United States v. Miller

• Decision Date: 03 December 2020
• Docket Number: No. 18-5578,18-5578
• Citation: 982 F.3d 412
• Parties: UNITED STATES of America, Plaintiff-Appellee, v. William J. MILLER, Defendant-Appellant.
• Court: U.S. Court of Appeals — Sixth Circuit

982 F.3d 412

UNITED STATES of America, Plaintiff-Appellee,

v.William J. MILLER, Defendant-Appellant.

No. 18-5578

United States Court of Appeals, Sixth Circuit.

Argued: December 11, 2019

Decided and Filed: December 3, 2020

ARGUED: Eric G. Eckes, PINALES, STACHLER, YOUNG, BURRELL & CROUSE CO., L.P.A., Cincinnati, Ohio, for Appellant. Elaine K. Leonhard, UNITED STATES ATTORNEY'S OFFICE, Ft. Mitchell, Kentucky, for Appellee. ON BRIEF: Eric G. Eckes, PINALES, STACHLER, YOUNG, BURRELL & CROUSE CO., L.P.A., Cincinnati, Ohio, for Appellant. Elaine K. Leonhard, UNITED STATES ATTORNEY'S OFFICE, Ft. Mitchell, Kentucky, Charles P. Wisdom, Jr., UNITED STATES ATTORNEY'S OFFICE, Lexington, Kentucky, for Appellee. Alan Butler, ELECTRONIC PRIVACY INFORMATION CENTER, Washington, D.C., Ryan T. Mrazik, PERKINS COIE LLP, Seattle, Washington, for Amici Curiae.

Before: McKEAGUE, KETHLEDGE, and MURPHY, Circuit Judges.

MURPHY, Circuit Judge.

Courts often must apply the legal rules arising from fixed constitutional rights to new technologies in an evolving world. The First Amendment's rules for speech apply to debate on the internet. Packingham v. North Carolina , ––– U.S. ––––, 137 S. Ct. 1730, 1735–36, 198 L.Ed.2d 273 (2017). The Second Amendment's rules for firearms apply to weapons that did not exist "at the time of the founding." District of Columbia v. Heller , 554 U.S. 570, 582, 128 S.Ct. 2783, 171 L.Ed.2d 637 (2008). The Supreme Court has made the same point for the rights at issue in this criminal case: The Fourth Amendment right against "unreasonable searches" and the Sixth Amendment right to confront "witnesses." See Kyllo v. United States , 533 U.S. 27, 34–36, 121 S.Ct. 2038, 150 L.Ed.2d 94 (2001) ; Melendez-Diaz v. Massachusetts , 557 U.S. 305, 315–17, 129 S.Ct. 2527, 174 L.Ed.2d 314 (2009). We must consider how the established rules for these traditional rights should apply to a novel method for combatting child pornography: hash-value matching.

A hash value has been described as "a sort of digital fingerprint." United States v. Ackerman , 831 F.3d 1292, 1294 (10th Cir. 2016). When a Google employee views a digital file and confirms that it is child pornography, Google assigns the file a hash value. It then scans Gmail for files with the same value. A "match" signals that a scanned file is a copy of the illegal file. Here, using this technology, Google learned that a Gmail account had uploaded two files with hash values matching child pornography. Google sent a report with the files and the IP address that uploaded them to the National Center for Missing and Exploited Children (NCMEC). NCMEC's systems traced the IP address to Kentucky, and a detective with a local police department connected William Miller to the Gmail account. Miller raises various constitutional challenges to his resulting child-pornography convictions.

He starts with the Fourth Amendment, arguing that Google conducted an "unreasonable search" by scanning his Gmail files for hash-value matches. But the Fourth Amendment restricts government, not private, action. And while Google's hash-value matching may be new, private searches are not. A private party who searches a physical space and hands over paper files to the government has not violated the Fourth Amendment. Burdeau v. McDowell , 256 U.S. 465, 475, 41 S.Ct. 574, 65 L.Ed. 1048 (1921). That rule covers Google's scan of virtual spaces and disclosure of digital files.

Miller next argues that the police detective conducted an "unreasonable search" when he later opened and viewed the files sent by Google. This claim implicates another settled rule: Under the private-search doctrine, the government does not conduct a Fourth Amendment search when there is a "virtual certainty" that its search will disclose nothing more than what a private party's earlier search has revealed. United States v. Jacobsen , 466 U.S. 109, 119, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984). So we must ask whether the detective's manual search would disclose anything more than what Google's hash-value search showed. Critically, Miller does not dispute the district court's finding about a hash-value match's near-perfect accuracy: It created a "virtual certainty" that the files in the Gmail account were the known child-pornography files that a Google employee had viewed. Given this (unchallenged) reliability, Jacobsen ’s required level of certainty is met.

