United States v. Luke Wilson

                       FOR PUBLICATION

   UNITED STATES COURT OF APPEALS
        FOR THE NINTH CIRCUIT


 UNITED STATES OF AMERICA,                     No. 18-50440
           Plaintiff-Appellee,
                                                 D.C. No.
                  v.                       3:15-cr-02838-GPC-1

 LUKE NOEL WILSON,
        Defendant-Appellant.                      OPINION

        Appeal from the United States District Court
          for the Southern District of California
        Gonzalo P. Curiel, District Judge, Presiding

         Argued and Submitted November 15, 2019
                   Pasadena, California

                    Filed September 21, 2021

   Before: Marsha S. Berzon and Paul J. Watford, Circuit
      Judges, and Robert H. Whaley, * District Judge.

                    Opinion by Judge Berzon




     *
       The Honorable Robert H. Whaley, United States District Judge for
the Eastern District of Washington, sitting by designation.
2                  UNITED STATES V. WILSON

                          SUMMARY **


                          Criminal Law

    The panel vacated a conviction for possession and
distribution of child pornography, reversed the district
court’s denial of a motion to suppress, and remanded for
further proceedings in a case in which the panel addressed
whether the government’s warrantless search of the
defendant’s email attachments was justified by the private
search exception to the Fourth Amendment.

    As required by federal law, Google reported to the
National Center for Missing and Exploited Children
(NCMEC) that the defendant had uploaded four images of
apparent child pornography to his email account as email
attachments. No one at Google had opened or viewed the
defendant’s email attachments; its report was based on an
automated assessment that the images the defendant
uploaded were the same as images other Google employees
had earlier viewed and classified as child pornography.
Someone at NCMEC then, also without opening or viewing
them, sent the defendant’s email attachments to the San
Diego Internet Crimes Against Children Task Force, where
an officer ultimately viewed the email attachments without
a warrant. The officer then applied for warrants to search
both the defendant’s email account and his home, describing
the attachments in detail in the application.




    **
       This summary constitutes no part of the opinion of the court. It
has been prepared by court staff for the convenience of the reader.
                 UNITED STATES V. WILSON                       3

    The private search doctrine concerns circumstances in
which a private party’s intrusions would have constituted a
search had the government conducted it and the material
discovered by the private party then comes into the
government’s possession. Invoking the precept that when
private parties provide evidence to the government on their
own accord, it is not incumbent on the police to avert their
eyes, the Supreme Court formalized the private search
doctrine in Walter v. United States, 447 U.S. 649 (1980),
which produced no majority decision, and United States v.
Jacobson, 466 U.S. 109 (1984), which did.

    The panel held that the government did not meet its
burden to prove that the officer’s warrantless search was
justified by the private search exception to the Fourth
Amendment’s warrant requirement. The panel wrote that
both as to the information the government obtained and the
additional privacy interests implicated, the government’s
actions here exceed the limits of the private search exception
as delineated in Walter and Jacobsen and their progeny.
First, the government search exceeded the scope of the
antecedent private search because it allowed the government
to learn new, critical information that it used first to obtain a
warrant and then to prosecute the defendant. Second, the
government search also expanded the scope of the
antecedent private search because the government agent
viewed the defendant’s email attachments even though no
Google employee—or other person—had done so, thereby
exceeding any earlier privacy intrusion. Moreover, on the
limited evidentiary record, the government has not
established that what a Google employee previously viewed
were exact duplicates of the defendant’s images. And, even
if they were duplicates, such viewing of others’ digital
communications would not have violated the defendant’s
expectation of privacy in his images, as Fourth Amendment
4               UNITED STATES V. WILSON

rights are personal. The panel concluded that the officer
therefore violated the defendant’s Fourth Amendment right
to be free from unreasonable searches when he examined the
defendant’s email attachments without a warrant.


                       COUNSEL

Devin Burstein (argued), Warren & Burstein, San Diego,
California, for Defendant-Appellant.

Peter Ko (argued), Assistant United States Attorney; Helen
H. Hong, Chief, Appellate Section, Criminal Division;
Robert S. Brewer, Jr., United States Attorney; United States
Attorney’s Office, San Diego, California; for Plaintiff-
Appellee.

Jennifer Lynch and Andrew Crocker, Electronic Frontier
Foundation, San Francisco, California; Jennifer Stisa
Granick, American Civil Liberties Union Foundation, San
Francisco, California; Brett Max Kaufman and Nathan Freed
Wessler, American Civil Liberties Union Foundation, New
York, New York; for Amici Curiae Electronic Frontier
Foundation and American Civil Liberties Union Foundation.

Marc Rotenberg, Alan Butler, and Megan Iorio, Electronic
Privacy Information Center, Washington, D.C., for Amicus
Curiae Electronic Privacy Information Center (EPIC).

Ryan T. Mrazik, Erin K. Earl, and Rachel A.S. Haney,
Perkins Coie LLP, Seattle, Washington, for Amici Curiae
Google LLC and Facebook, Inc.
                 UNITED STATES V. WILSON                    5

                         OPINION

BERZON, Circuit Judge:

    We once again consider the application of the Fourth
Amendment’s warrant requirement to new forms of
communication technology. See, e.g., United States v. Cano,
934 F.3d 1002 (9th Cir. 2019); cf. Carpenter v. United
States, 138 S. Ct. 2206 (2018). “When confronting [such]
concerns wrought by digital technology, th[e] [Supreme]
Court [and this court] ha[ve] been careful not to uncritically
extend existing precedents.” Id. at 2222. Our question this
time concerns the private search exception to the Fourth
Amendment—specifically, the intersection between
electronic communications providers’ control over material
on their own servers and the Fourth Amendment’s restriction
of warrantless searches and seizures, which limits only
governmental action. See Burdeau v. McDowell, 256 U.S.
465 (1921); Walter v. United States, 447 U.S. 649 (1980);
United States v. Jacobsen, 466 U.S. 109 (1984).

    The events giving rise to Luke Wilson’s conviction and
this appeal were triggered when Google, as required by
federal law, reported to the National Center for Missing and
Exploited Children (NCMEC) that Wilson had uploaded
four images of apparent child pornography to his email
account as email attachments. No one at Google had opened
or viewed Wilson’s email attachments; its report was based
on an automated assessment that the images Wilson
uploaded were the same as images other Google employees
had earlier viewed and classified as child pornography.
Someone at NCMEC then, also without opening or viewing
them, sent Wilson’s email attachments to the San Diego
Internet Crimes Against Children Task Force (ICAC), where
an officer ultimately viewed the email attachments without
a warrant. The officer then applied for warrants to search
6                   UNITED STATES V. WILSON

both Wilson’s email account and Wilson’s home, describing
the attachments in detail in the application.

    Our question is whether the government’s warrantless
search of Wilson’s email attachments was justified by the
private search exception to the Fourth Amendment. See
Walter, 447 U.S. at 655–56; Jacobsen, 466 U.S. at 113–14.
For the reasons that follow, we hold that it was not. We
therefore reverse the district court’s denial of Wilson’s
motion to suppress and vacate Wilson’s conviction.

