Fourth Amendment Search and the Power of the Hash
Responding to Orin S. Kerr, Searches and Seizures in a Digital World , 119 Harv. L. Rev. 531 (2005)
Hashing is a powerful and pervasive technique used in nearly every examination of seized digital media. The concept behind hashing is quite elegant: take a large amount of data, such as a file or all the bits on a hard drive, and use a complex mathematical algorithm to generate a relatively compact numerical identifier (the hash value) unique to that data. Examiners use hash values throughout the forensics process, from acquiring the data, through analysis, and even into legal proceedings. Hash algorithms are used to confirm that when a copy of data is made, the original is unaltered and the copy is identical, bit-for-bit. That is, hashing is employed to confirm that data analysis does not alter the evidence itself. Examiners also use hash values to weed out files that are of no interest in the investigation, such as operating system files, and to identify files of particular interest.
It is clear that hashing has become an important fixture in forensic examinations. What is not clear is whether the use of hashing implicates the Fourth Amendment, and if so, how. Is there a search when an examiner simply calculates the hash value of a hard drive in the data duplication process? Is there any Fourth Amendment moment if an examiner uses hashing to identify files on the media that are of interest but that are not within the scope of the search warrant or authority? What if those files constitute digital contraband? Does hashbased examination for child pornography fall outside the Fourth Amendment, allowing investigators throughout the country to look for child pornography on any seized electronic storage device, regardless of the nature of the investigation, without a warrant?
This Reply examines those questions within the framework of Professor Kerr’s “exposure” theory of search. I conclude that when used as part of the imaging process, hashing reveals no meaningful hints as to the contents of the imaged media and thus is not a “search” for the purposes of the Fourth Amendment. I also conclude that in the analysis process, the use of hashing to find only files that constitute contraband does not constitute a Fourth Amendment search under the rulings of United States v. Place, United States v. Jacobsen, and Illinois v. Caballes. There are important differences between the type of contraband in those cases — narcotics — and digital contraband that may make the discussion somewhat academic, at least at this juncture.
119 Harv. L. Rev. F. 38 (2005) | DOWNLOAD PDF
