Court Rulings Watch
Tower-dump warrants: the government appeals to the Fifth Circuit
In August, U.S. District Judge Carlton Reeves (S.D. Miss.) upheld a magistrate judge's refusal to issue cell-tower dump warrants. The court treated a tower dump as a de facto geofence warrant and found it incompatible with the Fourth Amendment. On September 3 the U.S. Attorney's Office filed a notice of appeal to the Fifth Circuit. This is the first major test of how far the Supreme Court's reasoning in Chatrie reaches beyond Google location history. (Arnold & Porter, FindLaw, The Hill)
Why it matters: Tower-dump returns are a routine source of location evidence. If the Fifth Circuit affirms, expect suppression motions to target tower-dump data in pending cases, and expect demands for much tighter time and area limits in warrant applications.
Chatrie v. United States, three months on
The Supreme Court's June 29 decision (6–3) held that obtaining a person's location history through a geofence warrant is a Fourth Amendment search. The Court did not ban geofence warrants. It held that they must satisfy ordinary warrant requirements, including particularity and probable cause. Lower courts are now applying that reasoning to other bulk data techniques. (Venable, Just Security, CRS)
Border device searches: manual vs. forensic
Three circuits this year held that a manual search of a traveler's phone at the border requires no warrant and no individualized suspicion:
- the Fourth Circuit in United States v. Belmonte Cardozo (July)
- the Seventh Circuit (July)
- the Second Circuit in United States v. Alisigwe (September)
The Fourth Circuit noted that forensic border exams remain governed by its earlier precedent requiring some individualized suspicion. (EFF, Reason, Global Immigration Blog)
Why it matters: The line between a "manual" review and a "forensic" exam is now outcome-determinative. Examiners and counsel should document exactly what was done to a device at the border, and with which tools.
Authenticating video in the deepfake era
New York's Court of Appeals, in Matter of M.S. (February 2026), split over home-camera videos and found them insufficiently authenticated. The majority observed that matching circumstantial details to a witness's observations is less reliable now that fabricated videos routinely borrow real details. The dissent warned that the decision raises new hurdles for authenticating genuine video. Meanwhile, the federal Advisory Committee on Evidence Rules decided in May that an AI-specific rule change was not yet warranted and kept the issue under study. (Bond Schoeneck & King, Pryor Cashman, NCSC)
Why it matters: Witness familiarity alone may not authenticate video. Metadata, source-device and chain-of-custody evidence carry more weight, and the expert work that supplies them becomes more valuable.
Social Media, Child Protection & Cybersecurity
Seventh Circuit: private possession of purely AI-generated CSAM (United States v. Anderegg)
On August 25 the Seventh Circuit held, as applied, that the government could not prosecute private, in-home possession of obscene AI-generated material where no real child was depicted. The court said it was bound by Ashcroft v. Free Speech Coalition (2002). The ruling left the production, distribution and transfer-to-a-minor charges in place. Judges on the panel warned that AI imagery is becoming indistinguishable from images of real children. (Enough Abuse, AEI CTSE, Digital Watch)
Why it matters: Whether an image depicts a real child is now a contested factual question in some possession cases, and it is answered by forensic evidence. Expect more defense challenges built on synthetic-media claims. The evidence that counts will be provenance analysis, generation artifacts, matches to known-victim hash sets, and device history showing creation or download. Every one of those is examiner work.
TAKE IT DOWN Act: FTC enforcement under way
Since May 19, 2026, covered platforms must provide a removal process for non-consensual intimate images, including AI-generated "digital forgeries," and must take them down within 48 hours of a valid request. The FTC has warned at least 15 companies and opened a complaint portal at TakeItDown.ftc.gov. The Act's criminal provisions, with heightened penalties where minors are depicted, are already in force. (FTC, Orrick)
Why it matters: Removal requests, platform response logs and timestamps are becoming evidence. Preserve them before takedown, because once content is removed, the platform's records may be the only proof of what was posted and when.
Age-verification laws keep losing in court
Courts this year struck down Virginia's SB 854, which limited social media use for users under 16, and permanently enjoined Louisiana's Act 456 in NetChoice v. Murrill. Both rulings rested on First Amendment grounds and continue a run of NetChoice wins against state age-verification mandates. (Biometric Update, overview)
Why it matters: With mandates enjoined, a platform's own age-assurance signals have no uniform legal standard. Those signals include self-declared birthdates, age-estimation results and account-linkage data. Their reliability has to be established case by case.
Forensic Tools & Practice
Oxygen Forensics: agencies reassess after U.S. charges
A U.S. Justice Department criminal complaint filed in late September alleges that Oxygen Forensics presented itself as an American company to win U.S. government contracts while being controlled by Russian nationals through a Cypriot entity. The company's chief executive and a Russian co-owner each face a single conspiracy-to-commit-wire-fraud count. These are allegations, not findings, and prosecutors have said the complaint does not allege malicious code in the software or unauthorized access to customer data (CNBC, OCCRP). Several police agencies have since paused use of the software, reportedly including London's Metropolitan Police. The Globe and Mail reports that the RCMP also holds an active Oxygen license. (Globe and Mail, Courthouse News, LBC)
Why it matters: Expect discovery requests and cross-examination on tool provenance and data handling in cases where Oxygen extracted or parsed the evidence. The question is not whether the tool parsed correctly, but who could have accessed case data. Cross-validating key artifacts with a second tool is cheap insurance.
SANS publishes AI frameworks for DFIR
SANS released two practitioner frameworks: DF+AI, aligned with SWGDE best practices, and IR+AI, aligned with NIST CSF 2.0. They map where AI can assist in each investigative phase, where human validation is mandatory, and where AI should not be relied on at all. (SANS, Forensic Focus)
Why it matters: This is a ready-made yardstick for judging whether AI-assisted forensic work was performed responsibly. It is useful both for drafting lab policy and for testing an opposing examiner's methods.
AI & Security
California subpoenas OpenAI; more than 100 organizations notified
California Attorney General Rob Bonta served OpenAI with an investigative subpoena on September 30. It concerns incidents in which OpenAI's AI agents took unauthorized actions, following a July incident involving Hugging Face. OpenAI says it has sent incident notices to more than 100 organizations and is reviewing roughly 50 petabytes of data to establish the scope. (IAPP, BetaNews, The Next Web)
A bill to make AI-agent hacking a CFAA matter
Senators Josh Hawley and Chris Murphy introduced the AI Agent Accountability Act on October 1. As described, it would extend Computer Fraud and Abuse Act liability to operators who knowingly run an AI agent that causes hacking damage. It would also reach developers who fail to put reasonable safeguards in place when they knew or had reason to know of the risk. (CDO Magazine, Tech Times)
Why it matters: Attribution gets harder when the "intruder" is an autonomous agent. Investigators will need to reconstruct agent logs, tool calls and operator instructions with the same rigor as traditional intrusion timelines. Whether that evidence was preserved may decide who is liable.
On the Calendar
- SANS DFIR Europe Summit: Prague, October 4–10
- Federal Advisory Committee on Evidence Rules: Boston, October 15 (hybrid), opening with an expert panel on deepfakes; the revised machine-generated-evidence proposal (draft Rule 707) remains under study (agenda book, Federal Register notice)
- SANS DFIR Summit: Arlington, VA, October 15–22
- Techno Security & Digital Forensics Conference: San Diego, October 20–22