This document defines the standard operating procedures for identifying and responding to crisis situations within the community, including threats, self-harm, illegal activity, and data breaches.
1. Purpose
This SOP provides clear, actionable procedures for community staff to follow when a crisis situation arises. The goal is to protect member safety, minimize harm, and ensure appropriate authorities are contacted when necessary.
2. Scope
This procedure applies to all moderators, administrators, and staff across all community platforms. A "crisis" is defined as any situation that poses an immediate or serious risk to the safety or well-being of community members, the organization, or the public.
3. Crisis Categories
| Category | Examples | Severity |
|---|---|---|
| Self-Harm / Suicide | Member expressing suicidal ideation, self-harm intent, or sharing evidence of self-harm | Critical |
| Threats of Violence | Threats against individuals, groups, events, or venues | Critical |
| Illegal Activity | CSAM, drug trafficking, fraud, or other criminal activity | Critical |
| Data Breach | Unauthorized access to member data, leaked credentials, or system compromise | High |
| Harassment Campaign | Coordinated harassment, doxxing, or targeted abuse of members | High |
| Minor Safety | An adult engaging in inappropriate contact with a minor, grooming behavior | Critical |
4. Immediate Response Procedures
4.1 Self-Harm / Suicide
- Do: Respond with empathy and concern. Let the person know you care and want to help.
- Do: Provide crisis resources: 988 Suicide & Crisis Lifeline (call or text 988), Crisis Text Line (text HOME to 741741).
- Do: Notify a community administrator immediately.
- Do: If the person shares their location and appears to be in imminent danger, contact local emergency services (911).
- Do not: Promise confidentiality if safety is at risk.
- Do not: Attempt to provide therapy or counseling. You are not a mental health professional.
- Do not: Share the situation publicly or with uninvolved parties.
4.2 Threats of Violence
- Immediately screenshot and preserve all evidence (messages, images, timestamps, usernames).
- Remove the threatening content from public view.
- Ban the account from all platforms immediately.
- Notify all administrators and the organization's leadership.
- If the threat appears credible or specific, contact local law enforcement immediately.
- If the threat targets a specific event or venue, notify the event organizers and venue management.
4.3 Illegal Activity / CSAM
- CSAM: Do not view, download, copy, or distribute the material. Report to NCMEC (CyberTipline.org) and contact local law enforcement. Preserve the account information but do not preserve the material itself.
- Ban the account immediately from all platforms.
- Notify the organization's leadership immediately.
- Cooperate fully with law enforcement requests for information.
4.4 Data Breach
- Immediately notify the Site Administrator and organization leadership.
- Isolate the affected systems if possible (take offline, revoke compromised credentials).
- Do not attempt to "fix" the breach without administrator guidance, as this may destroy forensic evidence.
- Document the timeline: when was the breach discovered, what data may be affected, who has been notified.
- Affected members must be notified within 72 hours of confirmed breach.
5. Escalation Chain
| Level | Who | When |
|---|---|---|
| 1 | On-duty Moderator | First responder; handles initial assessment and immediate safety actions |
| 2 | Senior Moderator / Admin | Contacted immediately for all crisis-level situations |
| 3 | Organization Leadership | Contacted for situations involving law enforcement, legal liability, or public safety |
| 4 | Law Enforcement / Emergency Services | Contacted when there is an immediate threat to life, illegal activity, or as required by law |
6. Law Enforcement Contact Procedures
- Only organization leadership or designated administrators should initiate contact with law enforcement (except in cases of immediate danger to life, where any staff member should call 911).
- When contacting law enforcement, provide: nature of the incident, platform(s) involved, usernames and any known identifying information, preserved evidence, and timeline of events.
- Document all interactions with law enforcement: officer name, badge number, case number, and what information was shared.
- Do not make public statements about law enforcement involvement without legal counsel.
7. Member Safety Protocols
- If a member is being targeted, offer to help them secure their account (password change, 2FA, privacy settings).
- If doxxing has occurred, assist the member in reporting to the relevant platforms and law enforcement.
- Provide the member with relevant safety resources and support contacts.
- Consider temporary enhanced moderation of the affected areas.
8. Post-Incident Review
- All crisis incidents must have a post-incident review within 7 days of resolution.
- The review should cover: what happened, how it was detected, response timeline, what went well, what could be improved, and any policy changes needed.
- Findings must be documented and shared with the moderation team (with appropriate redaction of sensitive details).
- Staff involved in traumatic incidents should be offered support and encouraged to take time off if needed.
9. Communication Templates
Template: Response to Member in Crisis (Self-Harm)
"I'm really concerned about what you've shared, and I want you to know that you matter to this community. I'm not a trained counselor, but I want to make sure you get the right support. Please reach out to the 988 Suicide & Crisis Lifeline by calling or texting 988, or text HOME to 741741 for the Crisis Text Line. You are not alone."
Template: Notification to Community After Incident (General)
"We want to let the community know that our moderation team recently responded to a safety concern. The situation has been addressed in accordance with our policies. We take the safety of our members seriously and are always working to maintain a secure environment. If you have any concerns, please reach out via our Contact Us page."
10. Support
For questions about crisis procedures or to report a concern, please visit Contact Us.
Revision History
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2026-05-16 | Moko Consulting | Initial release |