I. Background

    A. Google’s Identification              of    Apparent        Child
       Pornography

    Electronic communication service providers are not
required “affirmatively [to] search, screen, or scan” for
apparent violations on their platforms of federal child
pornography laws. 18 U.S.C. §§ 2258A(f), 2258E. But “[i]n
order to reduce . . . and . . . prevent the online sexual
exploitation of children,” such providers, including Google,
are directed, “as soon as reasonably possible after obtaining
actual knowledge” of “any facts or circumstances from
which there is an apparent violation of . . . child pornography
[statutes],” to “mak[e] a report of such facts or
circumstances” to NCMEC. 18 U.S.C. § 2258A(a). 1
NCMEC then forwards what is known as a CyberTip to the


    1
      “A provider that knowingly and willfully failed to make a report
required . . . shall be fined.” 18 U.S.C. § 2258A(e). Further, in the case
of “intentional, reckless, or other misconduct,” there may be “a civil
claim or criminal charge against a provider . . . arising from the
performance of the reporting or preservation responsibilities.” Id. at
§§ 2258B(a), (b).
                   UNITED STATES V. WILSON                           7

appropriate law enforcement agency for                       possible
investigation. Id. at §§ 2258A(a)(1)(B)(ii), (c).

    According to a two-page declaration from a senior
manager at Google, the company “independently and
voluntarily take[s] steps to monitor and safeguard [its]
platform,” including using a “proprietary hashing
technology” to identify apparent child pornography. 2

    As described in the record—vaguely, and with the gaps
noted—the process works as follows:

   First, a team of Google employees are “trained by
counsel on the federal statutory definition of child
pornography and how to recognize it.” Neither the training
materials themselves nor a description of their contents
appear in or are attached to the Google manager’s
declaration.

    Second, these employees “visually confirm[]” an image
“to be apparent child pornography.” According to an
industry classification standard created by various electronic
service providers, there are four industry categorizations:
“A1” for a sex act involving a prepubescent minor; “A2” for
a lascivious exhibition involving a prepubescent minor;
“B1” for a sex act involving a pubescent minor; and “B2”
for a lascivious exhibition involving a pubescent minor.

    Third, “[e]ach offending image” judged to be “apparent
child pornography as defined in 18 USC § 2256” is given a
hash value, which is “added to [the] repository of hashes.”

    2
      “A hash value is (usually) a short string of characters generated
from a much larger string of data (say, an electronic image) using an
algorithm.” United States v. Ackerman, 831 F.3d 1292, 1294 (10th Cir.
2016).
8               UNITED STATES V. WILSON

As far as the record shows, Google “stores only the hash
values” of images identified as apparent child pornography,
not the actual images. The government does not represent
otherwise.

    Finally, Google “[c]ompare[s] these hashes to hashes of
content uploaded to [their] services.” The exact manner in
which hash values are assigned to either the original
photographs or the ones deemed to replicate them is not
described in the Google manager’s declaration or anywhere
else in the record.

    B. Government Search

    On June 4, 2015, Google, using its propriety technology,
“became aware” that Wilson had attached to emails in his
email account—which may or may not have been sent—four
files that included apparent child pornography. United States
v. Wilson, No. 3:15-cr-02838-GPC, 2017 WL 2733879, at
*3 (S.D. Cal. June 26, 2017). In compliance with its
reporting obligations, Google automatically generated and
sent an electronic CyberTipline report to NCMEC. The
CyberTipline report included Wilson’s four email
attachments. According to the Google manager’s
declaration, “a Google employee did not view the images . . .
concurrently to submitting the report to NCMEC.” The
CyberTipline report did specify that Google had classified
each of Wilson’s four email attachments as “A1” under an
industry classification standard for “content [which]
contain[s] a depiction of a prepubescent minor engaged in a
sexual act.”

   Google’s report included Wilson’s email address,
secondary email address, and IP addresses. NCMEC
supplemented Google’s report with geolocation information
                    UNITED STATES V. WILSON                             9

associated with Wilson’s IP addresses, but did “not open[]
or view[] any uploaded files submitted with this report.”

    NCMEC then forwarded the CyberTip to the San Diego
Internet Crimes Against Children Task Force (“ICAC”).
Agent Thompson, a member of the San Diego ICAC,
received the report. He followed San Diego ICAC
procedure, which at the time called for inspecting the images
without a warrant whether or not a Google employee had
reviewed them. 3

    After Agent Thompson looked at Wilson’s four email
attachments, he applied for a search warrant of Wilson’s
email account. His affidavit asserted that probable cause for
the warrant was based on two facts: first, that “Google
became aware of four (4) image files depicting suspected
child pornography;” and second, that he had “reviewed the
four (4) images reported by Google to NCMEC and
determined they depict child pornography.” In support of his
own child pornography assessment, he included in the
warrant application detailed “descriptions of each of these
images.” The affidavit did not include the fact that Google
had originally classified the images as “A1” or provide any
detail about how Google had either classified or later
automatically identified Wilson’s images as apparent child
pornography.

   On the basis of the application and affidavit submitted
by Agent Thompson, a magistrate judge issued a search


    3
      Agent Thompson testified that San Diego ICAC, which includes
both local, county, regional, and federal agencies, now obtains a search
warrant before opening a CyberTip when the provider has not viewed
the images. It is not clear from the record whether other ICAC task forces
across the country have adopted the same policy.
10              UNITED STATES V. WILSON

warrant for Wilson’s email account. When Agent Thompson
executed the warrant, he discovered numerous email
exchanges in which Wilson received and sent images and
video files of alleged child pornography and in which
Wilson offered to pay for the creation of child pornography.

    Agent Thompson then obtained a search warrant for
Wilson’s residence. On executing the warrant, law
enforcement officers found and seized several electronic
devices that contained evidence of child pornography. One
officer observed a backpack being tossed over Wilson’s
balcony at the time officers were knocking on Wilson’s door
and announcing their presence. Wilson’s checkbook and a
thumb drive containing thousands of images of child
pornography—including the four images reported by
Google—were found in the backpack.

     C. Motion to Suppress

    Wilson filed a motion to suppress all evidence seized
from his email account and residence, arguing that Agent
Thompson’s review of his email attachments without a
warrant was impermissible under the Fourth Amendment.
Relying principally on Jacobsen, 466 U.S. 109, and United
States v. Tosti, 733 F.3d 816 (9th Cir. 2013), the government
maintained in response that Agent Thompson’s review of the
four images did not exceed the scope of Google’s private
search and so, under the private search doctrine as
enunciated in Jacobsen and Tosti, was valid without a
warrant.

    The district court agreed. The court denied Wilson’s
motion to suppress on the ground that the government’s
warrantless search did not exceed the scope of the antecedent
private search and so did not require a warrant. The district
court also concluded that “if [Agent] Thompson’s
                     UNITED STATES V. WILSON                            11

warrantless viewing of the four images constituted an illegal
search, neither excising the tainted evidence from the
affidavit nor the good faith exception would prevent
operation of the exclusionary rule.” 4 Wilson, 2017 WL
2733879, at *12–13.

