Forgot your password?
typodupeerror
Data Storage Government The Courts United States Your Rights Online News

US District Court Says Calculating a Hash Value = Search 623

Posted by timothy
from the fair-enough dept.
bfwebster writes "Orin Kerr over at The Volokh Conspiracy (a great legal blog, BTW) reports on a US District Court ruling issued just last week which finds that doing hash calculations on a hard drive is a form of search and thus subject to 4th Amendment limitations. In this particular case, the US District Court suppressed evidence of child pornography on a hard drive because proper warrants were not obtained before imaging the hard drive and calculating MD5 hash values for the individual files on the drive, some of which ended up matching known MD5 hash values for known child pornography image and video files. More details at Kerr's posting." Update: 10/28 16:23 GMT by T : Headline updated to reflect that this is a Federal District Court located in Pennsylvania, rather than a court of the Commonwealth itself.
This discussion has been archived. No new comments can be posted.

US District Court Says Calculating a Hash Value = Search

Comments Filter:
  • It's good to see. (Score:5, Informative)

    by UseTheSource (66510) on Tuesday October 28, 2008 @11:03AM (#25541399) Homepage Journal

    The courts are finally getting up to speed on technology.

    • by larry bagina (561269) on Tuesday October 28, 2008 @11:04AM (#25541411) Journal
      Or the joys of child porn
      • Re:It's good to see. (Score:5, Informative)

        by UseTheSource (66510) on Tuesday October 28, 2008 @11:08AM (#25541459) Homepage Journal

        It's not that child pornographers shouldn't be prosecuted, but like it or not, they're still entitled to the same due process as normal, "non-pervert" criminals. This "it's for the children" stuff shouldn't fly when we claim to follow the rule of law.

        • by jollyreaper (513215) on Tuesday October 28, 2008 @11:12AM (#25541501)

          It's not that child pornographers shouldn't be prosecuted, but like it or not, they're still entitled to the same due process as normal, "non-pervert" criminals. This "it's for the children" stuff shouldn't fly when we claim to follow the rule of law.

          And anything we can do to deflate the "think of the children" hysteria will help protect our society. It's not that protecting children is a bad thing, it's that turning people into frothing flesh-rending mobs at the drop of a hat is a bad thing. If I were a nasty sort of black-hatted individual, the quickest way I can think of for destroying an enemy would be planting kiddie porn on his computer and dropping a dime to the authorities. Kiddie porn will be the new "baggie of drugs to plant on a perp." I wouldn't be surprised to see cops dropping usb drives on accidentally shot guys. "No, don't worry, I just planted kiddie porn on the guy. Disciplinary action? We'll probably get a medal for this."

          Incidentally, your tagline: "Ein Volk, Ein Reich, Ein Messiah." Is that an inept slam against Obama?

          • Re:It's good to see. (Score:4, Interesting)

            by UseTheSource (66510) on Tuesday October 28, 2008 @11:28AM (#25541777) Homepage Journal
            Kiddie porn will be the new "baggie of drugs to plant on a perp." I wouldn't be surprised to see cops dropping usb drives on accidentally shot guys. "No, don't worry, I just planted kiddie porn on the guy. Disciplinary action? We'll probably get a medal for this."

            Or, a good excuse to turn a neighbor or family member in to the party. It wouldn't be hard for private citizens to plant evidence in that manner, either.

            Incidentally, your tagline: "Ein Volk, Ein Reich, Ein Messiah." Is that an inept slam against Obama?

            Actually, given that the Nazi's brand of national socialism was ideologically very similar to Soviet Communism in many ways, I think I prefer this [youtube.com]. ;)
            • by theaveng (1243528) on Tuesday October 28, 2008 @12:10PM (#25542441)

              >>>>>The man was clearly guilty

              A lot of you are missing the point, so let me put it in bold:

              Without the requirement for search warrants (obtained from an impartial judge), the police, FBI, or other government officials/politicians can go from house-to-house-to-house taking PCs simply because they feel like it. Do YOU want to be a victim of these random, harassing, and very inconvenient confiscations. I certainly Do Not! The Constitution was written because that's precisely what was happened in the 1760 and 1770s, and the American people were stick and tired of the bullshit.

              "[Our government] has erected a multitude of new offices by a self-assumed power, & sent hither swarms of officers to harrass our people" - Declaration of Independence, 1776

              So they setup a Supreme Law of the Land that would prevent this from ever happening again.

