Hash-Value Matching as a “Private Search”: Warrantless Government Viewing Permitted When It Reveals Nothing Beyond Google’s Hash-Match Identification

Case: United States v. Richard Brillhart (11th Cir. July 9, 2026)

I. Introduction

United States v. Richard Brillhart arose from parallel reports by Yahoo and Google that email accounts linked to Richard Edward Brillhart were transmitting child sexual abuse material (CSAM). After the providers submitted “CyberTips” to the National Center for Missing and Exploited Children (NCMEC), a Fort Myers police officer—without a warrant—opened and viewed the reported files to confirm they depicted child pornography. Those observations were then used to obtain warrants for Brillhart’s residence, devices, and accounts, leading to the discovery of extensive CSAM on a phone and micro-SD card.

Brillhart was convicted of (1) distribution of child pornography and (2) possession/access with intent to view. His appeal presented numerous issues, but the opinion’s central Fourth Amendment question was novel and consequential: when Google identifies a file as child pornography through automated “hash-value matching” against a database of previously human-confirmed CSAM, does that automated identification count as a “private search” such that a later warrantless government viewing of that same file is permissible (so long as it reveals nothing materially new)?

The Eleventh Circuit answered “yes,” aligning with the Fifth and Sixth Circuits and expressly rejecting the Second, Fourth, and Ninth Circuits’ contrary approaches. The court otherwise affirmed Brillhart’s convictions and most rulings, but vacated and remanded for resentencing because the district court erroneously applied the U.S.S.G. § 2G2.2(b)(5) “pattern of activity” enhancement.

II. Summary of the Opinion

III. Analysis

A. The Fourth Amendment Issue: Hash-Matching as a “Private Search”

1. Doctrinal framework adopted by the court

The panel treated the case as controlled by the two-part private-search doctrine synthesized from United States v. Jacobsen and later Eleventh Circuit cases: (1) the Fourth Amendment does not apply to a purely private search; and (2) government agents may repeat that private search without a warrant so long as they do not “exceed[] the scope of the private search.” The opinion quoted and applied the Eleventh Circuit’s formulation in United States v. Castaneda, which in turn quotes Jacobsen.

The operative test, as the court framed it, is whether the government’s subsequent inspection yields anything “materially more or different” than the private party already discovered—captured by Jacobsen’s “virtual certainty” language: whether there is “virtual certainty” that nothing else of significance will be found beyond what the private search already revealed.

2. How prior Eleventh Circuit precedents shaped the “scope” inquiry

The court relied on its own scope-of-search precedents to emphasize that lawful “replication and verification” does not become unlawful merely because law enforcement is more careful, slower, or more thorough with the same item(s):

• United States v. Garcia-Bercovich: A private search of one part of a single shipping unit could justify a warrantless search of the remainder where the district court found “it was all one package.” The Eleventh Circuit used this to highlight that “scope” may turn on how the “unit” of search is defined.
• United States v. Simpson: FBI review did not exceed scope merely because it was more thorough; “illicit character” had already been determined and contents were open for viewing.
• United States v. Sparks: The limiting principle—government exceeded scope when it viewed a video the private actor never watched. Conversely, viewing the same video more closely was permissible.

These cases were used to set up a key conceptual move later in the opinion: “scope” is primarily about breadth (which files/items were effectively identified as contraband), not necessarily about depth (how vivid or detailed the private party’s description was).

3. The circuit split—and the Eleventh Circuit’s alignment

The panel candidly acknowledged a live split over whether hash matching can qualify as a private search:

• Hash matching qualifies: United States v. Reddick (5th Cir. 2018) and United States v. Miller (6th Cir. 2020) treated hash matching as “near-perfect” identification such that government viewing learns nothing beyond the private identification.
• Hash matching does not qualify: United States v. Maher (2d Cir. 2024), United States v. Lowers (4th Cir. 2026), and United States v. Wilson (9th Cir. 2021) rejected hash matching as insufficiently revealing or too “container-like,” and emphasized Fourth Amendment rights as “personal.”

The Eleventh Circuit expressly “agree[d] with the Fifth and Sixth Circuits,” holding Google’s hash matching (as implemented here) constitutes a valid private search.

