Hash Values and 4th Amendment Particularity

A defendant in a federal child pornography case made an interesting argument recently. The case is U.S. v. Farlow, 2009 WL 4728690 (U.S. District Court for the District of Maine 2009), and here is how it arose:

On March 1, 2007, March 8, 2007, and April 14, 2007, Nassau County Detective Peter Badalucco, posing as a 14 year old teenager, `Chris’, received sexually suggestive emails from a person using the AOL screen name `FarlowMeCasa’, that included explicit sexual advances and a request for an in-person meeting. Sending written sexual solicitations to an . . . officer posing as a 14-year-old boy violates two . . . New York criminal statutes: dissemination of indecent materials to a minor in the first degree, N.Y. Penal Stat. § 235.22, and endangering the welfare of a child. N .Y. Penal Stat. § 260.00. In one or more of those emails, `FarlowMeCasa’ sent Badalucco a non-pornographic digital photograph of a bodybuilder, claiming it was his photograph. After Badalucco subpoenaed the AOL subscriber information for `FarlowMeCasa’ and confirmed the profile was registered to Gary Farlow of Litchfield, Maine, he contacted Detective Laurie Northrup of the Maine State Computer Crimes Unit (MCCU). . . to request her assistance in obtaining a search warrant . . . .

Northrup made out a search warrant and swore out an affidavit in support of the warrant. . . . [Her] affidavit highlighted . . . the crimes for which the warrant was being sought:

All of which constitute evidence of the crimes of disseminating indecent material to minor in the first degree in violation of New York State Statute 138-A § 235.22 and endangering the welfare of a child in violation of New York State Statute 138-A § 260.00.

On April 23, 2007, she presented the request for a search warrant to a state of Maine District Judge, who approved its issuance, authorizing a search of Mr. Farlow's Litchfield residence, his motor vehicles, any persons at the premises, and his computers. . . .

U.S. v. Farlow, supra. In addition to authorizing a search of “[c]omputers and computer equipment” of various types, the warrant authorized a search for computer records or

data . . . that are evidence of the crimes of dissemination of indecent materials to minors or endangering the welfare of a child, including but not limited to records of Internet use . . ., electronic communications . . ., stored data files and folders, graphic visual images . . . , software or programs for file sharing or peer-to-peer networks, personal calendars or diaries, and any records or data that demonstrate the identity of the person(s) who exercised dominion or control over the computer or its contents.

U.S. v. Farlow, supra.

Armed with this warrant, Northrup searched Farlow's Litchfield residence during the afternoon of April 23, 2007. As Northrup began to execute the search, Farlow was on-line with Balalucco, and the New York Detective was communicating . . . with Northrup by cell phone. Farlow admitted that he had been chatting with `Chris’ in New York, and had been doing so when the police arrived. Northrup seized Farlow's computer and removed it to the MCCU.

On April 24, 2007, Sergeant Lang of the MCCU performed an initial search of Farlow's computer. When the sergeant conducted the search for the bodybuilder image that `FarlowMeCasa’ had sent to `Chris’, digital images of child pornography appeared on the screen. Based on these images, Lang sought and obtained a second search warrant that permitted a search for images of child pornography.

U.S. v. Farlow, supra.

Farlow filed a motion to suppress the child pornography evidence, and asked the federal magistrate judge to whom the issue was assigned to grant him an evidentiary hearing on his motion. U.S. v. Farlow, supra. His request for an evidentiary hearing arose from the nature of the argument he made in his motion to suppress:

Farlow's argument is that the Encase software program Lang used to perform the computer search allows an investigator to track down a digital image based on its unique hash mark. As Farlow sent the bodybuilder photograph to Badalucco, posing as `Chris’, the police had access to the hash mark of the digital image. . . . Farlow says all Lang had to do was to enter the hash mark into the Encase program and the program would have revealed the presence of the same bodybuilder digital photograph on Farlow's computer. Once law enforcement confirmed that the bodybuilder photograph with its digital fingerprint was on both Farlow's and the New York Detective's computers, there would have been no justification for continuing to search Farlow's computer, since the purpose . . . was limited to the New York State crimes delineated in Northrup's affidavit. In other words, authorization to search a computer for a non-pornographic image of a bodybuilder does not include authorization to search for images of child pornography.

