The Fourth Amendment and Technological Exceptionalism After Carpenter: a Case Study on Hash-Value Matching
Total Page:16
File Type:pdf, Size:1020Kb
Fordham Intellectual Property, Media and Entertainment Law Journal Volume 29 XXIX Number 4 Article 6 2019 The Fourth Amendment and Technological Exceptionalism After Carpenter: A Case Study on Hash-Value Matching Denae Kassotis [email protected] Follow this and additional works at: https://ir.lawnet.fordham.edu/iplj Part of the Constitutional Law Commons, Intellectual Property Law Commons, and the Science and Technology Law Commons Recommended Citation Denae Kassotis, The Fourth Amendment and Technological Exceptionalism After Carpenter: A Case Study on Hash-Value Matching, 29 Fordham Intell. Prop. Media & Ent. L.J. 1243 (2019). Available at: https://ir.lawnet.fordham.edu/iplj/vol29/iss4/6 This Note is brought to you for free and open access by FLASH: The Fordham Law Archive of Scholarship and History. It has been accepted for inclusion in Fordham Intellectual Property, Media and Entertainment Law Journal by an authorized editor of FLASH: The Fordham Law Archive of Scholarship and History. For more information, please contact [email protected]. The Fourth Amendment and Technological Exceptionalism After Carpenter: A Case Study on Hash-Value Matching Cover Page Footnote J.D. Candidate, Fordham University School of Law, 2019; B.A., History, University of Delaware, 2016. This Note was prepared with the assistance of Professor Olivier Sylvain who served as my faculty adviser on the project. I would also like to thank John Bradshaw and Elias Wright for their input and edits. Lastly, I would like to thank my father, John Kassotis, for his suggestions and constant mentorship. This note is available in Fordham Intellectual Property, Media and Entertainment Law Journal: https://ir.lawnet.fordham.edu/iplj/vol29/iss4/6 The Fourth Amendment and Technological Exceptionalism After Carpenter: A Case Study on Hash-Value Matching Denae Kassotis* The Fourth Amendment has long served as a barrier between the police and the people; ensuring the government acts reasonably in combating crime. Fourth Amendment jurisprudence is more dynamic than other constitutional guarantees, and has undergone periodic shifts to account for technological and cultural changes. The Supreme Court’s 2018 decision in United States v. Carpenter marks the most recent jurisprudential shift, as the Court departed from the well-settled reasonable expectation of privacy test to account for a new technology (CSLI records). This Note examines Carpenter’s impact on future Fourth Amendment cases, using another novel surveillance technique, hash-value matching, as a case study. Hash-value matching is a binary authentication method that can scan billions of digital communications in seconds for evidence of contraband. * J.D. Candidate, Fordham University School of Law, 2019; B.A., History, University of Delaware, 2016. This Note was prepared with the assistance of Professor Olivier Sylvain who served as my faculty adviser on the project. I would also like to thank John Bradshaw and Elias Wright for their input and edits. Lastly, I would like to thank my father, John Kassotis, for his suggestions and constant mentorship. 1243 1244 FORDHAM INTELL. PROP. MEDIA & ENT. L.J. [Vol. XXIX:1243 INTRODUCTION ............................................................................ 1246 I. OVERVIEW OF HASH-VALUE MATCHING, INTERNET GOVERNANCE, AND INFORMATION PRIVACY .............. 1249 A. Hash-Value Matching ........................................... 1249 1. Detecting Child Pornography ......................... 1250 2. The Reporting Dynamic Between ECSPs and Law Enforcement .................................... 1251 3. The Crucial Role of an ISP in Obtaining Hash Evidence ................................................ 1254 4. Federal Framework Regulating Information Privacy ............................................................ 1257 B. The Fourth Amendment’s Role in Protecting Information Privacy .............................................. 1261 1. Reasonable Expectation of Privacy Test ........ 1263 2. An Objective, Privacy Centric Approach in a “World Without Privacy” ............................ 1265 C. Impact of United States v. Carpenter on the REP Test ....................................................................... 1267 1. The Third-Party Doctrine ............................... 1271 2. Private Search Doctrine .................................. 1274 3. The Private Search Doctrine in Hashing Cases ............................................................... 1276 4. The Binary Search Doctrine ........................... 1279 5. Formalist Approach to the Binary Search Doctrine .......................................................... 1282 II. FOURTH AMENDMENT EXCEPTIONALISM .................... 