How the Kingston Thomas abduction satisfied DOJ's five AMBER Alert criteria

The Kingston Thomas AMBER Alert began with a narrow practical question: did Enterprise police have enough confirmed facts to move a missing 2-year-old report into Alabama’s statewide child-abduction alert system? On July 22, 2026, the reported answer changed quickly. Kingston DeWayne Thomas was reportedly taken from a babysitter in Enterprise at about 4:30 p.m.; after police confirmed the taking as an abduction, the matter was upgraded from an initial missing-person alert to a statewide AMBER Alert, and Kingston was found safe in Montgomery later that evening, with cancellation reported at roughly 9:54 p.m. CDT.[1][2]

That sequence matters because AMBER activation is not supposed to rest on alarm alone. The Department of Justice’s Office of Justice Programs describes five recommended criteria: law enforcement must believe an abduction has occurred; the child must be at risk of serious bodily injury or death; enough descriptive information must exist to help the public; the child must be 17 or younger; and the child’s name and critical data must be entered into the National Crime Information Center system.[3]

The reported facts in Kingston’s case are useful precisely because they do not fit the popular shorthand of a stranger abduction. The suspect was identified publicly as Shamarco Moore, Kingston’s maternal uncle.[1] That family relationship did not answer the legal questions. It only made the custody-and-control question more important.

The Compressed July 22 Timeline

• Around 4:30 p.m.: Kingston Thomas, age 2, was reportedly taken from a babysitter in Enterprise, Alabama.[1]
• Initial response: Enterprise police issued a missing-person alert before the statewide AMBER escalation.[1]
• Escalation: the alert was upgraded after police confirmed that an abduction had occurred, including a reported forcible taking.[2]
• Broadcastable details: public materials identified Moore, described the child’s clothing, and circulated vehicle information that was later reported with some variation.[4][5]
• Recovery and cancellation: Kingston was found safe in Montgomery within hours; the AMBER Alert was canceled at about 9:54 p.m. CDT.[1][6]

The exact minute-by-minute record may be refined as the case develops. Public reports available on July 23 agree on the controlling procedural points: a 2-year-old was taken from a caregiver, police treated the matter as an abduction after confirmation, state and national alert machinery was used, the child was recovered safe, and Moore remained wanted after the alert was canceled.[1][2][6]

How the DOJ Criteria Were Satisfied

The five DOJ criteria are not elements of a criminal offense. They are activation thresholds. In a fast-moving case, they force officers to separate a serious but uncertain missing-child report from a confirmed abduction with enough public-facing information to justify mass notification.

1. Confirmation Was the Escalation Point

The first criterion did the real sorting work here. A missing toddler report can be urgent without yet being an AMBER case. The statewide alert became procedurally supportable when Enterprise police confirmed that Kingston had been abducted, not merely that he was absent from an expected location.[2]

That distinction is especially important in family-abduction cases. A biological or extended-family connection may explain access to the child, but it does not prove lawful authority to remove the child from the person then responsible for care. On the public facts, the relevant handoff was not “uncle to nephew.” It was “babysitter with immediate care to adult who allegedly took the child by force.”[1][2]

2. Danger Did Not Depend on a Stranger-Abduction Theory

The DOJ danger criterion asks whether law enforcement believes the child is in imminent danger of serious bodily injury or death.[3] It does not say the suspected abductor must be unknown to the child. For a 2-year-old, forcible removal from a caregiver compresses the risk analysis. The child cannot meaningfully protect himself, explain his legal status to bystanders, arrange transportation, or call for help.

That does not make every family dispute an AMBER case. It does mean officers are not required to discount danger because the suspect is a relative. The public facts reported in Kingston’s case supplied more than a custody disagreement in loose terms: they described an abduction from the babysitter and a rapid move away from Enterprise before the child was found in Montgomery.[1][2]

3. The Alert Had Usable Descriptive Information

The third criterion is easy to underestimate until a case lacks it. Public notification only works if the alert gives people something concrete to look for. In Kingston’s case, public materials identified him by name and age, described his clothing as a yellow shirt and blue shorts, identified Moore as the suspected abductor, and circulated vehicle information.[4][5]

There was some reported variation in the vehicle description: ABC 33/40 reported a dark blue Hyundai Genesis, while the NCMEC poster described a dark Honda CRV.[4][5] That discrepancy is worth noting without overstating it. Vehicle information can change as officers receive better information, verify plates, or distinguish between an initially reported vehicle and a later investigative lead. The key activation question is whether the alert contained enough descriptive content to assist the public, and the available record shows that it did.

4. Age Was Straightforward

The DOJ age criterion covers children 17 years old or younger.[3] Kingston was 2. This was not the contested part of the analysis, but it mattered because it brought the case squarely within the child-alert framework rather than some more general missing-person broadcast.

