A Police Ombudsman investigation has found that PSNI cybercrime teams did not have the capacity or capability to effectively manage the risk posed by online child sex abuser Alexander McCartney.
Chief Executive Hugh Hume said it was clear that PSNI teams tasked with detecting and investigating online child sexual abuse were under-resourced and under pressure, significantly compromising their ability to detect and prosecute offenders and keep children safe.
However, although under-resourcing was found to have resulted in delayed police enquiries and the ineffective management of McCartney’s bail conditions, Mr Hume said the investigation had identified no misconduct by any individual police officer, given the pressures they had been under.
In October 2024, McCartney, from Newry in Co. Down, was sentenced to a minimum of 20 years in prison after being convicted of offences including unlawful act manslaughter, inciting children to engage in sexual activity, and making and possessing indecent images of children.
Cimarron Thomas, from West Virginia in the United States, took her own life on 11 May 2018, immediately following contact with him online.
In January 2020, Cimarron’s father, Benjamin Jay Thomas, also took his own life. His widow Stephanie Thomas was adamant that the deaths of her husband and daughter were a direct result of McCartney’s activities.
McCartney had first been arrested more than two years before Cimarron’s death, in February 2016, after indecent images of children were found on his mobile phone. He was 17 at the time and was interviewed by police before being released on bail.
However, delays in producing evidential reports about some 1,100 indecent images of children found on his phone and other devices seized at the same time, meant that he was not interviewed about them again until more than two years later, in May 2018.
Cimarron died just five days before this interview.
During the same two-year period, McCartney had been involved in abusive online communications involving at least seven other children. He was on police bail throughout this time.
Mr Hume said the delays in police enquiries had been due to insufficient resourcing amidst a growing backlog of digital devices requiring examination in connection with online child abuse.
“When the initial devices were seized from McCartney in 2016, the officer responsible for investigating his online offending was part of a team that, due to absences and other factors, had only five officers in post against the complement of 14 that it was supposed to have.
“This resulted in delays in the investigation and potential prosecution of those whose activities pose such a risk to children and young people, and opportunities to proactively follow evidence to identify where indecent images of children were being shared were missed.
“Consequently, the PSNI’s ability to identify other offenders, frustrate sharing forums and ultimately protect children and young people were compromised.”
Concerns about delays in the McCartney investigation led the PSNI Chief Constable to ask the Police Ombudsman, in April 2021, to conduct an independent investigation into its handling of the case in the three years since McCartney’s home had first been searched in January 2016.
The PSNI advised that an internal review had raised concerns about the timeliness of the police investigation, the prioritisation of investigative actions, as well as about risk management processes and the management of McCartney’s bail conditions.
A separate report by the National Crime Agency, commissioned by the PSNI’s Public Protection Branch in September 2021, noted that the resources available to the PSNI’s Child Internet Protection Team (CIPT), were “currently insufficient to manage the number of referrals in a timely manner,” resulting in risks to victims and the wider community, and “the potential to impact on public confidence.”
Delayed examination of digital devices (a downloadable timeline is also available on this page)
There was a gap of more than two years and three months between McCartney’s initial arrest and interview and him being interviewed again about more than 1,100 indecent images which had by then been found on his phone, a tablet and five computers.
By the time this interview took place, on 18 May 2018, McCartney had been arrested a second time. This was on 21 March 2018, nine days after the PSNI received information from the National Centre for Missing and Exploited Children (NCMEC) that he had, during a Snapchat conversation, tricked a girl in Lancashire into sending him an indecent image, then threatened to post it online.
The NCMEC also advised PSNI that indecent images of children were being uploaded from McCartney’s home IP address.
Around five weeks later, he was in contact with a 14-year-old girl in Los Angeles who sent him images involving self-harm.
At the time of his second arrest, McCartney was 19 and studying Computer Science at college. His bedroom was searched, resulting in the seizure of eight more digital devices. Following an initial triage, five of these devices were submitted to other police teams for forensic examination.
The evidential report about one of these devices, a mobile phone which McCartney had admitted was his, was not completed until April 2019, over a year later.
By that stage he had been arrested a third time, after Police Scotland advised the PSNI that a young person had received naked photos via Snapchat from a person whose internet address was linked to McCartney’s home.
Reports on the four other devices seized in March 2018 had still not been completed by the time he was arrested for a fourth time on 30 July 2019.