4. The court’s key reasoning: why hash matching, here, satisfies Jacobsen

The opinion’s technical and doctrinal core is its conclusion that Google’s process produced “virtual certainty” that the file was contraband:

• Human review remains foundational: Google’s hash database is populated by expert human review at “step one.” Only at “step two” does automation match a newly encountered file to that previously human-confirmed file. This supported the court’s view that automation merely “save[s] one flesh-and-blood individual the trouble” of repeating what a human already decided.
• Uncontested record evidence of reliability: The suppression record contained testimony that “if two files ha[ve] the same hash value, they’re the same file,” and that alteration changes the hash. The court stressed the absence of contrary evidence and distinguished the Fourth Circuit’s concern in United States v. Lowers that there was “no record evidence” of extreme reliability in that case.
• Broader judicial consensus on practical uniqueness: The court bolstered its confidence by citing decisions crediting hash matching as essentially foolproof or “astronomically” unlikely to mismatch, including: United States v. Cartier, United States v. Wellman, United States v. Owens, United States v. Rosenschein, United States v. Gasperini, and Wilson v. Gamboa.

On this view, Officer Lee’s warrantless viewing of the file did not exceed the private search because it confirmed exactly what Google’s hash match had already established: that the file was the same previously reviewed CSAM file.

5. Rejection of the “label/container” analogy and other contrary rationales

The court identified three “missteps” in Maher, Lowers, and Wilson:

• (i) Misplaced analogy to Walter v. United States: Those circuits analogized hash values to the suggestive labels in Walter v. United States, where private actors read labels but did not view film contents, and the government later viewed the films. The Eleventh Circuit rejected the analogy as “technical[ly]” inaccurate: a hash value is not merely descriptive “label” information; it is derived from the file’s underlying data and uniquely identifies the file itself.
• (ii) Over-demand for “detail” from the private search: The court emphasized Jacobsen did not require a granular description from the private party—only that the subsequent government inspection be virtually certain to reveal nothing more of significance. It relied on Simpson to reiterate that what matters is prior determination of illicit character, not the private party’s narrative richness.
• (iii) Overreading “personal” Fourth Amendment rights: The court rejected the idea (prominent in Lowers, Maher, and Wilson) that prior review of the “same” file in someone else’s possession cannot dissipate the defendant’s privacy interest. Because hash matching “ensures a decisive personal link” to the suspect’s own account—i.e., it is the same file—Google’s prior human judgment about that same file is relevant to Google’s identification of what the suspect acquired.

The panel expressly reserved (because unnecessary on these facts) whether a qualifying private search must always entail prior human review of the file.

6. The role of other Fourth Amendment precedents cited

• United States v. Perkins supplied the standard of review for suppression rulings (facts for clear error; law de novo).
• United States v. Ackerman (10th Cir.) was used to illustrate the doctrine’s boundary in the digital context: opening and viewing additional attachments not previously examined risks exposing non-contraband information beyond the private search’s scope. The citation sharpened the Eleventh Circuit’s breadth-over-depth framing.

7. Impact of the hash-matching holding

The opinion establishes a clear Eleventh Circuit rule: when a provider’s hash matching identifies a file as CSAM by matching it to a provider repository populated through prior human confirmation, law enforcement may—without a warrant—view that file to verify the private identification, provided the officer’s search does not expand beyond what the hash match has already “revealed” (i.e., the identity and contraband nature of the file).

Practical consequences include:

• Suppression litigation shifts to “scope” questions: disputes will likely center on whether officers limited their warrantless review to the specific hash-matched file(s), or whether they opened additional files/attachments/accounts.
• Incentives for careful police practice: officers may still seek warrants to avoid litigation risk, but this decision provides a firm appellate backstop for narrow confirmatory viewing in the hash-match scenario.
• Deepening circuit split: by siding with Reddick and Miller against Maher, Lowers, and Wilson, the case increases the likelihood of further en banc review or Supreme Court attention to unify doctrine in hash-match investigations.

B. Double Jeopardy: Distribution vs. Possession

1. Precedents cited and their function

• Blockburger v. United States provided the elements-based test (“each provision requires proof of a fact which the other does not”).
• Illinois v. Vitale was cited for focusing on statutory elements, not the trial evidence.
• United States v. Ford provided the Eleventh Circuit’s de novo review standard for double jeopardy.
• United States v. Brunty (drug context) supplied the key analogy: distribution does not necessarily require possession.
• United States v. Oquendo (binding via Bonner v. City of Prichard) reinforced that arranging a distribution can constitute “distribution” without possession.
• Sister-circuit child-pornography cases—United States v. Chiaradio, United States v. Woerner, and United States v. McElmurry—were cited to show other circuits have applied the same logic to CSAM.
• United States v. Bobb (and the district court case United States v. Schaff) were distinguished because they involved receipt vs. possession, not distribution vs. possession.

2. Legal reasoning and impact

The court held possession does not require distribution (straightforward), and distribution does not require possession (less intuitive but supported by Brunty/Oquendo logic). As a result, charging and convicting both offenses does not violate the Double Jeopardy Clause.