5. NCIC Entry Connected the Local Case to the Alert System

The fifth criterion requires entry of the child’s name and critical data elements into NCIC, with the Child Abduction flag.[3] NCMEC’s public poster for Kingston Thomas, AMBER Alert number 31690, reflects that national alert pathway and made the public-facing information available beyond the initial local police audience.[5]

This is the procedural handoff that often gets flattened in public discussion. Enterprise police were not simply asking residents to be watchful. Once ALEA and national missing-child channels were engaged, the case moved through a structured alert architecture: local confirmation, state activation, NCIC-linked data, and NCMEC dissemination.[3][5]

For readers who need the broader federal-state framework rather than this case-specific application, see the internal explainer on AMBER Alert legal procedures.

What Changed After Kingston Was Found

Cancellation did not end the legal case. It ended the emergency public-search function because Kingston had been located safe in Montgomery. The criminal track continued: WTVY reported that Moore remained at large with an active warrant for second-degree kidnapping.[6]

That distinction is basic but necessary. AMBER cancellation is not a finding that no crime occurred, and it is not an adjudication of the suspect’s liability. It means the child-recovery objective of the alert has been satisfied. The warrant and charge then move through ordinary criminal procedure, with facts still subject to investigation, charging decisions, defenses, and proof.

Why “Maternal Uncle” Did Not End the Kidnapping Analysis

Alabama’s second-degree kidnapping statute provides that a person commits the offense by abducting another person, and the offense is classified as a Class B felony.[7] Alabama criminal defense commentary describes the sentencing range for a Class B felony as 2 to 20 years.[8] Those are charge-level consequences, not proof that Moore will be convicted.

The statutory family-relative language is the part most likely to be misunderstood. Ala. Code § 13A-6-44(b) provides a defense when a relative’s sole purpose is to assume lawful control of the person abducted.[7] The phrase does not say that relatives cannot kidnap. It does not make “uncle” a jurisdictional bar to arrest. It asks a different question: was the relative pursuing lawful control?

On the reported public facts, Kingston was taken from a babysitter, and the alert materials identified Moore as the suspected abductor rather than as a person exercising confirmed lawful custody or control.[1][5] Those facts do not themselves resolve any defense Moore might raise, but they explain why the family relationship did not prevent police from treating the event as both an AMBER-eligible abduction and a kidnapping investigation.

The careful stopping point is important. The statute’s defense language could matter if additional facts showed a lawful-control basis not yet public. As of July 23, 2026, the available record supports the narrower conclusion: being Kingston’s maternal uncle did not, by itself, defeat the alert activation or the reported second-degree kidnapping warrant.

The System Context, Kept in Proportion

National AMBER data show why a fast, criteria-based system exists. OJP reports that, as of December 31, 2025, 1,312 children had been recovered through AMBER Alerts, including 252 recoveries credited to Wireless Emergency Alerts.[9] Those numbers do not prove that any one alert caused any one recovery in isolation, but they do show the scale of the recovery tool that Alabama used in Kingston’s case.

Family abduction is not an odd fit for that tool. A dated but still useful context point from Scripps Howard reporting, summarized in the Wikipedia AMBER Alert article, stated that approximately half of AMBER Alerts in 2004 involved family abductions.[10] That figure should not be treated as a current 2026 proportion. It does, however, undercut the casual assumption that AMBER Alerts are designed only around stranger-abduction scenarios.

Kingston Thomas’s case is procedurally clean for that reason. The facts reported publicly moved in the order the alert criteria require: confirmed abduction, danger to a very young child, broadcastable descriptions, qualifying age, NCIC-linked entry, recovery, cancellation, and then the separate criminal charge track. The alert did not become softer because the suspect was a relative. The law still asked who had lawful control, what was confirmed, and what facts justified public activation.

This analysis is informational, not legal advice. The case remained active as of July 23, 2026, with Moore reported at large and additional facts or charges still possible.[6]

References

1. Enterprise toddler found safe in Montgomery, uncle still at-large — WSFA.com, 2026-07-23.
2. AMBER Alert cancelled for 2-year-old boy abducted in Enterprise — WVTM13.com.
3. Guidelines for Issuing AMBER Alerts — OJP.
4. AMBER Alert Canceled for Missing 2-Year-Old in South Alabama — ABC3340.com.
5. Have you seen this child? AMBER Alert: Kingston DeWayne Thomas — NCMEC MissingKids.org.
6. Enterprise toddler found safe in Montgomery, uncle still at-large — WTVY.com, 2026-07-23.
7. Section 13A-6-44. Kidnapping in the second degree — womenslaw.org.
8. The Crime of Kidnapping in Alabama — JoeIngramLaw.com.
9. Statistics | AMBER Alert — OJP.
10. Amber alert — Wikipedia.