Tennessee auditors warned two years ago that child-exploitation investigators were being overwhelmed. New numbers from Knoxville police show actionable leads still waiting for assignment — while a separate 2025 workload figure supplied by KPD exactly matches NCMEC’s published total for Indiana and remains unresolved.
By Brandon Burley
KNOXVILLE, Tenn. — A series of reports to the nation’s clearinghouse for suspected online child exploitation helped Knoxville police identify a suspect, search a Gleason Drive home and make an arrest last week.
But when The Redemption Project asked what happens to the thousands of other CyberTips entering Tennessee’s Internet Crimes Against Children system, Knoxville police disclosed a potentially more consequential number.
There are 190 actionable tips waiting to be assigned.
The oldest dates to October 2025.
“Our current backlog of actionable tips awaiting assignment is 190 with the oldest tip being October 2025,” Knoxville Police Department Communications Manager Scott Erland told TRP in a written response Sept. 1.
There is an important limitation to that disclosure.
KPD has not yet clarified whether those 190 actionable tips are waiting inside the Knoxville ICAC unit, sitting in a statewide Tennessee ICAC queue before assignment to an affiliate agency, or represent another defined workload category.
TRP asked KPD to make that distinction Tuesday. No additional response had been received as of Wednesday morning.
The number also does not mean 190 children are known to be in immediate danger while police wait to respond.
KPD defines an “actionable tip” as one containing information related to an actual crime and enough “solvability factors” for investigators potentially to identify and locate a suspect or victim. Erland said threats involving imminent harm trigger immediate notification and response.
That distinction matters.
A CyberTip is not automatically a crime. It is not necessarily a unique offender. It is not an arrest, and it is not necessarily a child waiting for rescue.
But a lead that police themselves have classified as actionable and that is still awaiting assignment is a different measurement from the millions of raw reports entering the national system.
And some of Tennessee’s oldest actionable work is now old enough that KPD’s description reaches back to last October.
One 2025 number does not reconcile
KPD supplied another figure that TRP is not prepared to publish without qualification.
Erland said the Tennessee ICAC Task Force received 37,755 CyberTips in 2025, with 2,298 unique investigations during the year. He said duplicate CyberTips are not formally tracked but are “exceedingly rare.”
The first number presents an unusual problem.
The National Center for Missing & Exploited Children’s official 2025 CyberTipline Reports by State table says 49,541 reports resolved to Tennessee: 35,504 classified as referrals and 14,037 classified as informational reports.
The same NCMEC table lists Indiana at exactly 37,755 reports — 28,000 referrals and 9,755 informational reports.
That does not prove KPD gave TRP the wrong state’s number.
The two organizations may be measuring different stages of the system. NCMEC’s table counts reports that resolved to a state, while KPD may be describing a narrower universe that actually entered or moved through the Tennessee ICAC workflow.
But because the number KPD supplied matches Indiana’s official total exactly, TRP asked the department whether 37,755 was inadvertently transposed from the wrong state or whether it describes a specific operational subset of Tennessee reports.
Until KPD answers that question, 37,755 should not be treated as Tennessee’s definitive 2025 CyberTip total.
Even the word “referral” means different things
There is another reason the numbers cannot simply be placed side by side.
KPD and NCMEC use some of the same words differently.
In its written response, KPD told TRP that a referral is a complaint received from or forwarded by another law-enforcement or government agency rather than NCMEC. A CyberTip, KPD said, is an investigative lead provided through NCMEC.
NCMEC uses “referral” differently in its national reporting.
It calls a CyberTipline report a referral when the submitting company has provided sufficient information for law enforcement potentially to act, usually including information about a user, imagery and a possible location for the child or offender.
NCMEC calls a report informational when the information is insufficient for that purpose or when, among other things, imagery has been widely circulated and repeatedly reported.
Those classifications describe the quality and usability of information reaching NCMEC.
They are not necessarily equivalent to KPD’s definition of an actionable tip, a referral or a unique investigation.
