This document defines the standard operating procedures for identifying and responding to crisis situations within the community, including threats, self-harm, illegal activity, and data breaches.

1. Purpose

This SOP provides clear, actionable procedures for community staff to follow when a crisis situation arises. The goal is to protect member safety, minimize harm, and ensure appropriate authorities are contacted when necessary.

2. Scope

This procedure applies to all moderators, administrators, and staff across all community platforms. A "crisis" is defined as any situation that poses an immediate or serious risk to the safety or well-being of community members, the organization, or the public.

3. Crisis Categories

CategoryExamplesSeverity
Self-Harm / SuicideMember expressing suicidal ideation, self-harm intent, or sharing evidence of self-harmCritical
Threats of ViolenceThreats against individuals, groups, events, or venuesCritical
Illegal ActivityCSAM, drug trafficking, fraud, or other criminal activityCritical
Data BreachUnauthorized access to member data, leaked credentials, or system compromiseHigh
Harassment CampaignCoordinated harassment, doxxing, or targeted abuse of membersHigh
Minor SafetyAn adult engaging in inappropriate contact with a minor, grooming behaviorCritical

4. Immediate Response Procedures

In any crisis, the immediate priority is safety. Do not delay action to gather more information if someone is in immediate danger.

4.1 Self-Harm / Suicide

  • Do: Respond with empathy and concern. Let the person know you care and want to help.
  • Do: Provide crisis resources: 988 Suicide & Crisis Lifeline (call or text 988), Crisis Text Line (text HOME to 741741).
  • Do: Notify a community administrator immediately.
  • Do: If the person shares their location and appears to be in imminent danger, contact local emergency services (911).
  • Do not: Promise confidentiality if safety is at risk.
  • Do not: Attempt to provide therapy or counseling. You are not a mental health professional.
  • Do not: Share the situation publicly or with uninvolved parties.

4.2 Threats of Violence

  • Immediately screenshot and preserve all evidence (messages, images, timestamps, usernames).
  • Remove the threatening content from public view.
  • Ban the account from all platforms immediately.
  • Notify all administrators and the organization's leadership.
  • If the threat appears credible or specific, contact local law enforcement immediately.
  • If the threat targets a specific event or venue, notify the event organizers and venue management.

4.3 Illegal Activity / CSAM

  • CSAM: Do not view, download, copy, or distribute the material. Report to NCMEC (CyberTipline.org) and contact local law enforcement. Preserve the account information but do not preserve the material itself.
  • Ban the account immediately from all platforms.
  • Notify the organization's leadership immediately.
  • Cooperate fully with law enforcement requests for information.

4.4 Data Breach

  • Immediately notify the Site Administrator and organization leadership.
  • Isolate the affected systems if possible (take offline, revoke compromised credentials).
  • Do not attempt to "fix" the breach without administrator guidance, as this may destroy forensic evidence.
  • Document the timeline: when was the breach discovered, what data may be affected, who has been notified.
  • Affected members must be notified within 72 hours of confirmed breach.

5. Escalation Chain

LevelWhoWhen
1On-duty ModeratorFirst responder; handles initial assessment and immediate safety actions
2Senior Moderator / AdminContacted immediately for all crisis-level situations
3Organization LeadershipContacted for situations involving law enforcement, legal liability, or public safety
4Law Enforcement / Emergency ServicesContacted when there is an immediate threat to life, illegal activity, or as required by law

6. Law Enforcement Contact Procedures

  • Only organization leadership or designated administrators should initiate contact with law enforcement (except in cases of immediate danger to life, where any staff member should call 911).
  • When contacting law enforcement, provide: nature of the incident, platform(s) involved, usernames and any known identifying information, preserved evidence, and timeline of events.
  • Document all interactions with law enforcement: officer name, badge number, case number, and what information was shared.
  • Do not make public statements about law enforcement involvement without legal counsel.

7. Member Safety Protocols

  • If a member is being targeted, offer to help them secure their account (password change, 2FA, privacy settings).
  • If doxxing has occurred, assist the member in reporting to the relevant platforms and law enforcement.
  • Provide the member with relevant safety resources and support contacts.
  • Consider temporary enhanced moderation of the affected areas.

8. Post-Incident Review

  • All crisis incidents must have a post-incident review within 7 days of resolution.
  • The review should cover: what happened, how it was detected, response timeline, what went well, what could be improved, and any policy changes needed.
  • Findings must be documented and shared with the moderation team (with appropriate redaction of sensitive details).
  • Staff involved in traumatic incidents should be offered support and encouraged to take time off if needed.

9. Communication Templates

Template: Response to Member in Crisis (Self-Harm)

"I'm really concerned about what you've shared, and I want you to know that you matter to this community. I'm not a trained counselor, but I want to make sure you get the right support. Please reach out to the 988 Suicide & Crisis Lifeline by calling or texting 988, or text HOME to 741741 for the Crisis Text Line. You are not alone."

Template: Notification to Community After Incident (General)

"We want to let the community know that our moderation team recently responded to a safety concern. The situation has been addressed in accordance with our policies. We take the safety of our members seriously and are always working to maintain a secure environment. If you have any concerns, please reach out via our Contact Us page."

10. Support

For questions about crisis procedures or to report a concern, please visit Contact Us.

Revision History

VersionDateAuthorChanges
1.02026-05-16Moko ConsultingInitial release