United States v. Luke Wilson

13 F.4th 961

Opinion

FOR PUBLICATION

UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, No. 18-50440 Plaintiff-Appellee, D.C. No. v. 3:15-cr-02838-GPC-1

LUKE NOEL WILSON, Defendant-Appellant. OPINION

Appeal from the United States District Court for the Southern District of California Gonzalo P. Curiel, District Judge, Presiding

Argued and Submitted November 15, 2019 Pasadena, California

Filed September 21, 2021

Before: Marsha S. Berzon and Paul J. Watford, Circuit Judges, and Robert H. Whaley, * District Judge.

Opinion by Judge Berzon

* The Honorable Robert H. Whaley, United States District Judge for the Eastern District of Washington, sitting by designation. 2 UNITED STATES V. WILSON

SUMMARY **

Criminal Law

The panel vacated a conviction for possession and distribution of child pornography, reversed the district court’s denial of a motion to suppress, and remanded for further proceedings in a case in which the panel addressed whether the government’s warrantless search of the defendant’s email attachments was justified by the private search exception to the Fourth Amendment.

As required by federal law, Google reported to the National Center for Missing and Exploited Children (NCMEC) that the defendant had uploaded four images of apparent child pornography to his email account as email attachments. No one at Google had opened or viewed the defendant’s email attachments; its report was based on an automated assessment that the images the defendant uploaded were the same as images other Google employees had earlier viewed and classified as child pornography. Someone at NCMEC then, also without opening or viewing them, sent the defendant’s email attachments to the San Diego Internet Crimes Against Children Task Force, where an officer ultimately viewed the email attachments without a warrant. The officer then applied for warrants to search both the defendant’s email account and his home, describing the attachments in detail in the application.

** This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. UNITED STATES V. WILSON 3

The private search doctrine concerns circumstances in which a private party’s intrusions would have constituted a search had the government conducted it and the material discovered by the private party then comes into the government’s possession. Invoking the precept that when private parties provide evidence to the government on their own accord, it is not incumbent on the police to avert their eyes, the Supreme Court formalized the private search doctrine in Walter v. United States, 447 U.S. 649 (1980), which produced no majority decision, and United States v. Jacobson, 466 U.S. 109 (1984), which did.

The panel held that the government did not meet its burden to prove that the officer’s warrantless search was justified by the private search exception to the Fourth Amendment’s warrant requirement. The panel wrote that both as to the information the government obtained and the additional privacy interests implicated, the government’s actions here exceed the limits of the private search exception as delineated in Walter and Jacobsen and their progeny. First, the government search exceeded the scope of the antecedent private search because it allowed the government to learn new, critical information that it used first to obtain a warrant and then to prosecute the defendant. Second, the government search also expanded the scope of the antecedent private search because the government agent viewed the defendant’s email attachments even though no Google employee—or other person—had done so, thereby exceeding any earlier privacy intrusion. Moreover, on the limited evidentiary record, the government has not established that what a Google employee previously viewed were exact duplicates of the defendant’s images. And, even if they were duplicates, such viewing of others’ digital communications would not have violated the defendant’s expectation of privacy in his images, as Fourth Amendment 4 UNITED STATES V. WILSON

rights are personal. The panel concluded that the officer therefore violated the defendant’s Fourth Amendment right to be free from unreasonable searches when he examined the defendant’s email attachments without a warrant.

COUNSEL

Devin Burstein (argued), Warren & Burstein, San Diego, California, for Defendant-Appellant.

Peter Ko (argued), Assistant United States Attorney; Helen H. Hong, Chief, Appellate Section, Criminal Division; Robert S. Brewer, Jr., United States Attorney; United States Attorney’s Office, San Diego, California; for Plaintiff- Appellee.

Jennifer Lynch and Andrew Crocker, Electronic Frontier Foundation, San Francisco, California; Jennifer Stisa Granick, American Civil Liberties Union Foundation, San Francisco, California; Brett Max Kaufman and Nathan Freed Wessler, American Civil Liberties Union Foundation, New York, New York; for Amici Curiae Electronic Frontier Foundation and American Civil Liberties Union Foundation.

Marc Rotenberg, Alan Butler, and Megan Iorio, Electronic Privacy Information Center, Washington, D.C., for Amicus Curiae Electronic Privacy Information Center (EPIC).

Ryan T. Mrazik, Erin K. Earl, and Rachel A.S. Haney, Perkins Coie LLP, Seattle, Washington, for Amici Curiae Google LLC and Facebook, Inc. UNITED STATES V. WILSON 5

OPINION

BERZON, Circuit Judge:

We once again consider the application of the Fourth Amendment’s warrant requirement to new forms of communication technology. See, e.g., United States v. Cano, 934 F.3d 1002 (9th Cir. 2019); cf. Carpenter v. United States, 138 S. Ct. 2206 (2018). “When confronting [such] concerns wrought by digital technology, th[e] [Supreme] Court [and this court] ha[ve] been careful not to uncritically extend existing precedents.” Id. at 2222. Our question this time concerns the private search exception to the Fourth Amendment—specifically, the intersection between electronic communications providers’ control over material on their own servers and the Fourth Amendment’s restriction of warrantless searches and seizures, which limits only governmental action. See Burdeau v. McDowell, 256 U.S. 465 (1921); Walter v. United States, 447 U.S. 649 (1980); United States v. Jacobsen, 466 U.S. 109 (1984).

The events giving rise to Luke Wilson’s conviction and this appeal were triggered when Google, as required by federal law, reported to the National Center for Missing and Exploited Children (NCMEC) that Wilson had uploaded four images of apparent child pornography to his email account as email attachments. No one at Google had opened or viewed Wilson’s email attachments; its report was based on an automated assessment that the images Wilson uploaded were the same as images other Google employees had earlier viewed and classified as child pornography. Someone at NCMEC then, also without opening or viewing them, sent Wilson’s email attachments to the San Diego Internet Crimes Against Children Task Force (ICAC), where an officer ultimately viewed the email attachments without a warrant. The officer then applied for warrants to search 6 UNITED STATES V. WILSON

both Wilson’s email account and Wilson’s home, describing the attachments in detail in the application.

Our question is whether the government’s warrantless search of Wilson’s email attachments was justified by the private search exception to the Fourth Amendment. See Walter, 447 U.S. at 655–56; Jacobsen, 466 U.S. at 113–14. For the reasons that follow, we hold that it was not. We therefore reverse the district court’s denial of Wilson’s motion to suppress and vacate Wilson’s conviction.

