AIP 210 · Educators & School Staff
School Incident Response Lead
Run the first 60 minutes, handle images and devices correctly, keep a defensible evidence log, communicate clearly, respond equitably, and practice until it is routine.
What you will be able to do
- Assign incident roles and run the first 60 minutes of an exploitation incident.
- Apply the hard rule on student images: never view, copy, forward or screenshot, and secure the device for law enforcement.
- Keep an evidence log and a clean chain of custody without copying content.
- Communicate with families, staff and press using facts only.
- Respond equitably, without blaming the student who was exploited.
- Plan, run and review a tabletop exercise.
1 Module 1 of 6 · 40 min
Incident command roles and the first 60 minutes
- Name the six incident roles and what each one owns.
- Sequence the first ten, thirty and sixty minutes.
- Explain why roles are assigned before an incident, with a named backup.
Incident responders do not improvise on the worst day. They follow a plan with named owners. A school can do the same. When roles are decided in advance, people can focus on the student instead of arguing about who decides.
| Role | Owns |
|---|---|
| Incident lead (principal or designee) | Final decisions, pace, and who is told what |
| Student support lead (counselor) | Safety, wellbeing and privacy of every affected student |
| Technical lead (IT) | Device handling, account and platform preservation, without viewing content |
| Law-enforcement liaison (SRO or designee) | Contact with police, NCMEC and handoff of devices |
| Communications lead | Parent, staff, student and media messages, with one spokesperson |
| Scribe | Time-stamped log of facts, decisions and handoffs |
| When | Priorities |
|---|---|
| 0 to 10 minutes | Make the student safe. Stop access to the device without viewing the content. Notify the incident lead. Call law enforcement. |
| 10 to 30 minutes | Assign roles. Start the log. Make the report to law enforcement and the NCMEC CyberTipline as appropriate. Support the student. |
| 30 to 60 minutes | Hand the device to law enforcement. Identify who is affected, without interrogating. Plan family notification and a holding statement. |
Name backups
Every role needs a named backup, because incidents do not wait for the right person to be on campus. Keep the roster on one printed page and in the staff folder.
A counselor tells you that students are passing around an intimate image of a classmate in a group chat. Dismissal is in 20 minutes. The principal is at the district office.
What are your first ten minutes?
Show the debrief
Protect the depicted student first and arrange a calm, private place with the counselor. Do not view or ask anyone to show the image. Alert the incident lead by phone, name the backup if the principal cannot be reached, call law enforcement, and start the log. Do not send a school-wide message yet, and do not interrogate students in a group. Ask staff who hold relevant devices to keep them secure, and let law enforcement guide the next steps. Immediate danger means 911.
Knowledge check
2 Module 2 of 6 · 35 min
The hard rule on student images
- State the hard rule and explain why it exists.
- Describe how to secure a device without viewing its contents.
- Respond correctly when someone has already opened or copied an image.
The hard rule
No staff member views, copies, forwards or screenshots an intimate image of a student. Each copy harms the child again, and possessing or sharing such an image can itself be a crime. Secure the device and hand it to law enforcement.
- Do not search the device or ask a student to show you the image.
- Isolate the device, not the child. Keep the student with a trusted adult.
- Handle the device as little as possible. Put it in airplane mode or power it off as law enforcement directs.
- Seal it in an envelope, label it, and log who held it and when.
- Hand it to law enforcement and record the handoff.
- Report to the NCMEC CyberTipline (report.cybertip.org or 1-800-843-5678). Under-18 images can be removed through Take It Down.
- Don’t forward the image to the school police officer, a lawyer or the district.
- Don’t ask students to delete evidence. Ask them to stop sharing, and hand the issue to law enforcement.
- Don’t tell a student their image was seen by staff in a way that increases shame.
An assistant principal reports that a student handed over a phone and, before anyone stopped them, the assistant principal opened the image. They want to forward it to the school police officer “so they can see exactly what it is.”
What do you tell them, and what do you record?
Show the debrief
Stop. Do not copy or forward the image. Tell law enforcement exactly who has seen it and when, and log that fact without describing the image. Secure the device as described. The assistant principal can be supported and does not need to be blamed. Law enforcement will decide what they need and collect it properly.