That makes the 2,298 unique investigations KPD reported potentially more useful than a raw CyberTip total — but even that number needs to be understood within KPD’s own case-definition system.
TRP therefore is not calculating a percentage of reports that became investigations. The numerator and denominator have not yet been shown to measure compatible things.
The national volume is enormous — and raw totals can mislead
NCMEC received approximately 21.3 million CyberTipline reports in 2025.
It identified and escalated more than 53,000 reports as urgent or involving a child in imminent danger. More than 2 million reports resolved to the United States, including about 1.9 million that resolved to a specific state.
Those figures sound overwhelming because they are.
They also require context.
Electronic service providers submit the vast majority of CyberTipline reports, and reported files can include imagery that has circulated repeatedly for years. NCMEC uses hash matching and other triage tools in part to reduce duplication at the file level and help investigators prioritize newer or more urgent material.
A report can also be made available to more than one law-enforcement agency if it contains geographic connections to different jurisdictions. NCMEC expressly warns that a single report can have multiple geographic nexuses.
That is why a headline based solely on the largest available CyberTip number can tell readers surprisingly little about the actual investigative workload.
The 190 figure is different.
KPD says those tips have already been classified as actionable and are waiting for assignment.
Tennessee was warned about this problem in 2024
The current disclosure is not the first indication that Tennessee’s child-exploitation investigators have struggled with volume.
An October 2024 Tennessee Comptroller performance audit of the Tennessee Bureau of Investigation devoted an entire observation to the issue.
Auditors warned that CyberTips related to internet crimes against children would likely continue to rise, “creating a backlog and overburdening the bureau’s limited investigative resources.”
At TBI, the word “backlog” had a specific meaning.
The agency classified a CyberTip as being on “active hold” until an agent became available to review it. As of April 1, 2024, the TBI ICAC squad had 2,543 cases in that status.
Auditors found that the bureau’s ICAC squad still had the same four agent positions it had when the squad was created in 2007.
From June 2020 through March 2024, TBI opened 3,044 cases related to CyberTips involving child sexual abuse material. Auditors found 84% contributed to the backlog and 90% involved allegations classified as child exploitation.
“The Internet Crimes Against Children Squad’s staffing levels have not kept pace with the growing backlog of cybertips,” auditors wrote.
TBI agreed with the observation and said it would continue seeking additional positions.
That was a TBI backlog, not the current 190-tip queue KPD has disclosed.
The numbers should not be added together or treated as the same measurement.
What they establish is continuity in the systems question: Tennessee auditors documented an investigative-assignment problem in 2024, and KPD is now reporting actionable work still awaiting assignment in 2026.
KPD sits at the front of Tennessee’s routing system
Tennessee’s ICAC structure makes the scope of the 190 especially important.
The 2024 Comptroller audit explains that NCMEC electronically transmits a Tennessee CyberTip to the state ICAC commander based on where NCMEC believes the victim or potential offender is located.
In Tennessee, that commander works at KPD.
KPD then triages the report and routes it to an affiliate law-enforcement agency covering the relevant geography. When no local affiliate covers a jurisdiction, KPD can assign the tip to TBI.
That creates at least two conceptually different places where something could be “awaiting assignment.”
A report could be waiting for routing to the law-enforcement agency that will own it.
Or an affiliate could already have received it and be waiting to assign the matter to an individual investigator.
KPD’s initial response does not distinguish between those possibilities for the 190.
That is why the answer to TRP’s follow-up question could materially change the headline’s statewide significance.
The task-force network has grown
The statewide network itself is larger than KPD’s public webpage suggests.
The department’s current ICAC page still says KPD works with 60 statewide affiliate agencies and lists the KPD unit as one lieutenant, one sergeant, three investigators and two computer forensic examiners.
KPD’s Aug. 28 Gleason Drive release said the task force links 80 state, local and federal agencies.
Erland told TRP the current number is actually 82 affiliated agencies when KPD is included, explaining that the task force has grown since the webpage was updated.
