GORSUCH, Circuit Judge, delivered the opinion of the Court, in which PHILLIPS, J., joined. HARTZ, J., joined Parts I, II, III(A), and IV.

Walter Ackerman's email never made it to its intended recipient. It didn't because AOL, Mr. Ackerman's internet service provider (ISP), has an automated filter designed to thwart the transmission of child pornography. After that filter identified one of four images attached to Mr. Ackerman's email as child pornography, AOL instantly stopped delivery and the company soon shuttered Mr. Ackerman's account.

How does AOL's screening system work? It relies on hash value matching. A hash value is (usually) a short string of characters generated from a much larger string of data (say, an electronic image) using an algorithm — and calculated in a way that makes it highly unlikely another set of data will produce the same value. Some consider a hash value as a sort of digital fingerprint. See Richard P. Salgado, Fourth Amendment Search and the Power of the Hash, 119 Harv. L. Rev. F. 38, 38-40 (2005). AOL's automated filter works by identifying the hash values of images attached to emails sent through its mail servers. Those values are then compared to the hash values of images that AOL employees have viewed previously and deemed child pornography. Any email containing an image with a matching hash value is automatically weeded out.

As soon as AOL identified a hash value match in this case, the company did just what federal law requires: it forwarded a report to the National Center for Missing and Exploited Children (NCMEC) through an online tool called the CyberTipline. AOL's report included Mr. Ackerman's email along with all four attached images. A NCMEC analyst opened the email, viewed each of the attached images, and confirmed that all four (not just the one AOL's automated filter identified) appeared to be child pornography. After the analyst determined as well that Mr. Ackerman was the likely owner of the account, NCMEC alerted law enforcement agents in the area where he lived. And not long after that, a federal grand jury indicted Mr. Ackerman on charges of possession and distribution of child pornography. At the end of it all, Mr. Ackerman entered a conditional guilty plea but reserved his right to appeal the denial of his motion to suppress the fruits of NCMEC's investigation.

We can appreciate why, for his motion raises (at least) two difficult constitutional questions. Mr. Ackerman alleges that NCMEC's actions amounted to an unreasonable search of his email and its attachments because no one sought a warrant and no one invoked any recognized lawful basis for failing to seek one. But the Fourth Amendment only protects against unreasonable searches undertaken by the government or its agents — not private parties. So Mr. Ackerman's motion raises the question: does NCMEC qualify as a governmental entity or agent? Even if it does, a second hard question remains. The Supreme Court's "private search" doctrine suggests the government doesn't conduct a Fourth Amendment "search" when it merely repeats an investigation already conducted by a private party like AOL. Which raises this question: did NCMEC simply repeat or did it exceed the scope of AOL's investigation? For its part, the district court denied Mr. Ackerman's motion to suppress both because NCMEC is not a governmental actor and, alternatively and in any event, because NCMEC's search didn't exceed the scope of AOL's private search.

We find we must disagree.

I

Start with the question whether NCMEC qualifies as a governmental entity. The problem of drawing a line between public and private entities is an old and difficult one. Perhaps the Supreme Court's first great tangle with the task came in Trustees of Dartmouth College v. Woodward, 17 U.S. (4 Wheat.) 518, 668-69, 4 L.Ed. 629 (1819). There the Court suggested that the calling card of a governmental entity is whether it is "invested with any portion of political power, partaking in any degree in the administration of civil government, and performing duties which flow from the sovereign authority." Id. at 634 (opinion of Marshall, C.J.). That an entity might be incorporated, as NCMEC is, doesn't prevent it from also qualifying as a governmental entity: the dispositive question isn't one of form but function, turning on what the entity does, not how it is organized. So, for example, a municipality may undoubtedly qualify both as a corporation and as a governmental entity. See Philips v. Bury (1694) 90 Eng. Rep. 1294, 1299 ("There are in law two sorts of corporations aggregate of many; such as are for publick government, and such as are for private charity."); 1 Joseph Stancliffe Davis, Essays in the Earlier History of American Corporations 72-74 (1917).

