Private Search Doctrine and Known Hashes

By: Dana Domenick
A Fourth Amendment search occurs where a government official invades an individual’s reasonable expectation of privacy.[1] However, Fourth Amendment protection is not invoked against an unreasonable search conducted by a private party.[2] A private search terminates the individual’s expectation of privacy.[3] Under the private search doctrine, government officials are authorized, without a warrant, to replicate a private search undertaken so long as the government search does not exceed the scope of the private search.[4] When government officials reconstruct a private search which reveals no more information than that which was previously learned by the private search, an individual’s privacy is not further infringed on, thus no Fourth Amendment violation occurs.[5]
The private search doctrine is applicable where a private party detects illegal files in an individual’s electronic device and either sends the files or turns the device over to law enforcement.[6] Most commonly, internet providers scan its users files by comparing each file’s hash value to known hash values corresponding to images of child pornography.[7] Service providers, in accordance with federal law, subsequently forward the files to the National Center for Missing and Exploited Children (NCMEC).[8] Once a NCMEC analyst confirms the images contain illegal content, NCMEC alerts law enforcement.[9]
The manner in which law enforcement receives the file impacts the court’s ruling. Circuits are split on what constitutes a search under the private search doctrine. In the Sixth, Tenth, and Eleventh Circuits, where a private party opened one file on a device, law enforcement agents may access only that single file and nothing more, otherwise an unlawful Fourth Amendment search is triggered.[10] For instance, in United States v. Ackerman, the Tenth Circuit court found a Fourth Amendment search where law enforcement agents who received a folder from NCMEC, viewed all four images in the folder, despite that only one file was flagged as child pornography. [11] Conversely, the Seventh Circuit found no Fourth Amendment search where a private party opened one file on a computer and law enforcement subsequently accessed the entire computer.[12]
In the aforementioned cases, each circuit ruled that law enforcement is protected under the private search doctrine in opening individual files that have hashes which match known hashes corresponding to child pornography. [13] Although this investigative technique is beneficial for the purposes of identifying violent offenders, it raises concerns that any file with a known hash, not limited to images of child exploitation, are subject to law enforcement’s viewing.[14]
  1. See Katz v. United States, 389 U.S. 347, 360-61 (1967).
  2. See United States v. Ackerman, 831 F.3d 1292, 1295 (10th Cir. 2016).
  3. See United States v. Johnson, 806 F.3d 1323, 1334 (11th Cir. 2015).
  4. See United States v. Jacobsen, 466 U.S. 109, 122, 130 (1984).
  5. See id. at 117.
  6. See United States v. Runyan, 275 F.3d 449, 463-64 (5th Cir. 2001).
  7. See Ackerman, 831 F.3d at 1294.
  8. See id.
  9. See id.
  10. See id. at 1306-08; United States v. Lichtenberger, 786 F.3d 478, 491 (6th Cir. 2015); Johnson, 806 F.3d at 1335 (11th Cir. 2015).
  11. See Ackerman, 831 F.3d at 1306-08.
  12. See Rann v. Atchison, 689 F.3d 832, 838 (7th Cir. 2012).
  13. See id.; Runyan, 275 F.3d at 464; Ackerman, 831 F.3d at 1294; Lichtenberger, 786 F.3d at 491; Johnson, 806 F.3d at 1335.
  14. See Orin Kerr, Opening a File After A Hash Was Made and Matched to Known Image of Child Pornography is not a “Search,” Fifth Circuit Rules, (Aug. 17, 2018) https://reason.com/volokh/2018/08/17/opening-a-file-after-a-hash-was-made-and.

Leave a Reply

Your email address will not be published. Required fields are marked *