Who This Page Is For
This page is for people who are under federal investigation or charged with an internet-based offense under 18 U.S.C. § 2252, § 2252A, or § 2422(b). Many of the people who call us have not been charged. Agents executed a search warrant, took phones and computers, and left. Others were contacted by an agent, received a target letter, or were arrested.
These cases are common in Florida. TRAC data for 2026 shows § 2252 in the national top 10 of federal prosecutions in 3 of the 5 months it reported, at about 79 new defendants a month. U.S. Sentencing Commission data for fiscal year 2025 shows these cases made up 3.7% of sentencings in the Southern District of Florida and 4.6% in the Middle District, compared with 2.1% nationally.
For state charges, registration violations, and other sex offense matters, see our Sex Offense and SORNA Defense page.
How These Cases Start
- CyberTipline reports. Under 18 U.S.C. § 2258A, email, cloud, and social media providers must report apparent violations to the National Center for Missing and Exploited Children (NCMEC). Many reports come from automated scanning that matches files against known material. NCMEC forwards the report, with account details and IP addresses, to law enforcement.
- ICAC task forces. State and local Internet Crimes Against Children task forces receive many of those reports and work them with federal partners.
- HSI and FBI. Homeland Security Investigations and the FBI run their own cases, including peer-to-peer network monitoring and undercover operations online.
- Records and the warrant. Agents subpoena the provider and internet carrier to tie an IP address to a home, then apply for a search warrant. Devices are seized and imaged for forensic review, which can take months.
- Agents at the door. Search warrants are often executed early in the morning, and agents usually try to interview the person at home during the search. That interview is frequently the most damaging evidence in the case.
Our Brillhart analysis explains how the Eleventh Circuit treats a provider's own scan of an account.
The Statutes and What the Government Must Prove
Federal law uses the term "child pornography." This page uses the more current term, child sexual abuse material (CSAM), except where quoting a statute.
18 U.S.C. § 2252 and § 2252A. The two statutes overlap and are charged in similar ways. The government must prove the person acted knowingly: that they knew the material was there and knew what it depicted. The key distinction is the type of conduct charged.
- Receipt or distribution (§ 2252(a)(2), § 2252A(a)(2)): mandatory minimum of 5 years, maximum of 20. With a qualifying prior conviction, 15 to 40 years.
- Possession or accessing with intent to view (§ 2252(a)(4), § 2252A(a)(5)): no mandatory minimum, maximum of 10 years, or 20 years if the material involves a prepubescent minor or a minor under 12. With a qualifying prior, 10 to 20 years.
18 U.S.C. § 2422(b), enticement of a minor. This statute covers using the internet or phone to knowingly persuade, induce, entice, or coerce a person under 18, or a person believed to be under 18, to engage in illegal sexual activity, and attempts to do so. The penalty is a mandatory minimum of 10 years and a maximum of life (§ 2422). Many of these cases come from undercover operations where no minor was involved.
18 U.S.C. § 2251. Production charges carry a 15-year mandatory minimum and are outside the scope of this page.
Penalties and How Sentencing Works
Sentences are driven by USSG § 2G2.2. The base offense level is 18 for possession and 22 for receipt or distribution, and enhancements are added for use of a computer, the number of images (each video counts as 75), the age of minors depicted, and distribution. Several of these enhancements apply in nearly every internet case, which pushes the advisory range high.
Federal judges know this. The U.S. Sentencing Commission's 2021 report on non-production offenses found that in fiscal year 2019, 59.0% of non-production defendants were sentenced below the guideline range, and only 30.0% within it. A variance is not automatic. It comes from a documented mitigation record and a precise challenge to each enhancement. See our federal sentencing mitigation page.
Other consequences:
- Supervised release. 18 U.S.C. § 3583(k) authorizes a term of 5 years to life, with conditions that usually limit internet use, device access, and contact with minors.
- Registration. Conviction triggers registration under the Sex Offender Registration and Notification Act. Failure to register is a separate federal felony under 18 U.S.C. § 2250.
- Restitution and forfeiture. In § 2252 and § 2252A cases, restitution to identified victims is mandatory under 18 U.S.C. § 2259, and seized devices are forfeited.
- Detention. Receipt, distribution, and enticement charges carry a presumption of detention before trial.
Defense Strategy
The forensic case. Digital evidence is the case, and it is not self-explanatory. We retain an independent forensic examiner to review the government's images and reports.
- Who had access. Shared homes, shared computers, open Wi-Fi, shared accounts, and remote access all bear on attribution.
- Automatic downloads and cache. Files in a browser cache, thumbnail database, or unallocated space can exist without the user ever opening them. Some apps download content automatically.
- Timing and metadata. File system dates, download dates, and login records can place a person somewhere else when a file arrived.
- Chain of custody. Every image, hash, and extraction must be traced from seizure to report.
The warrant. We review the probable cause affidavit, the age of the information it relied on, the scope of the search, and the provider's role. Suppression motions are filed when the facts support them.
The charge. Whether the case is charged as possession or receipt can decide whether a mandatory minimum applies. Early, informed negotiation can change the charge.
Mitigation. Psychosexual evaluations, treatment records, employment and family history, and character evidence are assembled early, so they are ready for a charging conversation or a sentencing hearing.
For computer intrusion and other technology charges, see Federal Cybercrime Defense.
What to Do After a Search Warrant
- Do not talk to agents. You may decline an interview, during the search or later. Say you want a lawyer and stop. Statements made "off the record" are recorded in the agent's report. Read our guide to the FBI doorstep interview.
- Do not delete anything. Do not wipe, reset, or discard devices, and do not close or change accounts. Destroying records after learning of an investigation can be charged under 18 U.S.C. § 1519, which carries up to 20 years.
- Do not discuss the case by phone, text, email, or social media, including with family.
- Keep the warrant paperwork and the inventory of what was taken.
- Call a federal defense lawyer now, before charges are filed. The pre-charge window is when counsel can do the most.
