Feeds

Judge: No cryptographic hash analysis without warrant

It's a search

The Power of One Brief: Top reasons to choose HP BladeSystem

In a case that could have important implications for law enforcement investigations throughout the US, a federal judge has ruled that the cryptographic fingerprinting of suspects' hard drives constitutes a search for purposes of the Constitution.

The decision by US District Judge Yvette Kane in the Middle District of Pennsylvania rejected prosecutors' arguments that running a hash value on the contents of a hard drive didn't qualify as a search because agents didn't actually open any of the suspect's files. Instead, she said agents overstepped their authority when they used a forensic tool called EnCase to take the cryptographic signature of each file on the hard drive of Robert Ellsworth Crist III, a man who was later found possessing a large cache of child pornography.

"To derive the hash values of Crist's computer, the government physically removed the hard drive from the computer, created a duplicate image of the hard drive without physically invading it, and applied the EnCase program to each compartment, disk, file, folder and bit," Kane wrote. "By subjecting the entire computer to a hash value analysis - every file, internet history, picture, and 'buddy list' became available for government review. Such examination constitutes a search."

Because Pennsylvania investigators examined the hard drive without first getting a search warrant, Kane ordered the evidence to be suppressed. Under the US Constitution's Fourth Amendment, searches are only authorized when law enforcement officials have a valid warrant.

The EnCase program allowed investigators to examine Crist's hard drive cluster by cluster and bypass user passwords to create an index of each file, even if it had already been deleted. Agents then compared the hash values of the files with a database of known child pornography. The analysis uncovered five videos containing known child pornography, according to the decision. A subsequent examination using a different method revealed 1,600 images of child porn.

Crist became a suspect while he was being evicted by his landlord. Someone who took possession of his computer stumbled upon some of the forbidden files and reported them to police.

Kane also rejected prosecutors contention that Crist's computer should be considered a single container that had already been breached when the landlord's acquaintance accessed it.

"Rather, a hard drive is comprised of many platters, or magnetic data storage units, mounted together," the judge wrote. In essence, she said, each platter constituted its own separate container and the acquaintance's search of one didn't breach the others. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Adam Afriyie MP: Smart meters are NOT so smart
Mega-costly gas 'n' 'leccy totting-up tech not worth it - Tory MP
Just TWO climate committee MPs contradict IPCC: The two with SCIENCE degrees
'Greenhouse effect is real, but as for the rest of it ...'
'Blow it up': Plods pop round for chat with Commonwealth Games tweeter
You'd better not be talking about the council's housing plans
Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold
Ministry of Fun confirms: Yes, we're busy doing nothing
ONE EMAIL costs mining company $300 MEEELION
Environmental activist walks free after hoax sent share price over a cliff
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
Apple smacked with privacy sueball over Location Services
Class action launched on behalf of 100 million iPhone owners
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.