I. Background

A. Google’s Identification of Apparent Child Pornography

Electronic communication service providers are not required “affirmatively [to] search, screen, or scan” for apparent violations on their platforms of federal child pornography laws. 18 U.S.C. §§ 2258A(f), 2258E. But “[i]n order to reduce . . . and . . . prevent the online sexual exploitation of children,” such providers, including Google, are directed, “as soon as reasonably possible after obtaining actual knowledge” of “any facts or circumstances from which there is an apparent violation of . . . child pornography [statutes],” to “mak[e] a report of such facts or circumstances” to NCMEC. 18 U.S.C. § 2258A(a). 1 NCMEC then forwards what is known as a CyberTip to the

1 “A provider that knowingly and willfully failed to make a report required . . . shall be fined.” 18 U.S.C. § 2258A(e). Further, in the case of “intentional, reckless, or other misconduct,” there may be “a civil claim or criminal charge against a provider . . . arising from the performance of the reporting or preservation responsibilities.” Id. at §§ 2258B(a), (b). UNITED STATES V. WILSON 7

appropriate law enforcement agency for possible investigation. Id. at §§ 2258A(a)(1)(B)(ii), (c).

According to a two-page declaration from a senior manager at Google, the company “independently and voluntarily take[s] steps to monitor and safeguard [its] platform,” including using a “proprietary hashing technology” to identify apparent child pornography. 2

As described in the record—vaguely, and with the gaps noted—the process works as follows:

First, a team of Google employees are “trained by counsel on the federal statutory definition of child pornography and how to recognize it.” Neither the training materials themselves nor a description of their contents appear in or are attached to the Google manager’s declaration.

Second, these employees “visually confirm[]” an image “to be apparent child pornography.” According to an industry classification standard created by various electronic service providers, there are four industry categorizations: “A1” for a sex act involving a prepubescent minor; “A2” for a lascivious exhibition involving a prepubescent minor; “B1” for a sex act involving a pubescent minor; and “B2” for a lascivious exhibition involving a pubescent minor.

Third, “[e]ach offending image” judged to be “apparent child pornography as defined in 18 USC § 2256” is given a hash value, which is “added to [the] repository of hashes.”

2 “A hash value is (usually) a short string of characters generated from a much larger string of data (say, an electronic image) using an algorithm.” United States v. Ackerman, 831 F.3d 1292, 1294 (10th Cir. 2016). 8 UNITED STATES V. WILSON

As far as the record shows, Google “stores only the hash values” of images identified as apparent child pornography, not the actual images. The government does not represent otherwise.

Finally, Google “[c]ompare[s] these hashes to hashes of content uploaded to [their] services.” The exact manner in which hash values are assigned to either the original photographs or the ones deemed to replicate them is not described in the Google manager’s declaration or anywhere else in the record.

B. Government Search

On June 4, 2015, Google, using its propriety technology, “became aware” that Wilson had attached to emails in his email account—which may or may not have been sent—four files that included apparent child pornography. United States v. Wilson, No. 3:15-cr-02838-GPC, 2017 WL 2733879, at *3 (S.D. Cal. June 26, 2017). In compliance with its reporting obligations, Google automatically generated and sent an electronic CyberTipline report to NCMEC. The CyberTipline report included Wilson’s four email attachments. According to the Google manager’s declaration, “a Google employee did not view the images . . . concurrently to submitting the report to NCMEC.” The CyberTipline report did specify that Google had classified each of Wilson’s four email attachments as “A1” under an industry classification standard for “content [which] contain[s] a depiction of a prepubescent minor engaged in a sexual act.”

Google’s report included Wilson’s email address, secondary email address, and IP addresses. NCMEC supplemented Google’s report with geolocation information UNITED STATES V. WILSON 9

associated with Wilson’s IP addresses, but did “not open[] or view[] any uploaded files submitted with this report.”

NCMEC then forwarded the CyberTip to the San Diego Internet Crimes Against Children Task Force (“ICAC”). Agent Thompson, a member of the San Diego ICAC, received the report. He followed San Diego ICAC procedure, which at the time called for inspecting the images without a warrant whether or not a Google employee had reviewed them. 3

After Agent Thompson looked at Wilson’s four email attachments, he applied for a search warrant of Wilson’s email account. His affidavit asserted that probable cause for the warrant was based on two facts: first, that “Google became aware of four (4) image files depicting suspected child pornography;” and second, that he had “reviewed the four (4) images reported by Google to NCMEC and determined they depict child pornography.” In support of his own child pornography assessment, he included in the warrant application detailed “descriptions of each of these images.” The affidavit did not include the fact that Google had originally classified the images as “A1” or provide any detail about how Google had either classified or later automatically identified Wilson’s images as apparent child pornography.

On the basis of the application and affidavit submitted by Agent Thompson, a magistrate judge issued a search

3 Agent Thompson testified that San Diego ICAC, which includes both local, county, regional, and federal agencies, now obtains a search warrant before opening a CyberTip when the provider has not viewed the images. It is not clear from the record whether other ICAC task forces across the country have adopted the same policy. 10 UNITED STATES V. WILSON

warrant for Wilson’s email account. When Agent Thompson executed the warrant, he discovered numerous email exchanges in which Wilson received and sent images and video files of alleged child pornography and in which Wilson offered to pay for the creation of child pornography.

Agent Thompson then obtained a search warrant for Wilson’s residence. On executing the warrant, law enforcement officers found and seized several electronic devices that contained evidence of child pornography. One officer observed a backpack being tossed over Wilson’s balcony at the time officers were knocking on Wilson’s door and announcing their presence. Wilson’s checkbook and a thumb drive containing thousands of images of child pornography—including the four images reported by Google—were found in the backpack.

C. Motion to Suppress

Wilson filed a motion to suppress all evidence seized from his email account and residence, arguing that Agent Thompson’s review of his email attachments without a warrant was impermissible under the Fourth Amendment. Relying principally on Jacobsen, 466 U.S. 109, and United States v. Tosti, 733 F.3d 816 (9th Cir. 2013), the government maintained in response that Agent Thompson’s review of the four images did not exceed the scope of Google’s private search and so, under the private search doctrine as enunciated in Jacobsen and Tosti, was valid without a warrant.

The district court agreed. The court denied Wilson’s motion to suppress on the ground that the government’s warrantless search did not exceed the scope of the antecedent private search and so did not require a warrant. The district court also concluded that “if [Agent] Thompson’s UNITED STATES V. WILSON 11

warrantless viewing of the four images constituted an illegal search, neither excising the tainted evidence from the affidavit nor the good faith exception would prevent operation of the exclusionary rule.” 4 Wilson, 2017 WL 2733879, at *12–13.

