CSAM detection & handling

Imaginook treats child sexual abuse material (CSAM) as an unconditional illegal-content floor: detection, quarantine, evidence preservation, and reporting are independent of the moderation policy and cannot be disabled by any taste-policy setting.

The pipeline is pluggable and off by default. The open-source self-host build runs the null driver (an operator cannot obtain the ESP licensing that PhotoDNA and NCMEC require). The hosted imaginook.com instance enables the real drivers.

Drivers

Concern	Contract	Self-host default	Hosted
Image scanning	App\Contracts\ImageScanner	NullImageScanner	PhotoDnaScanner (CSAM_DRIVER=photodna) or CloudflareCsamScanner
CyberTipline	App\Contracts\NcmecReporter	NullNcmecReporter	CyberTiplineReporter (CSAM_NCMEC_DRIVER=cybertip)

Credentials live in config/services.php (photodna, ncmec) and are never logged: the PhotoDNA subscription key is sent only as an Ocp-Apim-Subscription-Key header, and NCMEC credentials only as HTTP basic auth.

What happens on a match

The image scan runs on the queue (ScanUpload → FileScanner → the pluggable ImageScanner). On a positive match the CsamHandler runs, unconditionally:

1. Preserve — the flagged bytes are moved out of quarantine into the write-once restricted evidence store (CSAM_EVIDENCE_PATH, read-only), keyed by an opaque evidence_key on the csam_reports row. A preserved_until of at least 90 days is set. The evidence store is never pruned and is not torn down when the owner's account is deleted.
2. Take the site offline — a source=scan csam moderation flag is raised, which auto-suspends the site through the illegal-content floor.
3. Report — ReportCsamToNcmec is dispatched to file a CyberTipline report out of band (retryable). Under the null reporter this is a no-op; the report stays preserved.

No perceptual/PhotoDNA hash is ever stored in csam_reports or shared on the federated safety feed — only an opaque "actioned" signal.

Evidence access

csam_reports and the evidence store are restricted to designated CSAM handlers — a per-user capability (users.csam_handler) layered on top of the staff role, so a moderator or admin is not automatically a handler. The /admin/csam surface shows report metadata only (never the imagery), and every access is written to the immutable audit log with the actor, the report id, and a timestamp. The imagery is provided to NCMEC / law enforcement out of band.

NCMEC ESP registration (hosted only)

Begin early — registration takes weeks.

1. Apply to NCMEC as an Electronic Service Provider (ESP) and execute the required agreements.
2. Register a designated contact (legal + technical) for CyberTipline coordination and keep it current.
3. Obtain CyberTipline ESP API credentials and set NCMEC_USERNAME / NCMEC_PASSWORD (+ CSAM_NCMEC_DRIVER=cybertip).
4. Obtain a Microsoft PhotoDNA subscription and set PHOTODNA_SUBSCRIPTION_KEY (+ CSAM_DRIVER=photodna).

Operator runbook — a confirmed match

1. Automated: evidence preserved (≥ 90 days), site suspended, CyberTipline report filed (ncmec_report_id recorded on the report).
2. A CSAM handler reviews the report metadata at /admin/csam (access is logged).
3. Coordinate the evidence handoff with NCMEC / law enforcement per the ESP procedure; do not download or re-serve the imagery through the application.
4. Preserve for at least the statutory window; never release or delete the scan item (the quarantine controller refuses release/removal for category=csam).
5. Record the outcome; close the report only after the preservation window and any law-enforcement hold have elapsed.