When Hashing, Silver Platters and Privacy Collide

The “Silver Platter Doctrine” has had various reincarnations and permutations in the last hundred years, but generally, as pertinent here, provides that evidence obtained through a private search is outside of the Fourth Amendment’s application.¹ Today, with a world gone digital, a hand-off by a private individual or entity of a computer hard drive to law enforcement may involve the transfer of gigabytes or more of pertinent electronic data requiring expert and efficient computer forensic examination. The proponent of the evidence must demonstrate that the circumstances under which the evidence was obtained was proper and that the forensic examination was appropriate for admission of the evidence at trial. Frequently raised questions concerning the legality and scope of the subsequent government search without a warrant, and the lawfulness of the forensic examination, are subjects addressed here.

Hashing: Integrity of Evidence

In the routine seizure of digital evidence by the government, in order to protect the integrity of the evidence seized, a copy or “clone” of the digital files is made so that the evidence may be examined without the possibility of tainting the actual evidence seized. The clone is then subjected to expert forensic examination. The cloning process usually includes a process identifying each file’s hash value. “Hashing” is a mathematical formula that allows the identification of a digital file through a hash value, which is a string of letters and numbers representing the file’s absolute uniqueness. Every digital image or file has a hash value.² The hash value of a file is an important tool used to identify and authenticate it. It has been analogized to the 20th century Bates stamp in civil discovery, and in the criminal arena as the file’s “digital fingerprint.”³ Two files with identical content will have the same hash value. More specifically, hashing creates a digital fingerprint that represents the binary content of a file unique to every electronically-generated document, and thereby facilitates ensuring that the file has not been modified.