   After waiving his right to a jury trial, Wilson was
convicted of possession and distribution of child
pornography 5 and sentenced to 11 years of incarceration and


    4
        The government does not contest these contingent rulings.
      5
        While this appeal was pending, the California Court of Appeal held
that “the government’s warrantless search of Wilson’s four images was
permissible under the private search doctrine.” People v. Wilson, 56 Cal.
App. 5th 128, 147 (2020), as modified on denial of reh’g (Nov. 6, 2020),
review denied (Jan. 20, 2021). We have not squarely addressed the
preclusive effect of the denial of a suppression motion in an earlier state-
court proceeding. Other circuits, however, have held that “the
government may not collaterally estop a criminal defendant from
relitigating an issue against the defendant in a different court in a prior
proceeding.” United States v. Harnage, 976 F.2d 633, 636 (11th Cir.
1992); accord United States v. Pelullo, 14 F.3d 881, 896 (3d Cir. 1994);
United States v. Gallardo-Mendez, 150 F.3d 1240, 1244 (10th Cir.
1998). Citing those cases, we came to the similar conclusion that, in
criminal trials, the government “may not use collateral estoppel to
establish, as a matter of law, an element of an offense or to conclusively
rebut an affirmative defense on which the Government bears the burden
of proof beyond a reasonable doubt.” United States v. Smith-Baltiher,
424 F.3d 913, 920 (9th Cir. 2005) (quoting United States v. Arnett,
353 F.3d 765, 766 (9th Cir. 2003) (en banc) (per curiam)).

     We need not definitively resolve the preclusion question as it relates
to a motion to suppress, here, as the government has not asserted
collateral estoppel, so the argument is waived. Harbeson v. Parke Davis,
Inc., 746 F.2d 517, 520 (9th Cir. 1984) (“The United States was unaware
that Mr. Wilson had raised the same issue in his state appeal until the
letter filed in this case by [defense counsel] on October 16, 2020.”).
12                  UNITED STATES V. WILSON

10 years of supervised release for each count, to run
concurrently. 6

II. Discussion

    The government does not dispute for purposes of this
case Wilson’s assertion that Agent Thompson’s review of
his email attachments was a search within the meaning of the
Fourth Amendment. We proceed on that assumption as
well—that is, we assume that Wilson had a subjective
expectation of privacy in his email attachments that society
is prepared to recognize as reasonable, see Kyllo v. United
States, 533 U.S. 27, 33 (2001) (citing Katz v. United States,
389 U.S. 347, 361 (1967) (Harlan, J., concurring)); see also
United States v. Miller, 982 F.3d 412, 427 (6th Cir. 2020)
(taking the same approach); cf. United States v. Ackerman,
831 F.3d 1292, 1308 (10th Cir. 2016) (holding that when the
government views email attachments it is a “search” for
Fourth Amendment purposes under both an expectation-of-
privacy and a trespass-to-chattels theory). 7 Our question,
then, is whether Agent Thompson was permitted to look at
Wilson’s email attachments under the private search


     6
      Wilson maintains that the district court did not obtain a valid
waiver of his right to a jury trial, as required by Fed. R. Crim. P. 23(a).
Because we vacate Wilson’s conviction and reverse the district court’s
denial of Wilson’s motion to suppress, we do not reach this issue.
     7
      Because we hold that the government’s warrantless search violated
Wilson’s privacy-based Fourth Amendment rights, we do not consider
Wilson’s alternative argument that the government’s search violated his
property-based Fourth Amendment rights. See Carpenter v. United
States, 138 S. Ct. 2206, 2269 (2018) (Gorsuch, J. dissenting) (“[F]ew
doubt that e-mail should be treated much like the traditional mail it has
largely supplanted—as a bailment in which the owner retains a vital and
protected legal interest.”).
                UNITED STATES V. WILSON                   13

exception, such that the Fourth Amendment did not require
him to procure a warrant.

    We review the district court’s denial of Wilson’s motion
to suppress de novo and the district court’s underlying
factual findings for clear error. See United States v. Camou,
773 F.3d 932, 937 (9th Cir. 2014); see also United States v.
Mulder, 808 F.2d 1346, 1348 (9th Cir. 1987).

   A. Private Search Exception

    As the Fourth Amendment protects individuals from
government actors, not private ones, see Burdeau v.
McDowell, 256 U.S. 465 (1921), a private party may conduct
a search that would be unconstitutional if conducted by the
government. The private search doctrine concerns
circumstances in which a private party’s intrusions would
have constituted a search had the government conducted it
and the material discovered by the private party then comes
into the government’s possession. Invoking the precept that
when private parties provide evidence to the government “on
[their] own accord[,] … it [i]s not incumbent on the police
to . . . avert their eyes,” Coolidge v. New Hampshire,
403 U.S. 443, 489 (1971), the Supreme Court formalized the
private search doctrine in a pair of decisions about four
decades ago: Walter v. United States, 447 U.S. 649 (1980),
which produced no majority decision, and United States v.
Jacobsen, 466 U.S. 109 (1984), which did.

       1. Doctrinal Foundations

    Beginning from the initial articulation of the private
search doctrine, the extent to which it excuses the
government from compliance with the warrant requirement
of the Fourth Amendment has been the subject of concern.
The exception has, for example, been described as
14               UNITED STATES V. WILSON

“unsettling” for its potential reach. 1 Wayne R. LaFave,
Search and Seizure: A Treatise on the Fourth Amendment
§1.8(b) (6th ed. 2020); see also Jacobsen, 466 U.S. at 129–
34 (White, J., concurring in part and concurring in
judgment). On examination, however, the history of the
exception confirms that it is, in truth, a narrow doctrine with
limited applications.

    Beginning with Burdeau, the Supreme Court has
distinguished between government agents and private
parties for purposes of the Fourth Amendment. Burdeau
considered whether the Fourth Amendment restricts the
government’s ability to use papers incriminating an
individual when those papers were volunteered to the
government by a private party who had stolen them. Burdeau
disregarded the private theft, noting that although “[t]he
Fourth Amendment gives protection against unlawful
searches and seizures, . . . its protection applies to
governmental action.” 256 U.S. at 475.

    Coolidge, decided 50 years after Burdeau, addressed
whether a private party who provides the government with
another person’s contraband or evidentiary material can be
considered an agent of the government for purposes of the
Fourth Amendment. In that case, local police officers arrived
at a suspect’s home, questioned his wife about his
involvement in a murder, and obtained from his wife a rifle
and articles of clothing belonging to the suspect. Coolidge,
403 U.S. at 446, 486. The opinion does not explain whether
the suspect’s wife had proper possession of the items. The
Court stated only that, had the suspect’s wife, “wholly on her
own initiative, sought out her husband’s guns and clothing
and then taken them to the police station to be used as
evidence against him, there can be no doubt under [Burdeau]
that the articles would later have been admissible in
                UNITED STATES V. WILSON                   15

evidence.” Id. at 487. The relevant inquiry, according to the
Court, was whether the suspect’s wife, “in light of all the
circumstances of the case, must be regarded as having acted
as an instrument or agent of the state when she produced her
husband’s belongings.” Id. (internal quotation marks
omitted). As the record showed that the suspect’s wife had
shared the suspect’s guns and clothes with the local police
“of her own accord,” Coolidge held that “it was not
incumbent on the police to stop her or avert their eyes” when
offered the critical evidence. Id. at 489.

       2. Doctrinal Scope

    Following Burdeau and Coolidge, both Walter and
Jacobsen considered a warrantless government search after
a private party “freely made available” certain information
for the government’s inspection. Jacobsen, 466 U.S. at 119–
20 (citing Coolidge, 403 U.S. at 487–90). Together, the cases
determined that an antecedent private search excuses the
government from obtaining a warrant to repeat the search but
only when the government search does not exceed the scope
of the private one. That is, “[t]he additional invasions of
respondents’ privacy by the government agent must be tested
by the degree to which they exceeded the scope of the private
search.” Id. at 115.