Knowledge check
3 Module 3 of 6 · 30 min
Evidence log and chain of custody
- Write log entries that state facts without opinions or content descriptions.
- Maintain chain of custody for a device.
- List what can be preserved online without copying images.
A clear log lets law enforcement trust what happened and when. Record what people did and saw, not what you think happened. Never describe or paste the image itself.
| Date and time | Event | By whom | Where or which device | Handed to |
|---|---|---|---|---|
| 2:55 pm | Phone received from [Student A]; sealed in envelope #4; contents not viewed. | [Staff name] | Room 12 | Law-enforcement liaison |
| 3:20 pm | Envelope #4 handed to Officer [Name], seal intact. | [Staff name] | Main office | [Officer name] |
- Every entry has a date and time.
- Entries record facts and actions, not opinions.
- The image is never described, quoted or attached.
- Every handoff names who gave and who received.
- The seal is checked and noted at each handoff.
Online, preserve what identifies the source without copying images: usernames, profile links, group names, dates and times, and the text of threats or demands. Ask law enforcement to send preservation requests to platforms.
A teacher took a phone from a student on Wednesday, left it in an unlocked desk drawer over the weekend, and now cannot remember who else touched it.
What should the incident lead do now?
Show the debrief
Tell law enforcement the facts plainly, including the gap in custody. Write a time-stamped account from each person involved, then secure the device properly and log the handoff. An honest account of a gap is more useful than a hidden one. Add device handling to the school’s training and the after-action review.
Knowledge check
4 Module 4 of 6 · 40 min
Communications to parents, staff and press
- Draft factual, short messages for families, staff and students.
- Sequence notifications so affected families hear first.
- Handle media requests with one spokesperson and a holding statement.
Silence invites rumors, and speculation harms children. Good communication is short, factual and kind. It does not name minors, describe images or guess about responsibility.
- Use facts that are known and confirmed.
- Say what the school is doing and how families can get help.
- Name one contact person.
- Coordinate wording with law enforcement and district counsel before release.
- Don’t name minors or describe the image.
- Don’t speculate about who is responsible.
- Don’t promise outcomes.
- Don’t post first on social media.
Parent letter (short form)
“Dear [School name] families, the school has learned of an incident involving inappropriate images shared among students. We have contacted law enforcement and are supporting the students affected. Please talk with your child about sharing images and tell them to stop forwarding anything they receive. Our counselors are available at [contact]. To report concerns, call [name] at [number].”
Media holding statement
“[School name] is aware of a matter involving student safety. We have contacted law enforcement and are supporting the students and families affected. Out of respect for the privacy of minors, we cannot share more at this time. Please direct questions to [name] at [contact].”
Sequence matters. Tell directly affected families first and in person or by phone, then staff, then the wider parent community, then the media if needed. Hold the messages until the incident lead, law enforcement and counsel agree on wording.
A local reporter calls the front office and asks whether an image of a student was “leaked.” Meanwhile a parent group chat names a student as the person responsible.
How does the communications lead respond to each?
Show the debrief
Direct the reporter to the single spokesperson, who reads the holding statement and does not confirm details about minors. For the rumor, tell the incident lead and law enforcement, avoid correcting it by naming anyone, and send the approved parent message with facts and resources. Remind staff not to discuss the incident in chats. Support any student named in a rumor through the counselor.
Knowledge check
5 Module 5 of 6 · 35 min
Discipline, victim-blaming and an equitable response
- Distinguish the student who was exploited from students who requested, shared or received the image.
- Apply policy consistently, whatever a student’s status.
- Choose supports and consequences that do not shame.
When an image of a student circulates, people often turn on the student in the image. That is victim-blaming, and it teaches other children not to tell. A good response protects the student first, applies the school’s policy fairly to those who shared, and offers support to everyone who needs it.
| Role in the incident | Response approach |
|---|---|
| Student depicted or targeted | Treat as a victim. Do not discipline them for being exploited. Offer counseling and privacy. |
| Student who asked for or pressured | Take seriously. Consult law enforcement and counsel, and apply policy consistently. |
| Student who shared or forwarded | Stop the spread, apply proportionate, consistent consequences, and teach. |
| Student who received it | Instruct to stop sharing, give support, and let law enforcement guide next steps. |
- Don’t suspend or shame the student who was exploited.
