Artificial Intelligence and the Impact it Has in Criminal Investigations Today

United States v. William Miller

Case No. 18-5578

Decided: December 3, 2020

Artificial Intelligence (“AI”) is a wide-ranging branch of computer science concerned with building smart machines capable of performing tasks that typically require human intelligence. AI is not only evolving the way people live and do business every day, but it is also impacting the way cybercrimes are being triggered and investigated by law enforcement in today’s world.  In United States v. William Miller, the Sixth Circuit considered the impact AI is having on two very important principles of criminal law – the Fourth Amendment’s right against unreasonable searches and the Sixth Amendment’s right to confront witnesses.

Miller found himself facing a number of charges after his Gmail account was flagged by Google’s hash value matching algorithm.  A hash value can be described as a digital fingerprint, whereby a hash value is assigned to a digital file when a Google employee views content and confirms that it is illegal.  Google will then scan Gmail for files with the same hash value.  A “match” signals that a downloaded file within an individual’s Gmail account is a copy of an illegal file.

There are a number of reasons why Google assigns hash values to illegal content on the internet, but in the context of United States v. Miller there are two important things to know. First, when an individual signs up for a Gmail account, Google’s terms of service inform customers that they may not use services like Gmail in violation of the law. Perhaps unwittingly, Customers agree that “[Google] may review content to determine whether it is illegal or violates our policies, and we may remove or refuse to display content that we reasonably believe violates our policies or the law. But that does not necessarily mean that we review content, so please don’t assume that we do.”  Second, the federal government imposes on electronic communication services providers. such as Google, a duty to report and to work with the National Center for Missing and Exploited Children (“NCMEC”) when they become aware of individuals abusing their services. Specifically, once “electronic communication services providers” become aware of illegal content on their services, federal law requires them to report it to NCMEC.  18 U.S.C. §§ 2258A(a), 2258E(6).

Understanding its duty to report known illegal digital content, Google learned through its AI resources that a Gmail account had uploaded two files with hash values matching illegal content.  Through its AI capabilities, Google never had to access the Gmail account or open the files.  Google merely sent a report with the files and the IP addresses that uploaded the illegal content to NCMEC.  From there, NCMEC performed a “Who Is lookup” on the IP addresses and identified their location in Kentucky.  A NCMEC analyst next searched for information connected to the Gmail account and discovered a profile page on a social media website affiliated with the Gmail account, which also included a picture of Mr. Miller.  The NCMEC analyst then provided a printout of this social media page and the NCMEC automated report to the appropriate authorities in Kentucky.  From there, law enforcement  initiated an investigation.

After detectives received the report and confirmed that the files contained illegal content, they subpoenaed the local internet provider and learned that the IP address that uploaded the illegal content was assigned to a specific home address, which was the same address on Miller driver’s license.  Detectives obtained a warrant for the records that Google retained and identified Miller as the subscriber.  Google provided about 4,000 emails and chat messages, as well as information in a file-storage account, where more illegal digital content was discovered. Detectives, obtained a warrant to search Mr. Miller’s home and seized his computers, flash drives, and hard drives.  After a forensic examination was done, 571 illegal images were discovered, to include the original files that matched and triggered Google’s hash value algorithm. Soon thereafter, Miller was indicted and eventually a jury convicted him on all counts.  Miller was sentenced to prison for 150 months followed by 15 years of supervised release.

On appeal, Miller argued that the government violated his Fourth Amendment right against unreasonable searches and that the district court violated his Sixth Amendment right to confront witnesses.  However, the Sixth Circuit did not buy into Mr. Miller’s arguments. Mr. Miller argued that Google conducted an “unreasonable search” by scanning his Gmail files for hash value matches, but the Sixth Circuit quickly corrected Miller, advising that the Fourth Amendment restricts the Government, not private action.  The Court compared this search to a shopkeeper independently investigating a theft at his store.  While Google’s hash value matching may be new, private searches are not.  The Sixth Circuit relied up the Supreme Court case of Burdeau v. McDowell, 256 U.S. 465, 475 (1921), which held that a private party who searches a physical space and hands over paper files to the government has not violated the Fourth Amendment.  The Sixth Circuit also held that Google did not act under government compulsion because, while there is a federal mandate that compels electronic communication services providers to report illegal digital content that they know of, the statute does not compel such providers to search for illegal content that they are unaware of.  Therefore, the Sixth Circuit found that the Burdeau rule covered Google’s scan of virtual spaces and disclosure of illegal digital files.

Next, Miller argued that the detectives conducted an “unreasonable search” when they opened and viewed the files sent by Google.  The Sixth Circuit found that this claim implicated another well settled rule under the private-search doctrine found in United States v. Jacobsen, 466 U.S. 109, 119 (1984).  This doctrine stands for the proposition that the government does not conduct a Fourth Amendment search when there is “virtual certainty” that its search will disclose nothing more than what a private party’s earlier search has revealed. The Sixth Circuit held that Google’s hash value search reliability created a “virtual certainty” that the files in the Gmail account were illegal content, and that the required level of certainty under the private-search doctrine in relation to the detectives search was satisfied.  Thus, Miller’s Fourth Amendment right against unreasonable searches was not violated

As for Miller’s argument that the district court violated his Sixth Amendment right to confront witnesses, the Sixth Circuit did acknowledge that this right’s basic rule certainly applied to new types of witnesses, such as forensic analysts.  However, the Sixth Circuit held that the rule’s reach is nevertheless limited to statements by “witnesses” – that is, people and not information generated by machines.  As to how AI was utilized, the Sixth Circuit deemed that NCMEC’s automated systems, not a person, entered the specific information into the report that Mr. Miller challenged the admission of.  The Sixth Circuit found that the rules of evidence, not the Sixth Amendment, govern the admissibility of such computer-generated information.  Further, the Sixth Circuit recognized that courts have continually deemed machine generated information does not qualify as hearsay under the rules of evidence, and that this precedent extended to the data produced by NCMEC’s automated systems.

Ultimately, this case  sheds some light on how burgeoning new technologies like AI will be viewed in relation to longstanding constitutional protections.  The Sixth Circuit clearly has sent a message that it is going to take some far stepping action by a private company utilizing AI to constitute government action, which might equate to an unreasonable search in violation of the Fourth Amendment.