[Infowarrior] - Judge: No cryptographic hash analysis without warrant

[Richard Forno]

Judge: No cryptographic hash analysis without warrant

By Dan Goodin in San Francisco • Get more from this author

Posted in Law, 15th November 2008 00:08 GMT

http://www.theregister.co.uk/2008/11/15/cryptographic_hash_search_ruling/

In a case that could have important implications for law enforcement  
investigations throughout the US, a federal judge has ruled that the  
cryptographic fingerprinting of suspects' hard drives constitutes a  
search for purposes of the Constitution.

The decision by US District Judge Yvette Kane in the Middle District  
of Pennsylvania rejected prosecutors' arguments that running a hash  
value on the contents of a hard drive didn't qualify as a search  
because agents didn't actually open any of the suspect's files.  
Instead, she said agents overstepped their authority when they used a  
forensic tool called EnCase to take the cryptographic signature of  
each file on the hard drive of Robert Ellsworth Crist III, a man who  
was later found possessing a large cache of child pornography.

"To derive the hash values of Crist's computer, the government  
physically removed the hard drive from the computer, created a  
duplicate image of the hard drive without physically invading it, and  
applied the EnCase program to each compartment, disk, file, folder and  
bit," Kane wrote. "By subjecting the entire computer to a hash value  
analysis - every file, internet history, picture, and 'buddy list'  
became available for government review. Such examination constitutes a  
search."

Because Pennsylvania investigators examined the hard drive without  
first getting a search warrant, Kane ordered the evidence to be  
suppressed. Under the US Constitution's Fourth Amendment, searches are  
only authorized when law enforcement officials have a valid warrant.

The EnCase program allowed investigators to examine Crist's hard drive  
cluster by cluster and bypass user passwords to create an index of  
each file, even if it had already been deleted. Agents then compared  
the hash values of the files with a database of known child  
pornography. The analysis uncovered five videos containing known child  
pornography, according to the decision. A subsequent examination using  
a different method revealed 1,600 images of child porn.

Crist became a suspect while he was being evicted by his landlord.  
Someone who took possession of his computer stumbled upon some of the  
forbidden files and reported them to police.

Kane also rejected prosecutors contention that Crist's computer should  
be considered a single container that had already been breached when  
the landlord's acquaintance accessed it.

"Rather, a hard drive is comprised of many platters, or magnetic data  
storage units, mounted together," the judge wrote. In essence, she  
said, each platter constituted its own separate container and the  
acquaintance's search of one didn't breach the others.