Hash-Matching as a “Private Search”: Warrantless Government Viewing of Matched CSAM Files Does Not Exceed the Search’s Scope

1. Introduction

In United States v. Richard Brillhart (11th Cir. July 9, 2026), the Eleventh Circuit addressed an increasingly common Fourth Amendment problem: when a technology company detects suspected child sexual abuse material (“CSAM”) using automated tools—specifically hash-value matching—may law enforcement later open and view the matched file without a warrant under the private-search doctrine?

Richard Edward Brillhart, a convicted sex offender, was investigated after Yahoo and Google issued “CyberTips” to the National Center for Missing and Exploited Children (“NCMEC”) about suspected CSAM in his email accounts. Yahoo’s detections were confirmed by human review. Google confirmed several files by human review and one file through automated hash matching against Google’s internal CSAM hash repository. Without a warrant, a Fort Myers police officer viewed the files received via NCMEC and confirmed they were CSAM; that confirmation helped support warrants for searches that later uncovered extensive CSAM on a micro-SD card in Brillhart’s bedroom and additional evidence connected to his online accounts.

The appeal raised many issues—suppression, double jeopardy, evidentiary rulings, jury instructions, sufficiency, and sentencing—but the opinion’s central precedential contribution is its Fourth Amendment holding: Google’s hash match qualifies as a “private search,” and the officer’s subsequent viewing of the same file did not exceed the search’s scope.

2. Summary of the Opinion

• Fourth Amendment / Suppression: The court held that Google’s identification of a file through hash-value matching was a valid private search under United States v. Jacobsen, and law enforcement’s subsequent warrantless viewing of the same matched file revealed “no new material information,” thus no Fourth Amendment violation.
• Double Jeopardy: Convictions for distribution and possession of child pornography are not the “same offence” under Blockburger v. United States.
• Sufficiency: Evidence supported both distribution and possession convictions.
• Rule 403 / Graphic Evidence: No abuse of discretion in admitting and displaying a limited number of CSAM images/videos; and under United States v. Ewing, the court’s failure to pre-view the exhibits was not reversible given the defendant’s generalized objections.
• Defense Emails / Hearsay: No reversible error in excluding roommate-related emails as irrelevant/hearsay.
• Jury Instruction: No abuse of discretion in refusing a “framed” theory-of-defense instruction that was essentially argument.
• Sentencing (mental health motions): No abuse of discretion in denying a last-minute psychological exam and continuance under 18 U.S.C. §§ 3552(c), 4241(a).
• Sentencing (Guidelines enhancement): The court vacated and remanded due to erroneous application of the five-level “pattern of activity” enhancement under U.S.S.G. § 2G2.2(b)(5), following United States v. Alberts.
• Supervised release revocation: Challenges were dismissed as moot in light of the resentencing remand.

3. Analysis

3.1. Precedents Cited

A. The private-search doctrine framework

• United States v. Jacobsen (1984): The opinion treats Jacobsen as the controlling benchmark. Two principles are emphasized: (1) the Fourth Amendment does not apply to purely private searches; and (2) a subsequent government search is lawful if it does not “exceed[] the scope of the private search.” The court relies heavily on Jacobsen’s “virtual certainty” concept: if it is virtually certain the government’s inspection will reveal nothing “of significance” beyond what the private search already revealed, the government’s replication is not a Fourth Amendment “search” in the constitutional sense.
• United States v. Castaneda (11th Cir. 2021): Cited for the classic statement that the Fourth Amendment is “wholly inapplicable” to a private search not acting as a government agent, quoting Jacobsen.
• United States v. Garcia-Bercovich (11th Cir. 2009) and United States v. Simpson (11th Cir. 1990): Used to show that a government follow-up can be more thorough without exceeding the private search’s scope; the scope inquiry is not defeated merely because law enforcement “took more time and were more thorough.”
• Walter v. United States (1980): Invoked as the limiting case: a private party’s viewing of only external labels (without viewing film contents) did not permit the government to view the films themselves. The Eleventh Circuit distinguishes Walter to reject the analogy between a hash value and a descriptive label.
• United States v. Sparks (11th Cir. 2015): Used to illustrate that the private-search doctrine fails when the government views an item (e.g., a video) that the private party never viewed. Sparks helps the court characterize “scope” as primarily about breadth (which files were exposed), not depth (how detailed the later review is).

