Playbook
Intimate image or sextortion on campus: the school incident playbook
A full incident-response runbook for a school when an intimate image of a minor is circulating or a student is being blackmailed, with roles and a first-60-minutes timeline.
1 Phase 1 of 6 · Prepare
Prepare
Assign roles in advance. On the day, nobody should be deciding who does what.
| Role | Responsibilities |
|---|---|
| Incident lead (principal or designee) | Owns decisions, convenes the team, approves communications. Does not handle the device or the image. |
| Safety & student support (counselor) | Protects and supports the affected students. Leads recovery. Makes sure no student is interrogated or blamed. |
| Technical lead (IT) | Advises on securing devices and accounts. Does not open, copy or search for the image. Preserves logs only as law enforcement directs. |
| Law-enforcement liaison (SRO or designee) | Contacts law enforcement and the NCMEC CyberTipline. Takes custody of any device. |
| Communications | Drafts and sends parent, staff and media messages. Uses the communications guide. |
| Scribe / log keeper | Keeps one running written log: times, who, what was said and done. Distributes nothing without the lead’s approval. |
- Name a person and a backup for every role. Write the phone numbers on this page.
- Agree who calls law enforcement and child welfare, and the policy timing. Confirm with district counsel.
- Store hotline numbers: 911, NCMEC 1-800-843-5678, Childhelp 1-800-422-4453, 988.
- Run the tabletop exercise once a year.
Related
2 Phase 2 of 6 · Spot it
Spot it
Confirm what is being reported without looking at the image.
The hard rule
No staff member views, copies, forwards or screenshots an intimate image of a student. Not the principal, not IT, not the SRO acting alone. Possessing or sharing the image can itself be a crime, and every extra copy is more harm to the child.
- The person who receives the report writes down who reported it, what they said, and when. They do not ask to see the image.
- Tell the incident lead right away. The lead activates the roles above and the scribe starts the log.
- Establish only the basics: which student or students are depicted, which device or app, and whether anyone is threatening the student.
3 Phase 3 of 6 · Contain
Contain
Isolate the device, not the child. Stop the spread without punishing the victim.
| Time | Action | Owner |
|---|---|---|
| 0–10 min | Take the report. Activate the team. Start the log. Make sure the affected student is safe and with a trusted adult. | Incident lead, scribe |
| 10–20 min | Secure any device holding the image: switch it to airplane mode or power it off, do not browse it, bag it, and keep it with one named adult. | Law-enforcement liaison |
| 20–30 min | Call law enforcement. Report to the NCMEC CyberTipline (report.cybertip.org or 1-800-843-5678). Follow policy for child welfare. | Law-enforcement liaison |
| 30–45 min | Counselor meets the affected student privately and kindly. Check wellbeing. Do not ask for the image or for a full account. | Counselor |
| 45–60 min | Decide parent contact for affected students with law enforcement’s advice. Draft the first messages. | Incident lead, communications |
- Take the device, not the student. The student should never feel they are being detained.
- Keep the affected student’s name to the smallest possible group.
- If a student is being sextorted, tell the family not to pay and not to delete accounts. See the family playbook.
- Don’t search phones, ask students to show you the image, or ask them to delete it. Deleting can destroy evidence.
- Don’t line students up or interrogate them as a group.
- Don’t announce it over the intercom or in class.
4 Phase 4 of 6 · Clean up
Clean up
Work out who is affected, get the image removed, and keep the record clean.
- Law enforcement leads on who shared and who received. The school supports with schedules and facts, not interrogation.
- Help the affected student or family use Take It Down (takeitdown.ncmec.org) so participating platforms can remove the image. It works from a hash, so the image is not uploaded. Adults depicted use StopNCII.org.
- Separate roles. A student who was depicted is a victim. A student who shared it may have harmed someone and needs a proper response. A student who received it and did nothing has a different part. Treat each by what they did.
- Apply discipline consistently under your code of conduct and with counsel. Never discipline a depicted student for being in the image.
- The scribe closes the log and secures it. Share it only with law enforcement and district counsel.
- Log has times, names of staff, and actions, and no description of the image.
- Device custody is documented: who held it, when, and who received it.
- NCMEC CyberTipline report made, with the report number noted.
- Parents of affected students told, in the manner law enforcement agreed.
5 Phase 5 of 6 · Recover
Recover
The harm after the image is social. Protect the student from the school day.
- Offer the affected student flexible scheduling, a safe adult, and counseling.
- Watch for bullying, rumors and group chats. Respond quickly and quietly to any of it.
- Offer support to students who shared or received. Many are frightened or confused.
- If a student talks about self-harm, call or text 988 and follow your crisis procedure.
- Hold a brief, factual message for students about respect and reporting. Do not describe the incident.
6 Phase 6 of 6 · Learn
Learn
Within two weeks, review how the plan worked. Fix the plan, not the people.
- Meet with the incident team and read the log in order.
- Ask: what was slow, unclear or missing? Where did anyone handle the image or a device the wrong way?
- Update the roles table, contact list and parent letter.
- Brief all staff on the one-page rules: do not view, copy or forward; isolate the device; report.
Awareness Is Prevention is a prevention and education nonprofit, not a crisis line, law firm or law enforcement agency. This is general guidance, not legal or medical advice. In an emergency call 911.
Related
- When a student tells you: the educator disclosure playbook
- Incident communications: parent, staff, student and media templates
- Run a 45-minute tabletop exercise for your school
- Preserving evidence: a guide for families
- AI-generated fake images (“nudify” and deepfakes): the response playbook
- Blameless after-action review
- Hotlines and reporting tools
Safety is built before the crisis
Pick your part and see it through. Prevention works when people follow through.