After waiving his right to a jury trial, Wilson was convicted of possession and distribution of child pornography 5 and sentenced to 11 years of incarceration and

4 The government does not contest these contingent rulings. 5 While this appeal was pending, the California Court of Appeal held that “the government’s warrantless search of Wilson’s four images was permissible under the private search doctrine.” People v. Wilson, 56 Cal. App. 5th 128, 147 (2020), as modified on denial of reh’g (Nov. 6, 2020), review denied (Jan. 20, 2021). We have not squarely addressed the preclusive effect of the denial of a suppression motion in an earlier state- court proceeding. Other circuits, however, have held that “the government may not collaterally estop a criminal defendant from relitigating an issue against the defendant in a different court in a prior proceeding.” United States v. Harnage, 976 F.2d 633, 636 (11th Cir. 1992); accord United States v. Pelullo, 14 F.3d 881, 896 (3d Cir. 1994); United States v. Gallardo-Mendez, 150 F.3d 1240, 1244 (10th Cir. 1998). Citing those cases, we came to the similar conclusion that, in criminal trials, the government “may not use collateral estoppel to establish, as a matter of law, an element of an offense or to conclusively rebut an affirmative defense on which the Government bears the burden of proof beyond a reasonable doubt.” United States v. Smith-Baltiher, 424 F.3d 913, 920 (9th Cir. 2005) (quoting United States v. Arnett, 353 F.3d 765, 766 (9th Cir. 2003) (en banc) (per curiam)).

We need not definitively resolve the preclusion question as it relates to a motion to suppress, here, as the government has not asserted collateral estoppel, so the argument is waived. Harbeson v. Parke Davis, Inc., 746 F.2d 517, 520 (9th Cir. 1984) (“The United States was unaware that Mr. Wilson had raised the same issue in his state appeal until the letter filed in this case by [defense counsel] on October 16, 2020.”). 12 UNITED STATES V. WILSON

10 years of supervised release for each count, to run concurrently. 6

II. Discussion

The government does not dispute for purposes of this case Wilson’s assertion that Agent Thompson’s review of his email attachments was a search within the meaning of the Fourth Amendment. We proceed on that assumption as well—that is, we assume that Wilson had a subjective expectation of privacy in his email attachments that society is prepared to recognize as reasonable, see Kyllo v. United States, 533 U.S. 27, 33 (2001) (citing Katz v. United States, 389 U.S. 347, 361 (1967) (Harlan, J., concurring)); see also United States v. Miller, 982 F.3d 412, 427 (6th Cir. 2020) (taking the same approach); cf. United States v. Ackerman, 831 F.3d 1292, 1308 (10th Cir. 2016) (holding that when the government views email attachments it is a “search” for Fourth Amendment purposes under both an expectation-of- privacy and a trespass-to-chattels theory). 7 Our question, then, is whether Agent Thompson was permitted to look at Wilson’s email attachments under the private search

6 Wilson maintains that the district court did not obtain a valid waiver of his right to a jury trial, as required by Fed. R. Crim. P. 23(a). Because we vacate Wilson’s conviction and reverse the district court’s denial of Wilson’s motion to suppress, we do not reach this issue. 7 Because we hold that the government’s warrantless search violated Wilson’s privacy-based Fourth Amendment rights, we do not consider Wilson’s alternative argument that the government’s search violated his property-based Fourth Amendment rights. See Carpenter v. United States, 138 S. Ct. 2206, 2269 (2018) (Gorsuch, J. dissenting) (“[F]ew doubt that e-mail should be treated much like the traditional mail it has largely supplanted—as a bailment in which the owner retains a vital and protected legal interest.”). UNITED STATES V. WILSON 13

exception, such that the Fourth Amendment did not require him to procure a warrant.

We review the district court’s denial of Wilson’s motion to suppress de novo and the district court’s underlying factual findings for clear error. See United States v. Camou, 773 F.3d 932, 937 (9th Cir. 2014); see also United States v. Mulder, 808 F.2d 1346, 1348 (9th Cir. 1987).

A. Private Search Exception

As the Fourth Amendment protects individuals from government actors, not private ones, see Burdeau v. McDowell, 256 U.S. 465 (1921), a private party may conduct a search that would be unconstitutional if conducted by the government. The private search doctrine concerns circumstances in which a private party’s intrusions would have constituted a search had the government conducted it and the material discovered by the private party then comes into the government’s possession. Invoking the precept that when private parties provide evidence to the government “on [their] own accord[,] … it [i]s not incumbent on the police to . . . avert their eyes,” Coolidge v. New Hampshire, 403 U.S. 443, 489 (1971), the Supreme Court formalized the private search doctrine in a pair of decisions about four decades ago: Walter v. United States, 447 U.S. 649 (1980), which produced no majority decision, and United States v. Jacobsen, 466 U.S. 109 (1984), which did.

1. Doctrinal Foundations

Beginning from the initial articulation of the private search doctrine, the extent to which it excuses the government from compliance with the warrant requirement of the Fourth Amendment has been the subject of concern. The exception has, for example, been described as 14 UNITED STATES V. WILSON

“unsettling” for its potential reach. 1 Wayne R. LaFave, Search and Seizure: A Treatise on the Fourth Amendment §1.8(b) (6th ed. 2020); see also Jacobsen, 466 U.S. at 129– 34 (White, J., concurring in part and concurring in judgment). On examination, however, the history of the exception confirms that it is, in truth, a narrow doctrine with limited applications.

Beginning with Burdeau, the Supreme Court has distinguished between government agents and private parties for purposes of the Fourth Amendment. Burdeau considered whether the Fourth Amendment restricts the government’s ability to use papers incriminating an individual when those papers were volunteered to the government by a private party who had stolen them. Burdeau disregarded the private theft, noting that although “[t]he Fourth Amendment gives protection against unlawful searches and seizures, . . . its protection applies to governmental action.” 256 U.S. at 475.

Coolidge, decided 50 years after Burdeau, addressed whether a private party who provides the government with another person’s contraband or evidentiary material can be considered an agent of the government for purposes of the Fourth Amendment. In that case, local police officers arrived at a suspect’s home, questioned his wife about his involvement in a murder, and obtained from his wife a rifle and articles of clothing belonging to the suspect. Coolidge, 403 U.S. at 446, 486. The opinion does not explain whether the suspect’s wife had proper possession of the items. The Court stated only that, had the suspect’s wife, “wholly on her own initiative, sought out her husband’s guns and clothing and then taken them to the police station to be used as evidence against him, there can be no doubt under [Burdeau] that the articles would later have been admissible in UNITED STATES V. WILSON 15

evidence.” Id. at 487. The relevant inquiry, according to the Court, was whether the suspect’s wife, “in light of all the circumstances of the case, must be regarded as having acted as an instrument or agent of the state when she produced her husband’s belongings.” Id. (internal quotation marks omitted). As the record showed that the suspect’s wife had shared the suspect’s guns and clothes with the local police “of her own accord,” Coolidge held that “it was not incumbent on the police to stop her or avert their eyes” when offered the critical evidence. Id. at 489.

2. Doctrinal Scope

Following Burdeau and Coolidge, both Walter and Jacobsen considered a warrantless government search after a private party “freely made available” certain information for the government’s inspection. Jacobsen, 466 U.S. at 119– 20 (citing Coolidge, 403 U.S. at 487–90). Together, the cases determined that an antecedent private search excuses the government from obtaining a warrant to repeat the search but only when the government search does not exceed the scope of the private one. That is, “[t]he additional invasions of respondents’ privacy by the government agent must be tested by the degree to which they exceeded the scope of the private search.” Id. at 115.

