Court Says Child Porn Clearinghouse Acts As A Government Entity, Cannot Perform 'Private Searches'
from the gentlemen,-start-your-affidavits dept
A recent decision by the Tenth Circuit Court of Appeals reaches two conclusions: one obvious, and one not quite so obvious.
The defendant, Walter Ackerman, appealed the district court's denial of his motion to suppress evidence obtained through a warrantless search of his email. Unsurprisingly, the court finds [PDF] that the content of his emails are subject to Fourth Amendment protections. More surprisingly (and apparently to the government's complete surprise), it finds a private entity to be a government entity -- one unable to perform "private searches." (via FourthAmendment.com)
First, some background. Ackerman's AOL email account was flagged by the service provider when messages containing hashes known to be related to child porn images were discovered. AOL turned over the flagged email to the National Center for Missing and Exploited Children (NCMEC) as it is required to do by federal statute. NCMEC is the clearinghouse for any suspected child porn discovered by ISPs and works directly with law enforcement to locate suspects.
NCMEC is not a government entity. It is a nonprofit started and run (for the most part) by private citizens. However, it has additional duties imposed on it by Congress -- a total of "22 programs and services to assist law enforcement." The opinion details the close relationship NCMEC enjoys with the government, including the fact that 75% of its funding comes from the federal government and a number of government officials sit on its board. It also details the mandates Congress has handed to it, which require it to do exactly what it did in this case: confirm that flagged images were child porn and alert authorities.
Here we know Congress statutorily required AOL to forward Mr. Ackerman’s email to NCMEC; Congress statutorily required NCMEC to maintain the CyberTipline to receive emails like Mr. Ackerman’s; Congress statutorily permitted NCMEC to review Mr. Ackerman’s email and attachments; and Congress statutorily required NCMEC to pass along a report about Mr. Ackerman’s activities to law enforcement authorities. All at the government’s expense and backed by threat of sanction should AOL have failed to cooperate. All with special dispensation, too, to NCMEC to possess and review contraband knowingly and intentionally. This comprehensive statutory structure seems more than enough to suggest both congressional knowledge of and acquiescence in the possibility that NCMEC would do exactly as it did here.
NCMEC is also allowed to do something private citizens can't: retain and view child porn. While private citizens can come across child porn, preserve the evidence, and turn it over to law enforcement, they can't maintain a private database of images for cross reference like NCMEC does.
The government tried to argue that NCMEC's search of email given to it by AOL was a "private search," and therefore not subject to the Fourth Amendment. Private searches can be performed by almost anyone and these searches can sometimes be duplicated by a government agency without the need for a warrant.
AOL's hash-matching was a form of a private search, albeit a very cursory one that did not access the email's entire contents. It's somewhat the equivalent of a repair shop finding child porn while repairing a computer. In this case, AOL was required to give that information to NCMEC by federal law. NCMEC was required -- again by federal law -- to examine the images and determine the owner of the email account.
It's the insertion of federal law -- along with several other factors -- that turns a private nonprofit into a government agent. If NCMEC had done nothing more than confirmed the single image hash matched hashes in its database, it likely would have steered clear of this issue. But it opened the email and accessed three other attached images. A government agent can duplicate a private search without implicating the Fourth Amendment, but it has to remain within the confines of the original search. NCMEC's search went further than AOL's "private search" -- which only confirmed that one image matched hashes in the child porn database.
The government wanted to salvage the not-so-private search, but seemed completely confident that the appeals court would find in its favor. That's the only explanation for its lack of counterarguments when litigating on appeal. The appeals court, however, isn't obliged to make the government's arguments for it.
In the face of so much law and evidence suggesting NCMEC qualifies as a governmental entity, the government offers almost no reply. In fact, its only response is to question whether the question is properly before us.
[...]
Seeing the void left by the government, NCMEC offers a number of substantive responses to Mr. Ackerman’s entity theory in its own amicus brief. But ours is a party-directed adversarial system and we normally limit ourselves to the arguments the parties before us choose to present. Amici briefs often serve valuable functions, but those functions don’t include presenting arguments forgone by the parties themselves or effectively and unilaterally expanding the word limits established by rule for a favored party.
The NCMEC is a government entity for the purposes of investigating child porn tips. Even if it were to be considered a private entity, law enforcement would need a warrant to duplicate the searches it performs because NCMEC's investigative work goes beyond simply confirming hashes already flagged by ISPs. The government is not allowed to use private agencies to bypass warrant requirements. NCMEC can still do what it's statutorily required to do without violating the Fourth Amendment, but if law enforcement wishes to avail itself of the evidence the clearinghouse has obtained, it will need to obtain a warrant. The contents of the email accessed by NCMEC are protected by the Fourth Amendment.
