Background
Federal agents conducting a routine sweep of eMule, a peer-to-peer filesharing platform, flagged an account called “Sparky’s Engine” that appeared to be sharing files of child pornography. The agents could not download the files directly, but they could see the files’ “hash values” — unique digital fingerprints derived from a file’s contents. Nine of those hash values matched files already catalogued in law enforcement’s library of known child pornography. The filenames also contained abbreviations commonly associated with such material.
The IP address behind the account was registered to Duane Lee Johnsen, a registered sex offender with prior convictions involving minors. Agents obtained a search warrant based on an affidavit describing the hash matches, the suggestive filenames, and Johnsen’s criminal history. When they searched his home, they seized 59 electronic devices. Over the course of about eight months of forensic analysis, agents identified more than 140,000 images and 900 videos of child pornography across Johnsen’s devices.
Johnsen was indicted for receiving child pornography under 18 U.S.C. § 2252 and for accessing and possessing child pornography under 18 U.S.C. § 2252A. A jury convicted him on all counts, and he was sentenced to 168 months (14 years) in prison followed by lifetime supervised release.
The Court’s Holding
The Ninth Circuit affirmed Johnsen’s conviction on all counts, rejecting each of his three challenges.
First, the court held that hash-value matches between a suspect’s files and known child pornography provide sufficient support for probable cause to issue a search warrant — even when agents have not downloaded and visually confirmed the suspect’s files. Requiring visual confirmation would effectively demand certainty rather than the “fair probability” standard that probable cause requires. The court noted that several other circuits have reached the same conclusion. Here, the hash matches were further bolstered by filenames strongly indicative of child pornography and Johnsen’s prior sex-offense convictions.
Second, the court held that law enforcement’s pre-warrant review of Johnsen’s publicly shared eMule files did not violate the Fourth Amendment or the federal Wiretap Act. A person who shares files on a public peer-to-peer platform has no reasonable expectation of privacy in those files. And the Wiretap Act only covers communications intercepted during transmission, not files already stored on a computer.
Third, the court rejected Johnsen’s claims that his Sixth Amendment right to counsel was violated when agents conducted forensic analysis of his devices without his attorney present. Forensic analysis is not a “critical stage” of prosecution requiring counsel’s presence — it is scientific analysis that can be effectively challenged through cross-examination at trial. The court also found Johnsen’s selective-prosecution claim meritless because he offered no evidence of differential treatment or impermissible prosecutorial motive. Finally, the court declined to review his sufficiency-of-the-evidence challenge because he failed to identify any specific element that was inadequately supported.
Key Takeaways
- In the Ninth Circuit, a hash-value match between a suspect’s files and known child pornography can support probable cause for a search warrant even without agents visually confirming the suspect’s files. The “fair probability” standard does not require certainty.
- Files shared publicly on peer-to-peer platforms carry no reasonable expectation of privacy. Law enforcement may review publicly available files without a warrant and without violating the Fourth Amendment or the Wiretap Act.
- Forensic examination of seized electronic devices is not a “critical stage” of prosecution, so a defendant has no Sixth Amendment right to have counsel present during that process. Cross-examination at trial is the proper way to challenge forensic techniques.
- A selective-prosecution defense requires showing both that similarly situated individuals were not prosecuted and that the prosecution was driven by an impermissible motive such as race or religion. Sex-offender status is not a suspect classification that triggers heightened scrutiny.
Why It Matters
This decision provides clear Ninth Circuit authority on a question that arises frequently in digital-evidence cases: whether hash matching alone — without downloading and viewing a suspect’s actual files — can establish probable cause. The court’s answer is yes, aligning the Ninth Circuit with the Second, Third, Eighth, and Tenth Circuits. For law enforcement, this means investigators can rely on hash-value technology to build warrant applications more efficiently, without the additional step of obtaining and viewing the suspect files beforehand.
For defense attorneys, the decision narrows the available avenues for challenging digital search warrants. While the reliability of a specific hashing methodology could still be contested, the general principle that hash matches are probative of file contents is now firmly established. The ruling also reinforces that sharing files on public peer-to-peer networks eliminates any privacy expectation in those files — a principle with broad implications for anyone using such platforms.
The court’s treatment of the right-to-counsel issue during forensic device analysis is also significant. As digital forensic examinations become longer and more complex — here, the process took eight months — defendants may increasingly seek attorney involvement. This opinion makes clear that such examinations are treated like other scientific analyses that can be adequately tested through cross-examination, not like lineups where the defendant’s physical presence creates unique risks of prejudice.