In Walter, a package of obscene films was mistakenly delivered to the wrong recipient. 447 U.S. at 651. The recipient opened the external packaging and examined the boxes containing individual films. Id. at 651–52. Each box displayed “suggestive drawings” on one side and “explicit descriptions of the contents” of the film on the other. Id. at 652. After reading these descriptions, and “attempt[ing] without success to view portions of the film by holding it up to the light,” the recipient notified the FBI about the mistaken delivery. Id. The FBI then seized the boxes and 16 UNITED STATES V. WILSON

screened one of the films without first obtaining a warrant. Id.

Walter did not result in a majority opinion, but a majority of the justices concluded that there had been a violation of the Fourth Amendment, and a different majority of justices agreed on the standard to be applied.

Justice Stevens, joined by Justice Stewart, announced the judgment of the Court. Their opinion concluded that the government search exceeded the scope of the antecedent actions by the private individuals in two respects. First, the government agents had screened the film for the purpose of learning information necessary to determine that a crime had been committed:

It is perfectly obvious that the agents’ reason for viewing the films was to determine whether their owner was guilty of a federal offense. To be sure, the labels on the film boxes gave them probable cause to believe that the films were obscene and that their shipment in interstate commerce had offended the federal criminal code. . . . [But] a search of the contents of the films . . . was necessary in order to obtain the evidence which was to be used at trial.

Id. at 654. Second, the government agents had gone beyond the physical bounds of the private search, because “the private party had not actually viewed the films.” Id. at 657. “The private search [thus] merely frustrated [the] expectation [of privacy] in part,” not in full. Id. at 659. “It UNITED STATES V. WILSON 17

did not simply strip the remaining unfrustrated portion of that expectation of all Fourth Amendment protection.” Id. 8

The four justices in dissent would have concluded that there was no Fourth Amendment violation. The dissenters disputed not the basic approach of Justice Stevens’ opinion but its application to the facts of the case. Specifically, the dissent stressed that “[t]he containers . . . clearly revealed the nature of their contents,” such that the private employees “so fully ascertained the nature of the films . . . [that] the FBI’s subsequent viewing of the movies . . . was not an additional search subject to the warrant requirement.” Id. at 663–64 (Blackmun, J., dissenting, joined by Burger, C.J., and Powell and Rehnquist, JJ.).

Four years after Walter, the Supreme Court again applied the private search doctrine. Importantly, Jacobsen recognized “the agreement [in Walter] on the standard to be applied in evaluating the relationship between the two searches.” 466 U.S. at 117 n.12.

Jacobsen concerned a government search of a Federal Express (“FedEx”) package that had been partially opened by FedEx employees. See 466 U.S. at 111. While examining a damaged package, the FedEx employees “opened the

8 Justice Marshall concurred only in the judgment. Justice White, joined by Justice Brennan, concurred, noting that “the packages already had been opened, and the Government saw no more than what was exposed to plain view.” Walter, 447 U.S. at 661 (White, J., concurring in part and concurring in judgment). Although Justice Stevens emphasized that the private parties had not screened the film, see id. at 657 & n.9, the concurring justices would have found a Fourth Amendment violation even if the private parties had done so, as “a private screening of the films would not have destroyed petitioners’ privacy interest in them.” Id. at 662. 18 UNITED STATES V. WILSON

package,” “cut open the tube” within the package, and “found a series of four zip-lock plastic bags, the outermost enclosing the other three and the innermost containing about six and a half ounces of white powder.” Id. The employees “observed . . . white powder in the innermost plastic bag,” but did not open the (presumably transparent) bag. Id. Instead, they called the Drug Enforcement Administration (DEA), put the plastic bags back in the tube, and placed the tube back in the box. Id.

When DEA agents arrived, they did two things: First, to visually inspect the contents of the plastic bags, DEA agents removed the tube from the box and the plastic bags from the tube. See id. Second, federal agents “opened each of the four bags and removed a trace of the white substance with a knife blade.” Id. at 111–12. They performed a field test to determine whether the powder in the plastic bags was cocaine. See id.

Jacobsen considered whether the private search exception as adopted by a majority of justices in Walter applied to the facts at hand. In doing so, Jacobsen, like Justice Stevens’ opinion in Walter, looked at both the degree to which the government’s actions led to observing new information not uncovered by the private search and the extent to which the government’s investigation intruded on the package owner’s privacy interests to a greater degree than had the private party’s actions. As to the first parameter, the information gleaned by the government, Jacobsen permitted the government agent to “reexamine”—that is, examine in the same manner—the package previously examined by FedEx, the private party. The government “could utilize the [private] employees’ testimony concerning the contents of the package,” noted Jacobsen; “[p]rotecting the risk of misdescription . . . is not protected by the Fourth UNITED STATES V. WILSON 19

Amendment.” 466 U.S. at 119. As to the second parameter, the additional impairment of privacy interests, Jacobsen emphasized that the private search exception turns on parity with the impact of the private search: “[O]nce frustration of the original expectation of privacy occurs, the Fourth Amendment does not prohibit governmental use of the now- nonprivate information.” Id. at 117.

Applying these precepts, Jacobsen concluded that the “removal of the plastic bags from the tube and the [government] agent’s visual inspection of their contents” did not exceed the scope of the private search as to the information obtained. Id. at 120. “[T]he agent[s] . . . learn[ed] nothing [from those actions] that had not previously been learned during the private search” and conveyed to the federal agents by the FedEx employees. Id. And as to the privacy interests, the governmental search to that point “infringed no legitimate expectation of privacy and hence was not a ‘search’ within the meaning of the Fourth Amendment,” id., as “[t]he package itself, which had previously been opened, remained unsealed, and the Federal Express employees had invited the agents to examine its contents,” such that “the package could no longer support any expectation of privacy,” id. at 121.

Jacobsen then separately considered the chemical field test, conducted by the DEA agents, including the federal agents’ removal of the white powder from the plastic bag. Critically for our purposes, Jacobsen began this inquiry from the premise that because the field test “had not been conducted by the Federal Express agents,” it “therefore exceeded the scope of the private search.” Id. at 122 (emphasis added). The majority then determined that the government’s chemical field test of the substance in the properly seized plastic bags was nonetheless not a search 20 UNITED STATES V. WILSON

within the meaning of the Fourth Amendment, because “governmental conduct that can reveal whether a substance is cocaine, and no other arguably ‘private’ fact, compromises no legitimate privacy interest.” Id. at 122–23. This conclusion, Jacobsen explained, was “dictated” by the Court’s earlier decision in United States v. Place, 462 U.S. 696 (1983), “in which the Court held that subjecting luggage to a ‘sniff test’ by a trained narcotics detection dog was not a ‘search’ within the meaning of the Fourth Amendment.” Jacobsen, 466 U.S. at 123.

