D.Neb.: Computer searches: Finding files with the same hash value as known child pornography is PC without opening the files

In a P2P search of a computer left online and open, the officer found files with names and hash values the same as known child pornography. That is probable cause. In addition, there is no reasonable expectation of privacy in a computer left on for a P2P connection because the owner left it online to be viewed by others. United States v. Oliverius, 2011 U.S. Dist. LEXIS 110783 (D. Neb. August 5, 2011):

Based on his experience and training, Investigator Weinmaster’s affidavit explains that SHA1 values are 99.9999% reliable in identifying illegal pornographic images, and therefore the SHA1 assigned to an image is highly accurate and useful to law enforcement when investigating child pornography. See, e.g., U.S. v. Finley, 612 F.3d 998, 1000 n. 3 (8th Cir. 2010) (“The SHA is a mathematical algorithm that allows for unique identification of digital images and videos. SHA values are, in essence, unique digital fingerprints or signatures.”). The warrant application lists the names of four suspect images which were available for sharing from the computer at IP address 76.84.249.75, and this IP address was identified to a person located at defendant’s residence. The names of the four listed images were highly indicative of child pornography. See U.S. v. Stults, 575 F.3d 834, 838 (8th Cir. 2009) (“PTHC” stands for “preteen hard core,” a term associated with images of child pornography); U.S. v. Buesing, 615 F.3d 971, 973 (8th Cir. 2010) (search terms, such as “Lolita,” “pthc” (“preteen hardcore”), and “preteen,” were used by the officer to locate sources of pictures and movies available through P2P sharing and depicting pornographic images of girls under the age of 18). In addition, the warrant application states that after cross-referencing the SHA1 signatures available from IP address 76.84.249.75 with those in the SHA1 database, four files were identified as depicting child pornography. The warrant application listed, by SHA1 signature, these four specific files and for each of these files, provided a description of the sex acts involving children depicted in the file.

Based on the information in the warrant application, it is unclear whether Investigator Weinmaster looked at the actual content of files retrieved from the defendant’s computer to determine whether they depicted child pornography. However, contrary to the defendant’s argument, even absent looking at the files within the defendant’s computer and available for sharing from IP address 76.84.249.75, based on the totality of information presented in the warrant application, there was a fair probability that evidence of a child pornography crime would be found by searching the residence of the account holder for IP address 76.84.249.75. Specifically, law enforcement officers traced IP address 76.84.249.75 to an account holder at the defendant’s residence; from that IP address, officers located P2P shared files with titles highly indicative of child pornography; Investigator Weinmaster cross-referenced, by SHA1 signature, files available for sharing from IP address 76.84.249.75 with the SHA1 signatures of files known to depict child pornography; and the officer viewed four files with SHA1 signatures corresponding to those identified as containing child pornography by the SHA1 database; he confirmed the files contained graphic images of child pornography; and the application contains a graphic description of what the officer saw. Given the accuracy and reliability of SHA1 signatures and the development of a database listing of SHA1 signatures for files containing child pornography, a judge may find, in all likelihood, that a suspect’s computer contains images of child pornography even if the affiant officer has not opened and viewed the files on (and using) the defendant’s computer, and has not viewed files downloaded directly from that computer. U.S. v. Beatty, 2011 WL 2728298, 1 (3d Cir. July 14, 2011) (finding a sufficient showing of probable cause where officer did not open and view the suspect files, but explained the file retrieval process, provided the names of suspect files, and cross referenced and matched each file’s SHA1 to known child pornography files); U.S. v. Miknevich, 638 F.3d 178, 184 (3d Cir. 2011) (holding that although the investigating officer never viewed the alleged images of child pornography on the defendant’s computer, the warrant application provided sufficient probable cause where the highly descriptive names of the file contents indicated child pornography and the SHA1 values for these files matched SHA1 values of files known to contain child pornography).