              • by gillbates (106458) on Tuesday October 28, 2008 @12:59PM (#25543339) Homepage Journal

                But the recent civil forfeiture provisions for copyright infringement they're trying to get signed (maybe already signed?) into law will allow them to do the same thing. The Feds can already seize your property on the mere suspicion that it is being used for illegal drug activity, and are not required to even file charges. When said seizure happens, the burden of proof is on the owner prove that it wasn't used for illegal activity.

                • Re: (Score:3, Insightful)

                  by King_TJ (85913)

                  This sort of thing is all part of the move to the "New World Order" that presidents like Bush have spoken about fondly in several speeches in the last decade.

                  The majority in the USA apparently haven't learned from history, so now we're doomed to repeat it.

                  I predict a quick slide towards Socialism in U.S. govt. over the next 4-8 years. Our Constitution doesn't sound ALL that different from the ones written for countries like the U.S.S.R. Like them, we'll reduce it to a piece of paper that is only paid lip

              • by jeffb (2.718) (1189693) on Tuesday October 28, 2008 @01:03PM (#25543401)

                Without the requirement for search warrants (obtained from an impartial judge), the police, FBI, or other government officials/politicians can go from house-to-house-to-house taking PCs simply because they feel like it. Do YOU want to be a victim of these random, harassing, and very inconvenient confiscations. I certainly Do Not! The Constitution was written because that's precisely what was happened in the 1760 and 1770s, and the American people were stick and tired of the bullshit.

                Who cared if the Brits were confiscating PCs, with no electricity to run them anyhow?

  • by yincrash (854885) on Tuesday October 28, 2008 @11:04AM (#25541405)
    you can't generate md5s w/o actually looking at all of the data in the file.
    • Re: (Score:3, Insightful)

      by grapes911 (646574)
      And why did the technicians generating the md5's not know this? I'm all for the ruling, but how hard would it have been for someone to stand up and say, "We got this guy, but let's get a warrant before we scan his hard drive."
      • Re: (Score:3, Informative)

        by Anonymous Coward

        "We got this guy, but let's get a warrant before we scan his hard drive."

        The odd thing is that the computer was in the landlord's friend's friend's (brother's dogwalker's sister-in-law's... whoops, got carried away) possession having been seized during the eviction. The vast majority of precedent (used whenever the government wants data from phone companies and mail servers, etc) says that if the guy with the data freely gives it to the cops, they don't need no steenkin warrant.

        While the overall decision is

        • Re: (Score:3, Interesting)

          by PJ1216 (1063738) *
          But then they'll also point out its difficult to prove the pedophile had put the pictures there. If there was an extended amount of time outside of his control, who knows what someone could have done. Its easy to make the argument that someone is trying to set him up. May or may not be true, but it does cast doubt unless there isn't other evidence backing it up.

          In either case, I at least like the idea that they say calculating MD5s is considered protected by the 4th.
        • by nahdude812 (88157) * on Tuesday October 28, 2008 @12:13PM (#25542493) Homepage

          The landlord's friend's friend didn't own the laptop. He can no more authorize a search of it than your landlord can authorize a search of the apartment he rents to you.

    • Re: (Score:3, Insightful)

      by DeepDarkSky (111382)

      Very true. It's almost like simply taking a picture of evidence in a residence after busting down the door, even though there's no search warrant to search the residence.

    • Re: (Score:3, Insightful)

      by blitzkrieg3 (995849)
      That's what I don't understand. IANAL, but how is this different than just simply opening the images or videos of the CP? You have to access the hard drive either way.

      Which stage was the search - the creating the duplicate? The running of the hash? It's not really clear.

      I would say creating the image counts as a search, since you have to actually go in and read the data from his hard drive.

    • Re: (Score:3, Funny)

      But you only took a peek, and just jotted down the jist of it! Come on! Don't let a goddamn piece of paper stand in the way of a good wholesome lynching!

    • by Cajun Hell (725246) on Tuesday October 28, 2008 @01:16PM (#25543643) Homepage Journal

      I wouldn't rely on that argument to keep this from happening in the future. They could have some private third party generate the hashes and then the government could look through the hash list. Or it's not hard to imagine a filesystem with some high-level call that returns the hash given an inode, so that they aren't looking at the file; the system is. Such a call could even return a stored answer that was calculated when the file was written instead of when they call it, so that no actual file reading happens at the time the government looks at the computer.

