In a law enforcement context, a CP number almost always refers to a hash value — a unique string of letters and numbers that acts as a digital fingerprint for a specific image or video file flagged as child sexual abuse material. “CP” is shorthand for child pornography, the term still used in federal statutes, though investigators and child-safety organizations now generally use “child sexual abuse material,” or CSAM, to describe the same files. The number itself is not a case number or a defendant identifier; it points to one specific piece of digital evidence.
What “CP” Refers To
Federal law defines child pornography as any visual depiction of a minor engaged in sexually explicit conduct, including photographs, films, videos, and computer-generated images, and the definition reaches images digitally altered to make an identifiable minor appear to engage in such conduct.1Office of the Law Revision Counsel. 18 U.S. Code 2256 – Definitions for Chapter You will see “CSAM” in most current investigative and policy writing because the material documents real abuse rather than constituting a category of media. The underlying files are the same; only the label differs.
How Hash Values Work
A hash value is produced by running a file through a mathematical algorithm that outputs a fixed-length string tied to that file’s exact contents. Change a single pixel or frame, and the hash changes. Traditional algorithms like MD5 and SHA detect exact duplicates. Perceptual hashing systems, most notably Microsoft’s PhotoDNA, can flag files that remain visually similar after resizing, compression, or minor edits.
The workflow is straightforward. Once a vetted authority confirms a file as CSAM, its hash is added to a database. When investigators or platforms encounter a file, they hash it and compare the result against those databases. A match flags the file without anyone having to open it. Given the volume of material in circulation, that automation is what makes large-scale detection possible.
In court filings, forensic reports, and investigator notes, a specific hash often appears alongside a file to identify it. That hash is what a reader is likely seeing when a document refers to a “CP number.”
Where the Numbers Come From
Two organizations supply most of the hash intelligence used in U.S. investigations.
The National Center for Missing & Exploited Children (NCMEC) is the central clearinghouse. It vets reported material, generates hashes, and distributes them to technology companies and law enforcement through secure channels so detection can happen without access to the underlying content.2National Center for Missing & Exploited Children. CyberTipline Data
Project VIC International maintains the Video Image Classification Standard (VICS) data model, an internationally accepted format for normalizing hash data across the various forensic tools and vendors used in child exploitation investigations. Officers download hash intelligence from their country’s VICS service portal and import it into validated forensic tools for processing.3Project VIC International. VICS Data Model4Project VIC International. Get Project VIC Hashes
One limit is worth understanding. Hash-matching only identifies material that has already been reviewed and added to a database. Entirely new content will not trigger a match, which is why investigations also rely on tips, undercover work, and forensic review of new files.
When the Hash Is Attached to a Case
Hashes most often enter a specific case during forensic examination of seized devices. The FBI operates a network of 17 Regional Computer Forensics Laboratories that extract and analyze digital evidence for federal, state, and local investigations, and examiners there can recover deleted, encrypted, or damaged files.5Federal Bureau of Investigation. RCFLs Fight Violent Crime and Protect National Security One Byte at a Time6RCFL. Regional Computer Forensics Laboratory
During examination, analysts hash every file on the device and run those hashes against the known databases. Matches identify previously cataloged files. Files that do not match but appear to contain new CSAM are reviewed, categorized, and their hashes added for future detection. The hashes that end up referenced in reports, charging documents, or sentencing filings are generated and assigned at this stage, which is why they can look like opaque identifiers attached to specific items of evidence.
Why the Identifier Matters in Court
Because CSAM depicts the abuse of real children, federal law restricts how the material is handled during a criminal case. Defendants cannot copy, photograph, or reproduce the material. The government must make it reasonably available to the defense, but that access takes the form of inspection at a government facility rather than copies handed over in discovery.7Office of the Law Revision Counsel. 18 U.S. Code 3509 – Child Victims and Child Witnesses Rights
A defendant, their attorney, and any experts they intend to call can view the files at a government facility, but nothing leaves with them. Victims depicted in the material have a parallel right of inspection, again without reproduction.7Office of the Law Revision Counsel. 18 U.S. Code 3509 – Child Victims and Child Witnesses Rights Hash values let everyone involved refer to a specific file precisely without passing the file itself around. When a motion, exhibit list, or report cites a “CP number,” it is pointing at exactly one piece of evidence while keeping the image itself out of circulation.