Federal agents seeking to generate MD5 hashes from files on a suspect’s hard drive must now obtain a warrant before doing so, says a Pennsylvania U.S. District Court, as such an act constitutes a government search protected by the Fourth Amendment of the United States Constitution.
The case in question, United States v.Robert Crist, involves accusations of child pornography and a warrantless search conducted against the defendant’s hard drive. In the case, a federal agent generated an MD5 hash – a unique numeric signature of a file – of every file and then compared them to a national child pornography database.
How the computer ended up in authorities’ hands is a convoluted sequence of events. As part of a forced eviction in September 2005, Crist’s possessions were removed from his home; most of his belongings were placed on the curb for trash pickup, while a friend of the workers who removed Crist’s belongings – Seth Hipple of the East Pennsboro, Pennsylvania township – took possession of his computer. Upon rifling through the computer’s hard drive to see what “[he] could delete,” Hipple finds child pornography and, in a panic, deletes it before calling police.
Hipple later turned the computer over to authorities; a short while after Crist reported the computer as stolen. With this knowledge, the East Pennsboro Township Police Department opened an investigation and the detective assigned to the case, Michael Cotton, started by imaging Crist’s hard drive (among other things) and then generating MD5 hashes of the files stored in that image.
According to court documents (PDF), after using forensic tool EnCase’s “hash value analysis” against the image of Crist’s hard drive, computer forensics Special Agent David Buckwash “switch[ed] [EnCase] to gallery view,” for a heads-up display of every picture the software could find – allowing him to “mark every picture believed notable, whether it be child pornography or … something specific.” Buckwash ended up finding “almost 1600 images” of known or suspected child pornography.
U.S. District Chief Judge Yvette Kane dismissed the government’s arguments that “no search occurred” because agents “didn’t look at any files” – referring to the hash analysis, not the subsequent use of gallery view – and found that the “running of hash values” against either the physical hard drive or an image of it to be a search protected by the Fourth Amendment, which prohibits government search and seizure of private property without a warrant:
“Computers are composed of many compartments, among them a “hard drive,” which in turn is composed of many “platters,” or disks. To derive the hash values of Crist’s computer, the Government physically removed the hard drive from the computer, created a duplicate image of the hard drive without physically invading it, and applied the EnCase program to each compartment, disk, file, folder, and bi t… By subjecting the entire computer to a hash value analysis—every file, internet history, picture, and “buddy list” became available for Government review. Such examination constitutes a search.”
Moreover, writes the Court, since the government search was “different in character” from Hipple’s search, it cannot be classified as an extension of the search conducted privately by Hipple.
Orin Kerr, a blogger, computer crimes and criminal law specialist, and professor at George Washington University Law School, writes that U.S. v. Crist sets new precedent in an area of technology law that has, so far, gone untested by courts.
According to Kerr, however, Kane’s verdict was not completely clear: “It's somewhat hard to know what to make of the decision,” he writes. “Which stage was the search — the creating the duplicate? The running of the hash? I don't think it matters very much to this case, because the agent[s] who got the positive hit on the hashes didn't then get a warrant.”
With the ever-rising usage of computers and encryption technology, U.S. courts are quickly finding themselves in untested areas of the law governing citizens’ rights and technology. In another child pornography case, involving a laptop with an encrypted hard drive, defendant Sebastien Boucher was very nearly forced to divulge his encryption key after complying with a U.S. border search. A federal court eventually quashed a grand jury subpoena served to Boucher last November, citing his Fifth Amendment right to protect himself from self-incrimination. That decision is currently under appeal.
