A Google computer’s hash value match of a file passing through Google to a CSAM image then forwarded on to NCMEC was a private search. The court agrees with the Fifth and Sixth Circuits holding that the private search doctrine applies, and noting: “The Second, Fourth, and Ninth Circuits have held, to the contrary, that a hash-value match cannot constitute a valid private search.” United States v. Brillhart, 24-13226 (11th Cir. July 9, 2026):
As our descriptions indicate, to this point, most private-search cases (at least in this circuit) have involved a flesh-and-blood individual’s review of a disputed piece of evidence. The central question here is whether Google’s digital hash-value matching protocol should be treated the same way for private-search purposes. Recall, first, the nature of the hash value: A hash value is a string of characters that together constitute a file’s unique “digital signature or fingerprint,” such that “if two files ha[ve] the same hash value, they’re the same file[.]” Tr. of Mot. to Suppress Hr’g at 20.
Recall, next, Google’s particular hash-matching protocol: After an individual Google employee confirms through human review that a particular file depicts child pornography, that file’s hash value is added to a company database along with a corresponding “industry classification” describing the file’s contents. Id. at 101, 105. If, thereafter, an automated process reveals that another file’s hash value matches one in the database, Google concludes—without further human review—that it’s the same file and forwards it along with its classification to NCMEC. Id. at 121–22, 124.
Our sister circuits are split over whether hash matching constitutes a valid private search. The Fifth and Sixth Circuits have held that it does and, therefore, that a subsequent search by law
enforcement of the same images falls within the scope of the hash-match search, and thus of the private-search doctrine. See United States v. Reddick, 900 F.3d 636 (5th Cir. 2018); United States v. Miller, 982 F.3d 412 (6th Cir. 2020). In so holding, both courts emphasized the “near-perfect accuracy” of hash-value matching—which, they say, ensures that law enforcement “learn[s] nothing … that it had not already learned from the private search.” Reddick, 900 F.3d at 640; Miller, 982 F.3d at 418.The Second, Fourth, and Ninth Circuits have held, to the contrary, that a hash-value match cannot constitute a valid private search. See United States v. Maher, 120 F.4th 297, 314 (2d Cir. 2024); United States v. Lowers, 170 F.4th 134, 156 (4th Cir. 2026); United States v. Wilson, 13 F.4th 961, 971 (9th Cir. 2021). Although their approaches differ at the margins, all three courts have conceived of a digital file as akin to a “container[]” or a “sealed manila envelope” whose precise contents can’t really be known until a human opens it. Lowers, 170 F.4th at 149 & n.9; Maher, 120 F.4th at 317 (analogizing digital files found on two separate email accounts to two different sealed containers in the physical world); Wilson, 13 F.4th at 973, 977 n.13 (emphasizing that the image files were “unopened”). They have also emphasized that because Fourth Amendment rights are “personal,” a private search that uses information gleaned from a file that was once in the possession of a third party can’t defeat the suspect’s privacy interests, even in the very same file. Lowers, 170 F.4th at 153–54; Maher, 120 F.4th at 319; Wilson, 13 F.4th at 975.
We agree with the Fifth and Sixth Circuits, and thus hold that Google’s application of its hash-matching protocol to Brillhart’s file qualifies as a valid private search. Through hash matching, Google simply used a computer to save one flesh-and-blood individual the trouble of having to confirm what another (or perhaps even the same) flesh-and-blood individual had already concluded. It’s worth noting at the outset that, at least as Google employs it, hash-value matching doesn’t replace human review entirely. Rather, at step one, so to speak, an individual Google employee reviews a file, determines that it depicts child pornography, assigns it a hash value and classification, and enters it into the company’s database. See Tr. of Mot. to Suppress Hr’g at 76, 101. It is only at step two that the automated hash match occurs: A computer compares a new file’s hash value against those in the database known to depict child pornography and, if (but only if) there’s a match, reports the new file as child pornography. Id. at 124.
Under Supreme Court precedent, the controlling question is whether there is “virtual certainty” that law enforcement will find “nothing else of significance” in its own review that hadn’t already been revealed by the private search—here, that the digital file depicts child pornography. Jacobsen, 466 U.S. at 119. We are satisfied that the search at issue here satisfies that test.
