The government is fighting for unrestrained access to users’ files — and courts are split.
This week, the Supreme Court limited police use of broad “geofence” warrants to search the location data of millions of Americans. In March, a federal appellate court deepened a divide among the circuits over an equally urgent question: whether a technology company’s initial search of user files creates a backdoor for broader government access.
[T]echnological advancement does not automatically diminish our Fourth Amendment protections.
Every day, millions of users use cloud storage services like Google Drive, Apple iCloud, and Microsoft OneDrive to keep their important data safe. When a platform detects and discloses the existence of illicit child sexual abuse material (CSAM), the government routinely intervenes and opens those files without a search warrant. CSAM is a serious issue, and individuals who possess this content in their cloud storage should face legal consequences. But justice does not require officers to ignore the constitutional warrant requirement, which ensures they act with accountability before conducting a search.
Google and Microsoft identify CSAM using human specialists and automated technology. “Hash matching” enables the company to detect and remove illicit material at scale by comparing the unique hash code of an image or video against known CSAM hashes, which is sometimes reviewed in part by a specialist. A match results in the removal of content and a legally required report to the National Center for Missing & Exploited Children (NCMEC), which then forwards the information to federal authorities.
At issue is the government’s subsequent opening of the CSAM files without a warrant. This practice is in tension with the Fourth Amendment, which protects against unreasonable searches and seizures. A search occurs when the government infringes upon a “reasonable expectation of privacy” or engages in a physical trespass. In these instances, a search is presumptively unreasonable without a warrant, unless an exception applies.
The Fifth and Sixth Circuits were the first appellate courts to review this issue and found that any expectation of privacy was frustrated by Microsoft’s initial, private search. The hash values and prior search made the content virtually certain, meaning the government’s subsequent access did not infringe on privacy rights. According to the courts, no warrant was required. While these decisions rested on established doctrine, other appellate courts provided a more thorough answer for situations when no tech specialist opened all the files — only the hashing algorithm.
The Second, Ninth, and, now, Fourth Circuits held that there is a difference between viewing the files and receiving the hash values and the specialists’ more generalized labeling. In these cases, because the government’s review went beyond the files seen by company specialists, it extended further than the private search, and a warrant was needed.
The government could have easily obtained a warrant. Armed with the hash matches and the reports, the officers would likely have had the probable cause necessary to secure approval from a judge or magistrate. There is no danger of evidence destruction — one of the animating factors for an exception — when the information is secured by both the platform and NCMEC. According to an article published in the Harvard Law Review, a study of 33,000 warrant applications filed through Utah’s “e-Warrants” system revealed the median time for a warrant review was three minutes. Given the minimal risks, there was no reason for the government to hastily open the files.
The warrant requirement’s value lies not in its rejection rate: the Harvard study found that 93 percent of warrant reviews are approved on first submission. Rather, it serves as a constitutional check on unreasonable searches by requiring authorities to undergo a procedural review. As the split among the circuits intensifies, only a Supreme Court ruling can definitively settle whether hash matching erodes online privacy. This clarification is urgently needed because other legal doctrines can prevent the suppression of evidence when an officer has a good-faith basis for believing a warrant is unnecessary. The Second Circuit declined to suppress on good-faith grounds, and the Fourth Circuit similarly did not bar the evidence.
If courts continue to sanction warrantless viewing of files, hash matching becomes a constitutional loophole for cloud storage and private communications — one that AI will only make more robust and accessible over time.
Currently, only users with CSAM are affected by hash-enhanced searches. These are not sympathetic defendants. Yet, as Justice Antonin Scalia’s Kyllo v. United States reasoning reflects, technological advancement does not automatically diminish our Fourth Amendment protections. This was true at the turn of the century, and it should remain our guiding principle today.
READ MORE:
Is the Supreme Court the Final Word on the Constitution?
DOJ and Thomas Sowell: Disparate Impact Is Often Unconstitutional
The Constitution They Cannot Conquer
Rachel Chiu is a recent graduate of Yale Law School, a contributor for Young Voices, and a visiting fellow for the Independent Women’s Center for AI and Technology.