Miller thus asks us to depart from Jacobsen ’s idiosyncratic definition of a Fourth Amendment "search," noting that the Supreme Court recently clarified that such a "search" also occurs when the government trespasses onto property to obtain information. United States v. Jones , 565 U.S. 400, 404–08, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012). At the least, Miller says, the detective's opening of the files qualifies as a search in this "trespass-to-chattels" sense. He raises a legitimate (if debatable) point. The Supreme Court has long required the government to obtain a warrant to open sealed letters, the equivalent of modern emails. Ex parte Jackson , 96 U.S. 727, 732–33, 24 L.Ed. 877 (1877). Yet, well before Jacobsen , the Court also allowed the government to rely on letters illegally taken and opened by private parties. Burdeau , 256 U.S. at 474–75, 41 S.Ct. 574. And Google arguably "opened" the files and committed the "trespass" here. In the end, though, we need not resolve this debate. We find ourselves bound by Jacobsen no matter how this emerging line of authority would resolve things.

Miller lastly argues that the admission of NCMEC's report at trial violated his Sixth Amendment right to confront "witnesses." This right's basic rule (that a defendant must have the opportunity to cross-examine those who make testimonial statements) certainly applies to new types of witnesses, such as forensic analysts. Melendez-Diaz , 557 U.S. at 313–21, 129 S.Ct. 2527. But the rule's reach is nevertheless limited to statements by "witnesses"—that is, people. And NCMEC's automated systems, not a person, entered the specific information into the report that Miller challenges. The rules of evidence, not the Sixth Amendment, govern the admissibility of this computer-generated information.

For these reasons and those that follow, we affirm Miller's convictions.

I

A

Many companies rely on hash-value matching to remove child pornography from their email, file-sharing, and similar internet services. Amicus Br. of Discord et al., at 4–5. "A hash value is a number that is often represented as a sequence of characters and is produced by an algorithm based upon the digital contents of a drive, medium, or file." 2017 Advisory Committee Note to Fed. R. Evid. 902(14). As a government witness explained, hash values can be created using common algorithms like SHA or MD5. Johnson Tr., R.106, PageID#1290. "You basically point this algorithm toward a file, and you get back this alphanumeric string, and that's a series of characters that are a fingerprint; the VIN number or the DNA, if you will, of that file." Id. Some algorithms assign a character to every pixel in an image, such that the hash value will change if a single pixel changes. Id. , PageID#1291. Other programs, like Microsoft's PhotoDNA, return the same value even if a file changes slightly. Id. After companies assign a "hash value" to a known image of child pornography, they can scan their services for files with the same value. When they get a "match," they know that the scanned file is a duplicate of the child-pornography image without opening and viewing the file. Amicus Br. of Discord et al., at 4–5.

Apart from commonly used hash algorithms, companies create their own unique programs. "[S]ince 2008," for example, "Google has been using its own proprietary hashing technology to tag confirmed child sexual abuse images." McGoff Decl., R.33-1, PageID#161. When a Google employee finds a child-pornography image on its services, Google gives this image a "hash" and adds it to its "repository of hashes of apparent child pornography as defined in 18 U.S.C. § 2256." Id. Google might also discover child pornography from a customer's complaint, but "[n]o hash is added to [its] repository without the corresponding image first having been visually confirmed by a Google employee to be apparent child pornography." Id.

Google's terms of service inform its customers that they may not use services like Gmail in violation of the law. Id. The terms indicate: "We may review content to determine whether it is illegal or violates our policies, and we may remove or refuse to display content that we reasonably believe violates our policies or the law. But that does not necessarily mean that we review content, so please don't assume that we do." Terms, R.33-1, PageID#164.

Consistent with these terms, Google's "product abuse detection system" scans some files that customers upload looking for hash-value matches with the files in its child-pornography repository. McGoff Decl., R.33-1, PageID#161–62. When this system detects a match, Google does one of two things. Id. An employee might view the file to confirm that it is child pornography. Id. , PageID#162. Or Google might just send an automated report with the file to the National Center for Missing and Exploited Children (NCMEC). Id. NCMEC, a nonprofit entity, "was created to help find missing children, reduce child sexual exploitation, and prevent child victimization." Shehan Decl., R.33-6, PageID#193.

Companies like Google have business reasons to make these efforts to remove child pornography from their systems. As a Google representative noted, "[i]f our product is associated with being a haven for abusive content and conduct, users will stop using our services." McGoff Decl., R.33-1, PageID#161. Yet once "electronic communication services providers" become aware of child pornography on their services, federal law requires them to report it to NCMEC. 18 U.S.C. §§ 2258A(a), 2258E(6). NCMEC operates a "CyberTipline" that allows companies...