    In Walter, a package of obscene films was mistakenly
delivered to the wrong recipient. 447 U.S. at 651. The
recipient opened the external packaging and examined the
boxes containing individual films. Id. at 651–52. Each box
displayed “suggestive drawings” on one side and “explicit
descriptions of the contents” of the film on the other. Id.
at 652. After reading these descriptions, and “attempt[ing]
without success to view portions of the film by holding it up
to the light,” the recipient notified the FBI about the
mistaken delivery. Id. The FBI then seized the boxes and
16               UNITED STATES V. WILSON

screened one of the films without first obtaining a warrant.
Id.

    Walter did not result in a majority opinion, but a majority
of the justices concluded that there had been a violation of
the Fourth Amendment, and a different majority of justices
agreed on the standard to be applied.

    Justice Stevens, joined by Justice Stewart, announced the
judgment of the Court. Their opinion concluded that the
government search exceeded the scope of the antecedent
actions by the private individuals in two respects. First, the
government agents had screened the film for the purpose of
learning information necessary to determine that a crime had
been committed:

       It is perfectly obvious that the agents’ reason
       for viewing the films was to determine
       whether their owner was guilty of a federal
       offense. To be sure, the labels on the film
       boxes gave them probable cause to believe
       that the films were obscene and that their
       shipment in interstate commerce had
       offended the federal criminal code. . . . [But]
       a search of the contents of the films . . . was
       necessary in order to obtain the evidence
       which was to be used at trial.

Id. at 654. Second, the government agents had gone beyond
the physical bounds of the private search, because “the
private party had not actually viewed the films.” Id. at 657.
“The private search [thus] merely frustrated [the]
expectation [of privacy] in part,” not in full. Id. at 659. “It
                    UNITED STATES V. WILSON                          17

did not simply strip the remaining unfrustrated portion of
that expectation of all Fourth Amendment protection.” Id. 8

    The four justices in dissent would have concluded that
there was no Fourth Amendment violation. The dissenters
disputed not the basic approach of Justice Stevens’ opinion
but its application to the facts of the case. Specifically, the
dissent stressed that “[t]he containers . . . clearly revealed the
nature of their contents,” such that the private employees “so
fully ascertained the nature of the films . . . [that] the FBI’s
subsequent viewing of the movies . . . was not an additional
search subject to the warrant requirement.” Id. at 663–64
(Blackmun, J., dissenting, joined by Burger, C.J., and Powell
and Rehnquist, JJ.).

    Four years after Walter, the Supreme Court again applied
the private search doctrine. Importantly, Jacobsen
recognized “the agreement [in Walter] on the standard to be
applied in evaluating the relationship between the two
searches.” 466 U.S. at 117 n.12.

   Jacobsen concerned a government search of a Federal
Express (“FedEx”) package that had been partially opened
by FedEx employees. See 466 U.S. at 111. While examining
a damaged package, the FedEx employees “opened the

     8
       Justice Marshall concurred only in the judgment. Justice White,
joined by Justice Brennan, concurred, noting that “the packages already
had been opened, and the Government saw no more than what was
exposed to plain view.” Walter, 447 U.S. at 661 (White, J., concurring
in part and concurring in judgment). Although Justice Stevens
emphasized that the private parties had not screened the film, see id. at
657 & n.9, the concurring justices would have found a Fourth
Amendment violation even if the private parties had done so, as “a
private screening of the films would not have destroyed petitioners’
privacy interest in them.” Id. at 662.
18               UNITED STATES V. WILSON

package,” “cut open the tube” within the package, and
“found a series of four zip-lock plastic bags, the outermost
enclosing the other three and the innermost containing about
six and a half ounces of white powder.” Id. The employees
“observed . . . white powder in the innermost plastic bag,”
but did not open the (presumably transparent) bag. Id.
Instead, they called the Drug Enforcement Administration
(DEA), put the plastic bags back in the tube, and placed the
tube back in the box. Id.

    When DEA agents arrived, they did two things: First, to
visually inspect the contents of the plastic bags, DEA agents
removed the tube from the box and the plastic bags from the
tube. See id. Second, federal agents “opened each of the four
bags and removed a trace of the white substance with a knife
blade.” Id. at 111–12. They performed a field test to
determine whether the powder in the plastic bags was
cocaine. See id.

    Jacobsen considered whether the private search
exception as adopted by a majority of justices in Walter
applied to the facts at hand. In doing so, Jacobsen, like
Justice Stevens’ opinion in Walter, looked at both the degree
to which the government’s actions led to observing new
information not uncovered by the private search and the
extent to which the government’s investigation intruded on
the package owner’s privacy interests to a greater degree
than had the private party’s actions. As to the first parameter,
the information gleaned by the government, Jacobsen
permitted the government agent to “reexamine”—that is,
examine in the same manner—the package previously
examined by FedEx, the private party. The government
“could utilize the [private] employees’ testimony concerning
the contents of the package,” noted Jacobsen; “[p]rotecting
the risk of misdescription . . . is not protected by the Fourth
                UNITED STATES V. WILSON                   19

Amendment.” 466 U.S. at 119. As to the second parameter,
the additional impairment of privacy interests, Jacobsen
emphasized that the private search exception turns on parity
with the impact of the private search: “[O]nce frustration of
the original expectation of privacy occurs, the Fourth
Amendment does not prohibit governmental use of the now-
nonprivate information.” Id. at 117.

    Applying these precepts, Jacobsen concluded that the
“removal of the plastic bags from the tube and the
[government] agent’s visual inspection of their contents” did
not exceed the scope of the private search as to the
information obtained. Id. at 120. “[T]he agent[s] . . .
learn[ed] nothing [from those actions] that had not
previously been learned during the private search” and
conveyed to the federal agents by the FedEx employees. Id.
And as to the privacy interests, the governmental search to
that point “infringed no legitimate expectation of privacy
and hence was not a ‘search’ within the meaning of the
Fourth Amendment,” id., as “[t]he package itself, which had
previously been opened, remained unsealed, and the Federal
Express employees had invited the agents to examine its
contents,” such that “the package could no longer support
any expectation of privacy,” id. at 121.

    Jacobsen then separately considered the chemical field
test, conducted by the DEA agents, including the federal
agents’ removal of the white powder from the plastic bag.
Critically for our purposes, Jacobsen began this inquiry from
the premise that because the field test “had not been
conducted by the Federal Express agents,” it “therefore
exceeded the scope of the private search.” Id. at 122
(emphasis added). The majority then determined that the
government’s chemical field test of the substance in the
properly seized plastic bags was nonetheless not a search
20                 UNITED STATES V. WILSON

within the meaning of the Fourth Amendment, because
“governmental conduct that can reveal whether a substance
is cocaine, and no other arguably ‘private’ fact, compromises
no legitimate privacy interest.” Id. at 122–23. This
conclusion, Jacobsen explained, was “dictated” by the
Court’s earlier decision in United States v. Place, 462 U.S.
696 (1983), “in which the Court held that subjecting luggage
to a ‘sniff test’ by a trained narcotics detection dog was not
a ‘search’ within the meaning of the Fourth Amendment.”
Jacobsen, 466 U.S. at 123.

