In a powerful new ruling for digital privacy rights, the Ninth Circuit Court of Appeals has confirmed that the police need to get a warrant before they open your email attachments—even if a third party’s automated system has flagged those attachments as potentially illegal. We filed an amicus brief in the case.

How We Got Here

Federal law prohibits the possession and distribution of child sexual assault material (also known as child pornography or CSAM). It also requires anyone who knows another possesses or is engaged in distributing CSAM to report to a quasi-governmental organization called the National Center for Missing and Exploited Children (NCMEC).

Although federal law does not require private parties to proactively search for CSAM, most, if not all major ISPs do, including Google, the ISP at issue in Wilson’s case. Once one of Google’s employees identifies an image as CSAM, the company uses a proprietary technology to assign a unique hash value to the image. Google retains the hash value (but not the image itself), and its system automatically scans all content passing through Google’s servers and flags any images with hash values that match it. Once an image is flagged, Goggle’s system automatically classifies and labels the image based on what it has previously determined the image depicts and sends the image with its label to NCMEC, along with the user’s email address and IP addresses. NCMEC then sends the images and identifying information to local law enforcement, based on the IP address.

In Wilson’s case, Google’s automated system flagged four images attached to one of his emails. No Google employee ever looked at the exact images attached to Wilson’s email. Google forwarded them to NCMEC, and NCMEC sent them to San Diego law enforcement. There, an agent opened the images and confirmed they were CSAM – without a warrant.

Wilson filed a motion in federal court seeking to suppress the four images as well as evidence later seized from his online accounts and his home, arguing they were products of an unconstitutional warrantless search. The court denied Wilson’s motion based on a somewhat obscure exception to the Fourth Amendment called the “private search doctrine.”

The Private Search Doctrine

Almost every court to squarely address the issue has held the Fourth Amendment protects electronic communications from warrantless searches. However, the Fourth Amendment only applies to government searches; it does not prohibit private parties from searching through your stuff and turning over what they find to the police, which is what happened here.

The private search doctrine holds that law enforcement doesn’t need a warrant to search through your stuff if a private party has already searched it and the officer doesn’t search through anything more than that private search. For example, in one classic case, an inadvertent recipient of several film reels read the descriptions of the films on their canisters (but didn’t view the films), believed them to be obscene, and turned them over to the FBI. The FBI viewed one of the films without a warrant and charged the defendant. The Supreme Court held the FBI exceeded the scope of the private party’s search when it did more than just look at the labels on the film canisters. Because it did so without a warrant, the search was unconstitutional.

In this case, the district court held that when the agent opened and viewed the images attached to Mr. Wilson’s email, he did not expand the search beyond Google’s automatic scan in any meaningful way. This was because the agent only had access to the four images previously identified by Google. Also, based on Google’s stated reliability of its automated scanning system, the court decided it was a virtual certainty that the images attached to Wilson’s email were identical to previously flagged CSAM, and therefore conveyed illegal content and nothing more.  

The Ninth Circuit Opinion

The Ninth Circuit disagreed. It held that opening and viewing the images allowed the government to learn new, critical information—namely what exactly was depicted in each image—that it used to obtain a warrant to search Wilson’s residence and then to prosecute him.  The court noted further noted that Fourth Amendment rights are personal; even if the images attached to Mr. Wilson’s email were exact duplicates of images previously identified by a Google employee, they were still different images. No Google employee looked at the exact images attached to Wilson’s email, so the agent’s actions in opening and viewing those images were different from Google’s purely automated search.

The Twist

The Ninth Circuit is not the only appellate court to weigh in on the government’s review of Mr. Wilson’s images; the California Court of Appeal did as well and came to the opposite conclusion.  

Wilson was charged in both federal and California state court. The charges were different in each case, and they proceeded on their own timelines, but both cases involved the same search of Wilson’s email attachments. Mr. Wilson filed motions to suppress the evidence in both cases, making similar arguments. The California Court of Appeal issued its opinion in November 2020, months before this recent Ninth Circuit opinion, and held the government did not meaningfully expand Google’s private search in any manner that would violate Wilson’s Fourth Amendment rights. The California appellate court upheld Wilson’s sentence of 45 years to life, and the California Supreme Court denied review.

This means two appellate courts with overlapping jurisdiction over the same search are in conflict with one another, which is highly unusual. Wilson’s state lawyer has petitioned the U.S. Supreme Court for review (“certiorari”) of the state case, and the Court is planning to consider taking it this week. In Wilson’s federal case, the government has asked for more time to figure out its next steps.

There’s More

In the amicus brief we filed in Wilson’s case, we took on a separate argument that often arises in these kinds of cases—that Wilson lacked a reasonable expectation of privacy in the images because he agreed to Google’s terms of service, which stated the company would scan his email for illegal content.

As we argued in our brief, a company’s TOS should not dictate your constitutional rights, because terms of service are rules about the relationship between you and your email provider—not you and the government. A court ruling to the contrary could affect far more than child sexual assault material cases: on this theory, anyone whose account was shut down for any violation of a TOS could lose Fourth Amendment protections over all the emails in their account.

The Minnesota Supreme Court is currently considering this argument in a case called State v. Pauli, which will be heard by the court next week. We weighed in in that case too, and you can read more about that here.

We will continue to follow these cases and weigh in as necessary to protect our right to privacy in our electronic communications.