Can Hash Matching Be Challenged in Court? What the Defense Can Attack.

Can Hash Matching Be Challenged in Court?

What the Defense Can Attack Even if it seems like there is no way around a hash match, this is not necessarily true. Our attorneys have successfully challenged hash matches in federal court on several grounds. These grounds include: 1. While the matching hash identifies a specific file, it doesn’t identify how the investigators acquired that file. A matching hash doesn’t prove that the search of your computer was lawful.

2. A matching hash identifies data, but it doesn’t identify who owned that data. If the computer was shared by several individuals, then the computer and the matching file were not exclusively under your control.

3. Hash verification is a tool used to test whether a digital copy of a file is an accurate duplicate of the original. This process confirms that a reliable digital extraction was made, but it doesn’t confirm that the computer was seized lawfully or that the search warrant was executed properly. Depending on the circumstances involved, your defense attorney may have other defenses as well. Some examples of defenses that have successfully challenged the government’s case in federal court include:

• Authentication. Even though the hash match identifies the file, it doesn’t necessarily identify its source.
• Accuracy. Was the software used to identify the hash match accurate?
• Chain of Custody. Was the computer kept secure during transport and processing?
• Expert Interpretation. Was the expert’s interpretation of the hash match correct?
• Ineffective Assistance of Counsel. In Strickland v. Washington, the U.S. Supreme Court established a two-part test for determining when a defendant’s right to effective assistance has been violated. A defendant must prove that his lawyer’s performance was deficient, and that the deficient performance resulted in prejudice.
• Unlawful Jury Selection. In Batson v. Kentucky, the U.S. Supreme Court held that race cannot be used as a sole reason for a peremptory strike in jury selection.
• Insufficiency of Evidence. When determining the sufficiency of the evidence in a federal case, a court will assess: - Whether there is an issue in dispute; - The complete record of the proceedings; and, - The controlling circuit law.

  What Kind of Hash Match is the Government Using?

  While all hash matching uses hashing to create digital fingerprints that can be used to identify files, the process can take several different forms. If the government tells you that it has a match, you need to know what kind of match it has. Once you know what kind of match it is, then you can determine whether you can challenge the hash match in court.

If you are the target of a federal investigation, one of the first things your attorney will need to identify is whether the government is using the hash match to prove:

• Known-file identification. This is the most common form of hash matching in federal criminal cases. In this scenario, forensic software computes the hash values for the files on the suspect’s computer. The software then compares the hash values against those of classified reference files in a hash database. If a computed hash matches a hash value in the reference database, then the file is flagged as being a known file.
• Perceptual matching. Unlike known-file identification, perceptual matching relies on the similarity of digital files rather than the identity of digital files. The forensic software calculates the hash value of a suspected file and compares it with the hash value of a reference file. But, if the hash values are not identical, the software will then determine whether they are similar enough to be a match.

Unlike known-file identification, where a matching hash value definitively identifies the file, the risks of a false positive (identifying a file as a match when it is not) or a false negative (failing to identify a file as a match when it is) depend on the perceptual hash similarity threshold.

When the government is using known-file identification and perceptual matching, your defense attorney needs to establish an appropriate evidentiary foundation. This is especially true in cases involving digital evidence, where a judge will generally not take an expert’s word for the accuracy and reliability of the hash matching method without explanation.

If the government identified the match by hashing a disk image, it is not comparing your disk image to a reference file. If the government identified the match by hashing a single embedded file, it is comparing the embedded file to the reference file. A match that identifies a matching file proves only that the file is the same. It does not necessarily prove the reliability and accuracy of the computer forensics process.

A hash match may prove the hash value of the disk image did not change. It does not necessarily prove that the file was correctly classified by the reference database. The hash match only identifies the file.

Commonly used hash algorithms for digital forensics include MD5, SHA-1, and SHA-256.

Do Hash Collisions or Hash Mismatches Make the Evidence Unreliable?

A hash collision is the phenomenon of two different files sharing the same hash value. Because hash functions map an infinite number of possible inputs to a finite number of outputs, mathematical collisions must necessarily exist. This raises a critical question: how plausible is it that two files with the same hash value could actually be different?

When considering the possibility of a hash match, one must distinguish between the accidental and the adversarial scenario. In the accidental scenario, the party who created the suspected file does not know the hash value of a specific file, and by sheer coincidence, its hash value matches the reference hash. With modern, cryptographically secure hash algorithms, this is extraordinarily unlikely. In fact, it is the assumption that accidental collisions are that unlikely that allows the federal government to rely upon hash matching.

In the adversarial scenario, the party who created the suspected file could use their knowledge of the hash algorithm to create a file with the same hash value as the known file. But even in the adversarial scenario, the plausibility of an attack depends on several factors, including: (i) the specific hash algorithm at issue; (ii) whether the suspected file has any inherent constraints; and, (iii) whether the party launching the attack has the resources to execute the attack.

One easy and effective safeguard for protecting against the risks of hash collisions is to provide independent confirmation. This involves computing a second hash value for the file using a different, modern hash algorithm. The likelihood of two different files having the same MD5 hash AND the same SHA-256 hash is negligible.

Hash mismatches do not always represent a failure to identify known files as well. Examples of benign mismatches include:

• Metadata changes. If someone modifies the metadata in a file (e.g., changes the creation date), this can change the file’s hash value without altering the content.
• Transcoding. Transcoding a file converts it from one format to another. This process can alter the data at the binary level, potentially producing a hash mismatch even though the content remains substantially the same.
• Recompression. Similar to transcoding, recompressing a file can produce a hash mismatch without substantially altering its content.

It is also possible for a hash match to identify the same object without identifying the same file. For example, in some cases, files are embedded within containers. If a reference hash is for a file that is part of a container, but the suspect’s computer contains only the container, the suspect’s computer’s hash may not be identical to the reference hash. This could be due to the extraction method used by the computer forensics expert.

MD5 and SHA-1 have both been weakened by demonstrated collision attacks. A match using either of these algorithms does not have the same evidentiary weight as a match using a modern hash algorithm like SHA-256. However, an MD5 or SHA-1 match can still have significant evidentiary value if independently confirmed with a modern, cryptographically secure algorithm.

Which Evidence Rules Can Keep a Hash Match Out?

When challenging hash matching evidence in federal court, the evidence rules of the Federal Rules of Evidence (FRE) provide multiple bases for seeking exclusion. The most relevant evidence rules include FRE 901, FRE 104(a), FRE 702, FRE 1002, and FRE 1003.

FRE 901(a) states: “To satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.” This rule establishes that the federal government must be able to prove the hash match came from the suspect’s device.

FRE 104(a) states that “[t]he court must decide any preliminary question about whether a witness is qualified, a privilege exists, or evidence is admissible. In so deciding, the court is not bound by evidence rules, except those on privilege.” A federal district court judge decides whether a hash match is admissible, with the judge’s decision being subject to abuse of discretion review in the U.S. Court of Appeals.

FRE 702 requires that the expert’s testimony be the result of a “reliable principles and methods,” and, the testimony be the result of “applying the principles and methods to the facts of the case.” If the hash matching algorithm or the computer forensics process is fundamentally unreliable or not applied correctly, then the evidence should be excluded.

FRE 1002 states: “An original writing, recording, or photograph is required in order to prove its content unless these rules or a federal statute provides otherwise.” This is known as the “best evidence rule.”

FRE 1003 states: “A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate.”

If the hash match does not identify the source, it may be that the evidence must be excluded under FRE 901. If the government cannot adequately prove its authentication procedure, then the authenticity is in question. This may lead to the exclusion of the hash match evidence.

If the computer forensics expert cannot adequately testify to the reliability of his or her methodology, then it could be excluded under FRE 702. Even if the methodology is reliable, the application to the facts at hand may be unreliable, and the testimony would still be subject to exclusion.