No one in this appeal disputes that an email is a “paper” or “effect” for Fourth Amendment purposes, a form of communication capable of storing all sorts of private and personal details, from correspondence to images, video or audio files, and so much more.
[...]
Given the uncertain status of Jacobsen after Jones, we cannot see how we might ignore Jones’s potential impact on our case. And its impact here seems even clearer than in Jacobsen. After all, we are not dealing with a governmental drug test that destroyed but a trace amount of potential contraband. We are dealing instead with the warrantless opening and examination of (presumptively) private correspondence that could have contained much besides potential contraband for all anyone knew. And that seems pretty clearly to qualify as exactly the type of trespass to chattels that the framers sought to prevent when they adopted the Fourth Amendment.
[...]
So it seems that, whether we analyze the “search” question through the lens of the government’s preferred authority — Jacobsen and Katz — or through the lens of the traditional trespass test suggested by Jones, they yield the same (and pretty intuitive) result: NCMEC conducted a “search” when it opened and examined Mr. Ackerman’s email.
The court notes that this finding does not immediately preclude the government from successfully battling the suppression motion on remand. There are a host of questions not answered here, mainly because the government decided not to raise them.
Surely hard questions remain to be resolved on remand, not least the question whether the third-party doctrine might preclude Mr. Ackerman’s claim to the Fourth Amendment’s application, a question the government has preserved and the district court and we have reserved. But about one thing we can be very certain. There can be no doubt that NCMEC does important work and that its work can continue without interruption. After all, it could be that the third-party doctrine will preclude motions to suppress like Mr. Ackerman’s. Or that changes in how reports are submitted or reviewed might allow NCMEC to access attachments with matching hash values directly, without reviewing email correspondence or other attachments with possibly private, noncontraband content — and in this way perhaps bring the government closer to a successful invocation of the private search doctrine. Or it may be possible that the government could cite exigent circumstances or attenuation doctrine or special needs doctrine or the good faith exception to excuse warrantless searches or avoid suppression in at least some cases.
But, it goes on to state, this doesn't mean the government should continue to consider NCMEC as operating outside of the confines of the Fourth Amendment and using the nonprofit's statutory mandates to skirt warrant requirements. Given the nature of the NCMEC's investigative work, there should be little standing between law enforcement officers and the proper permission to view NCMEC's collected evidence.
[E]ven if not a single one of these potential scenarios plays out — and we do not mean to prejudge any of them — we are confident that NCMEC’s law enforcement partners will struggle not at all to obtain warrants to open emails when the facts in hand suggest, as they surely did here, that a crime against a child has taken place.
The case goes back to the lower court to discuss the defendant's motion to suppress. No evidence has been suppressed at this moment because the district court never gave Ackerman the opportunity to present a motion, due to its acceptance of the government's "private search" theory.
It's certainly an interesting decision as there appears to be little precedent for this conclusion. The NCMEC has been an integral part in the fight against child pornography -- so much so that the federal government has drafted it into service, funds it, and sits on its board of directors. This close relationship has its benefits for the clearinghouse, but -- at least in this circuit -- it can no longer act on behalf of the government while simultaneously being used by the government as a "private" party for searches.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: 10th circuit, 4th amendment, child porn, ncmec, searches
Companies: ncmec
Reader Comments
Subscribe: RSS
View by: Time | Thread
Hopefully one of these days something will be done about the Federal Reserve, which has all the power of a federal agency despite being a private corporation which is allowed to operate in complete secrecy outside any government oversight.
And then there are all those dozens (if not hundreds) of various non-profit organizations around the world that masquerade as NGOs but are essentially CIA fronts.
[ link to this | view in chronology ]
Re: Government Outlaws
Note here that the NCMEC personnel and all the government personnel who fraudulently used it to violate the 4th Amendment... will receive NOT the slightest punishment nor personal consequences for their crimes. The appeals court carefully highlighted those crimes,but expressed absolutely NO interest in even naming the NCMEC or police criminals involved, much less recommending any prosecution.
Laws are for the little people.
[ link to this | view in chronology ]
A private entity breaking some laws to comply with other laws.
When is AOL's court date?
[ link to this | view in chronology ]
If I understand digital images correctly they are created by turning on/off various digits that a computer can use to create a pattern.
If this is correct and I believe it is then how is it that a computer can not be used to create an animated picture just as Walt Dizney did with cartoons. In fact I believe that this is actually done.