When it comes to what qualifies as a public, political, or sovereign function, we know too that the "police function" is among the paradigmatic examples. See Foley v. Connelie, 435 U.S. 291, 297, 98 S.Ct. 1067, 55 L.Ed.2d 287 (1978) (describing the "police function" as "one of the basic functions of government"); Flagg Bros., Inc. v. Brooks, 436 U.S. 149, 163, 98 S.Ct. 1729, 56 L.Ed.2d 185 (1978) (noting that policing is among the "state and municipal functions" that "have been administered with a greater degree of exclusivity by States and municipalities"). Even before the rise of professional police departments, a private person dragooned into a "posse comitatus" bore "the same authority as the sheriff" and "was protected [by law] to the same extent." Filarsky v. Delia, ___ U.S. ___, 132 S.Ct. 1657, 1664, 182 L.Ed.2d 662 (2012); see also 1 William Blackstone, Commentaries *332. To be sure, some cases have suggested that the mere investigation of crime or temporary detention of suspected criminals by private security guards is not a uniquely public function. See, e.g., Gallagher v. "Neil Young Freedom Concert," 49 F.3d 1442, 1457 (10th Cir. 1995); Wade v. Byles, 83 F.3d 902, 905-06 (7th Cir. 1996); United States v. Garlock, 19 F.3d 441, 443-44 (8th Cir. 1994). But that's because the guards' lawful authority to act in those cases was no broader than that enjoyed by any private citizen — including the right to carry a weapon, to use deadly force in self-defense, and to conduct a citizen's arrest. See Romanski v. Detroit Entm't, L.L.C., 428 F.3d 629, 637-38 (6th Cir. 2005). Meanwhile, when an actor is endowed with law enforcement powers beyond those enjoyed by private citizens, courts have traditionally found the exercise of the public police power engaged. Id. at 637.1

NCMEC's law enforcement powers extend well beyond those enjoyed by private citizens — and in this way it seems to mark it as a fair candidate for a governmental entity. NCMEC's two primary authorizing statutes — 18 U.S.C. § 2258A and 42 U.S.C. § 5773(b) — mandate its collaboration with federal (as well as state and local) law enforcement in over a dozen different ways, many of which involve duties and powers conferred on and enjoyed by NCMEC but no other private person. For example, NCMEC is statutorily obliged to operate the official national clearinghouse for information about missing and exploited children, to help law enforcement locate and recover missing and exploited children, to "provide forensic technical assistance ... to law enforcement" to help identify victims of child exploitation, to track and identify patterns of attempted child abductions for law enforcement purposes, to "provide training... to law enforcement agencies in identifying and locating non-compliant sex offenders," and of course to operate the CyberTipline as a means of combating Internet child sexual exploitation. 42 U.S.C. § 5773(b). Responsibilities and rights Congress has extended to NCMEC alone "under Federal law" and done so specifically "to assist or support law enforcement agencies in administration of criminal justice functions." Id. § 16961(a)(1). This special relationship runs both ways, too, for NCMEC is also empowered to call on various federal agencies for unique forms of assistance in aid of its statutory functions. See 18 U.S.C. § 3056(f) (authorizing the U.S. Secret Service to provide, "at the request of" NCMEC, "forensic and investigative assistance in support of any investigation involving missing or exploited children").

Focusing in particular on NCMEC's CyberTipline functions, the functions at issue in this case, illustrates and confirms the special law enforcement duties and powers it enjoys. First, NCMEC and NCMEC alone is statutorily obliged to maintain an electronic tipline for ISPs to use to report possible Internet child sexual exploitation violations to the government. Under the statutory scheme, NCMEC is obliged to forward every single report it receives to federal law enforcement agencies and it may make its reports available to state and local law enforcement as well. See id. § 2258A(c).

Second, ISPs must report any known child pornography violations to NCMEC. Not to any other governmental agency, but again to NCMEC and NCMEC alone. ISPs who fail to comply with this obligation face substantial (and apparently criminal) penalties payable to the federal government. Id. § 2258A(a)(1), (e); see also Child Exploitation & Obscenity Section, Frequently Asked Questions (FAQs), U.S. Dep't Just., https://www.justice.gov/criminal-ceos/frequently-asked-questions-faqs (last visited July 7, 2016) ("If the ISP knowingly and willfully fails to report the apparent violation, it is subject to criminal penalties.").

