Ride the Lightning

NO “MAGIC LAMP” – RUNNING HASH VALUES CONSTITUTES A SEARCH

October 30, 2008

Amazing how many times child pornography cases end up making law. It has happened again, this time in Pennsylvania in U.S. v. Crist (M.D. Pa. October 22, 2008). Bottom line, law enforcement ran child porn hash values against a forensic image of a computer without a warrant.

The facts in the case were pretty comical. Defendant Crist was behind on his rent payment. His landlord hired a father and son team to remove his belongings though there was no official eviction action in place. The son had a friend named Hipple who needed a computer, so Crist’s computer was free pickings for Hipple, who came to pick it up. Shortly thereafter, Crist returned home and discovered the father and son team removing his belongings and reported his computer stolen to the police. OK, not bright, but these guys tend not to be rocket scientists. Hipple then found child pornography on the machine and flipped out. He called the police.

The police, not precisely rocket scientists either, were now aware that the computer had been reported stolen and that there was potentially CP on the machine. Nonetheless, they contacted the Attorney General’s office to have the computer forensically examined. Warrant? We don't need no stinking warrant.

Agent Buckwash, who conducted the warrantless examination on behalf of the Pennsylvania Attorney General’s office, found five videos containing known child porn and 171 videos containing suspected child porn. The hash set he used was from the National Center for Missing and Exploited Children. He then switched to the “gallery view” function to see the images, which was certainly the kiss of death, ultimately finding 1600 CP images. He also extracted the Internet history, and used the program NetAnalysis, sorting for suspected child pornography.

The question before the court was whether running the hash sets constituted a Fourth Amendment search. The court concluded that it was and ruled that the child pornography evidence would be suppressed. Long-standing precedent would suggest that Crist lost any privacy rights in his computer as to the images viewed by the private party. The issue is whether he lost any privacy rights as to the remaining files on the computer. There are several schools of thought on this, basically revolving around whether a computer is one container (like a briefcase) or many (which this court seemed to find). If a briefcase, the police would have been ok – the finding of contraband by a private party would have permitted the search of the rest of the briefcase without a warrant.

Among other claims of the U.S. – the searches were done in good faith and the evidence should be allowed. This resulted in my favorite line in the opinion: “good faith is not a magic lamp for police officers to rub whenever they find themselves in trouble.”

So far as I know, this was a case of first impression, and it would appear that running the hash values alone would be sufficient to constitute an illegal warrantless search. The government is expected to appeal.

This is definitely a case to watch. For my Christmas list, I would very much like a magic lamp which would absolve me of all errors. Are you listening, Santa?

Further information and a link to the opinion may be found at http://arstechnica.com/news.ars/post/20081029-court-rules-hash-analysis-is-a-fourth-amendment-search.html

E-mail:      Phone: 703-359-0700