PSNI did ‘not have capacity or capability’ to manage risk posed by prolific online child sex offender

Chief executive Hugh Hume said it was clear that PSNI teams tasked with detecting and investigating online child sexual abuse were under-resourced and under pressure, significantly compromising their ability to detect and prosecute offenders and keep children safe.

However, although under-resourcing was found to have resulted in delayed police inquiries and the ineffective management of McCartney’s bail conditions, Mr Hume said the investigation had identified no misconduct by any individual police officer, given the pressures they had been under.

In October 2024, McCartney, from Newry in Co. Down, was sentenced to a minimum of 20 years in prison after being convicted of offences including unlawful act manslaughter, inciting children to engage in sexual activity, and making and possessing indecent images of children.

Cimarron Thomas, from West Virginia in the US, took her own life on May 11, 2018, immediately following contact with him online.

In January 2020, Cimarron’s father, Benjamin Jay Thomas, also took his own life. His widow Stephanie Thomas was adamant that the deaths of her husband and daughter were a direct result of McCartney’s activities.

McCartney had first been arrested more than two years before Cimarron’s death, in February 2016, after indecent images of children were found on his mobile phone. He was 17 at the time and was interviewed by police before being released on bail.

However, delays in producing evidential reports about some 1,100 indecent images of children found on his phone and other devices seized at the same time, meant that he was not interviewed about them again until more than two years later, in May 2018.

Cimarron died just five days before this interview.

During the same two-year period, McCartney had been involved in abusive online communications involving at least seven other children. He was on police bail throughout this time.

Mr Hume said the delays in police enquiries had been due to insufficient resourcing amidst a growing backlog of digital devices requiring examination in connection with online child abuse.

“When the initial devices were seized from McCartney in 2016, the officer responsible for investigating his online offending was part of a team that, due to absences and other factors, had only five officers in post against the complement of 14 that it was supposed to have,” Mr Hume said.

“This resulted in delays in the investigation and potential prosecution of those whose activities pose such a risk to children and young people, and opportunities to proactively follow evidence to identify where indecent images of children were being shared were missed.

“Consequently, the PSNI’s ability to identify other offenders, frustrate sharing forums and ultimately protect children and young people were compromised.”

Concerns about delays in the McCartney investigation led the PSNI chief constable to ask the Police Ombudsman, in April 2021, to conduct an independent investigation into its handling of the case in the three years since McCartney’s home had first been searched in January 2016.

The PSNI advised that an internal review had raised concerns about the timeliness of the police investigation, the prioritisation of investigative actions, as well as about risk management processes and the management of McCartney’s bail conditions.

A separate report  by the National Crime Agency, commissioned by the PSNI’s Public Protection Branch in September 2021, noted that the resources available to the PSNI’s Child Internet Protection Team (CIPT), were “currently insufficient to manage the number of referrals in a timely manner”, resulting in risks to victims and the wider community, and “the potential to impact on public confidence”.

There was a gap of more than two years and three months between McCartney’s initial arrest and interview and him being interviewed again about more than 1,100 indecent images which had by then been found on his phone, a tablet and five computers.

By the time this interview took place, on May 18, 2018, McCartney had been arrested a second time. This was on March 21, 2018, nine days after the PSNI received information from the National Centre for Missing and Exploited Children (NCMEC) that he had, during a Snapchat conversation, tricked a girl in Lancashire into sending him an indecent image, then threatened to post it online.

The NCMEC also advised the PSNI that indecent images of children were being uploaded from McCartney’s home IP address.

Around five weeks later, he was in contact with a 14-year-old girl in Los Angeles who sent him images involving self-harm.

At the time of his second arrest, McCartney was 19 and studying Computer Science at college. His bedroom was searched, resulting in the seizure of eight more digital devices. Following an initial triage, five of these devices were submitted to other police teams for forensic examination.

The evidential report about one of these devices, a mobile phone which McCartney had admitted was his, was not completed until April 2019, more than a year later.

By that stage he had been arrested a third time, after Police Scotland advised the PSNI that a young person had received naked photos via Snapchat from a person whose internet address was linked to McCartney’s home.

Reports on the four other devices seized in March 2018 had still not been completed by the time he was arrested for a fourth time on July 30, 2019.