He also supplied an updated KPD staffing configuration: three detectives, three digital forensic analysts and two supervisors assigned to the ICAC unit.
That is eight people.
KPD said the Tennessee task force has approximately 164 members across participating agencies.
Those 164 people should not automatically be treated as 164 full-time ICAC investigators. Participating agencies can assign personnel in different capacities and at different levels of time commitment.
The 2024 audit illustrates that distinction. It calculated designated ICAC staffing in full- and partial-time equivalents rather than simply counting everyone connected with an affiliate.
One queue KPD says is not backed up
KPD’s answers also identify an important place where the department says there is not a backlog.
Asked how many devices were awaiting forensic examination, Erland told TRP:
“We have no forensic exam backlog at KPD. Turnaround time is case-dependent.”
That matters because digital child-exploitation investigations can involve two separate capacity problems.
Investigators first have to receive, triage and work the investigative lead.
After devices are seized, forensic personnel may have to extract and analyze large amounts of digital evidence.
KPD’s current disclosure puts the reported backlog at the actionable-tip assignment stage, not in its local forensic-examination queue.
That is useful operational context — and another reason the 190 should be defined precisely before being compared with other state or federal backlog figures.
The Gleason Drive case shows what happens when a CyberTip becomes a case
The reporting began with an Aug. 28 operation at a residence on Gleason Drive.
KPD said its ICAC detectives received a series of NCMEC CyberTips containing information concerning alleged exchanges of child sexual abuse material and alleged inappropriate communications with children through multiple online platforms.
Investigators identified Yaac Pekle Mendez, 33, searched the residence, recovered evidence and arrested him, according to KPD.
Mendez was booked on three counts of sexual exploitation of a minor.
The investigation remains active. The charges are allegations, and Mendez is presumed innocent unless and until proven guilty.
KPD declined to answer TRP’s case-specific questions about when the underlying reports arrived, whether any related to the same underlying conduct, what investigative steps occurred between receipt of the reports and the residential search warrant, and whether preservation demands, subpoenas, provider warrants or other legal process preceded the search.
Erland cited the continuing investigation.
The department did answer the broader systems questions.
KPD defined a CyberTip as an investigative lead supplied through NCMEC; an investigation as an agency’s investigative response to a complaint or lead; a child identified as a victim whose identity was previously unknown to law enforcement but discovered during an investigation; and a child rescue as locating a child and removing that child from ongoing physical or sexual abuse.
Those definitions help prevent raw activity statistics from becoming something they are not.
A million reports are not a million offenders.
A CyberTip is not an arrest.
A backlog does not establish that imminent-danger reports are sitting unattended.
But the inverse matters, too.
An actionable lead that law enforcement says contains evidence of an actual crime and enough information potentially to identify or locate a suspect or victim — yet remains unassigned — is a public-safety workload measure worth understanding.
KPD says there are 190 of them.
The oldest dates to October 2025.
The remaining question is where, exactly, those 190 cases are sitting — and how long actionable leads ordinarily wait before an investigator takes ownership of them.
TRP has asked KPD to answer that question and will update this report when it does.
I am a retired detective and criminal justice / government educator based in Tennessee. I founded The Redemption Project, as a place to focus on civics, rebuild non-partisan trust, and provide educational and emotional grace while learning about the news. I also have a column in Knox TN Today. My reporting and commentary have also appeared in other outlets including; Governing, The Arizona Capitol Times, South Florida Sun Sentinel, Police1, among other state and regional outlets.
Behind the Reporting:
Why We Are Not Turning 190, 37,755 and 49,541 Into One Scary Statistic
Paid subscribers get the source-response ledger, data reconciliation, 2024 audit comparison and the questions needed to determine whether Tennessee has a statewide assignment backlog or a narrower Knoxville workload problem.
The strongest number is 190 — but its denominator is still missing
KPD gave TRP unusually specific language:
“Our current backlog of actionable tips awaiting assignment is 190 with the oldest tip being October 2025.”
Three elements are directly supported:
