The Private Search Doctrine: When Google's Look Becomes a Government Search.

The Fourth Amendment generally restrains government searches, not purely private ones. However, government instigation (or “agency”) can transform a company’s scan into governmental action. Police ordinarily may repeat only the scope of a completed private search, and further governmental examination requires either a warrant or another Fourth Amendment exception.

2. How does the private-search doctrine apply to Google’s scan?

Google’s image-scanning efforts are purely private, and therefore do not need to comply with the Fourth Amendment, as long as they are not acting at the government’s behest. This principle was upheld in United States v. Jacobsen, 466 U.S. 109 (1984), in which police conducted a search based on a private freight company’s opened package.

Officials in Jacobsen inspected and tested material already uncovered privately. The court found that this was permissible under the Fourth Amendment, noting that the police’s actions were essentially identical in scope to the private company’s previous examination.

3. Do police have carte-blanche once a private scan reveals evidence?

No, the private-search doctrine does not categorically immunize every later police examination. The key is that governmental action should either match the scope of the preceding private scan, or officials must meet the Fourth Amendment’s requirements, including obtaining a warrant, for any additional action they take.

4. What has Google done to comply with the law?

Google has used a proprietary hashing system to identify images that match confirmed abuse material since 2008. As Google announced on its company blog:

“Since 2008, we have worked with NCMEC and other partners to help stop the spread of child sexual abuse material (CSAM) on our platforms. Our image-hashing technology is a key part of this effort, as it helps us quickly identify and remove previously known CSAM that has been uploaded by users and reported by partners. We also use this technology to detect when other known child sexual abuse images are being shared.”

When is Google acting as an agent of law enforcement?

1. When does a search cease to be private?

A search generally remains private when a private party is seeking to serve its own independent corporate interests. When Google explained that it implemented abuse scanning to serve these independent, nongovernmental business interests, that was sufficient to distinguish its conduct from government action.

2. Does the federal law requiring providers to report apparent child sexual abuse material make Google the government’s agent?

Although 18 U.S.C. § 2258A requires providers of electronic communication services or remote computing services to report material they discover that “may reasonably be concluded to be” obscene or depict “child pornography,” this is not enough to transform Google’s scanning efforts into governmental action. Section 2258A(f) is clear on this point:

“Nothing in this section shall be construed to require a provider to, (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b).”

The provision does not require providers to monitor for obscene or unlawful material, only to report such material when it is discovered. While providers can certainly monitor for such material on their own, doing so does not engage the “monitoring” mandate of the law, and therefore does not render them a state actor.

3. Does statutory regulation make Google the government’s agent?

No. As generally described above, the mere existence of statutory regulation (like the reporting obligation under Section 2258A) does not make it a “state actor” in all other respects. Does routine cooperation with law enforcement establish governmental agency?

No, routinely cooperating with law enforcement is generally not enough by itself to establish agency. At the same time, this is not the only factor courts consider when evaluating governmental agency.

5. What other factors establish governmental agency?

When evaluating governmental agency, courts generally consider whether the government has provided knowledge or acquiescence in the specific search in question, whether government pressure has played a role, and whether the company involved had the intent to assist law enforcement. Thus, among other inquiries, courts will examine the specific relationship between Google and the law enforcement officials who have the relevant “knowledge or acquiescence,” and the degree to which Google may have either intentionally or inadvertently assisted in the government’s attempt to circumvent the Fourth Amendment.

The more that government officials direct or control a private company’s activities, the more likely it is that the private company is acting as an agent of the government. At the same time, there are exceptions to this rule, and, of course, determining whether a private party is acting as the government’s agent on a case-by-case basis is often challenging.

Did police see only what Google had already seen?

1. How does the private-search framework allow for follow-up governmental review?

As established in United States v. Jacobsen, 466 U.S. 109 (1984), the private-search framework allows officials to follow up a private scan if there is virtual certainty that “nothing new” would be revealed. Here, “nothing new” means information not already known by the private company.

2. What information can be revealed?

File hashes can establish that two files match bit-for-bit. Image-matching hashes, which are less sensitive to changes, can recognize the same image despite differences such as resolution, crop, or rotation. This is in stark contrast to the same image being displayed on a screen, where the viewer’s perspective may be affected by brightness or angle.

3. What is the scope of a private search?

When determining the scope of a private search for constitutional purposes, courts will generally look at information revealed, not digital containers. As noted in the “The Private Search Doctrine: What is a private search?” section above, Google is already monitoring communications, and these monitoring efforts are entirely permissible under the Fourth Amendment. To some extent, this allows the government broad latitude to “rely on the scan’s outcome.” However, it cannot simply “piggyback on the provider’s data collection” efforts.

4. What are the different types of “perceptual matches” in Google’s scan?

The relevant type of scan here is one known as an image-hashing scan. Image-hashing systems use algorithms to create hash values that approximate the appearance of a given image. Then, the systems compare these hash values to hash values of previously known child sexual abuse material (CSAM). If the two match, the image is flagged as a “perceptual match.” While, unlike exact cryptographic matches, perceptual matches do not establish virtual certainty that two images are identical, they can still establish what is referred to as “virtual certainty” in Jacobsen in certain cases.

5. What role does a matching system’s false-positive rate play in the Jacobsen inquiry?

A matching system’s false-positive rate bears directly on whether a matching result can be considered “virtually certain” within the meaning of Jacobsen. If the false-positive rate is zero or extremely low, this helps establish virtual certainty. If, however, the false-positive rate is high (or if it is unknown), this will militate against virtual certainty. If a matching result cannot establish virtual certainty that an image depicts abuse material, then law enforcement personnel can do nothing with the image without violating the Fourth Amendment’s search and seizure rules.

6. Did Google’s hash-based detection system establish virtual certainty?

This is a question for the courts. But if Google’s hash-based system is “accurate enough” to be considered virtually certain (i.e., that Google’s results were not false positives), then police may have, under Jacobsen, a right to conduct an identical review of Google’s reported image. This, of course, may depend upon whether Google personnel viewed the image that was reported, and, if so, what their personnel actually saw.

7. Does this mean police can simply use Google’s reported results?

Not necessarily. As established in the “The Private Search Doctrine: What is a private search?” section above, while law enforcement can rely on the results of a private scan, the Fourth Amendment imposes restrictions on the scope of subsequent governmental review. If Google personnel did not view the reported file, then law enforcement personnel’s review of the image is an independent examination, and its legality will depend upon the search and seizure requirements of the Fourth Amendment.

If Google personnel viewed the image and then reported it, law enforcement personnel are still limited to repeating what Google’s personnel saw. The scope of the private search will depend on what information the private personnel identified, and there are limitations on how far that scope extends. For example, if Google’s personnel did not identify anyone in an image who was depicted, law enforcement personnel cannot independently identify individuals in the same image.

Todd Spodek and the attorneys at Spodek Law Group handle federal cases of this kind from New York, Brooklyn, Queens and Los Angeles.

Can NCMEC or police open every reported attachment?

1. Is NCMEC a private entity?

The answer to this question is unsettled. In United States v. Ackerman, 831 F.3d 1292 (10th Cir. 2016), the court held that “NCMEC is, nonetheless, a governmental entity, subject to the Fourth Amendment when it acts as the arm of the government.” However, in United States v. Reddick, 900 F.3d 636 (5th Cir. 2018), the court went in a different direction:

“As a result of NCMEC’s receipt and review of Microsoft’s reporting, the government’s investigation of the user, and its issuance of the warrant, the question raised here is not one of NCMEC’s status as a state actor, but of the status of the government’s subsequent warrantless search of the data. NCMEC’s receipt and review of Microsoft’s reporting constitutes agovernmental search to the extent that the search exceeds the scope of Microsoft’s private search.”

2. If NCMEC views a reported attachment, does this authorize police to open every attachment in the same email?

No, and this is probably a case where even the clearest-eyed judges will struggle to agree. For example, in Walter v. United States, 447 U.S. 649 (1980), the court noted that, while the plaintiff had consented to the government open-and-inspect “the materials contained in his envelopes”, this was “not inclusive of the film in the envelopes.” While “the film” was privately discovered, officials were not entitled to “project and view the content of the film” because, at that point, officials’ action had exceeded the scope of the search previously conducted by private persons.

A similar issue will likely arise if an attachment is included in an email alongside a reported image. For example, in United States v. Wilson, 13 F.4th 961 (9th Cir. 2021), the court held that, in regard to certain attachments, police had:

“exceeded the scope of Google’s search by opening attachments that were not identified by Google’s scan, and no Google employees viewed the image of child pornography that the detectives relied upon when they claimed that the attachment contained child pornography or was sent in aid of child pornography distribution.”

In this case, law enforcement’s action is not authorized by the private-search doctrine. Thus, the answer to this question is generally no, and the mere presence of an attachment in an email should not necessarily place the attachment within the scope of the private-search authorized government search.

3. Has a governmental agent in a similar case been found to fall within the scope of a private search?

Yes. In Reddick, the court found that the government had virtual certainty based on a Microsoft hash match to an image in “a known abuse database, and, as such, the government is entitled to rely on this as a virtual certainty that the image had not undergone substantial alteration.”

And, in United States v. Miller, 982 F.3d 412 (6th Cir. 2020), the court held that “When a detective received an email notification from Google’s CSAM reporting system, viewed a file in the email that identified as an abuse image, and then opened that same file using Google’s interface, he simply viewed that file, and his actions did not go beyond ‘viewing’ the file as allowed by the Fourth Amendment’s private-search doctrine.”

However, in this case, as in Wilson, the private search was conducted by Google’s automated abuse scan (not by Google personnel), and it appears that Google’s personnel did not view the same file that the detective in Miller opened. If so, this would raise important questions. As a result, courts will almost certainly need to determine whether Google’s scan, NCMEC’s investigation, and the detective’s file-opening are each entitled to protection under the private-search doctrine.

What happens if police went beyond Google’s search?

1. What happens if police exceeded the scope of Google’s (or NCMEC’s) private scan?

If law enforcement personnel’s review of a user’s stored image-matching data exceeds the scope of Google’s (or NCMEC’s) private scan, the results are, generally, subject to suppression. However, this result will depend upon two additional factors:

• First, the government bears the burden of justifying a warrantless search; and,
• Second, the government must establish that no independent-source or inevitable-discovery exception (see below) is available.

2. How can this be determined?

When establishing its authority to conduct a warrantless search of a reported attachment, law enforcement officials should be able to rely on provider access logs and NCMEC’s access logs. These logs can establish (i) who opened which attachment, when they opened it, and (ii) whether they did so with a warrant.

When justifying a warrantless search on the ground that it was a follow-up to a private search, law enforcement officials can also rely on the provenance of the hash result that prompted the scan. For example, if a provider’s scan matches the hash of an image that has already been classified as child abuse material, then law enforcement personnel’s viewing of that image may qualify as a warrantless search under Jacobsen.

3. If the government’s follow-up to a private search is subject to suppression, does this mean that the provider’s private search is also subject to suppression?

No. Even if law enforcement’s follow-up violates the Fourth Amendment, the provider’s private search is not subject to suppression. As established above, the private search does not violate the Fourth Amendment; and the mere fact that officials unlawfully relied upon the findings of a private search does not change this.

4. Are the independent-source or inevitable-discovery exceptions available here?

Generally, these exceptions are unavailable when, as noted below, the law enforcement search occurs as part of a warrant application process. However, these are the relevant standards if the law enforcement search occurs independently:

• Independent Source: Under United States v. Murray, 520 U.S. 291 (1998), the independent-source exception allows admission of evidence that would have been discovered without a Fourth Amendment violation as a result of “genuinely independent and lawful activity.”
• Inevitable Discovery: Under Nix v. Williams, 467 U.S. 431 (1984), a search may be justified when law enforcement personnel can show that, despite the violation of the Fourth Amendment, they “would have discovered the evidence by lawful means.”

5. What if law enforcement personnel seek a warrant based on their (unauthorized) viewing of a reported image?

If law enforcement personnel view a reported image, this image is then incorporated into the warrant affidavit. Then, the issuing judge must reassess the affidavit without the facts derived from the unlawful file opening. If the affidavit does not establish probable cause without those facts, then the warrant is invalid, and the evidence must be suppressed.

6. Will the good-faith exception established in United States v. Leon, 468 U.S. 299 (1984), apply here?

The good-faith exception established in Leon is fundamentally different from the good-faith exception available in other contexts. Here, Leon’s rule protects law enforcement officials’ “objectively reasonable reliance” on a warrant; it does not generally protect “good-faith mistakes” that lead to warrantless searches of a person’s stored communications and devices.

1. Do Miller and Chatrie Cover Google Search and Google Location History?

No. While both of these cases are instructive, they concern different scenarios. In Miller, the focus was on Gmail image uploads, not on the users’ Google Search queries. In Chatrie, the focus was on users’ Google Location History, not on users’ search terms.

2. If Police Use This Data in Court, is it Admissible?

Law enforcement personnel may use lawfully obtained Google records as evidence in court regardless of whether Google’s employees have seen it. The question of admissibility is separate from whether obtaining the data constituted a “search” that is subject to the Fourth Amendment.

3. Does Carpenter v. United States Govern the Private-Search Doctrine?

No. Carpenter v. United States, 138 S. Ct. 2206 (2018), governs how governmental agents may acquire Google Location History records. By contrast, Jacobsen governs the circumstances under which officials may repeat a private search of the same data.

4. Does the Validity of a Geofence Warrant Affect the Use of Google’s Reporting System?

No. The validity of a geofence warrant is independent of whether officials may warrantlessly open reported attachments.

But how can this be? As discussed below, both of these issues are separate because they are addressed under different theories of the Fourth Amendment.

5. What Are the Different Theories of the Fourth Amendment?

The Fourth Amendment contains two theories of search protection:

• A property-based theory of the Fourth Amendment focuses on violations of a person’s “persons, houses, papers, or effects.”
• A privacy-based theory of the Fourth Amendment focuses on whether the government officials in question violated a person’s reasonable expectation of privacy in their belongings, without needing to prove that officials’ action constitutes a trespass.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.