B. Application of the Private Search Exception to This Case

The government bears the burden to prove Agent Thompson’s warrantless search was justified by the private search exception to the Fourth Amendment’s warrant requirement. Before considering the private search exception, Coolidge emphasized “the most basic constitutional rule” in the Fourth Amendment arena: warrantless searches are per se unreasonable, subject to few exceptions that are “jealously and carefully drawn.” 403 U.S. at 454–55. Accordingly, “[t]he burden is on those seeking the exemption.” Id. at 455 (quoting United States v. Jeffers, 342 U.S. 48, 51 (1951)). The government has not met its burden here.

Both as to the information the government obtained and the additional privacy interests implicated, the government’s actions here exceed the limits of the private search exception as delineated in Walter and Jacobsen and their progeny. 9

Wilson opines that the private search exception to the Fourth 9

Amendment should be overruled, and seeks to preserve that question for any Supreme Court review of this case. As a court of appeals, we of UNITED STATES V. WILSON 21

First, the government search exceeded the scope of the antecedent private search because it allowed the government to learn new, critical information that it used first to obtain a warrant and then to prosecute Wilson. Second, the government search also expanded the scope of the antecedent private search because the government agent viewed Wilson’s email attachments even though no Google employee—or other person—had done so, thereby

course cannot overrule Supreme Court cases. United States v. Weiland, 420 F.3d 1062, 1079 n.16 (9th Cir. 2005) (“[W]e are bound to follow a controlling Supreme Court precedent until it is explicitly overruled by that Court.”); accord Nunez-Reyes v. Holder, 646 F.3d 684, 692 (9th Cir. 2011). We do note that the private search doctrine rests directly on the same precepts concerning the equivalence of private intrusions by private parties and the government that underlie the so-called third-party doctrine. See e.g., Smith v. Maryland, 442 U.S. 735, 744 (1979) (holding that by “voluntarily” conveying to his telephone company the phone numbers he dialed, the defendant forsook his reasonable expectation of privacy in that information); United States v. Miller, 425 U.S. 435, 442 (1976) (holding the defendant lacked a reasonable expectation of privacy in “information [he had] voluntarily conveyed to [his] bank[]” like financial statements and deposit slips). In Jacobsen, the Supreme Court reasoned that the private search exception follows from the premise, underlying the third-party doctrine, that “when an individual reveals private information to another, he assumes the risk that his confidant will reveal that information to the authorities.” 466 U.S. at 117. In recent years, however, the Court has refused to “mechanically apply[] the third- party doctrine,” stressing that “the fact of ‘diminished privacy interests does not mean that the Fourth Amendment falls out of the picture entirely.’” Carpenter, 138 S. Ct. at 2219 (quoting Riley, 573 U.S. at 392); see United States v. Jones, 565 U.S. 400, 417 (2012) (Sotomayor, J., concurring) (explaining that the third-party doctrine “is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks”); Susan Freiwald & Stephen Wm. Smith, The Carpenter Chronicle: A Near-Perfect Surveillance, 132 Harv. L. Rev. 205, 224 (2018) (noting that Carpenter “significantly narrowed the [third-party] doctrine’s scope”). 22 UNITED STATES V. WILSON

exceeding any earlier privacy intrusion. Moreover, on the limited evidentiary record, the government has not established that what a Google employee previously viewed were exact duplicates of Wilson’s images. And, even if they were duplicates, such viewing of others’ digital communications would not have violated Wilson’s expectation of privacy in his images, as Fourth Amendment rights are personal.

1. Additional Information

The district court analogized Agent Thompson’s review of Wilson’s email attachments to the government search in Jacobsen, concluding that Agent Thompson’s search allowed him to “learn nothing new,” because Google had already classified the images as child pornography. Wilson, 2017 WL 2733879, at *10–11. The government similarly argues on appeal that its official search did not impermissibly expand the scope of the private search because it “just confirmed what Google employees already knew and could say.” Both the district court’s conclusion and the governments’ argument misstate the record.

The record indicates that Google does not keep a repository of child pornography images, so no Google employee could have shown the government the images it believed to match Wilson’s. Nor does the record identify the individual who viewed those images in the repository, so no identified Google employee “knew and could say” what those images showed. Instead, Google keeps a repository of unique hash values corresponding to illicit images, and tags each image with one of four generic labels. All Google communicated to NCMEC in its CyberTip was that the four images Wilson uploaded to his email account matched images previously identified by some Google employee at some time in the past as child pornography and classified as UNITED STATES V. WILSON 23

depicting a sex act involving a prepubescent minor (the “A1” classification). 10 Based only on the barebones CyberTip, Agent Thompson testified, he opened and reviewed each of Wilson’s images to determine “whether or not it is a case that . . . can be investigated” for violations of federal law.

A detailed description of the images was then included in the applications for search warrants. The gulf between what Agent Thompson knew about Wilson’s images from the CyberTip and what he subsequently learned is apparent from those descriptions. In contrast to Google’s label of the images just as “A1,” which the government did not mention in the warrant application, the government learned the following:

1. 140005125216.jpg – This image depicts a young nude girl, approximately five (5) to nine (9) years of age, who is lying on her stomach with her face in the nude genital region of an older female who is seated with her legs spread. A second young girl, approximately five (5) to nine (9) years of age, is also visible in this image and she is partially nude with her vagina exposed. Google identified this image was uploaded on June 4, 2015, at 16:11:04 UTC.

2. 140005183260.jpg – This image depicts a young nude girl, approximately five (5) to nine (9) years of age, who is lying on top of

10 Perhaps a Google employee could also have testified to details about the company’s proprietary technology. But no such information appears in the record, and the CyberTip did not convey any more information than what is now included in the record. 24 UNITED STATES V. WILSON

an older nude female, approximately eighteen years of age. Within this image the girl’s genital regions are pressed against one another and the older girl appears to be touching the face of the younger child with her tongue. Google identified this image was uploaded on June 4, 2015, at 16:11:21 UTC.

3. 140005129034.jpg – This image depicts a partially nude young girl, approximately five (5) to nine (9) years of age, who is lying on her back with her legs spread and her vagina exposed. An older female is positioned in front of this girl’s exposed vagina in this image and the younger girl has her left hand on the vaginal/buttocks area of a second nude girl of similar age. Google identified this image was uploaded on June 4, 2015, at 16:11:06 UTC.

4. 1400052000787.jpg – This image depicts a wider angle view of the previously referenced images possessing file names 140005125216.jpg and 140005129034.jpg as reported by Google.

Wilson, 2017 WL 2733879, at *4–5.

Given the large gap between the information in the CyberTip and the information the government obtained and used to support the warrant application and to prosecute Wilson, the government search in Walter offers a much more apt comparison to the circumstances here than does the government search in Jacobsen. Google’s categorization of Wilson’s email attachments as “A1” functioned as a label for UNITED STATES V. WILSON 25

the images in the same way that the boxes describing the films in Walter suggested that the images on the films were obscene. The “A1” labels, in fact, provided less information about the images’ contents than did the boxes in Walter, which had “explicit descriptions of the contents” of the film. 447 U.S. at 652. The “A1” labels, in contrast, specified only the general age of the child and the general nature of the acts shown.