This was despite one of those devices, a laptop, having been found during an initial triage examination in September 2018 to contain indecent images of children, along with evidence that McCartney had, during January and February 2018, been sent a video of self-harm by a 13-year-old girl in Florida, and another explicit video involving other children.
On 2 January 2019, the laptop was resubmitted to the Cybercrime Centre, with a higher priority, to enable the production of an evidential report. Despite its priority status, the report was not completed until 20 February 2020, almost two years after the laptop’s initial seizure.
Enquiries by Police Ombudsman investigators found significant pressures among all PSNI teams responsible for investigating online offending involving children and indecent images. In 2018, the Service’s Cybercrime Centre, staffed by around 60 officers, accepted applications from other police teams for the examination of some 935 computers and 284 mobile phones.
Mr Hume said: “Despite this, sufficient investment was not allocated during this period to allow for any purposeful increases in human and technical resourcing to assist in reducing investigative delays.
“In addition, the PSNI’s Cybercrime Centre, which conducts digital forensic examinations on behalf of other teams, used a prioritisation process in which terrorism and serious crime offences received priority, negatively and disproportionately impacting on the examination of devices being submitted to it by the Child Internet Protection Team (CIPT).
"However, McCartney's targeting of young girls is a clear example of violence against women and girls in the digital space. As this case demonstrates, it can have devastating consequences and should carry equal weight in terms of the prioritisation of digital forensic examinations.
“We have also reported on a number of cases recently in which issues have been identified in the way digital devices have been handled, stored and examined by police. We recognise the resourcing demands and complexities of digital forensics, but it is clear that the PSNI needs to take positive steps to ensure the integrity of all digital exhibits, the protection of personal data and the effective and timely use of digital forensics to protect the vulnerable and secure important evidence."
Ineffective bail conditions and management
The Police Ombudsman’s investigation also found that there were insufficient police resources to effectively manage McCartney’s bail conditions.
“The lack of resources available to the CIPT led to a culture where officers imposed superficial, ineffective and unsupervised bail conditions upon suspects and offenders,” said Mr Hume.
After his initial arrest in February 2016, McCartney was made subject to two bail conditions:
to live at an address approved by police and not to sleep in the same bedroom as his brother,
and save for everyday contact, not to have any contact with children aged under 16 unless approved by Social Services, or in respect of his brother, while supervised by his mother or father.
He remained on bail, subject to these conditions, for 12 months until February 2017.
The same conditions were imposed again following his second arrest in March 2018, but were rescinded just a month later after police consulted with a social worker who advised that McCartney and his family were co-operating well with Social Services.
The Police Ombudsman’s investigation found that apart from being required to attend a police station to answer bail on three occasions during the first year after his initial arrest, no other measures had been taken by police to ensure that he was complying with the bail conditions.
“As a result, his continued offending went completely unchecked during this time,” said Mr Hume.
“It is clear that the bail conditions imposed on him failed to manage the risks he posed. Indeed, this was symptomatic of the wider situation across Northern Ireland, as other suspected offenders were subject to similar conditions, also without any checks to ensure compliance.
“The overstretched staff within the CIPT were unable to adequately impose or manage meaningful bail conditions, such as restrictions around internet usage, due to unacceptable delays and excessive workloads.”
It was only after an additional third bail condition restricting his access to the internet was imposed after his third arrest in March 2019, that police gained the ability to check that the condition was being complied with.
At that stage McCartney, then aged 20 and studying at university, was ordered not to access the internet, except in connection with his studies.
Within nine days he had breached that condition, having accessed Facebook and WhatsApp and created a PayPal account which he had used to send money to someone.
This and several other breaches became apparent in a report provided to police by the university.
He was subsequently arrested for a fourth time in July 2019, after which he was remanded in custody and suspended by the university.
Police learned about Cimarron’s death on 21 January 2021, just a day before McCartney pleaded guilty to 102 charges including making and possessing indecent images of children and inciting children to engage in sexual activity.
Unlawful act manslaughter and blackmail were among the additional offences for which he was sentenced in October 2024.
The Police Ombudsman made no recommendations to the PSNI as a result of her enquiries, on the basis that the findings were already known to police following a previous internal review and other reports which had identified the same issues.
“It is my hope that the learning from our investigation and other similar enquiries will help ensure that the PSNI addresses the identified failings, leading to swift and proactive enquiries and effective bail management to provide children and young people with the protection they require,” said Mr Hume.
Information and support for anyone affected by the issues raised in this media release is available on the Safer Schools NI website: Home - Safer Schools NI