Do Police Need a Warrant to Search Cloud Files? United States v. Lowers and CSAM Hash Matches
Whether the government can access a private citizen's digital files without a warrant has been debated for years. Before digital storage became commonplace, most Americans kept private documents and effects—letters, contracts, photographs, and movies—in their homes, offices, or secure locations such as safe-deposit boxes.
For more than 200 years, the Fourth Amendment to the United States Constitution has protected Americans' papers and effects from unreasonable searches and seizures. Ordinarily, a government actor seeking to enter a home or business and inspect or seize private materials must establish probable cause and obtain a warrant from a judge or magistrate.
The Fourth Amendment and the Private Search Doctrine
The Fourth Amendment applies to government action, not a search performed independently by a private person or company. If a private individual discovers evidence and reports it to police, the original private search generally does not implicate the Fourth Amendment. This principle is known as the private search doctrine.
The distinction becomes more complicated when private information is stored electronically. Phones, tablets, laptops, desktops, and cloud-storage accounts now hold the kinds of personal files that once occupied physical filing cabinets. Electronic service providers (ESPs) such as Google, Microsoft, and Apple are private companies rather than government actors, but they may detect and report files stored on their systems.
Digital Files, Hash Values, and Cloud Storage
A hashing algorithm processes a digital file and generates a sequence of letters and numbers known as a hash value. A hash value functions much like a digital fingerprint. It can be compared against hash values associated with other files to identify an exact or very similar match without necessarily requiring a person to open and view the file.
This technology has become important in investigations involving suspected child sexual abuse material (CSAM). The National Center for Missing & Exploited Children (NCMEC) is an organization that receives reports from electronic service providers concerning apparent CSAM. Some providers also compare files uploaded to their systems with databases of hash values associated with previously identified material.
Federal law requires a provider that becomes aware of apparent violations involving CSAM to submit a CyberTip report to NCMEC. A provider may have an employee visually inspect a flagged file before reporting it, or it may report and transmit a hash-matched file without anyone opening it. As the Fourth Circuit recently explained, that difference matters.
Why It Matters Whether a Private Company Viewed the File
When a private provider has already opened and reviewed a file, a later government review may fall within the scope of the prior private search. But when the provider has only identified a hash match and has not visually inspected the file, law enforcement may reveal information the private company never actually saw. In that situation, opening the file can constitute a new government search rather than a repetition of a private search.
This distinction may be central to a suppression analysis in federal and state cases involving digital evidence. Our Maryland CSAM defense attorneys examine not only what investigators obtained, but also who first accessed the material, what the provider's report disclosed, and whether officers secured a warrant before expanding the search.
United States v. Lowers
That was the issue in United States v. Lowers, No. 24-4546 (4th Cir. Mar. 10, 2026). Google's hashing system flagged 156 files uploaded to a private Google Drive account. A Google reviewer opened 31 of those files; 125 remained unopened. Google sent a CyberTip report and the files to NCMEC. An NCMEC employee reviewed the same 31 files but did not open the remaining 125.
When the report later reached local law enforcement, a detective reviewed the 31 files that Google and NCMEC had already opened. Without first obtaining a warrant, the detective also opened at least three files that neither Google nor NCMEC had visually inspected.
The Fourth Circuit Found a Fourth Amendment Violation
The United States Court of Appeals for the Fourth Circuit held that people retain a reasonable expectation of privacy in private files stored in the cloud. A hash value by itself is a non-descriptive identifier; it does not reveal the actual contents of a particular unopened file. The court therefore held that law enforcement's warrantless opening of the previously unviewed files exceeded the scope of any private search and violated the Fourth Amendment.
The defendant did not ultimately obtain suppression of the later-discovered evidence. The court found that the connection between the unlawful search and the evidence supporting the conviction had become too attenuated because of the time and intervening events. The conviction was therefore affirmed even though the warrantless search was unconstitutional.
A Developing Circuit Split Over Digital Privacy
The Fourth Circuit aligned itself with decisions from the Second and Ninth Circuits holding that a hash match does not eliminate a person's reasonable expectation of privacy in an unopened digital file. It declined to follow contrary reasoning from the Fifth and Sixth Circuits. The Tenth Circuit has separately held in United States v. Ackerman, 831 F.3d 1292 (10th Cir. 2016), that NCMEC itself may qualify as a governmental actor for Fourth Amendment purposes.
These different approaches make this an evolving area of constitutional law. Future appellate decisions—or eventual review by the Supreme Court—may provide additional consistency concerning cloud storage, provider reports, hash matching, and the private search doctrine.
Digital Search Issues Require a Careful Case-Specific Review
A hash match, a CyberTip report, and a later police review are not necessarily a single search. The sequence matters. So do the provider's actions, the report's contents, the files actually viewed, the warrants obtained, and the relationship between any constitutional violation and the evidence used in court.
For additional background on related Maryland law, read our discussion of the statute of limitations for child pornography possession in Maryland. If you are under investigation or facing allegations involving CSAM or digital evidence, contact Craig M. Kadish & Associates, LLC to discuss the specific facts of your case.