Viewing Wilson’s email attachments—like viewing the movie in Walter—substantively expanded the information available to law enforcement far beyond what the label alone conveyed, and was used to provide probable cause to search further and to prosecute. The government learned at least two things above and beyond the information conveyed by the CyberTip by viewing Wilson’s images: First, Agent Thompson learned exactly what the image showed. Second, Agent Thompson learned the image was in fact child pornography. Until he viewed the images, they were at most “suspected” child pornography. Just as it “was clearly necessary for the FBI to screen the films [in Walter], which the private party had not done, in order to obtain the evidence needed to accomplish its law enforcement objectives,” Walter, 447 U.S. at 659 n.14 (plurality), so here, to prosecute Wilson it was necessary for Agent Thompson to view the images no Google employee had opened. Id. Until Agent Thompson viewed Wilson’s images, no one involved in enforcing the child pornography ban had seen them. Only by viewing the images did the government confirm, and convey to the fact finder in Wilson’s criminal case, that they depicted child pornography under the applicable federal standard.

Importantly, the district court found—and we agree— that if Agent Thompson’s affidavit in support of a warrant 26 UNITED STATES V. WILSON

had been “excise[d]” of “the tainted evidence,” “the affidavit would not support issuance of the search warrant for Defendant’s email account.” Wilson, 2017 WL 2733879, at *12. 11 The district court’s findings about the inadequacy of the warrant application without the important information Agent Thompson obtained by viewing Wilson’s images demonstrate that the government learned new, critical information by viewing Wilson’s images, information “not previously . . . learned during the private search,” Jacobsen, 466 U.S. at 120. Because the government saw more from its search than the private party had seen, it exceeded the scope of the private search.

2. Additional Intrusion on Wilson’s Privacy Interest

The government also maintains that directly viewing Wilson’s images for the first time was not a further invasion of Wilson’s privacy, beyond any privacy invasion by Google. The government’s expectation of privacy analysis fails for much the same reason as did its argument that it learned nothing new by viewing the images.

The government’s central submission in this regard is that Wilson’s expectation of privacy in his images was fully frustrated when Google’s computer technology scanned them, such that any further government search of the images

We also agree with the district court that the government might 11

have been able to demonstrate probable cause sufficient to obtain a warrant without the descriptions of Wilson’s images, by presenting, for example, more “information about Google’s screening process for child pornography,” Wilson, 2017 WL 2733879, at *12. UNITED STATES V. WILSON 27

should be exempt from the Fourth Amendment’s warrant requirement. 12 We cannot agree.

Although Google’s proprietary technology labelled Wilson’s email attachments as “A1,” “the content of the [images] . . . was [no more] apparent” to Google than the image content was to the private party in Walter, as no Google employee had opened and viewed the attachments, and Google does not appear to retain any record of the original images used to generate hash matches. See Tosti, 733 F.3d at 823. Agent Thompson did not obtain a specific description of the content of Wilson’s attachments from Google, so he was not simply confirming what he had been told. Until he viewed the images, he had no image at hand at all; the entire composition was hidden. Only the image itself could reveal, for example, the number of minors depicted, their identity, the number of adults depicted alongside the minors, the setting, and the actual sexual acts depicted. Reading a label affixed to an image is a different experience entirely from looking at the image itself. To read even a detailed description, which this A1 classification was not, is still not to see. Wilson’s privacy interest was in the actual image—which could have included features in addition to child pornography—not just in its classification as child pornography.

The government’s argument to the contrary mischaracterizes the record, by representing that Google’s scan “equates to a full-color, high-definition view” of Wilson’s images. It does not. The critical fact is that no Google employee viewed Wilson’s files before Agent

12 The government stated at oral argument that it is not relying on the contraband nature of child pornography as a justification for the search. 28 UNITED STATES V. WILSON

Thompson did. When the government views anything other than the specific materials that a private party saw during the course of a private search, the government search exceeds the scope of the private search. That is the clear holding of Jacobsen. In that case, “[t]he field test . . . had not been conducted by the Federal Express agents and therefore exceeded the scope of the private search.” 466 U.S. at 122 (emphasis added); see supra Part II.B.1.

3. Personal Nature of the Fourth Amendment

The government attempts to save its warrantless search by shifting the analysis from the private search of Wilson’s files, flagged by Google and classified as A1 by its proprietary technology, to the private search of other individuals’ files, which some Google employee previously viewed and classified as child pornography in Google’s database of hash values. The government argues that Agent Thompson’s search did not exceed the bounds of the private search because a Google employee had previously viewed different child pornography files, and Google’s computers flagged Wilson’s email attachments as containing the same images as those files, using an unspecified hash value comparison system. This line of argument cannot save the validity of the government’s search. Even if Wilson’s email attachments were precise duplicates of different files a Google employee had earlier reviewed and categorized as child pornography, both Walter and Jacobsen—and general Fourth Amendment principles—instruct that we must specifically focus on the extent of Google’s private search of Wilson’s effects, not of other individuals’ belongings, to assess whether “the additional invasions of [Wilson’s] privacy by the government agent . . . exceeded the scope of the private search.” Jacobsen, 466 U.S. at 115. UNITED STATES V. WILSON 29

To see why, consider whether Walter would have come out differently had the misdirected package come into the hands of someone who had previously viewed another copy of the same film and, recognizing the box, told the police that the film in it was, in her view, legally obscene. Under Walter, the government in the hypothesized circumstance would still need a warrant to view the film in the box. Viewing the copy of the film actually in the box, which the mistaken recipient of the box had not done, would still entail an additional governmental intrusion on both the physical integrity of the film and the owner’s privacy interest in its content.

Fourth Amendment rights are personal rights. Rakas v. Illinois, 439 U.S. 128 (1978), is illustrative: Rakas held that a passenger could not challenge a police search as violative of the Fourth Amendment because he owned neither the vehicle that was searched nor the rifle found. Although the owners of each item had an expectation of privacy, the defendant did not. See id. at 134.

So Wilson did not have an expectation of privacy in other individuals’ files, even if their files were identical to his files. The corollary of this principle must also be true: Wilson did have an expectation of privacy in his files, even if others had identical files. If, for example, police officers search someone else’s house and find documents evidencing wrongdoing along with notes indicating that I have identical documents in my house, they cannot, without a warrant or some distinct exception to the warrant requirement, seize my copies. I would retain a personal expectation of privacy in them, and in my connection to them, even if law enforcement had a strong basis for anticipating what my copies would contain. A violation of a third party’s privacy has no bearing 30 UNITED STATES V. WILSON

on my reasonable expectation of privacy in my own documents. The government does not argue otherwise.

