Federal agents seeking to generate MD5 hashes from files on a suspect’s hard drive must now obtain a warrant before doing so, says a Pennsylvania U.S. District Court, as such an act constitutes a government search protected by the Fourth Amendment of the United States Constitution.
The case in question, United States v.Robert Crist, involves accusations of child pornography and a warrantless search conducted against the defendant’s hard drive. In the case, a federal agent generated an MD5 hash – a unique numeric signature of a file – of every file and then compared them to a national child pornography database.
How the computer ended up in authorities’ hands is a convoluted sequence of events. As part of a forced eviction in September 2005, Crist’s possessions were removed from his home; most of his belongings were placed on the curb for trash pickup, while a friend of the workers who removed Crist’s belongings – Seth Hipple of the East Pennsboro, Pennsylvania township – took possession of his computer. Upon rifling through the computer’s hard drive to see what “[he] could delete,” Hipple finds child pornography and, in a panic, deletes it before calling police.
Hipple later turned the computer over to authorities; a short while after Crist reported the computer as stolen. With this knowledge, the East Pennsboro Township Police Department opened an investigation and the detective assigned to the case, Michael Cotton, started by imaging Crist’s hard drive (among other things) and then generating MD5 hashes of the files stored in that image.
According to court documents (PDF), after using forensic tool EnCase’s “hash value analysis” against the image of Crist’s hard drive, computer forensics Special Agent David Buckwash “switch[ed] [EnCase] to gallery view,” for a heads-up display of every picture the software could find – allowing him to “mark every picture believed notable, whether it be child pornography or … something specific.” Buckwash ended up finding “almost 1600 images” of known or suspected child pornography.
U.S. District Chief Judge Yvette Kane dismissed the government’s arguments that “no search occurred” because agents “didn’t look at any files” – referring to the hash analysis, not the subsequent use of gallery view – and found that the “running of hash values” against either the physical hard drive or an image of it to be a search protected by the Fourth Amendment, which prohibits government search and seizure of private property without a warrant:
“Computers are composed of many compartments, among them a “hard drive,” which in turn is composed of many “platters,” or disks. To derive the hash values of Crist’s computer, the Government physically removed the hard drive from the computer, created a duplicate image of the hard drive without physically invading it, and applied the EnCase program to each compartment, disk, file, folder, and bi t… By subjecting the entire computer to a hash value analysis—every file, internet history, picture, and “buddy list” became available for Government review. Such examination constitutes a search.”
Moreover, writes the Court, since the government search was “different in character” from Hipple’s search, it cannot be classified as an extension of the search conducted privately by Hipple.
Orin Kerr, a blogger, computer crimes and criminal law specialist, and professor at George Washington University Law School, writes that U.S. v. Crist sets new precedent in an area of technology law that has, so far, gone untested by courts.
According to Kerr, however, Kane’s verdict was not completely clear: “It's somewhat hard to know what to make of the decision,” he writes. “Which stage was the search — the creating the duplicate? The running of the hash? I don't think it matters very much to this case, because the agent[s] who got the positive hit on the hashes didn't then get a warrant.”
With the ever-rising usage of computers and encryption technology, U.S. courts are quickly finding themselves in untested areas of the law governing citizens’ rights and technology. In another child pornography case, involving a laptop with an encrypted hard drive, defendant Sebastien Boucher was very nearly forced to divulge his encryption key after complying with a U.S. border search. A federal court eventually quashed a grand jury subpoena served to Boucher last November, citing his Fifth Amendment right to protect himself from self-incrimination. That decision is currently under appeal.
quote: but was he hurting anyone by looking at pictures in his apartment? I think prosecuting people like this is just filling up the jails with more non-violent offenders.
quote: if you want to let the corrupt crooks of Enron of the hook, then be my guest.
quote: If you arrest all of the people creating the child porn, then no one would be able to look at it.
quote: I highly doubt the people making the stuff do it only for other people.
quote: I disagree, how exactly does one separate ethics and morals from the rules of the social structure (ie: laws)?
quote: Laws clearly shape a society’s ethics
quote: I think many people would indulge in this type of behavior except for the fear of getting caught.
quote: By your reasoning if we repealed all laws our morals and ethics would be enough to maintain our social structure by its self? I seriously doubt it.
quote: Easily. Ie. it's perfectly ethical and moral to copy a DVD for backup purposes, but it's against the law.
quote: It's the other way around, Soceity's ethics clearly shape laws and laws reflect a society's morals. - You
quote: The two mutually affect each other. Laws clearly shape a society’s ethics and morals affect laws. - tmouse
quote: I think this analogy might apply to say, illegally downloading copyrighted material, but not to higher crime in general, especially when there is a victim. Most people choose not to steal physical property from someone else, not because it's against the law, but because it hurts someone (ie. there is a victim).
quote: How do you think society's existed before laws were written? Most people live life based on the golden rule, don't do to others what you wouldn't want done to yourself. As for the few that didn't live by that, they usually got something in return. Karma, payback, retribution, revenge, whatever you want to call it, when people committed crimes in the past, they would be ostricized, beaten, publically humiliated, or put to death depending on the severity of the crime committed.
quote: You completely missed his point here. He did not say they were one in the same (i.e. every law is verbatim from ethics and every ethic is strickly taken from a law. He said that the two are so intertwined that it is near impossible to determine whether a person is acting through respect for laws or respect for ethics and morals.
quote: You do realize thats what he said right?
quote: You espouse a lot of omnicience here, but I question whether it can really be told whether people act entierly through their wish to not harm others as you claim here. In fact, I would argue that equally many if not more people act so as not to harm themselves (i.e. not get caught breaking a loaw) than act so as not to harm others. The question of whether they think they would harm themselves (i.e. if they think they will get caught) is a different story entierly.
quote: The system you have here still sounds a lot like there are laws. Maybe noone wrote them down. Or maybe only a few people knew how to read them, or whatnot... But regardless, there is a system of crime and punishment in place in your example.
quote: In all, your post seems like an exuse to make an argument for the end of marijuana prohibition.
quote: ...you seemed to have made a very bad argument for your case through your absurdly illogical argumentation (incase you don't follow me, your argument sounds like you were high when you wrote it).
quote: You quoted him twice, disagreed with him by saying the same thing, misinterpreted (straw manned) one of his points and then commenced to say that he was wrong on the grounds that marijuana should be legal.
quote: This sounds very reminecent of the arguments I would have with my pothead roomates in college.... Perhaps it being illegal has not done you any favors, but it managed to keep me from retarding myself any more than I did in college.
quote: Pot may have spared you..
quote: Also why should a guy be charged with child porn or "statutory rape" if it's pictures of his girl friend?
quote: compared them to a national child pornography database
quote: Seth Hipple of the East Pennsboro, Pennsylvania township
quote: Job well done WITHOUT breaking any amendments.
quote: The guys stuff was on the curb, available to the public, the public took it to the authorities.
quote: Actually an MD5 Hash is calculated in such a way as that every file created is unique.
quote: I am not saying that it is impossible to match an MD5 Hash with say ... an image file vs. a text file.
quote: We need to punish people for actions. Not thoughts. Not information.
quote: This can work as an argument for legalized of drugs, for example, because consumption despite being benevolent in and of itself still fuels violence, crime, etc.
quote: We need to punish people for actions. Not thoughts. Not information.