This was despite one of those devices, a laptop, having been found during an initial triage examination in September 2018 to contain indecent images of children, along with evidence that McCartney had, during January and February 2018, been sent a video of self-harm by a 13-year-old girl in Florida, and another explicit video involving other children.

On January 2, 2019, the laptop was resubmitted to the Cybercrime Centre, with a higher priority, to enable the production of an evidential report. Despite its priority status, the report was not completed until February 20, 2020, almost two years after the laptop’s initial seizure.

Enquiries by Police Ombudsman investigators found significant pressures among all PSNI teams responsible for investigating online offending involving children and indecent images. In 2018, the Service’s Cybercrime Centre, staffed by around 60 officers, accepted applications from other police teams for the examination of some 935 computers and 284 mobile phones.

Mr Hume said: “Despite this, sufficient investment was not allocated during this period to allow for any purposeful increases in human and technical resourcing to assist in reducing investigative delays.

“In addition, the PSNI’s Cybercrime Centre, which conducts digital forensic examinations on behalf of other teams, used a prioritisation process in which terrorism and serious crime offences received priority, negatively and disproportionately impacting on the examination of devices being submitted to it by the CIPT.

“However, McCartney’s targeting of young girls is a clear example of violence against women and girls in the digital space. As this case demonstrates, it can have devastating consequences and should carry equal weight in terms of the prioritisation of digital forensic examinations.

“We have also reported on a number of cases recently in which issues have been identified in the way digital devices have been handled, stored and examined by police. We recognise the resourcing demands and complexities of digital forensics, but it is clear that the PSNI needs to take positive steps to ensure the integrity of all digital exhibits, the protection of personal data and the effective and timely use of digital forensics to protect the vulnerable and secure important evidence.”

The Police Ombudsman’s investigation also found that there were insufficient police resources to effectively manage McCartney’s bail conditions.

“The lack of resources available to the CIPT led to a culture where officers imposed superficial, ineffective and unsupervised bail conditions upon suspects and offenders,” said Mr Hume.

After his initial arrest in February 2016, McCartney was made subject to two bail conditions:

• To live at an address approved by police and not to sleep in the same bedroom as his brother; and
• Save for everyday contact, not to have any contact with children aged under 16 unless approved by Social Services, or in respect of his brother, while supervised by his mother or father.

He remained on bail, subject to these conditions, for 12 months until February 2017.

The same conditions were imposed again following his second arrest in March 2018, but were rescinded just a month later after police consulted with a social worker who advised that McCartney and his family were co-operating well with Social Services.

The Police Ombudsman’s investigation found that apart from being required to attend a police station to answer bail on three occasions during the first year after his initial arrest, no other measures had been taken by police to ensure that he was complying with the bail conditions.

“As a result, his continued offending went completely unchecked during this time,” said Mr Hume.

“It is clear that the bail conditions imposed on him failed to manage the risks he posed. Indeed, this was symptomatic of the wider situation across Northern Ireland, as other suspected offenders were subject to similar conditions, also without any checks to ensure compliance.

“The overstretched staff within the CIPT were unable to adequately impose or manage meaningful bail conditions, such as restrictions around internet usage, due to unacceptable delays and excessive workloads.”

It was only after an additional third bail condition restricting his access to the internet was imposed after his third arrest in March 2019, that police gained the ability to check that the condition was being complied with.

At that stage McCartney, then aged 20 and studying at university, was ordered not to access the internet, except in connection with his studies.

Within nine days he had breached that condition, having accessed Facebook and WhatsApp and created a PayPal account which he had used to send money to someone.

This and several other breaches became apparent in a report provided to police by the university.

He was subsequently arrested for a fourth time in July 2019, after which he was remanded in custody and suspended by the university.

Police learned about Cimarron’s death on January 21, 2021, just a day before McCartney pleaded guilty to 102 charges, including making and possessing indecent images of children and inciting children to engage in sexual activity.

Unlawful act manslaughter and blackmail were among the additional offences for which he was sentenced in October 2024.

The Police Ombudsman made no recommendations to the PSNI as a result of her enquiries, on the basis that the findings were already known to police following a previous internal review and other reports which had identified the same issues.

