FDLE Child Exploitation Arrests Show How Cybertips Become Florida Cases

The Florida Department of Law Enforcement has announced arrests in two separate child sexual abuse material investigations in recent weeks, one in Monroe County and one in Seminole County. Both cases began the same way most do, with an electronic tip routed through the National Center for Missing and Exploited Children. Both defendants are accused and have not been convicted. The cases illustrate a pipeline that handles a volume of referrals most Floridians never see.

The two cases

FDLE, working with Homeland Security Investigations, arrested Melvin Donald Ellington, 76, of Summerland Key, on 11 counts of possession of child sexual abuse material. Agents obtained an arrest warrant on August 24, and Ellington was arrested at the Monroe County Detention Center.

In a separate investigation, FDLE arrested Michael Wesley Zacharia Stokes, 20, of Sanford, on 10 counts of possession of child sexual abuse material. That investigation began in December 2025 when FDLE agents received a cybertip from the National Center for Missing and Exploited Children.

Both men face charges only. Each is entitled to the presumption of innocence, and the allegations reflect the state's position rather than adjudicated facts.

How a cybertip becomes an investigation

The National Center for Missing and Exploited Children operates the CyberTipline, a congressionally authorized national reporting mechanism. Electronic service providers are required by federal law to report apparent child sexual abuse material they detect on their platforms, and those reports flow into the CyberTipline.

NCMEC reviews and triages incoming reports, then routes them to the appropriate law enforcement agency based on where the account activity appears to have originated. Reports involving Florida generally reach FDLE or one of the state's Internet Crimes Against Children task forces.

From there, investigators work to connect an internet protocol address or account to a physical location and a person. That typically requires subpoenas or search warrants served on internet service providers and platform operators, followed by a search warrant for the residence and the seizure of devices.

Forensic examination of seized devices is the step that determines whether charges follow. Digital forensic examiners recover files, reconstruct deleted data, and establish what was stored and when. The process takes time, which is why the Seminole County investigation that began in December 2025 produced an arrest months later.

The Florida statutory framework

Florida law addresses possession of child sexual abuse material under Florida Statutes section 827.071 and related provisions in Chapter 847. Possession is charged as a third-degree felony, and Florida law permits charging a separate count for each item possessed.

That counting structure explains charge totals in the double digits. Eleven counts and ten counts reflect distinct files or images rather than distinct incidents. Because Florida sentencing operates on a scoresheet that aggregates points across counts, the number of counts materially affects the sentencing range.

Offenses of this category also carry collateral consequences beyond incarceration. A conviction triggers sex offender registration requirements under Florida law, which impose lifetime reporting obligations and residency restrictions. Those consequences attach on conviction regardless of the sentence imposed.

Related offenses carry higher classifications. Distribution and production charges are more serious than possession, and cases sometimes begin as possession investigations and expand when forensic examination reveals evidence of other conduct.

The scale of the caseload

The volume of CyberTipline reports has grown substantially over the past decade, driven by improved automated detection by major platforms and by increased overall internet activity. NCMEC has reported annual totals in the tens of millions of reports nationally.

That volume creates a triage problem. Law enforcement agencies cannot investigate every report, and prioritization systems weight factors including indications that a child is in immediate danger, evidence of production rather than possession, and whether the subject has access to children.

Florida participates in the national Internet Crimes Against Children Task Force Program, a federally funded network coordinating investigations across state, local, and federal agencies. Florida's task forces are hosted by agencies around the state, which distributes investigative capacity geographically.

The multi-agency structure

The Monroe County case involved Homeland Security Investigations alongside FDLE. HSI has jurisdiction over child exploitation offenses with an interstate or international nexus, which most internet-based cases have by definition.

That overlapping jurisdiction means cases can be charged in state court, in federal court, or in both, and the decision involves considerations including available penalties, evidentiary rules, and resource allocation. Federal child exploitation statutes carry mandatory minimum sentences that state law in some categories does not.

FDLE functions as Florida's statewide investigative agency, filling a role comparable to a state bureau of investigation. It supports local agencies with forensic laboratory services, operates the state criminal history repository, and conducts investigations that cross jurisdictional lines or that local agencies refer to it.