If an image can be and is created with a computer by turning on/off selected bits how is it that some pictures are considered porn and some not?
Also if these pictures are created by a computer how can one set of on/off digits be considered child porn while another set is considered regular porn and a third set is considered non-porn when they are created by the same workstation at the same time?
Another point I do not understand is how an image created in one country suddenly becomes porn when viewed in a different country?
Sorry, I am just confused by all this and do not understand how an image created on a computer has any bearing on anything much less a life sentence in a box because the wrong set of digits is turned on/off.
[ link to this | view in chronology ]
Re:
For your picture vs. video argument, visually, either something is child porn or it isn't. How it was made doesn't matter. There are requirements that must be met for it to be considered child porn (real naked children in sexual situations automatically qualify, for example, in most jurisdictions I'm aware of), regardless of video or still. Actual, fully fictional cartoon/ comic book like images fall in a legal grey area that the courts would need to figure out if it qualifies or not. There are First Amendment implications due to animation & drawings being Art. Real pics of real nude children that aren't sexual in nature probably fall into a similar 1st Amendment grey area (since they are similar to of-age nudes, in all but age) which, again, courts would need to rule on if they haven't already, but people rarely want to talk about that & many just go with naked kid = child porn (which is probably how the government looks at things, whether or not supported by the Law). (So someone doesn't complain about this paragraph, an example: a mom taking pics/ video of her naked child running around not listening probably shouldn't be considered child porn, but some people lump even that in.)
We are talking about pictures/ video. Not the digital encoding. The fact it is digital is meaningless. If the output is an image that is considered child porn, it is child porn. In fact, people have encrypted child porn as non-porn images. In those cases, it is the true, unencrypted files' forms that are considered.
We are usually talking about pics not created by a computer (a digital camera is still a camera & just copies what's in the field of view) that are then digitized & stored on a computer. In the case of a bit by bit manual creation, which has no real human child used as a reference, a pure computer creation, we're back in the legal grey area nude children in animation or comic-like books is. Can purely fictional children give rise to child porn status? That's unknown. I think there was at least one court that has said it does, but I don't remember any details & I don't think it looked at the Art question.
What qualifies as child porn varies by country. The age of consent in one country is different from another. So, the definition of child is different. Sometimes, there is even a separate age for consideration of other things. I don't know any examples off hand, so I can't give any, but I do know Japan has multiple ages for things.
Pics of naked children in sexual situations (or just naked children in some places) is automatically suspect in the USA. A long time ago, a set of rules regarding what constitutes child porn were made. Those rules don't change just because computers exist. The concern is that REAL children are being abused. The legal grey area of completely fictional child porn is probably not even a part of this case. Pictures are pictures whether they are digital or not.
I went point by point with my understanding of this. If any of this is wrong, someone correct me. I'm not entirely clear on the concept of Hashes, for example.
[ link to this | view in chronology ]
Re: Re: Hashes of content
Hash outputs are typically tens of bytes long, versus the received image which is usually thousands or millions of bytes long (kilobytes, megabytes, respectively). Any commercially available hard drive today likely has capacity to store the entire NCMEC hash database several times over. Using hashes also makes the comparison much faster. Comparing the candidate hash against a 20-byte or 32-byte block is cheaper than comparing the candidate image against every bad image, even if in most cases, the comparison would declare "no match" and move on before reading more than 1% of the "bad" image.
The comparator can further optimize this by storing the hashes in sorted order, which enables it to skip around in the table instead of checking every element. Suppose the hash of the received image starts 0123.... If the table of prohibited images is sorted, but not indexed, the comparator can know that once it finds a hash that starts 02..., there are no further hashes that start 01..., so it can stop searching, despite not having reached the end of table.
The short-circuit lookup from a sorted table does not require hashes, but it does provide a huge performance boost.
[ link to this | view in chronology ]
Re: Re: Re: Hashes of content
[ link to this | view in chronology ]
Re: Re: Re: Re: Hashes of content
Yeah, except for the fact that the question you were answering had nothing to do with hashes. The question was about images and never hinted at hashes, nor does an answer to the question require bringing up hashes. Good job...
[ link to this | view in chronology ]
Re: Re:
Not really. Child porn is basically now anything involving kids that someone might jerk off to. Video of (fully dressed) kids playing in a public playground has been ruled child porn based on which parts of the children the person focused on. People have been arrested and prosecuted for having videos starring legal, but young-looking actresses based on the idea that since they look underage, they were as good as child porn to the person who owned them.
