Background
Instagram used Microsoft’s PhotoDNA software to scan uploaded or transmitted content for files matching known child sexual abuse material. Images associated with Eric M. Naparalla’s account were flagged, and Instagram reported them to the National Center for Missing and Exploited Children. NCMEC matched some files to known child pornography through their hash values and forwarded a CyberTip report to the Wisconsin Department of Justice.
DOJ investigators traced the account to Naparalla, viewed the flagged images without first obtaining a warrant, and later secured a warrant to search his home. Naparalla moved to suppress the CyberTip evidence and the resulting evidence as fruits of an unconstitutional search. After the circuit court denied the motion, he pleaded guilty to one count of possession of child pornography and received three years of initial confinement followed by five years of extended supervision.
The Court’s Holding
The Court of Appeals affirmed. Assuming without deciding that Naparalla had a reasonable expectation of privacy in the Instagram material, the court held that Instagram acted as a private party when it scanned the files. Police did not initiate, encourage, or participate in the scan, and Instagram conducted it to further its own business interest in keeping child sexual abuse material off its platform.
The court also assumed without deciding that NCMEC was a government actor, but concluded that NCMEC did not exceed the scope of Instagram’s private search because it relied on the same files Instagram had flagged. Applying State v. Gasper and United States v. Jacobsen, the court further held that DOJ agents did not expand the search by opening the hash-matched images to confirm that they depicted child pornography. Instagram’s PhotoDNA scan had already frustrated any reasonable expectation of privacy in those particular files, and the hash matches made it virtually certain that investigators would see no more than the material identified through the private search.
Key Takeaways
- An electronic service provider acts as a private party when it independently scans user content to further its own business purposes without police initiation, encouragement, or participation.
- Government review of material identified through a private hash-based search does not violate the Fourth Amendment when the review remains within the scope of that search.
- DOJ agents did not need a separate warrant merely to open the flagged images and confirm that they contained child pornography.
Why It Matters
The decision applies Wisconsin Supreme Court precedent concerning hash-based detection of child sexual abuse material to Instagram’s use of PhotoDNA. It confirms that law enforcement may inspect files already identified and disclosed through a provider’s private search without conducting a new Fourth Amendment search, so long as officers do not exceed the scope of the provider’s search.
The opinion is unpublished and generally may not be cited as precedent or authority in Wisconsin courts except for the limited purposes permitted by Wisconsin’s appellate rules.