Third, when NCMEC confirms it has received a report the ISP must treat that confirmation as a request to preserve evidence issued by the government itself. Compare 18 U.S.C. § 2258A(h)(1) ("[T]he notification to an [ISP] ... by the CyberTipline of receipt of a report ... shall be treated as a request to preserve, as if such request was made pursuant to section 2703(f)."), with id. § 2703(f)(1) ("A[n ISP]..., upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession...."). Failure to comply again opens an ISP to potential civil or criminal sanctions. See id. § 2258B.

Fourth, in aid of its tipline functions NCMEC is statutorily authorized to receive contraband (child pornography) knowingly and to review its contents intentionally. Id. § 2258A(a), (b)(4); NCMEC Amicus Br. at 20-21. Actions that would normally subject private persons to criminal prosecution. See 18 U.S.C. § 2252A(a)(2) (knowing receipt or distribution); id. § 2252A(a)(5)(B) (knowing possession or access with intent to view). But actions that Congress allows NCMEC to take precisely because of the unique value it provides in the prosecution of child exploitation crimes. See R. vol. 3 at 198-99. Of course, Congress also provides that ISPs who forward and preserve images of child pornography in accord with the law may not be prosecuted. See 18 U.S.C. § 2258B(a). But this insulates ISPs only when they do what any private citizen who discovers apparent child pornography might without inviting a real risk of criminal prosecution: pass evidence along to law enforcement and comply with its preservation instructions. All quite unlike NCMEC, which (again alone) enjoys the right to receive child pornography knowingly and review it intentionally.

Recent Supreme Court decisions fortify our conviction that NCMEC qualifies as a governmental entity. In a pair of cases the Court held that Amtrak — a publicly owned corporation — is a governmental entity. Lebron v. Nat'l R.R. Passenger Corp., 513 U.S. 374, 399, 115 S.Ct. 961, 130 L.Ed.2d 902 (1995); Dep't of Transp. v. Ass'n of Am. R.Rs. (DOT), ___ U.S. ___, 135 S.Ct. 1225, 1233, 191 L.Ed.2d 153 (2015). The Court began by recalling that the government cannot "evade the most solemn obligations imposed in the Constitution by simply resorting to the corporate form." Lebron, 513 U.S. at 397, 115 S.Ct. 961. Then the Court proceeded to examine the level of governmental control over Amtrak, the broad statutory mandates to which it was subject, its dependence on federal funding, the purpose behind its creation, and the benefits it conferred on the government. See id. at 397-400, 115 S.Ct. 961; see also DOT, 135 S.Ct. at 1231-33. In the end, the Court held that the "combination" of these considerations conspired to suggest that Amtrak was indeed a governmental entity. Id. at 1232-33.

Looking to similar considerations here leads us to a similar conclusion. Much as Amtrak was created by statute to assume functions previously carried out by private railroads, Congress passed statutes to fund and mandate various of NCMEC's functions soon after private parties incorporated it.2 Today, NCMEC is statutorily required to perform over a dozen separate functions, a fact that evinces the sort of "day-to-day" statutory control over its operations that the Court found tellingly present in the Amtrak cases.3 Law enforcement agents participate at varying levels in its daily operations,4 and government officials enjoy a sizeable presence on its board.5 As much as 75 percent of its budget (excluding in-kind donations) comes from the federal government. NCMEC Amicus Br. at 9. Neither is there any question about the public benefit NCMEC confers, for by all accounts its important work is essential to the identification and prevention of child sexual exploitation crimes. Congress and NCMEC alike have expressly said as much. See, e.g., 42 U.S.C. § 5771; National Center for Missing & Exploited Children: Our Work, NCMEC, http://www.missingkids.com/NCMEC (last visited July 7, 2016). Given all this and as a matter of analogistic reasoning, it's difficult to see how a quasi-public corporation like Amtrak (a mere utility, really) might qualify as a governmental entity while NCMEC, an entity afforded so many unique law enforcement powers, might not.