This reasoning supports broader prosecutorial charging discretion in CSAM cases (e.g., when distribution occurs through brokering, facilitating, or platform-mediated acts that may not involve traditional “possession”).

C. Sufficiency of the Evidence

Applying the sufficiency standard in United States v. Gamory, the court held the evidence supported both convictions. It also invoked United States v. Glinton to emphasize appellate deference to the jury’s rejection of Brillhart’s “framed” theory and its credibility determinations.

D. Evidentiary Rulings: Rule 403 and Prior Review of Images

The panel reaffirmed the Eleventh Circuit’s approach that CSAM itself is typically highly probative of the charged “thing” and of knowledge, citing United States v. Alfaro-Moncada and United States v. Dodds. It also relied on United States v. Ewing to reject the argument that a district judge must personally preview the images where the defendant made only a general objection rather than specific objections to particular files.

The exclusion of roommate-related emails was upheld, and the opinion referenced United States v. De La Cruz Suarez in affirming exclusion of after-the-fact statements with limited relevance.

E. Jury Instructions

The refusal to give Brillhart’s requested “framed” instruction was affirmed under a line of cases treating argumentative “instructions” as improper: United States v. Barham and United States v. Hill. The panel cited United States v. Carrasco for the abuse-of-discretion standard and United States v. Ndiaye for the principle that a specific defense instruction is unnecessary when the given charge adequately covers the substance (here, that Brillhart could only be convicted for what the government proved he did).

F. Sentencing

1. Psychological examination and continuance

The court applied United States v. Nickels and United States v. Valladares (abuse-of-discretion review), and held neither 18 U.S.C. § 3552(c) (permissive “may” order exam) nor 18 U.S.C. § 4241(a) (competency; requires “reasonable cause”) compelled an additional last-minute evaluation. For competency principles, it cited United States v. Cruz and Dusky v. United States.

2. “Pattern of activity” enhancement (vacated) and commentary reliance

The panel held the district court misapplied U.S.S.G. § 2G2.2(b)(5) in light of United States v. Alberts, which requires that each qualifying instance of “sexual abuse or exploitation” fall within one of the statutory sections referenced in the guideline’s application notes. Because only one of Brillhart’s prior episodes qualified, there was no “pattern,” and the case was remanded for resentencing.

The opinion noted, without deciding, potential interactions between United States v. Dupree (en banc) and Alberts, citing United States v. Lusk and United States v. Jews to explain the issue was not preserved/argued.

3. Mootness of supervised-release-revocation sentencing issues

Because the case was remanded for resentencing, the panel dismissed as moot Brillhart’s challenges to his supervised-release-revocation sentence, invoking the “sentencing package” concept from United States v. Fowler and United States v. Stinson. It flagged that the district court on remand “may wish to consider” 18 U.S.C. § 3583(k).

IV. Complex Concepts Simplified

• Hash-value matching: a “hash” is a computed fingerprint of a digital file. If two files have the same cryptographic hash, they are, for practical purposes, the same file; if a file changes, the hash changes.
• Private-search doctrine: if a private party (not acting as the government) has already searched an item and revealed its illicit nature, police may repeat that same search without a warrant so long as they do not go further than what the private search already exposed.
• “Scope” (breadth vs. depth): this opinion treats “scope” largely as which files/items were effectively identified and exposed (breadth), not how detailed or graphic the private party’s description was (depth).
• Double jeopardy / Blockburger: two offenses are different if each has at least one element the other does not. Distribution can be proved without proving possession.
• Rule 403: even relevant evidence can be excluded if unfair prejudice substantially outweighs probative value; in CSAM cases, courts often find a limited set of files probative to show the “thing” and knowledge.
• Guidelines “pattern of activity” (§ 2G2.2(b)(5)): requires more than one qualifying episode of sexual abuse/exploitation as defined by the guideline commentary’s enumerated statutory references (per Alberts).

V. Conclusion

United States v. Richard Brillhart makes the Eleventh Circuit a firm “yes” jurisdiction on a pivotal digital-investigation question: Google’s automated hash-value match—when tethered to prior human confirmation and when it uniquely identifies the same file—can constitute a private search that permits narrow warrantless government viewing of that file under Jacobsen’s “virtual certainty” framework. The decision simultaneously reinforces conventional doctrines on double jeopardy, evidentiary discretion in CSAM trials, and theory-of-defense instructions, while policing guideline application by vacating a § 2G2.2(b)(5) enhancement that lacked two qualifying predicate episodes under Alberts.