Alan John McEwan of Australia was convicted of possessing child pornography for having cartoons depicting the Simpsons engaging in various sex acts. In the US, artwork depicting minors having sex was originally outlawed by the PROTECT Act of 2003, however courts later ruled that this was unconstitutional and that only "obscene" cartoons of children having sex were illegal. Of course with what's obscene being subject to the whim of a prosecutor, most cartoons depicting children having sex are considered obscene. Unfortunately, most of the court cases so far have either involved real child porn or the defendant has accepted a plea bargain, so no case that I know has gone to trial. According to Wikipedia, some states specifically outlaw artwork depicting minors having sex.
Unfortunately, the obsession over finding child porn has basically thrown any such rules out the window and replaced them with "I'll know it when I see it." Today, it doesn't matter how legal an image or video is, if it looks like child porn, or if a fed/prosecutor thinks that you get aroused by looking at it, your reputation will get dragged through the mud and your life will get ruined.
[ link to this | view in chronology ]
Re: Re: Re:
Bad enforcement of the law does not mean it is the Law. The right person (sympathetic & clearly a good person) in possession of anime w/ underage nudity that is clearly acknowledged as art, in the right courtroom, with a smart lawyer, could get First Amendment to clear them & fix some of the mess...
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
If the search gets suppressed in this case, it's because some FBI or DHS agent didn't bother to do his job right.
[ link to this | view in chronology ]
Oh, and by the way. Thanks, Tenth Circuit for telling the government exactly how to avoid warrant requirements for these searches in future. Nice job breaking it (fourth amendment protection) there, Heroes. /s
[ link to this | view in chronology ]
The moment they say "this doesn't apply here" is a big warning sign to me no matter the case.
[ link to this | view in chronology ]
Re:
Because as far as the government is concerned, the only "rights" that people should have are the ones it feels like allowing them in any given situation. They really would be happier if the Bill of Rights was abolished for everyone except law enforcement and politicians. Oh, and their corporate sponsors...
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Child Porn law incompatible with 4th amendment
AOL, a private entity, compelled by law to search the contents of basically all e-mail by computing a hash....no warrant, no nothing!
Certain patterns of bits (of course produced by horrible people, none of whom are at the NCMEC, and of course ill-defined) require a special dispensation to possess legally. We will put the horrible people in prison.
Haven't I heard this before from the MPAA or RIAA?? Or was that for Chelsea Manning? Or was that for the war on drugs?
Note that this particular class of horrible people will either be killed by their fellow inmates will kill them or they will go nuts from loneliness, and that if you are prejudged a horrible person, otherwise legal patterns of bits can put you in jail.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
WTF?
"...not least the question whether the third-party doctrine might preclude Mr. Ackerman’s claim to the Fourth Amendment’s application"
This to me is the most brain boogering interpretation. It's protected by the fourth amendment, but it's not. I'm pretty sure that I don't know anyone who would consider their emails anything but private. If we had an opportunity to opt out of email storage on a server owned by a third party (ISP) by default and chose not to, it one thing. This is something else and designed to help law enforcement violate the Constitution. The Third Party Doctrine should be declared unconstitutional, since it is.
[ link to this | view in chronology ]
Re: WTF?
..you can. It just requires that you set up your own server and domain for emails. It isn't simple, but it's perfectly possible.
Also, this has nothing to do with email storage on separate servers. Your service provider has access to the information used here by virtue of handling your email protocols, not because you store the email on their servers.
[ link to this | view in chronology ]
Re: Re: WTF?
If your needs are minimal, as would be the case if you just want a mail server to handle a single email address, then it can be simple. There are even a number of live CD images that will have you running in a few minutes.
[ link to this | view in chronology ]
Re: Re: Re: WTF?
Rickroll, anyone?
[ link to this | view in chronology ]
Re: Re: Re: Re: WTF?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Does this ruling also apply to private database entities ...
IIRC during the Vietnam war the government directly kept databases on individual people and other entities related to their lifestyles, credit, relatives, friends, neighbors, economic activities, political affiliation, FBI interview transcripts with neighbors, ... the list is endless. When some of the worst abuses of this came to light congress passed legislation and the president signed it into law that prohibited the government from possessing such databases.
The result was the government passing legislation that created "opportunities" for private companies to do exactly what the federal government had been doing on its own and for the government to buy access to these databases. The government is in compliance with the letter of the law, but not the spirit.
So, does the 10th Circuits ruling apply to the numerous entities that build and maintain these databases for the government's convenience?
[ link to this | view in chronology ]
Re: Does this ruling also apply to private database entities ...
[ link to this | view in chronology ]