In the face of so much law and evidence suggesting NCMEC qualifies as a governmental entity, the government offers almost no reply. In fact, its only response is to question whether the question is properly before us. According to the government, when Mr. Ackerman was before the district court he argued merely that NCMEC is a governmental agent and failed to argue that NCMEC is also a governmental entity. As a result, the government suggests, any "entity argument" is waived. Of course, Mr. Ackerman avidly disputes the government's assessment and submits that he pursued both an agent and an entity theory before the district court. But who is right about this much doesn't much matter. It doesn't because the Supreme Court has specifically held that a defendant who asserts an agency theory before the district court preserves an entity theory on appeal. See Lebron, 513 U.S. at 378-79, 115 S.Ct. 961. And to this controlling direction the government provides no answer. So it is that the government's only response turns out to be no real response at all.

Seeing the void left by the government, NCMEC offers a number of substantive responses to Mr. Ackerman's entity theory in its own amicus brief. But ours is a party-directed adversarial system and we normally limit ourselves to the arguments the parties before us choose to present. Amici briefs often serve valuable functions, but those functions don't include presenting arguments forgone by the parties themselves or effectively and unilaterally expanding the word limits established by rule for a favored party. Indeed, for just these reasons (and more) this court has routinely declined to consider arguments presented only in an amicus brief — and no one even attempts to offer us a reason to depart from that practice here. See, e.g., Fed. R. App. P. 28; In re McGough, 737 F.3d 1268, 1277 n.8 (10th Cir. 2013); Tyler v. City of Manhattan, 118 F.3d 1400, 1403-04 (10th Cir. 1997).

Alternatively and anyway, the various arguments NCMEC offers do not change the equation materially. In an effort to distinguish Lebron from its own case, NCMEC argues that, unlike Amtrak, it and its CyberTipline existed for a (brief) period of time before Congress passed statutes funding and mandating its functions. But factually the distinction seems pretty unpersuasive, for many of the assets of what later became Amtrak existed in private hands long before Amtrak's statutory authorization. And analytically we are uncertain why it matters whether NCMEC was once private. For no one, NCMEC included, gives us reason to doubt that even an admittedly private entity can be made into a public one later by sufficient statutory action (consider the Tennessee Valley Authority).

In an effort to establish that even today it is not a public entity, NCMEC stresses that it receives some (unspecified amount of) in-kind donations from private parties every year and engages in partnerships with private firms interested in reducing child exploitation. But it remains undisputed that NCMEC receives the bulk of its funding from the federal government and we are aware of no authority suggesting that the existence of some (unspecified) amount of in-kind private donations converts a public entity into a private one. Surely the local public library would disagree — and so might Amtrak for it, too, receives plenty of private funding (not merely in-kind donations) from paying customers. See 49 U.S.C. § 24301(a)(2) ("Amtrak... shall be operated and managed as a for-profit corporation...."). Neither is it unknown for public entities to partner with private ones. See Partnerships and Outreach, FBI, https://www.fbi.gov/about-us/partnerships_and_outreach (last visited July 7, 2016) ("To do its job, the FBI works with both government and private sector partners every day....").

Next, NCMEC suggests it isn't required to spend its federal funding in any particular way. It may pursue the various law enforcement functions Congress has identified, but it doesn't have to do so. Here again we cannot agree. The law expressly states that NCMEC's federal funding "shall be used" for over a dozen specifically enumerated functions. 42 U.S.C. § 5773(b). And while "shall" can sometimes mean "may," that's the exception and not the rule, for the word is generally considered "imperative or mandatory" in character. Black's Law Dictionary 1375 (6th ed. 1990). Neither do we see the case for an exception here. Congress itself has described NCMEC's functions as "duties and responsibilities under Federal law." 42 U.S.C. § 16961(a)(1). Neither does anyone dispute that the use of "shall" in the first clause of § 5773(b) — providing that "[t]he Administrator shall annually make a grant" to NCMEC — is mandatory in character, and it seems most unlikely that the same word might bear a different meaning in the second clause where NCMEC's duties are described. After all, we usually presume Congress means the same thing when it uses the same word more than once in the same sentence. See Brown v. Gardner, 513 U.S. 115, 118, 115 S.Ct. 552, 130 L.Ed.2d 462 (1994). Congress, too, appears to be well aware of the difference between "may" and "shall" in the funding context, for in other similar grant-making statutes it has indeed adopted the more permissive "may." See, e.g., 42 U.S.C. § 16985(b)(2) ("The Administrator shall annually make a grant to RAINN, which shall be used for the performance of the organization's national programs, which may include...." (emphasis added)). And in other contexts, too, even NCMEC itself has seemed to characterize its work as mandatory. See, e.g., Michelle K. Collins, Child Pornography: A Closer Look, The Police Chief, Mar. 2007, available at http://goo.gl/LohIYz (the director of NCMEC's Exploited Child Division discussing "NCMEC's congressionally mandated CyberTipline").

