Feeds

Judge: No cryptographic hash analysis without warrant

It's a search

Secure remote control for conventional and virtual desktops

In a case that could have important implications for law enforcement investigations throughout the US, a federal judge has ruled that the cryptographic fingerprinting of suspects' hard drives constitutes a search for purposes of the Constitution.

The decision by US District Judge Yvette Kane in the Middle District of Pennsylvania rejected prosecutors' arguments that running a hash value on the contents of a hard drive didn't qualify as a search because agents didn't actually open any of the suspect's files. Instead, she said agents overstepped their authority when they used a forensic tool called EnCase to take the cryptographic signature of each file on the hard drive of Robert Ellsworth Crist III, a man who was later found possessing a large cache of child pornography.

"To derive the hash values of Crist's computer, the government physically removed the hard drive from the computer, created a duplicate image of the hard drive without physically invading it, and applied the EnCase program to each compartment, disk, file, folder and bit," Kane wrote. "By subjecting the entire computer to a hash value analysis - every file, internet history, picture, and 'buddy list' became available for government review. Such examination constitutes a search."

Because Pennsylvania investigators examined the hard drive without first getting a search warrant, Kane ordered the evidence to be suppressed. Under the US Constitution's Fourth Amendment, searches are only authorized when law enforcement officials have a valid warrant.

The EnCase program allowed investigators to examine Crist's hard drive cluster by cluster and bypass user passwords to create an index of each file, even if it had already been deleted. Agents then compared the hash values of the files with a database of known child pornography. The analysis uncovered five videos containing known child pornography, according to the decision. A subsequent examination using a different method revealed 1,600 images of child porn.

Crist became a suspect while he was being evicted by his landlord. Someone who took possession of his computer stumbled upon some of the forbidden files and reported them to police.

Kane also rejected prosecutors contention that Crist's computer should be considered a single container that had already been breached when the landlord's acquaintance accessed it.

"Rather, a hard drive is comprised of many platters, or magnetic data storage units, mounted together," the judge wrote. In essence, she said, each platter constituted its own separate container and the acquaintance's search of one didn't breach the others. ®

Remote control for virtualized desktops

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Lawyers mobilise angry mob against Apple over alleged 2011 Macbook Pro crapness
We suffered 'random bouts of graphical distortion' - fanbois
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Verizon bankrolls tech news site, bans tech's biggest stories
No agenda here. Just don't ever mention Net neutrality or spying, ok?
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.