If there is no evidence of alteration and an expert can testify to the image’s reliability, then a missing or broken chain of custody might affect the weight of the evidence, but it will not render it inadmissible. If there is evidence to suggest that the integrity of the image is in question, then the admissibility will be in dispute.

If the government does not have the original computer and presents a duplicate instead, then under FRE 1002, the original writing, recording, or photograph is required to prove its content. This applies to hash matching, and unless the government meets an exception to FRE 1002, the evidence might be excluded.

What Technical Records Should the Defense Demand in Discovery?

Our attorneys handle matters litigating the government’s reliance on hash matching in federal court. When defending our clients, we will want to learn everything about how the government gathered and analyzed the hash match evidence. This includes demanding all relevant records in discovery. For hash matching, these records include:

Acquisition and Verification Records

In addition to providing the original or image hash, the acquisition logs should provide:

• A detailed record of each imaging step;
• Identification of the imager;
• Date and time of the imaging operation; and,
• The resulting hash.

Verification hashes, such as an image hash or an acquisition hash, are obtained by hashing the result of an acquisition. The computer forensics expert should be able to use this hash value to verify that the copy is an accurate replica of the original. This is a crucial step in establishing the reliability of the computer forensics process. The verification record should be acquired along with any other hash values obtained during the acquisition process.

Processing Details Just

knowing the software used to generate a hash match is not enough. This alone would not make it possible to replicate the government’s process in order to check for mistakes. The computer forensics expert should be prepared to provide his or her tool version and tool configuration, which includes the settings that were applied during the search and the analysis. The government should be able to produce the specific settings applied during the computer forensics process. If the tool produced multiple potential matches, it will be important to know which ones the computer forensics expert deemed as valid matches.

Tool Reliability Along

with identifying the tools used to process digital files, the computer forensics expert should be prepared to testify about the reliability of his or her methodology. To provide an evidentiary foundation for the forensic analysis results, the expert should be able to produce any validation studies or other documentation for the tool used. This should include any documentation of known limitations and any documented testing of error rates. Reference-Database Provenance When the government uses reference hashes, the provenance of the reference database is of great importance. The reference database is a compilation of reference files that have been identified as being known illegal files. As a result, those files must be classified correctly. The records should identify who is responsible for classifying the original reference file, the steps they took to determine that the reference file contains illegal data, and the person who entered the hash into the reference database. Perceptual-Match Details If the government is using perceptual matching, the defense is entitled to more information about the specific nature of the match. We can then determine how to effectively challenge the hash match in federal court. This information includes:

• The similarity threshold. This is the minimum similarity value that can lead to a hash match in perceptual matching.
• Documentation of any testing related to false-positive and false-negative rates at the relevant similarity threshold.
• Evidence of any other testing conducted to determine the suitability of the hash match for a federal criminal investigation.

  Human Confirmation Records Since

  a hash match result in federal criminal cases can have severe consequences, a human confirmation is essential to provide an additional layer of protection for the accused. Thus, it will be important to demand evidence of human confirmation. Human confirmation records should include:

• the identity of the reviewer;
• the date and time of the review;
• the specific image that was reviewed;
• a detailed record of the reviewer’s confirmation of the computer forensics tool’s finding; and,
• the reason the reviewer confirmed the match. Proprietary Software If the government relies on software that is not generally available to the public, a defendant’s interest in discovery is particularly strong. While trade-secret status can be an issue, it does not necessarily eliminate the defendant’s discovery rights. Even if the government can establish the proprietary nature of the tool it is using, this does not outweigh a defendant’s right to a fair trial. In many cases, the court can grant access to the source code under a protective order. The source code may be made available for inspection by the defendant’s designated computer forensics expert or other experts subject to confidentiality agreements. If the government fails to provide the information in discovery, this could also serve as a basis for the computer forensics expert’s findings to be inadmissible at trial.

  Can Provider Scanning Lead to an Unlawful Government Search?

