In U.S. v Wilson, the Ninth Circuit Reaffirms Fourth Amendment Protection for Electronic Communications – EFF

In a powerful new ruling for digital privacy rights, the Ninth Circuit Court of Appeals has confirmed that the police need to get a warrant before they open your email attachmentseven if a third partys automated system has flagged those attachments as potentially illegal. We filed an amicus brief in the case.

How We Got Here

Federal law prohibits the possession and distribution of child sexual assault material (also known as child pornography or CSAM). It also requires anyone who knows another possesses or is engaged in distributing CSAM to report to a quasi-governmental organization called the National Center for Missing and Exploited Children (NCMEC).

Although federal law does not require private parties to proactively search for CSAM, most, if not all major ISPs do, including Google, the ISP at issue in Wilsons case. Once one of Googles employees identifies an image as CSAM, the company uses a proprietary technology to assign a unique hash value to the image. Google retains the hash value (but not the image itself), and its system automatically scans all content passing through Googles servers and flags any images with hash values that match it. Once an image is flagged, Goggles system automatically classifies and labels the image based on what it has previously determined the image depicts and sends the image with its label to NCMEC, along with the users email address and IP addresses. NCMEC then sends the images and identifying information to local law enforcement, based on the IP address.

In Wilsons case, Googles automated system flagged four images attached to one of his emails. No Google employee ever looked at the exact images attached to Wilsons email. Google forwarded them to NCMEC, and NCMEC sent them to San Diego law enforcement. There, an agent opened the images and confirmed they were CSAM without a warrant.

Wilson filed a motion in federal court seeking to suppress the four images as well as evidence later seized from his online accounts and his home, arguing they were products of an unconstitutional warrantless search. The court denied Wilsons motion based on a somewhat obscure exception to the Fourth Amendment called the private search doctrine.

The Private Search Doctrine

Almost every court to squarely address the issue has held the Fourth Amendment protects electronic communications from warrantless searches. However, the Fourth Amendment only applies to government searches; it does not prohibit private parties from searching through your stuff and turning over what they find to the police, which is what happened here.

The private search doctrine holds that law enforcement doesnt need a warrant to search through your stuff if a private party has already searched it and the officer doesnt search through anything more than that private search. For example, in one classic case, an inadvertent recipient of several film reels read the descriptions of the films on their canisters (but didnt view the films), believed them to be obscene, and turned them over to the FBI. The FBI viewed one of the films without a warrant and charged the defendant. The Supreme Court held the FBI exceeded the scope of the private partys search when it did more than just look at the labels on the film canisters. Because it did so without a warrant, the search was unconstitutional.

In this case, the district court held that when the agent opened and viewed the images attached to Mr. Wilsons email, he did not expand the search beyond Googles automatic scan in any meaningful way. This was because the agent only had access to the four images previously identified by Google. Also, based on Googles stated reliability of its automated scanning system, the court decided it was a virtual certainty that the images attached to Wilsons email were identical to previously flagged CSAM, and therefore conveyed illegal content and nothing more.

The Ninth Circuit Opinion

The Ninth Circuit disagreed. It held that opening and viewing the images allowed the government to learn new, critical informationnamely what exactly was depicted in each imagethat it used to obtain a warrant to search Wilsons residence and then to prosecute him. The court noted further noted that Fourth Amendment rights are personal; even if the images attached to Mr. Wilsons email were exact duplicates of images previously identified by a Google employee, they were still different images. No Google employee looked at the exact images attached to Wilsons email, so the agents actions in opening and viewing those images were different from Googles purely automated search.

The Twist

The Ninth Circuit is not the only appellate court to weigh in on the governments review of Mr. Wilsons images; the California Court of Appeal did as well and came to the opposite conclusion.

Wilson was charged in both federal and California state court. The charges were different in each case, and they proceeded on their own timelines, but both cases involved the same search of Wilsons email attachments. Mr. Wilson filed motions to suppress the evidence in both cases, making similar arguments. The California Court of Appeal issued its opinion in November 2020, months before this recent Ninth Circuit opinion, and held the government did not meaningfully expand Googles private search in any manner that would violate Wilsons Fourth Amendment rights. The California appellate court upheld Wilsons sentence of 45 years to life, and the California Supreme Court denied review.

This means two appellate courts with overlapping jurisdiction over the same search are in conflict with one another, which is highly unusual. Wilsons state lawyer has petitioned the U.S. Supreme Court for review (certiorari) of the state case, and the Court is planning to consider taking it this week. In Wilsons federal case, the government has asked for more time to figure out its next steps.

Theres More

In the amicus brief we filed in Wilsons case, we took on a separate argument that often arises in these kinds of casesthat Wilson lacked a reasonable expectation of privacy in the images because he agreed to Googles terms of service, which stated the company would scan his email for illegal content.

As we argued in our brief, a companys TOS should not dictate your constitutional rights, because terms of service are rules about the relationship between you and your email providernot you and the government. A court ruling to the contrary could affect far more than child sexual assault material cases: on this theory, anyone whose account was shut down for any violation of a TOS could lose Fourth Amendment protections over all the emails in their account.

The Minnesota Supreme Court is currently considering this argument in a case called State v. Pauli, which will be heard by the court next week. We weighed in in that case too, and you can read more about that here.

We will continue to follow these cases and weigh in as necessary to protect our right to privacy in our electronic communications.

More here:
In U.S. v Wilson, the Ninth Circuit Reaffirms Fourth Amendment Protection for Electronic Communications - EFF