When receiving a CYBERTIP from NCMEC, what is the first step an investigator should take?

Serving a preservation letter on the social media platform is the appropriate first step when receiving a CYBERTIP from the National Center for Missing & Exploited Children (NCMEC). This action ensures that any potential evidence related to the case is preserved and not deleted or modified. A preservation letter formally requests the service provider to maintain records that could be vital for the investigation. This includes account information, messages, and any content shared by users relevant to the tip, effectively safeguarding the integrity of the evidence for future analysis.

Preservation is critical in these scenarios, as digital evidence can be transient and easily lost if not promptly secured. By taking this step immediately, investigators set a solid foundation for their case, which can lead to more effective subsequent actions, such as notifying local law enforcement or contacting victims' families once the evidence is securely preserved.