  A CyberTip is an investigative lead that can lead to further inquiries. The presence of a CyberTip provides reason for federal law enforcement to further investigate, but it should not be considered conclusive proof of a crime. As the U.S. Court of Appeals for the Third Circuit explains:

• While the scanning is private, any expansion of a private search can lead to the government search being judged by the Fourth Amendment. (United States v. Jacobsen)
• While scanning remains private, expanding on the scan can present privacy concerns that are protected under the Fourth Amendment. (United States v. Jacobsen)

Can a CyberTip provided by a service provider be considered “governmental” in nature? In other words, does a provider’s act of sending a CyberTip to NCMEC constitute government action? Many federal courts have disagreed on this issue.

There is a federal circuit split on this issue. some federal courts have found that NCMEC’s handling of CyberTips is governmental in nature, while others have found that NCMEC is a private actor and that its actions do not trigger the Fourth Amendment.

Does the search performed by a provider on a suspect’s account limit the subsequent search by the government? If the provider’s search was performed automatically, then any further review of the account could be considered an expansion of the search. Under United States v. Jacobsen, an expansion of a private search that results in a violation of a defendant’s Fourth Amendment rights can lead to the exclusion of the evidence obtained.

As a general rule, the person filing the motion to suppress the evidence must be able to show that the government’s actions violated the Fourth Amendment with respect to a personal or third-party search of their devices, accounts, or personal property.

Under the PROTECT Act, U.S.C. § 2258A requires electronic service providers that “become aware of any violation” of the CSAM prohibition to report it to NCMEC. If they are not aware, however, electronic service providers are not required to proactively search for any information that may lead to the investigation. As a result, when they discover the image upon conducting a scan, this should be considered a private search. When the government receives the CyberTip and proceeds with further review, this could be considered the expansion of a private search that may not be protected under the Fourth Amendment.

Does a Matching File Prove Knowing Possession or Control?

If a matching file was found on the suspect’s device, does this prove that the suspect possessed that file? The simple answer is no. Even though a matching file proves a suspected file was present on the suspect’s device, it does not necessarily mean that the suspect possessed the file. There are many different ways in which files can be placed on a device without the owner’s knowledge, permission, or control.

One common way a file can be placed on a device without the owner’s knowledge is by means of cloud sync. Many individuals use services like Dropbox, iCloud, or Google Drive, and these services can automatically download files from the cloud onto a user’s device. A matching file may have been downloaded to the device because it was sync-downloaded by the device’s cloud software, without the user ever opening the file or knowing that it was there.

Several federal court cases highlight how files can be found on a device without creating a knowing possession. Examples of these cases include:

• United States v. Flyer. In this case, the only evidence of possession was images that were found in unallocated space on the suspect’s computer. The U.S. Court of Appeals for the Fourth Circuit reversed the suspect’s conviction, stating that the mere existence of the images on the hard drive was not enough to prove knowing possession.
• United States v. Kuchinski. In this case, the government presented evidence that images were cached on the suspect’s computer. The U.S. District Court for the Middle District of Ohio rejected this as evidence of knowing possession, stating that automatic caching does not establish possession.
• United States v. Lowe. In this case, multiple computer users had access to the same computer. The U.S. District Court for the District of New Mexico ruled that the government failed to sufficiently attribute any of the matching files to the suspect.

Even if a matching file was found on a device, that does not prove that the owner of the device possessed the file. If a device is shared among family members or friends, this will present attribution problems.

Also, if a device is owned by a company, then the company’s employees will have access to the device. These employees can upload files to the computer without the owner’s permission.

Ownership of a device does not establish possession of the content of the device. In federal criminal law, possession means dominion and control over the accused property. Dominion and control requires the ability to locate, use, view, and/or dispose of the material. If the suspected file is in a hidden folder, then the owner may have no dominion and control. If there are no artifacts from opening a matching file, the prosecution’s evidence of knowing possession is diminished.

Talk to Spodek Law Group

Every case turns on its own facts, and general information is no substitute for advice about yours. Todd Spodek, managing partner of Spodek Law Group, and the firm& #x27;s attorneys defend federal criminal and white collar matters nationwide. Reach the firm at 212-300-5196.