     B. Application of the Private Search Exception to
        This Case

    The government bears the burden to prove Agent
Thompson’s warrantless search was justified by the private
search exception to the Fourth Amendment’s warrant
requirement. Before considering the private search
exception, Coolidge emphasized “the most basic
constitutional rule” in the Fourth Amendment arena:
warrantless searches are per se unreasonable, subject to few
exceptions that are “jealously and carefully drawn.”
403 U.S. at 454–55. Accordingly, “[t]he burden is on those
seeking the exemption.” Id. at 455 (quoting United States v.
Jeffers, 342 U.S. 48, 51 (1951)). The government has not
met its burden here.

    Both as to the information the government obtained and
the additional privacy interests implicated, the government’s
actions here exceed the limits of the private search exception
as delineated in Walter and Jacobsen and their progeny. 9

     Wilson opines that the private search exception to the Fourth
     9

Amendment should be overruled, and seeks to preserve that question for
any Supreme Court review of this case. As a court of appeals, we of
                    UNITED STATES V. WILSON                            21

First, the government search exceeded the scope of the
antecedent private search because it allowed the government
to learn new, critical information that it used first to obtain a
warrant and then to prosecute Wilson. Second, the
government search also expanded the scope of the
antecedent private search because the government agent
viewed Wilson’s email attachments even though no Google
employee—or other person—had done so, thereby


course cannot overrule Supreme Court cases. United States v. Weiland,
420 F.3d 1062, 1079 n.16 (9th Cir. 2005) (“[W]e are bound to follow a
controlling Supreme Court precedent until it is explicitly overruled by
that Court.”); accord Nunez-Reyes v. Holder, 646 F.3d 684, 692 (9th Cir.
2011). We do note that the private search doctrine rests directly on the
same precepts concerning the equivalence of private intrusions by
private parties and the government that underlie the so-called third-party
doctrine. See e.g., Smith v. Maryland, 442 U.S. 735, 744 (1979) (holding
that by “voluntarily” conveying to his telephone company the phone
numbers he dialed, the defendant forsook his reasonable expectation of
privacy in that information); United States v. Miller, 425 U.S. 435, 442
(1976) (holding the defendant lacked a reasonable expectation of privacy
in “information [he had] voluntarily conveyed to [his] bank[]” like
financial statements and deposit slips). In Jacobsen, the Supreme Court
reasoned that the private search exception follows from the premise,
underlying the third-party doctrine, that “when an individual reveals
private information to another, he assumes the risk that his confidant will
reveal that information to the authorities.” 466 U.S. at 117. In recent
years, however, the Court has refused to “mechanically apply[] the third-
party doctrine,” stressing that “the fact of ‘diminished privacy interests
does not mean that the Fourth Amendment falls out of the picture
entirely.’” Carpenter, 138 S. Ct. at 2219 (quoting Riley, 573 U.S. at 392);
see United States v. Jones, 565 U.S. 400, 417 (2012) (Sotomayor, J.,
concurring) (explaining that the third-party doctrine “is ill suited to the
digital age, in which people reveal a great deal of information about
themselves to third parties in the course of carrying out mundane tasks”);
Susan Freiwald & Stephen Wm. Smith, The Carpenter Chronicle: A
Near-Perfect Surveillance, 132 Harv. L. Rev. 205, 224 (2018) (noting
that Carpenter “significantly narrowed the [third-party] doctrine’s
scope”).
22              UNITED STATES V. WILSON

exceeding any earlier privacy intrusion. Moreover, on the
limited evidentiary record, the government has not
established that what a Google employee previously viewed
were exact duplicates of Wilson’s images. And, even if they
were duplicates, such viewing of others’ digital
communications would not have violated Wilson’s
expectation of privacy in his images, as Fourth Amendment
rights are personal.

       1. Additional Information

    The district court analogized Agent Thompson’s review
of Wilson’s email attachments to the government search in
Jacobsen, concluding that Agent Thompson’s search
allowed him to “learn nothing new,” because Google had
already classified the images as child pornography. Wilson,
2017 WL 2733879, at *10–11. The government similarly
argues on appeal that its official search did not
impermissibly expand the scope of the private search
because it “just confirmed what Google employees already
knew and could say.” Both the district court’s conclusion
and the governments’ argument misstate the record.

    The record indicates that Google does not keep a
repository of child pornography images, so no Google
employee could have shown the government the images it
believed to match Wilson’s. Nor does the record identify the
individual who viewed those images in the repository, so no
identified Google employee “knew and could say” what
those images showed. Instead, Google keeps a repository of
unique hash values corresponding to illicit images, and tags
each image with one of four generic labels. All Google
communicated to NCMEC in its CyberTip was that the four
images Wilson uploaded to his email account matched
images previously identified by some Google employee at
some time in the past as child pornography and classified as
                  UNITED STATES V. WILSON                         23

depicting a sex act involving a prepubescent minor (the “A1”
classification). 10 Based only on the barebones CyberTip,
Agent Thompson testified, he opened and reviewed each of
Wilson’s images to determine “whether or not it is a case
that . . . can be investigated” for violations of federal law.

    A detailed description of the images was then included
in the applications for search warrants. The gulf between
what Agent Thompson knew about Wilson’s images from
the CyberTip and what he subsequently learned is apparent
from those descriptions. In contrast to Google’s label of the
images just as “A1,” which the government did not mention
in the warrant application, the government learned the
following:

         1. 140005125216.jpg – This image depicts a
         young nude girl, approximately five (5) to
         nine (9) years of age, who is lying on her
         stomach with her face in the nude genital
         region of an older female who is seated with
         her legs spread. A second young girl,
         approximately five (5) to nine (9) years of
         age, is also visible in this image and she is
         partially nude with her vagina exposed.
         Google identified this image was uploaded
         on June 4, 2015, at 16:11:04 UTC.

         2. 140005183260.jpg – This image depicts a
         young nude girl, approximately five (5) to
         nine (9) years of age, who is lying on top of

    10
       Perhaps a Google employee could also have testified to details
about the company’s proprietary technology. But no such information
appears in the record, and the CyberTip did not convey any more
information than what is now included in the record.
24              UNITED STATES V. WILSON

       an older nude female, approximately
       eighteen years of age. Within this image the
       girl’s genital regions are pressed against one
       another and the older girl appears to be
       touching the face of the younger child with
       her tongue. Google identified this image was
       uploaded on June 4, 2015, at 16:11:21 UTC.

       3. 140005129034.jpg – This image depicts a
       partially nude young girl, approximately five
       (5) to nine (9) years of age, who is lying on
       her back with her legs spread and her vagina
       exposed. An older female is positioned in
       front of this girl’s exposed vagina in this
       image and the younger girl has her left hand
       on the vaginal/buttocks area of a second nude
       girl of similar age. Google identified this
       image was uploaded on June 4, 2015, at
       16:11:06 UTC.

       4. 1400052000787.jpg – This image depicts
       a wider angle view of the previously
       referenced images possessing file names
       140005125216.jpg and 140005129034.jpg as
       reported by Google.

Wilson, 2017 WL 2733879, at *4–5.