      Instead of looking at it as "they have to read the file to generate the hash," I'd look at it as "the hash is a form of representation of the file." If they're picking through your hashes, they're picking through your hashes.

  • by betterunixthanunix (980855) on Tuesday October 28, 2008 @11:10AM (#25541483)
    This sounds like the worse possible way to search for kiddie porn, because a suspect who wanted to conceal his activities could just change a single pixel, and the entire hash would change. They would need a signature method that doesn't change dramatically when a single bit changes, like something based on a frequency analysis.
    • by Chyeld (713439) <chyeld@@@gmail...com> on Tuesday October 28, 2008 @11:24AM (#25541707)

      More than likely the hashes are generated against the picture not the file data, and are 'fuzzy' enough that minute changes in the image are ignored. That was many 'Usenet duplicate image detectors' do. For instance, one of the old programs I used to use did this:

      * Render image and convert it to grayscale.
      * Resize image to 128x128 or some other 'thumbnail' size.
      * Create a hash based on the thumbnail.

      You'd have to mangle a picture a good amount for it not to show up as a positive match. The problem is you'd have a good number of false positives. On the other hand, if you are using this as a fishing expedition to find an excuse for a more through search, that really isn't a problem... is it?

  • by phatvw (996438) on Tuesday October 28, 2008 @11:11AM (#25541493)
    Hash is ~$30/gram depending on quality. Seems like those folks in PA have been smoking something else if they thought they needed to calculate an emmm-dee-five.
  • by Phizzle (1109923) on Tuesday October 28, 2008 @11:11AM (#25541497) Homepage
    The guy whose computer was searched, abandoned the computer and gave up any rights at that point, the person who found the porn was computers new owner. Just like any trash tossed out becomes public domain, there should have been zero expectation of privacy at that point. I am not a legal scholar, but I do not see how the 4th amendment applies here. It would be no different than if this was a diary in a different language and the person who inherited the diary found a translator, upon finding criminal evidence it would be fully admissible.
  • search = search (Score:4, Insightful)

    by drfireman (101623) <.moc.grebmik. .ta. .nad.> on Tuesday October 28, 2008 @11:15AM (#25541551) Homepage

    Calculating hash values isn't search. Calculating them and comparing them to a database is. Not only is it quite clearly search (searching for files that match known MD5 signatures), it's hard to imagine another way to describe it without being deliberately obfuscatory.

  • by tripdizzle (1386273) on Tuesday October 28, 2008 @11:22AM (#25541661)
    "some of which ended up matching known MD5 hash values for known child pornography image and video files." Wait, so law enforcement has a database of kiddie porn and kiddie porn md5's? Some perverted bureaucrat found himself the right job.
    • Re: (Score:3, Interesting)

      by darkmeridian (119044)

      Actually, it's a terrible job. There's a guy out there who has to look at all the child porn and verify that it is in fact child porn. There's also a guy out there who has to look at videos of brutal murders to try and figure out who did what. I'm sure these guys aren't too happy about their jobs but realize it's a necessary evil if you want to hunt down those who commit these crimes.

      I know a guy who works for Google. His job is to look at porn all the time. He has to verify that SafeSearch has accurately c

  • by bfwebster (90513) on Tuesday October 28, 2008 @11:25AM (#25541715) Homepage

    When I submitted this story, I gave it the headline "US Court:...". Someone changed that to "PA Court Says...". That's wrong. This is a ruling from a US District (Federal) court, not a Pennsylvania state court, and so carries much more weight. ..bruce..

  • Cops blow it again (Score:5, Informative)

    by russotto (537200) on Tuesday October 28, 2008 @12:18PM (#25542567) Journal

    Not only did they search the drive without a warrant, but they also got the defendant to confess to putting the files there by questioning him without reading his rights and telling him that he didn't need an attorney. Genius.

    Even dumber: Based on the testimony of the guy who originally found the child porn, they could have gone to a magistrate and gotten a warrant. Then there would have been no issue of a warrantless search.

    BTW, for those considering the abandoned-property angle -- the court goes into that. It wasn't a legal eviction and the defendant hadn't abandoned his stuff; he merely hadn't removed it all yet.

An optimist believes we live in the best world possible; a pessimist fears this is true.

Working...