Fourth Amendment Privacy in Cloud-Storage Files: Hash-Matching Does Not Trigger the Private-Search Exception; Warrants Required to Open Unviewed Files (But Suppression May Be Barred by Attenuation)

Introduction

United States v. Nico Aaron Lowers (4th Cir. Mar. 10, 2026) squarely confronts whether Fourth Amendment privacy protections “apply with equal force in the digital world,” specifically to files stored in a private cloud account (Google Drive). The Government’s investigation began when Google generated a CyberTip to the National Center for Missing and Exploited Children (“NCMEC”) after Google’s hash-matching process flagged 156 uploaded files as apparent child sexual abuse material (“CSAM”). Months later, a Chesapeake, Virginia detective opened and viewed—without a warrant—at least three files that neither Google nor NCMEC had opened. That viewing helped propel a multi-jurisdiction investigation that eventually led North Carolina officers to CSAM on Lowers’s devices and to a search warrant for his apartment, where officers seized a flash drive and hard drive containing CSAM.

The appeal presented two core questions: (1) whether Lowers retained a reasonable expectation of privacy in cloud-stored files—especially files flagged by hash-matching—and whether the “private search doctrine” allowed police to open and view unreviewed files without a warrant; and (2) even if a Fourth Amendment violation occurred, whether the exclusionary rule required suppression of later-obtained evidence.

Summary of the Opinion

The Fourth Circuit (Judge Thacker, joined by Judge Benjamin) held:

  • Fourth Amendment violation: Lowers had an objectively reasonable expectation of privacy in his private Google Drive and in the digital files stored there. Police generally must obtain a warrant before opening and viewing those files.
  • Hash-matching is not enough for the private-search exception: A hash value is “just raw data,” and a hash-match, without prior human viewing of that specific file, does not frustrate the user’s expectation of privacy. Thus, opening unviewed files exceeded any private search.
  • No suppression due to attenuation: Despite the constitutional violation, suppression was unwarranted because the connection between the illegal viewing and the evidence of conviction was too attenuated, given the passage of time and intervening circumstances (including voluntary interviews and consent searches).

The judgment was affirmed solely on attenuation grounds. Judge King concurred in the judgment but would have affirmed on a different rationale: he would have applied the private search doctrine (aligning with the Fifth and Sixth Circuits) and found no Fourth Amendment violation.

Analysis

Precedents Cited

1) Reasonable expectation of privacy (the Katz framework)

  • Katz v. United States: Provided the foundation for the two-part expectation-of-privacy test; the court relied on Katz’s logic to reject the idea that provider access/monitoring alone eliminates Fourth Amendment protection.
  • California v. Ciraolo: Cited for the two-step structure (subjective expectation + objective reasonableness).
  • United States v. Castellanos: Supplied the formulation that a search is unreasonable when it infringes on a privacy expectation society deems reasonable.
  • United States v. Rose: Emphasized the defendant’s burden on the Katz prongs—though the court later clarified that, once a warrantless search is shown, the Government bears the burden to prove an exception.

2) Provider policies/notice and diminished privacy

  • Riley v. California: Used to underscore that “diminished privacy” does not eliminate Fourth Amendment protection; also invoked for the sensitivity and breadth of digital information.
  • United States v. Warshak: Central to the majority’s rejection of “provider access = no privacy”; the ability of an intermediary to access content does not extinguish privacy expectations against the Government.
  • United States v. Simons: Distinguished as a case where the government employer itself gave monitoring notice—eliminating any expectation of privacy against that very government actor.
  • United States v. Young: Discussed and rejected as unpersuasive to the extent it treated private-carrier inspection clauses as eliminating privacy “as a matter of law.”
  • United States v. Maher: Adopted as persuasive authority that Google-style “may” review terms do not negate privacy against the Government.

3) Containers, warrants, and rejecting “contraband-only” reasoning

  • United States v. Jacobsen: Dual role. First, as the core private-search case defining the “scope” limitation. Second, as the container-search principle that even where seizure may be lawful, opening/examining contents generally requires a warrant.
  • United States v. Buster: Reinforced that probable cause typically points officers to a warrant, not a warrantless search.
  • Horton v. California (quoting Coolidge v. New Hampshire): Used for the proposition that “no amount of probable cause” justifies a warrantless search absent exigency.
  • Illinois v. Caballes: The district court relied on it (contraband reveals no legitimate privacy interest); the Fourth Circuit rejected extending that logic to warrantless opening/viewing of digital files.