    Given the large gap between the information in the
CyberTip and the information the government obtained and
used to support the warrant application and to prosecute
Wilson, the government search in Walter offers a much more
apt comparison to the circumstances here than does the
government search in Jacobsen. Google’s categorization of
Wilson’s email attachments as “A1” functioned as a label for
                 UNITED STATES V. WILSON                    25

the images in the same way that the boxes describing the
films in Walter suggested that the images on the films were
obscene. The “A1” labels, in fact, provided less information
about the images’ contents than did the boxes in Walter,
which had “explicit descriptions of the contents” of the film.
447 U.S. at 652. The “A1” labels, in contrast, specified only
the general age of the child and the general nature of the acts
shown.

    Viewing Wilson’s email attachments—like viewing the
movie in Walter—substantively expanded the information
available to law enforcement far beyond what the label alone
conveyed, and was used to provide probable cause to search
further and to prosecute. The government learned at least
two things above and beyond the information conveyed by
the CyberTip by viewing Wilson’s images: First, Agent
Thompson learned exactly what the image showed. Second,
Agent Thompson learned the image was in fact child
pornography. Until he viewed the images, they were at most
“suspected” child pornography. Just as it “was clearly
necessary for the FBI to screen the films [in Walter], which
the private party had not done, in order to obtain the evidence
needed to accomplish its law enforcement objectives,”
Walter, 447 U.S. at 659 n.14 (plurality), so here, to prosecute
Wilson it was necessary for Agent Thompson to view the
images no Google employee had opened. Id. Until Agent
Thompson viewed Wilson’s images, no one involved in
enforcing the child pornography ban had seen them. Only by
viewing the images did the government confirm, and convey
to the fact finder in Wilson’s criminal case, that they
depicted child pornography under the applicable federal
standard.

    Importantly, the district court found—and we agree—
that if Agent Thompson’s affidavit in support of a warrant
26                 UNITED STATES V. WILSON

had been “excise[d]” of “the tainted evidence,” “the affidavit
would not support issuance of the search warrant for
Defendant’s email account.” Wilson, 2017 WL 2733879,
at *12. 11 The district court’s findings about the inadequacy
of the warrant application without the important information
Agent Thompson obtained by viewing Wilson’s images
demonstrate that the government learned new, critical
information by viewing Wilson’s images, information “not
previously . . . learned during the private search,” Jacobsen,
466 U.S. at 120. Because the government saw more from its
search than the private party had seen, it exceeded the scope
of the private search.

          2. Additional Intrusion on Wilson’s Privacy
             Interest

    The government also maintains that directly viewing
Wilson’s images for the first time was not a further invasion
of Wilson’s privacy, beyond any privacy invasion by
Google. The government’s expectation of privacy analysis
fails for much the same reason as did its argument that it
learned nothing new by viewing the images.

    The government’s central submission in this regard is
that Wilson’s expectation of privacy in his images was fully
frustrated when Google’s computer technology scanned
them, such that any further government search of the images




      We also agree with the district court that the government might
     11

have been able to demonstrate probable cause sufficient to obtain a
warrant without the descriptions of Wilson’s images, by presenting, for
example, more “information about Google’s screening process for child
pornography,” Wilson, 2017 WL 2733879, at *12.
                   UNITED STATES V. WILSON                          27

should be exempt from the Fourth Amendment’s warrant
requirement. 12 We cannot agree.

     Although Google’s proprietary technology labelled
Wilson’s email attachments as “A1,” “the content of the
[images] . . . was [no more] apparent” to Google than the
image content was to the private party in Walter, as no
Google employee had opened and viewed the attachments,
and Google does not appear to retain any record of the
original images used to generate hash matches. See Tosti,
733 F.3d at 823. Agent Thompson did not obtain a specific
description of the content of Wilson’s attachments from
Google, so he was not simply confirming what he had been
told. Until he viewed the images, he had no image at hand at
all; the entire composition was hidden. Only the image itself
could reveal, for example, the number of minors depicted,
their identity, the number of adults depicted alongside the
minors, the setting, and the actual sexual acts depicted.
Reading a label affixed to an image is a different experience
entirely from looking at the image itself. To read even a
detailed description, which this A1 classification was not, is
still not to see. Wilson’s privacy interest was in the actual
image—which could have included features in addition to
child pornography—not just in its classification as child
pornography.

   The government’s argument to the contrary
mischaracterizes the record, by representing that Google’s
scan “equates to a full-color, high-definition view” of
Wilson’s images. It does not. The critical fact is that no
Google employee viewed Wilson’s files before Agent

    12
       The government stated at oral argument that it is not relying on
the contraband nature of child pornography as a justification for the
search.
28               UNITED STATES V. WILSON

Thompson did. When the government views anything other
than the specific materials that a private party saw during the
course of a private search, the government search exceeds
the scope of the private search. That is the clear holding of
Jacobsen. In that case, “[t]he field test . . . had not been
conducted by the Federal Express agents and therefore
exceeded the scope of the private search.” 466 U.S. at 122
(emphasis added); see supra Part II.B.1.

       3. Personal Nature of the Fourth Amendment

    The government attempts to save its warrantless search
by shifting the analysis from the private search of Wilson’s
files, flagged by Google and classified as A1 by its
proprietary technology, to the private search of other
individuals’ files, which some Google employee previously
viewed and classified as child pornography in Google’s
database of hash values. The government argues that Agent
Thompson’s search did not exceed the bounds of the private
search because a Google employee had previously viewed
different child pornography files, and Google’s computers
flagged Wilson’s email attachments as containing the same
images as those files, using an unspecified hash value
comparison system. This line of argument cannot save the
validity of the government’s search. Even if Wilson’s email
attachments were precise duplicates of different files a
Google employee had earlier reviewed and categorized as
child pornography, both Walter and Jacobsen—and general
Fourth Amendment principles—instruct that we must
specifically focus on the extent of Google’s private search of
Wilson’s effects, not of other individuals’ belongings, to
assess whether “the additional invasions of [Wilson’s]
privacy by the government agent . . . exceeded the scope of
the private search.” Jacobsen, 466 U.S. at 115.
                 UNITED STATES V. WILSON                    29

    To see why, consider whether Walter would have come
out differently had the misdirected package come into the
hands of someone who had previously viewed another copy
of the same film and, recognizing the box, told the police
that the film in it was, in her view, legally obscene. Under
Walter, the government in the hypothesized circumstance
would still need a warrant to view the film in the box.
Viewing the copy of the film actually in the box, which the
mistaken recipient of the box had not done, would still entail
an additional governmental intrusion on both the physical
integrity of the film and the owner’s privacy interest in its
content.

     Fourth Amendment rights are personal rights. Rakas v.
Illinois, 439 U.S. 128 (1978), is illustrative: Rakas held that
a passenger could not challenge a police search as violative
of the Fourth Amendment because he owned neither the
vehicle that was searched nor the rifle found. Although the
owners of each item had an expectation of privacy, the
defendant did not. See id. at 134.

    So Wilson did not have an expectation of privacy in
other individuals’ files, even if their files were identical to
his files. The corollary of this principle must also be true:
Wilson did have an expectation of privacy in his files, even
if others had identical files. If, for example, police officers
search someone else’s house and find documents evidencing
wrongdoing along with notes indicating that I have identical
documents in my house, they cannot, without a warrant or
some distinct exception to the warrant requirement, seize my
copies. I would retain a personal expectation of privacy in
them, and in my connection to them, even if law enforcement
had a strong basis for anticipating what my copies would
contain. A violation of a third party’s privacy has no bearing
30               UNITED STATES V. WILSON

on my reasonable expectation of privacy in my own
documents. The government does not argue otherwise.

