This case arose from a tip generated by Google's automated hash-matching system, which identified 156 files uploaded to a private Google Drive account as containing child sexual abuse material. While Google flagged the files and reported them to the National Center for Missing and Exploited Children, it did not visually inspect all of them; only a subset of 31 files were opened by a human reviewer. Detective Jennifer Rider of the Chesapeake Police Department, acting on the report without a warrant, opened and viewed three of the unreviewed files, confirming they contained CSAM. This warrantless inspection led to a series of investigative steps, including a search of the defendant's parents' home and two voluntary interviews with the defendant, Nico Aaron Lowers. During these interviews, Lowers confessed to downloading the material and led police to a flash drive and hard drive containing additional CSAM. Lowers was charged with transporting and possessing CSAM, but he moved to suppress all evidence, arguing that the initial warrantless search of his Google Drive violated the Fourth Amendment and that the subsequent evidence was the fruit of that poisonous tree.
Judge Thacker, writing for the panel, addressed the Fourth Amendment implications of cloud storage and the private search doctrine. First, the court rejected the district court's reliance on Google's privacy policy, holding that a service provider's right to monitor content for abuse does not extinguish a user's reasonable expectation of privacy against government intrusion. The court analogized cloud storage to a physical filing cabinet or hotel room, where third-party access does not grant the government unfettered access. Second, the court clarified that digital files are containers; while probable cause may justify seizing a container, the Fourth Amendment requires a warrant to open it and examine its contents. The court rejected the district court's analogy of hash-matching to a dog sniff, noting that a hash value is merely a serial number that reveals nothing about the actual image, unlike a binary drug test. Consequently, the court held that a hash-match does not frustrate a defendant's expectation of privacy because it does not constitute a visual inspection of the specific file. The court further ruled that the private search exception did not apply because Google had not visually inspected the specific files in question, and a private search of a third party's identical files does not defeat the privacy rights of the current owner. However, the court found that the exclusionary rule did not require suppression of the evidence. Applying the attenuation doctrine, the court noted that seven months elapsed between the illegal search and the discovery of the evidence, and the defendant's voluntary acts—consenting to interviews, allowing device searches, and confessing—sufficiently broke the causal chain. The court also found the officer's misconduct was not flagrant, as there was no evidence she intended to circumvent the warrant requirement.
This decision establishes a clear warrant requirement for law enforcement to inspect unopened digital files in private cloud storage, even when flagged by automated hash-matching systems. It aligns the Fourth Circuit with the Second and Ninth Circuits, rejecting the contrary views of the Fifth and Sixth Circuits. While the conviction in this specific case stands due to the attenuation of the evidence, the ruling mandates that future investigations involving cloud storage must secure warrants before visual inspection of flagged files to avoid Fourth Amendment violations.
Podcast (federal-narrative-summaries): Play in new window | Download