Entering search terms in the P2P software results in a list of SHA1 digital signatures that Detective Williams can choose for download. By using this type of search Detective Williams compares the offered SHA1 signatures with SHA1 signatures known to belong to movies or images of child pornography. Detective Williams confirms these SHA1 values as belonging to child pornography by examining the files from previous investigations with the matching SHA1 value. By watching these movies or viewing these images Detective Williams is able to determine the exact file referenced by the given SHA1 value. Once matchings set of digital signatures is identified, Detective Williams submits a download request for the file.

This method has proven to be extremely reliable, working just like software used by end users around the world in locating and downloading precise files. Once the download is initiated, Detective Williams receives a list of download candidates who are participating in the possession, receipt, and/or distribution of child pornography.

*5 6) Any computer hard drive, computer system, tablet, video gaming console containing a hard disk drive, external hard drives, Compact Discs, USB flash drives, memory cards, any other electronic media capable storing data, Cellular phones capable of storing electronic images and/or videos (hereafter referred to as “COMPUTER”) found to contain information otherwise called for by this warrant including but not limited to:

a. Evidence of who used, owned or controlled the COMPUTER at the time the items described in this warrant were created, edited, viewed or deleted, such as logs, registry entries, saved user names and passwords, documents and browsing history, to include bookmarked sites; Evidence of malicious software (“Malware”);

b. Evidence identifying the location from which images of child pornography were downloaded, including date and time of such downloads;

c. Evidence identifying whether image and, or, video files containing child pornography were ever viewed, in include date and time of such viewing;

d. Evidence identifying whether image and, or, video files were deleted, to include date and time of deletion;

e. Contents of volatile memory related to computers and other digital communication devices that would tend to show the current and recent use of the computer, use of encryption, use of communication devices, routes of Internet and other digital communications traffic and passwords, encryption keys or other dynamic details necessary to preserve the true state of running evidence;

f. If computers or other digital devices are found in a running state evidence may be acquired from the devices prior to shutting the devices off;

g. Examination of each of the above listed digital items for digital files, data, images, videos, audio files, software, operating systems and supporting files, deleted files, related to the possession of child pornography.

Item 17: TT Model Thermaltake Computer in a large black tower (operating)

Item 22: OCZ Technology 2 1/2-inch solid state drive, 60 gigabytes, Serial No. 017681101002713

Item 23: Republic of Gamers Model AX850 computer tower, Serial No. XHSA011070070395

The events giving rise to Luke Wilson's conviction and this appeal were triggered when Google, as required by federal law, reported to the National Center for Missing and Exploited Children (NCMEC) that Wilson had uploaded four images of apparent child pornography to his email account as email attachments. No one at Google had opened or viewed Wilson's email attachments; its report was based on an automated assessment that the images Wilson uploaded were the same as images other Google employees had earlier viewed and classified as child pornography. Someone at NCMEC then, also without opening or viewing them, sent Wilson's email attachments to the San Diego Internet Crimes Against Children Task Force (ICAC), where an officer ultimately viewed the email attachments without a warrant. The officer then applied for warrants to search both Wilson's email account and Wilson's home, describing the attachments in detail in the application.

A. Google's Identification of Apparent Child Pornography

Electronic communication service providers are not required “affirmatively [to] search, screen, or scan” for apparent violations on their platforms of federal child pornography laws. 18 U.S.C. §§ 2258A(f), 2258E. But “[i]n order to reduce ... and ... prevent the online sexual exploitation of children,” such providers, including Google, are directed, “as soon as reasonably possible after obtaining actual knowledge” of “any facts or circumstances from which there is an apparent violation of ... child pornography [statutes],” to “mak[e] a report of such facts or circumstances” to NCMEC. 18 U.S.C. § 2258A(a). NCMEC then forwards what is known as a CyberTip to the appropriate law enforcement agency for possible investigation. Id. at §§ 2258A(a)(1)(B)(ii), (c).