1286 A. A Dynamic Fourth Amendment ............................. 1288 1. Technological Exceptionalism ....................... 1290 2. Quantifying What Renders a Technology “Exceptional” ................................................. 1292 3. Cost-Centric Structural-Privacy Rights Approach to “Exceptionalism” ....................... 1293 4. Cost Centric Approach to Eroding Privacy Rights.............................................................. 1296 B. Rejecting Conventional Analogies When an Exceptional Technology Is at Issue ....................... 1298 1. Mono-Analogical Reasoning .......................... 1298 2019] THE FOURTH AMENDMENT & HASH-VALUE MATCHING 1245 2. Poly-Analogical Reasoning ............................ 1301 3. Riley, Carpenter, and Poly-Analogical Analysis in Action .......................................... 1302 4. Riley Declines to Extend the Search Incident to Lawful Arrest Doctrine to a Smart Phone on Arrestee’s Person ....................................... 1302 5. Carpenter Declines to Extend the Third- Party Doctrine to CSLI Held by a Private Wireless Carrier .............................................. 1304 III. ASSESSING HASH-VALUE MATCHING AND THE PRIVATE AND BINARY SEARCH DOCTRINES AFTER CARPENTER .................................................................. 1307 A. Surveillance Techniques that Reveal Information in the Binary .......................................................... 1308 1. Canine Sniffs .................................................. 1308 2. Narcotics Colorimetric (Spot) Test ................ 1311 B. Hash-Value Matching is Exceptional ................... 1313 1. Hashing is Non-Targeted................................ 1314 2. Hashing is Less Costly Than Other Binary Authentication Methods ................................. 1315 C. How Will Hashing Be Treated by the Post- Carpenter Framework? ......................................... 1316 1. A Fourth Amendment Inquiry Will Not Be Foreclosed Due to Hashing’s Binary Nature .. 1316 2. A Fourth Amendment Analysis Will Not Be Automatically Foreclosed by an ECSP’s Private Search ................................................. 1317 3. The Court Will Apply the Carpenter Factors to the Class of Information Sought................. 1317 CONCLUSION ................................................................................ 1320 1246 FORDHAM INTELL. PROP. MEDIA & ENT. L.J. [Vol. XXIX:1243 INTRODUCTION Have you ever wondered how your email account verifies that you have entered the correct password when you attempt to log-in? Websites that require a user to log-in with a password keep a repository of hash-values corresponding to passwords that unlock specific user’s accounts.1 When a user first creates their password, the alphanumeric string they enter is run through a hash algorithm, converting it into a shortened output with a fixed length.2 This output, known as the password’s hash-value, is then saved by the website.3 When a user later attempts to log-in with the same input, the input will again be run through the hash-algorithm to create a hash-value.4 If the hash-value for the attempted log-in matches the stored hash-value, corresponding to the password initially entered, the user will be allowed to proceed into the account.5 Moreover, since websites store password’s hash-values, which cannot be converted back to the passwords they correspond to, even if their repository of hashes was hacked, a hacker would not be able to retrieve the desired passwords.6 The process used to verify passwords is called data-exposure.7 Data-exposure refers to a model where an entity keeps a repository of hash-values corresponding to known inputs (such as correct passwords), and compares unknown inputs (such as attempted passwords) against the repository to “expose” a match.8 If an unknown input matches a known hash-value, it is certain that the 1 Understanding Password Authentication & Password Cracking, WORDFENCE, https://www.wordfence.com/learn/how-passwords-work-and- cracking-passwords/ [https://perma.cc/9GUQ-EV9E] (last updated June 25, 2018). 2 Id. 3 Id. 4 Id. 5 Id. 6 See id. 7 Cf. Richard P. Salgado, Fourth Amendment Search and the Power of the Hash, 119 HARV. L. REV. 38, 43 (2005) (defining data exposure as matching an unknown set of hash-values against a known hash list to reveal particular files.); see also infra Introduction. 8 Id. 2019] THE FOURTH AMENDMENT & HASH-VALUE MATCHING 1247 unknown input is the same as the input that created the known hash-value.9 Safe password storage is one of many innocuous uses of data exposure. For example, law enforcement can compare a suspect’s hard-drive against a customized hash-list to look for files stolen during an intrusion, or for pirated software not yet released to the public.10 These examples refer to a targeted