In short, whether Google had previously reviewed, at some earlier time, other individuals’ files is not pertinent to whether a private search eroded Wilson’s expectation of privacy. Under the private search doctrine, the Fourth Amendment remains implicated “if the authorities use information with respect to which the expectation of privacy has not already been frustrated.” Jacobsen, 466 U.S. at 117 (emphasis added).

C. Relevant Appellate Caselaw

(i) Our application of Jacobsen and Walter is consistent with Ninth Circuit case law. The district court misapplied United States v. Tosti, 733 F.3d 816 (9th Cir. 2013), in reaching the contrary conclusion.

In Tosti, a private party entrusted with the defendant’s computer found thumbnails of images believed to be child pornography and alerted law enforcement officers. 733 F.3d at 818–19. The private party showed the thumbnails to law enforcement, and the agents “could tell from viewing the thumbnails that the images contained child pornography.” Id. at 822.

Tosti held that law enforcement’s enlarging of the thumbnails did not expand on the antecedent private search. For one, based on the standard articulated in Jacobsen, “the police learned nothing new through their actions.” Tosti, 733 F.3d at 822. Further, “scrolling through the images [the private party] had already viewed was not a search because any private interest in those images had been extinguished.” Id. UNITED STATES V. WILSON 31

Neither is true in this case. Here, what was conveyed to Agent Thompson was that a not-yet-viewed image uploaded by Wilson matched a different image that an unidentified Google employee had previously viewed and classified as child pornography. So until Agent Thompson actually viewed the images, he knew only that Google’s propriety technology had identified a match between Wilson’s images and other images that Google had classified as child pornography. He “learned . . . [a]new through [his] actions,” for the first time, what the images actually showed. See supra pp. 23–24. And, as no one at Google had previously viewed Wilson’s attachments, “any privacy interest in those images had [not] been extinguished.” Tosti, 733 F.3d at 822. Google’s algorithm “frustrated [Wilson’s] [privacy] expectation in part,” but it “did not . . . strip the remaining unfrustrated portion of that expectation of all Fourth Amendment protection.” Walter 447 U.S. at 659 (plurality); see also Jacobsen, 466 U.S. at 116 n.11.

For these reasons, Tosti is fully consistent with our conclusion that Agent Thompson’s search exceeded the scope of the private search and so required a warrant.

(ii) In so holding, we contribute to a growing tension in the circuits about the application of the private search doctrine to the detection of child pornography.

In United States v. Ackerman, 831 F.3d 1292, 1294 (10th Cir. 2016), AOL automatically identified one of the defendant’s four email attachments as apparent child pornography, based on a hash value match. AOL then sent the text of the defendant’s email and all four attachments to NCMEC, where an analyst “opened the email, viewed each of the attached images, and confirmed that all four [images] (not just the one AOL’s automated filed identified) appeared to be child pornography.” Id. Ackerman emphasized that 32 UNITED STATES V. WILSON

“AOL never opened the email itself. Only NCMEC did that.” Id. at 1305–06. Then-Judge Gorsuch, after holding that NCMEC is either a governmental entity or a government agent, see id. at 1308, concluded that “in at least this way [the government] exceeded rather than repeated AOL’s private search,” id. at 1305–06.

Ackerman did suggest that, had the government viewed only the attachment AOL identified as a hash value match and not other attachments and the text of the defendant’s email, that distinction might “bring the government closer to a successful invocation of the private search doctrine.” Id. at 1308 (emphasis added). But Ackerman also noted that in that circumstance—which appears to be what happened here—the government’s action may still be a new search, as the government, “might . . . have risked exposing new and protected information, maybe because the hash value match could have proven mistaken . . . or because the AOL employee who identified the original image as child pornography was mistaken in his assessment.” Id. at 1306. Although Ackerman did not decide the precise issue before us, and expressly disavowed “prejudg[ing]” it, id. at 1308– 09, its underlying analysis is entirely consistent with ours, and its suggestions about why there could be a search in our circumstances echo some of the reasons we have given for so concluding.

Other private search cases concerning the discovery of child pornography, outside the context of automated hash value matching, have also ruled consistently with our understanding of the limited scope of the private search exception. For example, in United States v. Lichtenberger, 786 F.3d 478 (6th Cir. 2015), the defendant’s girlfriend had discovered child pornography on his computer. She later showed his computer to the police and opened some UNITED STATES V. WILSON 33

computer files that were determined to contain child pornography. But the defendant’s girlfriend was “not at all sure whether she opened the same files with [the police] as she had opened earlier that day.” Id. at 490. As a result, the Sixth Circuit concluded that the government search exceeded the scope of the private search. This reasoning supports our result here. The record does not identify the Google analyst who could have stated that the images Agent Thompson viewed were identical to images the analyst previously viewed, nor does it explain Google’s algorithm in any detail. Given these gaps, there is no way to be “at all sure” that the images Agent Thompson viewed were the same images a Google analyst had earlier viewed, so the government search exceeded the scope of Google’s search.

Further, in United States v. Sparks, 806 F.3d 1323 (11th Cir. 2015), overruled on other grounds by United States v. Ross, 963 F.3d 1056 (11th Cir. 2020), a store employee and her fiancé discovered child pornography on a lost cell phone and showed the phone to the police. The police officer ultimately viewed two videos on the cell phone, one of which the private parties “had not watched.” Id. at 1332. Because the government search exposed new information, not seen by the private party, the Eleventh Circuit concluded that the government search exceeded the scope of the private search. 13

13 Both the Fifth Circuit and the Seventh Circuit have held that an individual’s privacy interest in a digital container, such as an email account, cell phone, or laptop, is entirely frustrated whenever any part of the container is searched. See United States v. Runyan, 275 F.3d 449, 465 (5th Cir. 2001); Rann v. Atchison, 689 F.3d 832 (7th Cir. 2012). But this approach is squarely contrary to the Ninth Circuit’s approach to digital devices, has been undermined by more recent Supreme Court cases about 34 UNITED STATES V. WILSON

Conversely, the Fifth and Sixth Circuits recently decided the issue before us and came to a conclusion contrary to the one we reach, although the reasoning of the two opinions diverged. The circumstances in both cases were similar to those here. See United States v. Reddick, 900 F.3d 636 (5th Cir. 2018); United States v. Miller, 982 F.3d 412, 427 (6th Cir. 2020). In both cases, after an electronic service provider flagged certain email attachments as apparent child pornography, the attachments were forwarded to a local law enforcement agency, whose officers viewed the images for the first time without a warrant.