- Don’t give a lighter outcome because of status, grades or sports.
- Don’t use public apologies or hallway naming.
Sexual harassment duties, including Title IX where it applies, and discipline rules vary by district and situation. Consult district counsel and law enforcement before disciplining any student involved.
A popular athlete forwarded the image to a team chat. Coaches and some parents ask the school to “handle it quietly” so the season is not affected. The student in the image is being teased.
What does the incident lead do?
Show the debrief
Apply the policy consistently regardless of status, guided by counsel and law enforcement, and do not handle it quietly. Protect the depicted student with counseling, a safety plan and steps to stop the teasing. Offer supports to the athlete as well, and use restorative steps only where it is safe and the affected student agrees.
Knowledge check
6 Module 6 of 6 · 40 min
Running a tabletop and the after-action review
- Plan and facilitate a 45-minute tabletop exercise.
- Run a blameless after-action review with the four questions.
- Turn findings into owned, dated fixes.
A tabletop exercise is a talk-through of a realistic scenario with the people who would respond. It finds gaps in a plan before a real incident does. Responders in many fields use it because practice makes the real thing calmer.
- Invite the incident lead, student support lead, technical lead, law-enforcement liaison and communications lead.
- Read a short scenario and give timed ‘injects’ such as a new report, a parent email or a reporter call.
- Ask each role what they would do, and who they would call.
- Note gaps, assumptions and delays in plain words.
- End with the after-action review and assign owners and dates.
| After-action question | Purpose |
|---|---|
| What did we expect to happen? | Compare the plan to reality |
| What actually happened? | State the facts without blame |
| Why was there a difference? | Find the cause |
| What will we change? | Create owned, dated fixes |
| Finding | Why | Fix | Owner | Date |
|---|---|---|---|---|
| No named technical lead | IT staff vary by shift | Name lead and backup | [Name] | [Date] |
During a tabletop, the incident lead asks who secures the device. Three people point at one another, and the person everyone names is on leave next week.
What finding do you record, and what is the fix?
Show the debrief
Record that the technical lead role and its backup are unclear. The fix is a named lead and backup, written on the one-page roster, with an owner and a date, rechecked at the next drill. The review is blameless: the gap is in the plan, not the people.
Knowledge check
★ Capstone
A school-specific response plan and a tabletop you ran
The capstone is how you show you can do the work, not just answer questions. It produces something real that you keep.
- Write your school’s response plan: the six roles with names and backups, contact numbers for law enforcement and the child welfare agency, the device-handling steps from module 2, and adapted communication templates from module 4.
- Create a one-page roster and a blank evidence log using the format in module 3.
- Run a 45-minute tabletop with at least four of the six roles, using the facilitator guide and at least two injects.
- Write an after-action review with at least five findings, each with a cause, a fix, an owner and a date.
- Ask your district counsel or administrator to review the plan and record their feedback.
How it is reviewed
- Every role has a named owner and backup, and the roster fits on one page.
- The plan states the hard rule on images and does not instruct anyone to view or copy them.
- The evidence log and chain-of-custody steps contain no content descriptions.
- The tabletop included at least two injects and four roles, and the review is blameless.
- Each finding has an owner and a date, and counsel or an administrator reviewed the plan.
- No real student names or case details appear in any capstone document.
Pass every module check at 80% or better, finish the capstone, then follow the steps on the credentials page to request your certificate.
Counts toward
Companion playbooks
- Intimate image or sextortion on campus: the school incident playbook
- Incident communications: parent, staff, student and media templates
- Run a 45-minute tabletop exercise for your school
- Blameless after-action review
- Preserving evidence: a guide for families
AIP Academy courses are awareness and skills training. They are not legal, medical or clinical advice, and an AIP certificate is not a license, state or professional accreditation, CLE credit, or a promise of employment. In an emergency call 911.
Safety is built before the crisis
Pick your part and see it through. Prevention works when people follow through.