B. The inter-circuit split on hash matching

• Hash matching qualifies as a private search: United States v. Reddick (5th Cir. 2018) and United States v. Miller (6th Cir. 2020). The Eleventh Circuit adopts their core rationale: hash matching’s “near-perfect accuracy” yields “virtual certainty” that the matched file is the same file previously identified as contraband.
• Hash matching does not qualify as a private search: United States v. Maher (2d Cir. 2024), United States v. Lowers (4th Cir. 2026), and United States v. Wilson (9th Cir. 2021). The Eleventh Circuit rejects these decisions’ container/label analogies and their view that hash values provide “no useful information” absent human opening of the file.
• Reliability of hashes in other cited authorities: The court reinforces reliability with citations including United States v. Cartier (8th Cir. 2008), United States v. Wellman (4th Cir. 2011), United States v. Owens (7th Cir. 2021), United States v. Rosenschein (10th Cir. 2025), United States v. Gasperini (2d Cir. 2018), and Wilson v. Gamboa (9th Cir. 2025). Notably, the court distinguishes Lowers on the evidentiary record: unlike that case, the record here contained uncontested testimony supporting hash matching’s accuracy.
• United States v. Ackerman (10th Cir. 2016): Cited to illustrate the “scope” problem when law enforcement (or an intermediary like NCMEC) opens additional files beyond the one implicated by the private search.

C. Double jeopardy and related precedent

• Blockburger v. United States (1932) and Illinois v. Vitale (1980): Establish the elements-based “same offence” analysis.
• United States v. Brunty (11th Cir. 1983) and United States v. Oquendo (5th Cir. 1975): Support the proposition that distribution does not necessarily require possession (developed in the drug context, extended here by analogy).
• United States v. Chiaradio (1st Cir. 2012), United States v. Woerner (5th Cir. 2013), United States v. McElmurry (9th Cir. 2015): Sister-circuit support extending that logic to child pornography.
• United States v. Bobb (11th Cir. 2009) and United States v. Schaff (S.D. Ga. 2011): Distinguished because Bobb concerned receipt vs. possession, not distribution vs. possession.
• Bonner v. City of Prichard (11th Cir. 1981) (en banc): Explains binding effect of pre-1981 Fifth Circuit precedent.

D. Evidence, trial rulings, and sentencing precedent

• Sufficiency standard: United States v. Gamory (11th Cir. 2011); credibility deference: United States v. Glinton (11th Cir. 1998).
• Rule 403 in CSAM cases: United States v. Alfaro-Moncada (11th Cir. 2010), United States v. Dodds (11th Cir. 2003), and especially United States v. Ewing (11th Cir. 2025) on pre-viewing exhibits.
• Defense instruction: United States v. Barham (5th Cir. 1979), United States v. Hill (11th Cir. 2011), United States v. Ndiaye (11th Cir. 2006).
• Exclusion of emails: United States v. De La Cruz Suarez (11th Cir. 2010).
• Competency / mental exams: United States v. Nickels (11th Cir. 2003), United States v. Valladares (11th Cir. 2008), United States v. Cruz (11th Cir. 1986), and Dusky v. United States (1960).
• Guidelines enhancement: United States v. Alberts (11th Cir. 2017) as controlling on § 2G2.2(b)(5)’s definition; the opinion notes but does not analyze any possible interaction with United States v. Dupree (11th Cir. 2023) (en banc), citing preservation decisions United States v. Lusk (11th Cir. 2024) and United States v. Jews (11th Cir. 2023).
• Mootness / sentencing package: United States v. Fowler (11th Cir. 2014) and United States v. Stinson (11th Cir. 1996).

3.2. Legal Reasoning

A. The new rule: hash-value matching can be a “private search”

The court’s doctrinal move is to treat Google’s hash match as functionally equivalent to a human private search for purposes of Jacobsen’s “virtual certainty” test. It emphasizes that Google’s process, as described in the record, is “semi-automated”: a prior human review identifies a specific file as CSAM, assigns/records the hash value, and stores it in an internal repository with an “industry classification.” Later, automation compares a newly encountered file’s hash to the known-CSAM hash; if it matches, Google treats the file as the same file and reports it to NCMEC without re-opening it.

On that account, the hash match does not “replace human review entirely”; it “simply used a computer to save one flesh-and-blood individual the trouble of having to confirm what another ... had already concluded.” The constitutional significance is that once Google’s private process establishes (with near-perfect accuracy) that the file is the same file previously adjudged contraband, law enforcement’s later viewing of that same file reveals nothing materially new.

B. Why the court rejects the contrary “container/label” approach

The opinion identifies three “missteps” in United States v. Maher, United States v. Lowers, and United States v. Wilson:

1. Hash values are not “labels” like Walter: The court explains that a hash is a one-way transformation derived from the file’s underlying bits; it is not a descriptive tag that could be true or false about unknown contents. Therefore, the “label on a container” analogy is said to misunderstand what a hash represents in relation to the file.
2. “Scope” is about breadth more than depth: The court reads Jacobsen and Eleventh Circuit precedent to require virtual certainty that nothing significant beyond contraband identification will be discovered, not a detailed narrative description of the file. The opinion treats concerns about how lurid or specific the government’s later description becomes as largely a “depth” issue, and it emphasizes that the core scope violation arises when government opens additional, not-previously-implicated files (as in United States v. Sparks and United States v. Ackerman).
3. “Personal rights” do not defeat hash matching’s link to the suspect: The court reasons that hash matching creates a “decisive personal link” because it establishes that the suspect’s file is the same file previously identified as CSAM. Thus, the earlier private determination is relevant to the suspect’s own file precisely because the match ties that earlier adjudication to the suspect’s possession/distribution of the identical digital object.

