to 60 years across counts) and a 168–210 month advisory range, was not “shockingly high” or otherwise outside the realm of permissible decisions.

6) Supervised Release Conditions: Oral Controls Written

The panel enforced the familiar rule: the oral pronouncement governs when it conflicts with the written judgment. It ordered a limited remand to:

• Clarify that Special Conditions 2 and 4 do not bar Guard from contact with his own minor children.
• Clarify that any one-device limit under Special Condition 7 is imposed by the district court upon recommendation, not unilaterally by probation.
• No change to Special Condition 3 (avoiding places where children congregate), which did not conflict with the oral pronouncement.

Impact and Forward-Looking Implications

A. A New, Binding Second Circuit Rule: NCMEC Is Governmental

Guard settles a foundational question in the Second Circuit: NCMEC is a governmental entity for Fourth Amendment purposes. This has immediate consequences for litigation about whether and when NCMEC’s own conduct constitutes a “search,” and especially whether NCMEC’s review exceeds the scope of a private search initiated by an ESP. Ackerman teaches that if NCMEC opens files or attachments not previously examined by the private party, that can be state action exceeding the private search, potentially requiring a warrant or an applicable exception.

Expect more granular discovery and evidentiary hearings about:

• Exactly what the ESP viewed versus what NCMEC later examined.
• What portions of the CyberTipline report are auto-populated (e.g., Section B hash-match metadata) versus human-generated (Section C open-source or other analysis).
• Whether NCMEC staff actually “opened” or “viewed” content beyond the provider’s private review.

The government will likely structure workflows to ensure NCMEC’s role aligns with Jacobsen’s “scope of the private search” doctrine, or that any expansion is justified by a warrant or exception.

B. ESP Scanning and Hash-Matching: Still Private on This Record

Guard underscores the heavy burden on defendants to prove state action. Mere participation in an ecosystem Congress designed—NCMEC hash repositories, mandatory reporting upon actual knowledge—does not automatically render ESP searches governmental. To transform a private scan into state action under the close-nexus framework, defendants will need evidence of significant governmental coercion, direction, or entwinement regarding the specific search conduct.

C. Circuit Landscape and Potential Supreme Court Interest

With the Second Circuit now aligned with the Tenth (Ackerman) and in tension with the Ninth (Rosenow) on NCMEC’s status, the national split deepens. The Supreme Court may ultimately clarify whether, and to what extent, NCMEC is a state actor across contexts and how Jacobsen’s private-search limits operate in the CyberTipline regime.

D. Practical Takeaways

• For the defense:
  • Build a fact-rich record on the ESP–NCMEC relationship: contracts, communications, technical controls, and the precise sequence of who viewed what and when.
  • Focus on whether NCMEC’s human review exceeded the provider’s private search (opening files the provider did not, or doing more than hash-based verification).
• For the government:
  • Document that ESPs act independently and voluntarily; avoid directions that could be construed as significant encouragement or coercion.
  • Where NCMEC’s activities could exceed a private search, consider warrants or articulate exceptions.
• For ESPs:
  • Maintain clear policies: scanning is voluntary; mandatory reporting triggers only upon actual knowledge, not upon governmental compulsion to search.
  • Segregate and log automated hash-matching and limited human verification steps.

Complex Concepts Simplified

• Hashing / PhotoDNA:
  • A hash is a unique, short alphanumeric signature derived from a file’s content. PhotoDNA uses perceptual hashing—robust to common edits—to match against a database of known CSAM hashes curated via NCMEC. A “hash match” strongly indicates the file is a duplicate of a previously confirmed contraband image.
• CyberTipline Report Structure:
  • Section A: ESP-provided content and metadata (e.g., user IDs, IPs, timestamps, files).
  • Section B: Automatically generated by NCMEC systems (e.g., hash-match labels, categorizations, IP geo-lookup).
  • Section C: Human-entered NCMEC information (often open-source research).
  • Section D: The law enforcement agency receiving the tip.
• Close Nexus Test (State Action):
  • Private conduct triggers the Fourth Amendment only if the government coerced, significantly encouraged, or is entwined with the specific conduct—mere approval or passive receipt of information is not enough.
• Private Search Doctrine (Jacobsen):
  • Government may replicate, but not exceed, a private party’s prior search without a warrant. Opening or viewing content the private party did not examine can constitute a new governmental search requiring justification.
• “On or About” in Indictments:
  • Permits proof that the offense occurred reasonably close to the alleged date; precise-date proof is not always required if the evidence supports temporal proximity.
• Constructive Possession:
  • Possession can be established by the power and intention to exercise control (dominion) over contraband, even if not in one’s immediate physical custody.
• Oral vs. Written Sentence:
  • When the written judgment conflicts with the unambiguous oral pronouncement at sentencing, the oral controls; the remedy is to remand to conform the written judgment.

Conclusion

United States v. Guard is a landmark Second Circuit decision in the digital child-exploitation context. It holds that NCMEC is a governmental entity for Fourth Amendment purposes, reshaping the analytical starting point for suppression litigation involving CyberTipline processes in this circuit. At the same time, the court preserves a crucial boundary: an ESP’s voluntary use of NCMEC hash values and PhotoDNA scanning does not, without more, transform it into a state actor. On the facts presented, Kik’s scanning and human confirmation remained private action.

The court’s treatment of Miranda, sufficiency, and sentencing reflects well-settled principles: careful deference to the jury’s reasonable inferences, respect for district court discretion within the § 3553(a) framework (even amid § 2G2.2’s known issues), and adherence to the oral-controls-written rule for supervised release conditions.

Most importantly for future cases, Guard invites more precise factual development about the boundary between private ESP activity and NCMEC’s governmental role. Where NCMEC’s human review ventures beyond what the provider previously examined, Fourth Amendment scrutiny will now be more searching in the Second Circuit. That clarification is likely to influence investigative practices, defense strategies, and perhaps, given the deepening split, eventual Supreme Court review.