This whole situation is shitty all around, I was really hoping it would be an isolated incident and that they wouldn't come back. I think I speak for everyone when I say that the bastards posting CSAM need to be jailed or worse. Disagree with an instance or community all you want, the instant you pull something like this, you've lost every single argument and are irredeemably a horrible person not worthy of touching a computer ever again.

Once again pedophiles ruin everything nice. I know me saying this isn't that helpful since I can't do anything about it, but I'm sorry this is happening on your instance (and is getting federated to other instances). Don't worry about inconvencing regular users, taking action against CSAM is far more important and any half amicable user will understand.

Some resources for reporting CSAM if you come across it anywhere (not just Lemmy):

US: https://www.missingkids.org/cybertipline

Canada: https://cybertip.ca/app/en/

International: https://www.inhope.org/

Last but not least, a reminder that if you accidentally load CSAM on your device, in most cases it will get cached to your storage because the majority of apps and browsers employ disk caching by default. You should at the very least clear your caches and then trim and fully wipe the free space on your device (maybe also directly shred the actual files if you can do that/know how to). Also know if you have any mandatory reporting laws where you live and comply with them. (EDIT: another commenter mentioned that in some jurisdictions you might actually not be allowed to delete them immediately and, presumably, have to contact police immediately reporting the active file on your device.) CYA to prevent yourself from getting screwed because of someone else's horrible acts. Also, something I've been thinking about since this whole thing started: it might also be helpful to use a no-disk-cache browser/app (or disable disk caching on your current browser/app if you are able to) if you do wish to keep using Lemmy, at least until this whole thing blows over, that way you can just close the page/program and reboot your device, and the local version should be gone, especially since flash storage devices cannot be reliably wiped with the "fill the drive with blank data" method (not sure how big the risk of it ending up in the swapfile or otherwise sticking around though or at what point it stops counting as possession). Being exposed to CSAM is a nightmare for this reason and unfortunately there seem to be no good resources on what to do if you're exposed.

I am not a lawyer and no part of this comment is legal advice.