What parents and the public should know

The CyberTipline accepts reports from the public as well as from electronic service providers. Anyone who encounters suspected child sexual abuse material online can report it, and NCMEC's reporting mechanism is available online and by telephone.

Prevention guidance from child safety organizations centers on communication rather than surveillance. Children who understand that they can report uncomfortable online interactions without losing device access are more likely to disclose, and grooming behavior depends substantially on a child's reluctance to tell an adult.

Platform safety settings matter but are not sufficient. Most major platforms offer parental controls and restricted modes, though determined circumvention is common among older children. Layered approaches that combine technical controls with ongoing conversation perform better than either alone.

What FDLE does

The Florida Department of Law Enforcement operates as the state's central investigative and forensic agency, with regional operations centers distributed around the state. Its role is distinct from that of local police departments and sheriff's offices, which handle the bulk of routine law enforcement.

Forensic laboratory services are among its largest functions. FDLE laboratories process DNA, controlled substances, firearms and toolmarks, latent prints, toxicology, and digital evidence for agencies across Florida that do not maintain their own laboratories. Backlogs in those laboratories have been a recurring subject of legislative attention and funding.

The agency also maintains the state criminal history repository, which supports background screening for employment, licensing, and firearm purchases. It operates the Florida Crime Information Center and coordinates with federal databases.

Investigative work concentrates on cases that cross jurisdictional lines or that require specialized capacity: public corruption, major drug conspiracies, officer-involved incidents referred by local agencies, and computer crimes including the child exploitation cases described here.

Digital forensics and its limits

Device examination is the technical core of these investigations. Forensic examiners create bit-for-bit images of seized storage media, then analyze those images rather than the original devices, preserving the evidence in its seized state.

Recovery of deleted material is routine. Deleting a file typically removes its directory entry without overwriting the underlying data, which means examiners can often recover content a user believed was gone. File system metadata establishes creation and access times, which matters for proving knowing possession.

Encryption is the primary obstacle. Full-disk encryption on modern devices, enabled by default on most phones, can place content beyond reach without the passcode. Courts have addressed whether a defendant can be compelled to provide a passcode, and the answer varies by jurisdiction and by the specific legal theory applied.

Case backlogs affect timelines. Digital forensic examination requires trained personnel and specialized tools, and demand across all case types has grown faster than capacity. A months-long gap between a cybertip and an arrest, as occurred in the Seminole County case, frequently reflects that queue rather than any lack of urgency.

What's next

Both cases proceed through their respective county court systems, with prosecution handled by the State Attorney's Office for the relevant judicial circuit. Monroe County falls in the Sixteenth Judicial Circuit and Seminole County in the Eighteenth.

Court records are public and can be tracked through each county's clerk of courts. Filings, hearing dates, and dispositions appear as the cases progress, though certain materials in cases of this type are sealed to protect victim identities.

FDLE publishes announcements of arrests through its news office, and those releases are the primary record on which reporting of these cases rests. The agency also maintains the Florida sex offender registry, which is publicly searchable.

Resources for families are available through the National Center for Missing and Exploited Children, which publishes guidance on online safety alongside its reporting mechanism. Florida's Internet Crimes Against Children task forces also conduct community education, often through school districts and local law enforcement.

For anyone who becomes aware of material or conduct of this kind, the reporting channels are the CyberTipline and local law enforcement. Both accept anonymous reports, and investigators have consistently said that tips from the public account for a meaningful share of the cases they open.

Both men described here face charges that have not been proven. Florida court files will show how each case proceeds, and outcomes in cases of this type range from negotiated pleas to trial verdicts to dismissal when evidence does not hold up under scrutiny. Reporting on an arrest is reporting on an accusation, and the distinction matters to the people named and to the accuracy of the record.

What the two cases illustrate more broadly is the volume behind them. Every arrest in this category represents one referral among millions processed nationally each year, filtered through triage, investigation, forensic examination, and prosecutorial review. The cases that surface publicly are the small fraction that complete that sequence.

Two Florida men now face charges that began with automated detection on a platform neither controlled, a pipeline that did not exist a generation ago and that now produces most cases of this kind.