    In short, whether Google had previously reviewed, at
some earlier time, other individuals’ files is not pertinent to
whether a private search eroded Wilson’s expectation of
privacy. Under the private search doctrine, the Fourth
Amendment remains implicated “if the authorities use
information with respect to which the expectation of privacy
has not already been frustrated.” Jacobsen, 466 U.S. at 117
(emphasis added).

     C. Relevant Appellate Caselaw

    (i) Our application of Jacobsen and Walter is consistent
with Ninth Circuit case law. The district court misapplied
United States v. Tosti, 733 F.3d 816 (9th Cir. 2013), in
reaching the contrary conclusion.

    In Tosti, a private party entrusted with the defendant’s
computer found thumbnails of images believed to be child
pornography and alerted law enforcement officers. 733 F.3d
at 818–19. The private party showed the thumbnails to law
enforcement, and the agents “could tell from viewing the
thumbnails that the images contained child pornography.”
Id. at 822.

    Tosti held that law enforcement’s enlarging of the
thumbnails did not expand on the antecedent private search.
For one, based on the standard articulated in Jacobsen, “the
police learned nothing new through their actions.” Tosti,
733 F.3d at 822. Further, “scrolling through the images [the
private party] had already viewed was not a search because
any private interest in those images had been extinguished.”
Id.
                 UNITED STATES V. WILSON                    31

    Neither is true in this case. Here, what was conveyed to
Agent Thompson was that a not-yet-viewed image uploaded
by Wilson matched a different image that an unidentified
Google employee had previously viewed and classified as
child pornography. So until Agent Thompson actually
viewed the images, he knew only that Google’s propriety
technology had identified a match between Wilson’s images
and other images that Google had classified as child
pornography. He “learned . . . [a]new through [his] actions,”
for the first time, what the images actually showed. See
supra pp. 23–24. And, as no one at Google had previously
viewed Wilson’s attachments, “any privacy interest in those
images had [not] been extinguished.” Tosti, 733 F.3d at 822.
Google’s algorithm “frustrated [Wilson’s] [privacy]
expectation in part,” but it “did not . . . strip the remaining
unfrustrated portion of that expectation of all Fourth
Amendment protection.” Walter 447 U.S. at 659 (plurality);
see also Jacobsen, 466 U.S. at 116 n.11.

   For these reasons, Tosti is fully consistent with our
conclusion that Agent Thompson’s search exceeded the
scope of the private search and so required a warrant.

   (ii) In so holding, we contribute to a growing tension in
the circuits about the application of the private search
doctrine to the detection of child pornography.

    In United States v. Ackerman, 831 F.3d 1292, 1294 (10th
Cir. 2016), AOL automatically identified one of the
defendant’s four email attachments as apparent child
pornography, based on a hash value match. AOL then sent
the text of the defendant’s email and all four attachments to
NCMEC, where an analyst “opened the email, viewed each
of the attached images, and confirmed that all four [images]
(not just the one AOL’s automated filed identified) appeared
to be child pornography.” Id. Ackerman emphasized that
32              UNITED STATES V. WILSON

“AOL never opened the email itself. Only NCMEC did
that.” Id. at 1305–06. Then-Judge Gorsuch, after holding that
NCMEC is either a governmental entity or a government
agent, see id. at 1308, concluded that “in at least this way
[the government] exceeded rather than repeated AOL’s
private search,” id. at 1305–06.

    Ackerman did suggest that, had the government viewed
only the attachment AOL identified as a hash value match
and not other attachments and the text of the defendant’s
email, that distinction might “bring the government closer to
a successful invocation of the private search doctrine.” Id.
at 1308 (emphasis added). But Ackerman also noted that in
that circumstance—which appears to be what happened
here—the government’s action may still be a new search, as
the government, “might . . . have risked exposing new and
protected information, maybe because the hash value match
could have proven mistaken . . . or because the AOL
employee who identified the original image as child
pornography was mistaken in his assessment.” Id. at 1306.
Although Ackerman did not decide the precise issue before
us, and expressly disavowed “prejudg[ing]” it, id. at 1308–
09, its underlying analysis is entirely consistent with ours,
and its suggestions about why there could be a search in our
circumstances echo some of the reasons we have given for
so concluding.

    Other private search cases concerning the discovery of
child pornography, outside the context of automated hash
value matching, have also ruled consistently with our
understanding of the limited scope of the private search
exception. For example, in United States v. Lichtenberger,
786 F.3d 478 (6th Cir. 2015), the defendant’s girlfriend had
discovered child pornography on his computer. She later
showed his computer to the police and opened some
                    UNITED STATES V. WILSON                            33

computer files that were determined to contain child
pornography. But the defendant’s girlfriend was “not at all
sure whether she opened the same files with [the police] as
she had opened earlier that day.” Id. at 490. As a result, the
Sixth Circuit concluded that the government search
exceeded the scope of the private search. This reasoning
supports our result here. The record does not identify the
Google analyst who could have stated that the images Agent
Thompson viewed were identical to images the analyst
previously viewed, nor does it explain Google’s algorithm in
any detail. Given these gaps, there is no way to be “at all
sure” that the images Agent Thompson viewed were the
same images a Google analyst had earlier viewed, so the
government search exceeded the scope of Google’s search.

    Further, in United States v. Sparks, 806 F.3d 1323 (11th
Cir. 2015), overruled on other grounds by United States v.
Ross, 963 F.3d 1056 (11th Cir. 2020), a store employee and
her fiancé discovered child pornography on a lost cell phone
and showed the phone to the police. The police officer
ultimately viewed two videos on the cell phone, one of
which the private parties “had not watched.” Id. at 1332.
Because the government search exposed new information,
not seen by the private party, the Eleventh Circuit concluded
that the government search exceeded the scope of the private
search. 13


    13
       Both the Fifth Circuit and the Seventh Circuit have held that an
individual’s privacy interest in a digital container, such as an email
account, cell phone, or laptop, is entirely frustrated whenever any part of
the container is searched. See United States v. Runyan, 275 F.3d 449, 465
(5th Cir. 2001); Rann v. Atchison, 689 F.3d 832 (7th Cir. 2012). But this
approach is squarely contrary to the Ninth Circuit’s approach to digital
devices, has been undermined by more recent Supreme Court cases about
34                  UNITED STATES V. WILSON

    Conversely, the Fifth and Sixth Circuits recently decided
the issue before us and came to a conclusion contrary to the
one we reach, although the reasoning of the two opinions
diverged. The circumstances in both cases were similar to
those here. See United States v. Reddick, 900 F.3d 636 (5th
Cir. 2018); United States v. Miller, 982 F.3d 412, 427 (6th
Cir. 2020). In both cases, after an electronic service provider
flagged certain email attachments as apparent child
pornography, the attachments were forwarded to a local law
enforcement agency, whose officers viewed the images for
the first time without a warrant.