4) Automobile exception rejected for cloud files

  • United States v. Brookins (quoting Maryland v. Dyson), Collins v. Virginia, California v. Carney: Used to explain the rationales for the automobile exception (mobility + diminished privacy due to regulation) and why those rationales do not apply to static, already-preserved cloud files.

5) Private search doctrine (digital hashing and circuit split)

  • United States v. Fall, United States v. Richardson: Framed the private-search doctrine as a Fourth Amendment exception that allows police to view what a private party already exposed, but not more.
  • Walter v. United States: Key analogy—where government “significantly expanded” the private party’s search by using different means (a projector) to reveal previously unknown information.
  • United States v. Arce: Important for two propositions: hash values “standing alone” reveal little, and CSAM determinations entail human judgment.
  • United States v. Wilson, United States v. Maher: Adopted; both hold that hash-matching alone does not defeat privacy in unopened files.
  • United States v. Reddick, United States v. Miller: Rejected by the majority (but embraced by the concurrence) as resting on flawed reasoning, including treating third-party file review as defeating privacy in a defendant’s separate file and treating post-search confirmation of contraband as validating the search.
  • United States v. Holmes: Used to illustrate real-world risk of false positives/overbreadth—reported “apparent CSAM” may not satisfy the statutory definition.

6) Judicial notice limits and record-based factfinding

  • United States v. Zayyad (quoting Int'l Star Class Yacht Racing Ass'n v. Tommy Hilfiger U.S.A., Inc.): The court condemned the district court’s reliance on “secondary sources in other cases” to find Google’s hash technology “exceedingly reliable” without evidence in this record.

7) Standing/personal nature of Fourth Amendment rights

  • Rakas v. Illinois, United States v. Green, United States v. Ferebee, United States v. Daniels (quoting Byrd v. United States): These cases grounded the majority’s point that Fourth Amendment rights are personal; Google’s viewing of someone else’s file cannot eliminate Lowers’s privacy interest in his own unopened file.

8) Exclusionary rule and attenuation

  • Davis v. United States, Elkins v. United States, United States v. Leon (quoting United States v. Calandra), Herring v. United States, Hudson v. Michigan, Arizona v. Evans: Built the framework that exclusion is deterrence-based, “last resort,” and not automatic.
  • Utah v. Strieff, Wong Sun v. United States, Brown v. Illinois, United States v. Najjar: Provided the attenuation test and its three factors (time; intervening circumstances; purpose/flagrancy).
  • United States v. Seidman, United States v. Hooker, United States v. Terry: Supported the court’s conclusion that voluntary acts can sever causation and that non-flagrant mistakes weigh against suppression.
  • United States v. Ray: Reiterated that suppression covers both direct evidence and “fruit of the poisonous tree,” subject to exceptions like attenuation.

Legal Reasoning

1) Cloud storage is the digital analogue of “papers” kept in a file cabinet

The court’s core move is conceptual: it treats private cloud storage as functionally akin to a private filing cabinet. Users do not forfeit Fourth Amendment protection merely because their “papers” are stored with a third-party service provider. Google’s policy that it “may” analyze content for “illegal content” may diminish privacy expectations “to some degree,” but it does not convert the account into a government-searchable space.

2) The district court’s “notice,” “contraband,” and “automobile” rationales were rejected

The Fourth Circuit dismantled three district-court routes to “no search”:

  • Notice (privacy policy): Monitoring clauses do not eliminate expectations of privacy against the Government; the court analogized to hotel rooms and cited Katz/Warshak to stress that third-party access is not government carte blanche.
  • Contraband framing: The court rejected a results-driven view that opening files is permissible if contraband is found. The Fourth Amendment assesses reasonableness at the time of intrusion, and “the results of a warrantless search cannot cure the search’s illegality.”
  • Automobile exception: Cloud files are not mobile vehicles, and here the files were already preserved at NCMEC/law enforcement for months; there was no exigency and no diminished privacy rationale analogous to pervasive vehicle regulation.