*10 According to a two-page declaration from a senior manager at Google, the company “independently and voluntarily take[s] steps to monitor and safeguard [its] platform,” including using a “proprietary hashing technology” to identify apparent child pornography.2

As described in the record—vaguely, and with the gaps noted—the process works as follows:

First, a team of Google employees are “trained by counsel on the federal statutory definition of child pornography and how to recognize it.” Neither the training materials themselves nor a description of their contents appear in or are attached to the Google manager's declaration.

Second, these employees “visually confirm[ ]” an image “to be apparent child pornography.” According to an industry classification standard created by various electronic service providers, there are four industry categorizations: “A1” for a sex act involving a prepubescent minor; “A2” for a lascivious exhibition involving a prepubescent minor; “B1” for a sex act involving a pubescent minor; and “B2” for a lascivious exhibition involving a pubescent minor.

Third, “[e]ach offending image” judged to be “apparent child pornography as defined in 18 USC § 2256” is given a hash value, which is “added to [the] repository of hashes.” As far as the record shows, Google “stores only the hash values” of images identified as apparent child pornography, not the actual images. The government does not represent otherwise.

Finally, Google “[c]ompare[s] these hashes to hashes of content uploaded to [their] services.” The exact manner in which hash values are assigned to either the original photographs or the ones deemed to replicate them is not described in the Google manager's declaration or anywhere else in the record.

B. Government Search

On June 4, 2015, Google, using its propriety technology, “became aware” that Wilson had attached to emails in his email account—which may or may not have been sent—four files that included apparent child pornography. United States v. Wilson, No. 3:15-cr-02838-GPC, 2017 WL 2733879, at *3 (S.D. Cal. June 26, 2017). In compliance with its reporting obligations, Google automatically generated and sent an electronic CyberTipline report to NCMEC. The CyberTipline report included Wilson's four email attachments. According to the Google manager's declaration, “a Google employee did not view the images ... concurrently to submitting the report to NCMEC.” The CyberTipline report did specify that Google had classified each of Wilson's four email attachments as “A1” under an industry classification standard for “content [which] contain[s] a depiction of a prepubescent minor engaged in a sexual act.”

Google's report included Wilson's email address, secondary email address, and IP addresses. NCMEC supplemented Google's report with geolocation information associated with Wilson's IP addresses, but did “not open[ ] or view[ ] any uploaded files submitted with this report.”

NCMEC then forwarded the CyberTip to the San Diego Internet Crimes Against Children Task Force (“ICAC”). Agent Thompson, a member of the San Diego ICAC, received the report. He followed San Diego ICAC procedure, which at the time called for inspecting the images without a warrant whether or not a Google employee had reviewed them.3

*11 After Agent Thompson looked at Wilson's four email attachments, he applied for a search warrant of Wilson's email account. His affidavit asserted that probable cause for the warrant was based on two facts: first, that “Google became aware of four (4) image files depicting suspected child pornography;” and second, that he had “reviewed the four (4) images reported by Google to NCMEC and determined they depict child pornography.” In support of his own child pornography assessment, he included in the warrant application detailed “descriptions of each of these images.” The affidavit did not include the fact that Google had originally classified the images as “A1” or provide any detail about how Google had either classified or later automatically identified Wilson's images as apparent child pornography.

Based upon the Affidavit, the magistrate judge might reasonably have inferred that Rodriguez did not download any files from defendant's computer because the Affidavit explained that Rodriguez only reviewed the contents of files after he “searched for files with SHA1 values that matched” those suspected of being shared over the Suspect IPs. Affidavit ¶¶ 31(b), 32(b). There would have been no reason for Rodriguez to go through the additional step of finding files with the same SHA1 values if he had downloaded suspect files directly from the Suspect IPs via a P2P network. More to the point, Rodriguez's failure to state expressly whether he directly downloaded any files from the Suspect IPs was immaterial to the magistrate judge's conclusion because Rodriguez was not required to download any files from the Suspect IPs in order to establish probable cause. Courts routinely find probable cause based upon an investigator's review of files with the same SHA1 values or a comparison of SHA1 values alone. See United States v. Thomas, 788 F.3d 345, 348 n. 5 (2d Cir. 2015), cert. denied, 136 S. Ct. 848 (2016); United States v. Miknevich, 638 F.3d 178 (3d Cir. 2011).