The Fifth Circuit held the private search exception justified the government’s warrantless search because the government agent’s “visual review of the suspect images . . .

the scope of digital information, and is inconsistent with Jacobsen. For starters, Tosti did not regard the viewing of some files as sufficient for purposes of the private search doctrine to show that the government only invaded a defendant’s privacy interests to the same extent as the private party. See 733 F.3d at 822. More generally, and dispositively, the Ninth Circuit has not treated digital devices as unitary, such that a permissible search of one file or attachment justifies a search of a larger swatch of digital material. See United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013) (en banc); United States v. Cano, 934 F.3d 1002, 1007 (9th Cir. 2019). Further, Runyan and Rann are in tension with recent Supreme Court cases, which express concern that given the “immense storage capacity” of modern technology, the Fourth Amendment will be undermined unless government searches of digital material are meaningfully confined in accord with established Fourth Amendment doctrine. Riley v. California, 573 U.S. 373, 393 (2014); see also Carpenter v. United States, 138 S. Ct. 2206, 2214 (2018). Finally, if, in Jacobsen, law enforcement officers had opened and searched not only the specific containers investigated by the FedEx employees but others included in the same box, the private search doctrine would not have applied to the still-sealed containers. There is no basis for ruling otherwise with regard to unopened digital files. Runyan and Rann were in our view wrongly decided. UNITED STATES V. WILSON 35

was akin to the government agents’ decision to conduct chemical tests on the white powder in Jacobsen,” insofar as “opening the file merely confirmed that the flagged file was indeed child pornography, as suspected.” Reddick, 900 F.3d at 639.

We cannot accept this analysis for several reasons. First, and most important, Reddick conflates Jacobsen’s first holding regarding the private search exception to the Fourth Amendment with its second holding regarding whether the field test constituted a search under the Fourth Amendment. The private search exception excuses a warrantless government search that would otherwise violate the Fourth Amendment; the field test determination in Jacobsen, based on Fourth Amendment law outside the private search context, was that a warrantless government field drug test simply does not trigger the Fourth Amendment’s protections. 466 U.S. at 123–24. In other words, the warrantless chemical test in Jacobsen was not excused via the private search exception but for an entirely different reason—that confirming through a field test that an already exposed and seized contraband substance was a drug is not a search for Fourth Amendment purposes. Id. at 122.

Moreover, in Jacobsen, the white powder was fully visible to the government officers when they repeated the steps taken by the FedEx employees to inspect the package. Not so here, as no human had viewed Wilson’s images before. The part of Jacobsen that does elucidate the private search doctrine cannot govern here.

Notably, we have held that the chemical field test exception to the Fourth Amendment’s warrant requirement does not apply to a more complete chemical analysis of a drug. In United States v. Mulder, 808 F.2d 1346 (9th Cir. 1987), a hotel security officer removed items left behind in 36 UNITED STATES V. WILSON

a hotel room after a guest’s scheduled departure, including plastic bags full of tablets, and provided them to federal agents. Id. at 1347. The tablets “were tested at the Western Regional Laboratory through the use of mass spectrometry, infrared spectroscopy and gas chromatography.” Id. at 1348. Mulder distinguished between the chemical field test in Jacobsen and a laboratory test: “[T]he chemical testing in this case was not a field test which could merely disclose whether or not the substance was a particular substance, but was a series of tests designed to reveal the molecular structure of a substance and indicate precisely what it is. Because of the greater sophistication of these tests, they could have revealed an arguably private fact,” and thus compromised the defendant’s legitimate privacy interest. Id. at 1348–49.

To the extent opening an email attachment to view its contents is analogous to drug testing at all, it is akin to a laboratory test with the potential to reveal new private information, as in Mulder, not a binary field test that yields either a positive or negative result. Just as a laboratory test of a suspected drug reveals its precise molecular structure and so potentially exposes additional private information like other illicit contaminants or the source of the substance, so viewing an image of suspected child pornography reveals innumerable granular private details—for example, the faces of the people depicted, the setting, and, perhaps, other speech or conduct also in the frame. Viewing the images here allowed the government to do more than just confirm the images’ classification as child pornography, implicating privacy interests beyond a binary classification. Contrary to Reddick, the government’s “visual review of the suspect images” was not analogous to “the government agents’ decision to conduct chemical tests on the white powder in Jacobsen.” 900 F.3d at 639 (emphasis added). UNITED STATES V. WILSON 37

The Sixth Circuit recognized the error in Reddick concerning the reach of the private search holding in Jacobsen and “opt[ed] not to rely” on it. Miller, 982 F.3d at 429. As Miller points out, the government agent’s “inspection (unlike the [field] test) qualifies as the invasion of a ‘legitimate privacy interest’ unless Google’s actions had already frustrated the privacy interest in the files.” Id.

Miller instead resolved the Fourth Amendment question it faced by focusing exclusively on the assumed reliability of Google’s proprietary technology. “At bottom,” Miller explained, “this case turns on the question whether Google’s hash-value matching is sufficiently reliable.” Id. at 429–30. Because the defendant in Miller “never challenged the reliability of hashing,” id. at 430 (internal brackets and quotation omitted) (Miller thought the burden was on the defendant, see id. at 430), Miller deferred to the district court’s finding “that the technology was ‘highly reliable.’” Id.

Wilson, by contrast, did challenge the “accuracy and reliability” of Google’s hashing technology in the district court. And, contrary to Miller’s assertion, the government bears the burden to prove its warrantless search was permissible, see supra p. 20—a burden it failed to carry.

Our analysis, however, relies only contingently on the adequacy of the record with regard to the hash match technology. In our view, the critical factors in the private search analysis, both unacknowledged in Miller, include the personal nature of Fourth Amendment rights and the breadth of essential information Agent Thompson obtained by opening the attachment, information—and a privacy invasion—well beyond what Google communicated to NCMEC. See supra Parts II.B.1, II.B.2. The reliability of Google’s proprietary technology, in our estimation, is 38 UNITED STATES V. WILSON

pertinent to whether probable cause could be shown to obtain a warrant, not to whether the private search doctrine precludes the need for the warrant.

And, as the district court noted, and we have noted as well, the warrant application here contained inadequate information about Google’s proprietary technology to establish probable cause without reliance on the descriptions of the actual images. See supra p. 25.

III. Conclusion

“When confronting new concerns wrought by digital technology, this Court has been careful not to uncritically extend existing precedents.” Carpenter, 138 S. Ct. at 2222. The government reports there were 18.4 million CyberTips in 2018, making it all the more important that we take care that the automated scanning of email, and the automated reporting of suspected illegal content, not undermine individuals’ Fourth Amendment protections.

Having examined this case with the requisite care, we hold, for the reasons explained, that Agent Thompson violated Wilson’s Fourth Amendment right to be free from unreasonable searches when he examined Wilson’s email attachments without a warrant. Wilson’s conviction is vacated, the district court’s denial of Wilson’s motion to UNITED STATES V. WILSON 39

suppress is reversed, and this case is remanded for further proceedings. 14

14 As noted, the district court concluded that if Agent Thompson’s warrantless actions constituted an illegal search, no exception “would prevent operation of the exclusionary rule.” Wilson, 2017 WL 2733879, at *13. The government did not raise before us any argument to the contrary, and thus waived any challenge. See United States v. Gamboa- Cardenas, 508 F.3d 491, 502 (9th Cir. 2007).