    The Fifth Circuit held the private search exception
justified the government’s warrantless search because the
government agent’s “visual review of the suspect images . . .

the scope of digital information, and is inconsistent with Jacobsen. For
starters, Tosti did not regard the viewing of some files as sufficient for
purposes of the private search doctrine to show that the government only
invaded a defendant’s privacy interests to the same extent as the private
party. See 733 F.3d at 822. More generally, and dispositively, the Ninth
Circuit has not treated digital devices as unitary, such that a permissible
search of one file or attachment justifies a search of a larger swatch of
digital material. See United States v. Cotterman, 709 F.3d 952 (9th Cir.
2013) (en banc); United States v. Cano, 934 F.3d 1002, 1007 (9th Cir.
2019). Further, Runyan and Rann are in tension with recent Supreme
Court cases, which express concern that given the “immense storage
capacity” of modern technology, the Fourth Amendment will be
undermined unless government searches of digital material are
meaningfully confined in accord with established Fourth Amendment
doctrine. Riley v. California, 573 U.S. 373, 393 (2014); see also
Carpenter v. United States, 138 S. Ct. 2206, 2214 (2018). Finally, if, in
Jacobsen, law enforcement officers had opened and searched not only
the specific containers investigated by the FedEx employees but others
included in the same box, the private search doctrine would not have
applied to the still-sealed containers. There is no basis for ruling
otherwise with regard to unopened digital files. Runyan and Rann were
in our view wrongly decided.
                 UNITED STATES V. WILSON                   35

was akin to the government agents’ decision to conduct
chemical tests on the white powder in Jacobsen,” insofar as
“opening the file merely confirmed that the flagged file was
indeed child pornography, as suspected.” Reddick, 900 F.3d
at 639.

    We cannot accept this analysis for several reasons. First,
and most important, Reddick conflates Jacobsen’s first
holding regarding the private search exception to the Fourth
Amendment with its second holding regarding whether the
field test constituted a search under the Fourth Amendment.
The private search exception excuses a warrantless
government search that would otherwise violate the Fourth
Amendment; the field test determination in Jacobsen, based
on Fourth Amendment law outside the private search
context, was that a warrantless government field drug test
simply does not trigger the Fourth Amendment’s
protections. 466 U.S. at 123–24. In other words, the
warrantless chemical test in Jacobsen was not excused via
the private search exception but for an entirely different
reason—that confirming through a field test that an already
exposed and seized contraband substance was a drug is not
a search for Fourth Amendment purposes. Id. at 122.

    Moreover, in Jacobsen, the white powder was fully
visible to the government officers when they repeated the
steps taken by the FedEx employees to inspect the package.
Not so here, as no human had viewed Wilson’s images
before. The part of Jacobsen that does elucidate the private
search doctrine cannot govern here.

   Notably, we have held that the chemical field test
exception to the Fourth Amendment’s warrant requirement
does not apply to a more complete chemical analysis of a
drug. In United States v. Mulder, 808 F.2d 1346 (9th Cir.
1987), a hotel security officer removed items left behind in
36               UNITED STATES V. WILSON

a hotel room after a guest’s scheduled departure, including
plastic bags full of tablets, and provided them to federal
agents. Id. at 1347. The tablets “were tested at the Western
Regional Laboratory through the use of mass spectrometry,
infrared spectroscopy and gas chromatography.” Id. at 1348.
Mulder distinguished between the chemical field test in
Jacobsen and a laboratory test: “[T]he chemical testing in
this case was not a field test which could merely disclose
whether or not the substance was a particular substance, but
was a series of tests designed to reveal the molecular
structure of a substance and indicate precisely what it is.
Because of the greater sophistication of these tests, they
could have revealed an arguably private fact,” and thus
compromised the defendant’s legitimate privacy interest. Id.
at 1348–49.

    To the extent opening an email attachment to view its
contents is analogous to drug testing at all, it is akin to a
laboratory test with the potential to reveal new private
information, as in Mulder, not a binary field test that yields
either a positive or negative result. Just as a laboratory test
of a suspected drug reveals its precise molecular structure
and so potentially exposes additional private information
like other illicit contaminants or the source of the substance,
so viewing an image of suspected child pornography reveals
innumerable granular private details—for example, the faces
of the people depicted, the setting, and, perhaps, other
speech or conduct also in the frame. Viewing the images
here allowed the government to do more than just confirm
the images’ classification as child pornography, implicating
privacy interests beyond a binary classification. Contrary to
Reddick, the government’s “visual review of the suspect
images” was not analogous to “the government agents’
decision to conduct chemical tests on the white powder in
Jacobsen.” 900 F.3d at 639 (emphasis added).
                 UNITED STATES V. WILSON                    37

    The Sixth Circuit recognized the error in Reddick
concerning the reach of the private search holding in
Jacobsen and “opt[ed] not to rely” on it. Miller, 982 F.3d
at 429. As Miller points out, the government agent’s
“inspection (unlike the [field] test) qualifies as the invasion
of a ‘legitimate privacy interest’ unless Google’s actions had
already frustrated the privacy interest in the files.” Id.

     Miller instead resolved the Fourth Amendment question
it faced by focusing exclusively on the assumed reliability of
Google’s proprietary technology. “At bottom,” Miller
explained, “this case turns on the question whether Google’s
hash-value matching is sufficiently reliable.” Id. at 429–30.
Because the defendant in Miller “never challenged the
reliability of hashing,” id. at 430 (internal brackets and
quotation omitted) (Miller thought the burden was on the
defendant, see id. at 430), Miller deferred to the district
court’s finding “that the technology was ‘highly reliable.’”
Id.

    Wilson, by contrast, did challenge the “accuracy and
reliability” of Google’s hashing technology in the district
court. And, contrary to Miller’s assertion, the government
bears the burden to prove its warrantless search was
permissible, see supra p. 20—a burden it failed to carry.

    Our analysis, however, relies only contingently on the
adequacy of the record with regard to the hash match
technology. In our view, the critical factors in the private
search analysis, both unacknowledged in Miller, include the
personal nature of Fourth Amendment rights and the breadth
of essential information Agent Thompson obtained by
opening the attachment, information—and a privacy
invasion—well beyond what Google communicated to
NCMEC. See supra Parts II.B.1, II.B.2. The reliability of
Google’s proprietary technology, in our estimation, is
38              UNITED STATES V. WILSON

pertinent to whether probable cause could be shown to
obtain a warrant, not to whether the private search doctrine
precludes the need for the warrant.

    And, as the district court noted, and we have noted as
well, the warrant application here contained inadequate
information about Google’s proprietary technology to
establish probable cause without reliance on the descriptions
of the actual images. See supra p. 25.

III.   Conclusion

    “When confronting new concerns wrought by digital
technology, this Court has been careful not to uncritically
extend existing precedents.” Carpenter, 138 S. Ct. at 2222.
The government reports there were 18.4 million CyberTips
in 2018, making it all the more important that we take care
that the automated scanning of email, and the automated
reporting of suspected illegal content, not undermine
individuals’ Fourth Amendment protections.

    Having examined this case with the requisite care, we
hold, for the reasons explained, that Agent Thompson
violated Wilson’s Fourth Amendment right to be free from
unreasonable searches when he examined Wilson’s email
attachments without a warrant. Wilson’s conviction is
vacated, the district court’s denial of Wilson’s motion to
                   UNITED STATES V. WILSON                         39

suppress is reversed, and this case is remanded for further
proceedings. 14




    14
       As noted, the district court concluded that if Agent Thompson’s
warrantless actions constituted an illegal search, no exception “would
prevent operation of the exclusionary rule.” Wilson, 2017 WL 2733879,
at *13. The government did not raise before us any argument to the
contrary, and thus waived any challenge. See United States v. Gamboa-
Cardenas, 508 F.3d 491, 502 (9th Cir. 2007).