“It is my hope that the learning from our investigation and other similar enquiries will help ensure that the PSNI addresses the identified failings, leading to swift and proactive enquiries and effective bail management to provide children and young people with the protection they require,” said Mr Hume.

The PSNI said it “acknowledges the findings from the Police Ombudsman’s investigation into our handling of the case involving Alexander McCartney”.

In a statement it said: “First and foremost, our thoughts are with the victims, their families, and all those affected by McCartney’s appalling crimes. We recognise the profound and lasting harm caused by his actions, and we are deeply sorry for any further distress these findings may cause. No words can undo the pain experienced, but we are committed to learning from this case to strengthen our ability to protect children and young people from harm in the future.

“We note the Police Ombudsman’s conclusion that no individual officer was found to have committed misconduct, and that the challenges identified stemmed from systemic resource pressures and capacity constraints within specialist teams at the time. Nevertheless, we fully accept the findings and the lessons that must be learned.

“At the time of this investigation, the demand on our CIPT and Cybercrime Centre was rising exponentially, far exceeding the available resources and technological capability. We recognise that this resulted in unacceptable delays in digital forensic analysis, investigative progression, and the management of bail conditions.

“Since then, a number of steps have been taken to improve our capacity and capability in this critical area of policing, ensuring information regarding digital submissions and associated risk are considered at an early stage. These include:

“Our Cyber Crime Centre has introduced a new submissions portal, which uses the THRIVE (Threat, Harm, Risk, Investigation, Vulnerability, Engagement) risk model. This enables investigating officers to indicate increased risk factors and determine priorities for submitted devices.

“As part of a significant and longer-term transformation project, a new ‘gatekeeping’ team are in the process of being established.  The team will specifically process all submissions in direct liaison with investigating officers, during which increased risk can be identified and prioritisation made.

“New technology has been employed, which encompasses both new hardware and software.  The new technology significantly speeds up the process, decreasing the time from submission of a seized device, to identification if said device contains indecent images of children.

“However, it is important to be clear that the resourcing position today is even more challenging than it was at that time. Demand continues to grow across all areas of public protection and cybercrime, while the service faces ongoing financial and resourcing constraints. The Chief Constable has been unequivocal that sustained investment in policing is essential if we are to keep pace with this ever-increasing demand and maintain public confidence.

“In relation to bail, the Police Ombudsman’s report rightly highlights that investigative (pre-charge) bail is used in circumstances where a case is not yet ready to bring before the courts. This was the situation in McCartney’s case, where complex digital forensic work and evidence gathering were still ongoing. Once the case became ready for charge, McCartney was charged and subsequently remanded into custody.

“Protecting children from online sexual abuse and exploitation remains one of the Police Service’s highest priorities. Dedicated detectives within our Public Protection Branch continue to work tirelessly with colleagues across the UK, Ireland, and internationally to detect offenders, safeguard victims, and prevent further harm.”

PSNI Assistant Chief Constable Davy Beck, Crime Department, said: “We acknowledge the serious concerns raised by the Police Ombudsman and accept that, at the time, our systems and resources were not where they needed to be. The officers involved worked under immense pressure, and while their dedication was never in question, the service simply did not have the capacity to deliver the level of responsiveness that victims and families rightly expect.

“We have listened, we have learned, and we are acting. Improvements have already been made to ensure that those who exploit and abuse children online are identified more swiftly, investigated more effectively, and brought to justice. We remain steadfast in our commitment to protecting the most vulnerable in our community.

“I also want to take this opportunity to acknowledge the work of the dedicated team that investigated this particularly challenging and complex case. Their commitment never wavered and was recognised by the sentencing judge. They built strong relationships with victims throughout the investigation and remained by their side throughout the criminal justice process.

“We self-referred this case to the Police Ombudsman because it was the right thing to do — to shine a light on the very real pressures facing our specialist teams and the consequences that can arise when resources do not match demand. We will take all learning on board and act upon it with the resources available to us, but meaningful and sustained investment in policing is key to achieving lasting positive change and ensuring we can continue to protect children effectively in the online world.”

The PSNI said it will continue to “review and strengthen” its approach to tackling online child sexual abuse and exploitation to ensure that the findings identified in this case are not repeated.