It seems to come from images reported to this group https://www.missingkids.org/ through their CyberTipline.

Edit: toward the end of the interview, Craig says the database can be audited. Obviously not the actual images, but people can verify that the list is the same across all countries, for example.