C. The court’s limiting note

The court expressly declined to decide whether a qualifying private search must include human involvement, because the case involved prior human review before the hash was added to Google’s repository. That reservation leaves open future disputes where contraband classification is produced without any prior human confirmation.

D. Other holdings (briefly) show methodological consistency

• Double jeopardy: Applying Blockburger v. United States, the court focuses on statutory elements rather than trial evidence, following Illinois v. Vitale. It rejects the premise that distribution requires possession, citing United States v. Brunty and the possibility of distribution through brokering/arranging rather than physical or digital custody.
• Sentencing enhancement: Following United States v. Alberts, the court enforces a categorical constraint: only conduct that matches enumerated statutory references in the guideline commentary counts toward § 2G2.2(b)(5)’s “pattern of activity.” With only one qualifying episode, “a pattern of one is no pattern.”

3.3. Impact

A. Fourth Amendment investigations involving NCMEC CyberTips

The opinion firmly places the Eleventh Circuit on the Fifth/Sixth Circuit side of the split, aligning with United States v. Reddick and United States v. Miller and rejecting the approach of United States v. Maher, United States v. Lowers, and United States v. Wilson. Practically, this supports warrantless law-enforcement viewing of a file when (1) a provider’s hash match indicates it is identical to a file previously confirmed as CSAM in the provider’s database, and (2) the government views only that matched file (and does not expand to other files not within the private search’s scope).

B. Litigation focus shifts to record-building and “scope discipline”

Two likely consequences follow from the court’s reasoning:

• Reliability record: The court distinguished Lowers on the presence/absence of “record evidence.” Suppression litigation in the Eleventh Circuit will predictably concentrate on evidentiary proof of the specific hash technology used, its error rate, and whether the provider’s process truly ties the match to a previously human-confirmed contraband file.
• Scope boundaries: Even with hash matching treated as a private search, United States v. Sparks and United States v. Ackerman remain cautionary: opening additional attachments, adjacent files, or accounts not implicated by the private search creates the kind of “breadth” expansion that triggers Fourth Amendment scrutiny.

C. Sentencing: reinforcing limits on § 2G2.2(b)(5)

On remand, the case also reinforces that Eleventh Circuit district courts must apply § 2G2.2(b)(5) with Alberts’ enumerated-offense constraint. The government’s concession underscores that disputes over what counts as “sexual abuse or exploitation” are not merely factual—they are often categorical/legal.

4. Complex Concepts Simplified

• Hash value / hash matching: A hash is a computer-generated “digital fingerprint” of a file. If two files have the same hash (as used here), they are treated as the same file. Google compared the hash of a file in Brillhart’s account to hashes of files previously confirmed as CSAM.
• Private-search doctrine: If a private party (not acting for the government) has already searched something, police can generally repeat that search without a warrant—but only up to the same scope. The key is whether police learn something materially new beyond what the private party already revealed.
• “Scope” (breadth vs. depth): “Breadth” asks: did police look at additional items the private party never exposed (e.g., other files/attachments)? That is usually unconstitutional without a warrant. “Depth” asks: did police look more closely at the same item? That can be permissible if it reveals nothing materially new.
• Double jeopardy / Blockburger: Two convictions are allowed if each crime requires proof of something the other does not. Distribution can occur without possession (e.g., arranging delivery), so the crimes are distinct.
• “Pattern of activity” enhancement (§ 2G2.2(b)(5)): A five-level increase applies only if the defendant engaged in at least two qualifying acts of “sexual abuse or exploitation” as specifically defined by the guideline notes (per Alberts).

5. Conclusion

United States v. Richard Brillhart establishes (for the Eleventh Circuit) that a provider’s hash-value match—built on a prior human-confirmed CSAM hash—can constitute a “private search,” and that law enforcement may view the matched file without a warrant when that viewing does not exceed the private search’s scope under United States v. Jacobsen. The decision deepens the circuit split by rejecting the “digital container/label” framing of United States v. Maher, United States v. Lowers, and United States v. Wilson, and it signals that future suppression disputes will hinge on both the technical record supporting hash matching and strict adherence to scope limits (especially avoiding review of additional files). Separately, the opinion reaffirms elements-based double jeopardy analysis for distribution vs. possession and tightens sentencing practice by enforcing United States v. Alberts’ limitation on § 2G2.2(b)(5)’s “pattern of activity.”