U.S. v. Farlow, supra. In terms of legal principles, Farlow’s argument was based on the 4^th Amendment’s requirement that search warrants must “particularly describe” the place to be searched and the things to be seized. As I noted in an earlier post, applying that requirement to digital searches and seizures can be a bit tricky.

As part of his particularity argument, Farlow claimed that the search warrant itself was defective because it was “overbroad,” i.e., did not describe the items to be searched for and seized with the particularity necessary to limit the discretion of the officer executing the warrant. U.S. v. Farlow, supra. The federal district judge who ultimately ruled on Farlow’s motion to suppress held that the warrant satisfied the particularity requirement because “it limited the search to evidence of the crimes under investigation”. U.S. v. Farlow, supra.

Farlow next argued that the warrant “was fatally defective because it did not restrict the type of search” the officers could conduct of Farlow’s computer. Here, he claiming that the warrant should have included or been accompanied by a search protocol that specified what officers could do in searching for evidence. U.S. v. Farlow, supra.

At this point in his opinion, the district court judge addressed the applicability of the Ninth Circuit Court of Appeal’s decision in the U.S. v. Comprehensive Drug Testing case. After reviewing that decision, he noted that if the procedures that court mandated for future digital searches and seizures had

applied here, and the Government had forsworn or been ordered to forswear the plain view doctrine in searching, and a third party had segregated all photographs not directly related to the search for evidence of the state of New York crimes, either Sgt. Land would not have discovered the child pornography or the third party would have been compelled not to have disclosed its existence.

U.S. v. Farlow, supra. The judge noted, though, that he wasn’t bound by that decision because the U.S. District Court for the District of Maine is under the immediate authority of the U.S. Court of Appeal for the First Circuit. (If that’s not clear, check out Wikipedia’s entry on the U.S. Courts of Appeal).

The judge then explained that under the controlling precedent in the First Circuit (which he indicated would probably not authorized a deliberate search “for child pornography under the guise of a search for a single non-pornographic digital photograph of a bodybuilder”) Farlow’s argument failed because Sergeant Lang

declared under the penalty of perjury `[t]he only reasonable way for an examiner to locate most of the copies of a particular image is to do it visually.’ . . . Lang rejected the defense assertion that tracking the hash mark would have led to the bodybuilder photograph, since `[e]very time one pixel of a picture is changed the hash value is completely different. If the user were to open the picture and save it to another location with a picture viewer, the hash can be changed via compression. When a file is deleted, its hash value changes.’ Based on this . . ., Lang's method of searching the Farlow computer was `about the narrowest definable search and seizure reasonably likely to obtain the images.’ This is especially true here, where. . . `[t]he warrant process is primarily concerned with identifying what may be searched or seized -- not how -- and whether there is sufficient cause for the invasion of privacy thus entailed.’

U.S. v. Farlow, supra (quoting U.S. v. Upham, 168 F.3d 532 (U.S. Court of Appeals for the First Circuit 1999)). The judge therefore held that “[o]nce the contents of Sgt. Lang’s declaration are conceded, his search protocol does not violate Fourth Amendment particularity requirements, and when he visually tripped over evidence of the commission of other crimes in plain view, he was not required to ignore it.” U.S. v. Farlow, supra.

(In a footnote, the judge noted that it was

not inconceivable that Lang, realizing Farlow was soliciting sex from a presumed minor over the internet, was suspicious that he might also possess child pornography, and used a computer search protocol that gave him the ability to view other images, finding by indirection what he would not have been able to look for directly. But, the record is silent as to the efficacy of other protocols and whether the visual inspection Lang used in this case is standard operating procedure or something out of the ordinary. Absent countervailing evidence, the Court will not assume Lang was gaming the restrictions in the warrant.

U.S. v. Farlow, supra.)