3) Hash-matching does not satisfy the private search doctrine for unopened files

The majority’s rule is narrow but consequential: a hash value is a non-descriptive identifier. A hash-match does not mean police are “merely” repeating a private visual inspection of that same file. Unless the specific file was previously visually inspected by a private party, police viewing it is an expansion—more like Walter v. United States (projecting films) than United States v. Jacobsen (reopening what was already effectively known).

Two reinforcing doctrinal points drive the holding:

  • Record-based reliability: The Government bears the burden to prove a warrant exception. With no evidentiary hearing, it could not rely on other cases’ findings about hash reliability; judicial notice could not supply the missing proof.
  • Fourth Amendment rights are personal: Even if Google previously viewed an identical image in another user’s file, that does not defeat Lowers’s privacy interest in his different file. The “private search” must be of what belongs to (or implicates the privacy interest of) the defendant.

4) Remedy: attenuation defeats suppression on these facts

After finding a Fourth Amendment violation, the court declined to suppress the North Carolina evidence because the causal link was “too strained.” Applying the three-factor test from United States v. Najjar / Brown v. Illinois:

  • Time: Approximately seven months elapsed between the illegal viewing and the later evidence.
  • Intervening circumstances: Lowers’s voluntary interviews, consent to search his phone/laptop, and later confession (including directing officers to the flash drive) were treated as significant acts of free will severing the chain.
  • Purpose/flagrancy: The court found no indication Detective Rider acted to intentionally circumvent the warrant requirement; the misconduct was not “flagrant.”

The court thus affirmed while explicitly limiting its affirmance to attenuation, leaving the district court’s good-faith ruling unreviewed.

Impact

The opinion establishes (within the Fourth Circuit) several practical and doctrinal guideposts:

  • Warrant-first default for cloud files: Law enforcement generally must obtain a warrant before opening and viewing private cloud-stored files, even when a platform flags the files via hash-matching.
  • Hash-match ≠ private search (standing-based limitation): The Government cannot bootstrap a prior private viewing of a third party’s file into authority to open a defendant’s unopened file.
  • Evidence and burden discipline in suppression litigation: Reliability of proprietary tools cannot be assumed via judicial notice of other cases; the Government must build a record if it seeks to invoke a warrant exception dependent on technological accuracy.
  • Remedy may turn on attenuation: Even where an initial digital search is unconstitutional, downstream evidence may survive if time, intervening voluntary acts, and lack of flagrancy substantially weaken deterrence-based justification for exclusion.

The case also deepens a recognized inter-circuit divide: the Fourth Circuit aligns with United States v. Maher and United States v. Wilson, and rejects United States v. Reddick and United States v. Miller. Judge King’s concurrence highlights the continuing disagreement and suggests that future Supreme Court review remains plausible, particularly as CSAM reporting regimes and automated detection scale.

Complex Concepts Simplified

  • Hash-matching: Software generates a unique-looking string (“digital fingerprint”) from a file’s contents and compares it to a database. A match suggests similarity/identity, but the hash itself does not describe what’s depicted.
  • Private search doctrine: If a private party (not the police) searches your property and shows police what they found, police can look at what was already exposed. But police generally cannot go further than what the private party actually viewed without a warrant.
  • “Containers” in Fourth Amendment law: Courts treat many things as “containers” (packages, envelopes, digital files). Even with probable cause, police typically need a warrant to open the container absent an exception.
  • Exclusionary rule and attenuation: Even if police act unlawfully, evidence is excluded only when doing so meaningfully deters misconduct. If later evidence is discovered after time passes and new, independent events occur, courts may deem the connection too weak (“attenuated”) to justify suppression.
  • “Standing” (personal Fourth Amendment rights): You can usually challenge only searches that invade your privacy interest. What police or a company did to someone else’s files does not automatically affect your rights in your own files.

Conclusion

United States v. Nico Aaron Lowers announces a clear Fourth Circuit rule for the cloud era: users retain a reasonable expectation of privacy in private cloud-stored files, and law enforcement generally must secure a warrant before opening and viewing files that have not been visually inspected by a private party—hash-matching alone does not trigger the private-search exception. Yet the decision also underscores the limits of Fourth Amendment remedies: even a conceded constitutional violation will not necessarily yield suppression where the later evidence is sufficiently attenuated and exclusion would not meaningfully deter police misconduct. The result is a two-level precedent—stronger privacy doctrine for cloud files, coupled with a fact-intensive remedial backstop that may preserve convictions despite early investigative error.