Finally, NCMEC suggests that the statutes governing its operations are "like" routine federal grant-making or state licensing statutes. But we just don't see how. Federal grantees and state licensees don't typically enjoy (for example) the statutory authority to receive contraband knowingly, backed by statutes compelling private and public entities to cooperate with them. Neither do they typically enjoy such powers in aid of traditionally public law enforcement functions. Certainly at no point in these proceedings has NCMEC or the government sought to identify a single federal grantee or state licensee with anything fairly analogous to the sorts of statutory law enforcement powers and duties NCMEC possesses.

II

Even if we are wrong and NCMEC isn't a governmental entity, that doesn't necessarily mean its searches escape the Fourth Amendment's ambit. After all, since time out of mind the law has prevented agents from exercising powers their principals do not possess and so cannot delegate. 1 William Blackstone, Commentaries *417-20; Restatement (Second) of Agency § 17 (1958). That is a rule of law the founders knew, understood, and undoubtedly relied upon when they drafted the Fourth Amendment — for what would have been the point of the Amendment if the government could have instantly rendered it a dead letter by the simple expedient of delegating to agents investigative work it was forbidden from undertaking itself? Indeed, it's long since accepted that the Amendment's proscriptions apply not just to governmental entities but also to those who serve as the government's agents in particular cases. See Skinner v. Ry. Labor Execs.' Ass'n, 489 U.S. 602, 614, 109 S.Ct. 1402, 103 L.Ed.2d 639 (1989) ("Although the Fourth Amendment does not apply to a search or seizure, even an arbitrary one, effected by a private party on his own initiative, the Amendment protects against such intrusions if the private party acted as an instrument or agent of the Government.").

How can we tell if NCMEC acted as the government's agent in this case? An agency relationship is usually said to "result[] from the manifestation of consent by one person to another that the other shall act on his behalf and subject to his control, and consent by the other so to act." Restatement (Second) of Agency § 1. This manifestation and consent doesn't have to be formalized in any particular way. See id. §§ 15-16. Instead, the "authority to do an act can be created by written or spoken words or other conduct of the principal which, reasonably interpreted, causes the agent to believe that the principal desires him so to act on the principal's account." Id. § 26. As well, a principal may delegate general authority to his or her agent to act in the ordinary course, without constant supervision or awareness of every discrete act. See id. § 7 cmt. c. Neither has the common law traditionally required that the agent be an altruist, acting without any intent of advancing some personal interest along the way (like monetary gain). As clients know well, lawyers can serve as their agents all while zealously charging by the hour. Instead, the question is usually simply whether the agent acts with the principal's consent and (in some way) to further the principal's purpose. See generally id. §§ 387-93. All these traditional agency principles were reasonably well ensconced in the law at the time of the founding and would seem the natural place to start in understanding the Amendment's original meaning and application to governmental agents. See generally Joseph Story, Commentaries on the Law of Agency (6th ed., Little, Brown & Co. 1863) (1839); United States v. Ellyson, 326 F.3d 522, 527 (4th Cir. 2003) (noting that the governmental agent inquiry should be "guided by common law agency principles").

Admittedly, in recent years some courts have offered more stylized agency tests for Fourth Amendment cases, which at first glance may appear to depart from and demand more than the common law did to establish an agency relationship. So, for example, some treat the Fourth Amendment agency inquiry as a three-factor test. See, e.g., United States v. Silva, 554 F.3d 13, 18 (1st Cir. 2009) (analyzing "[1] the extent of the government's role in instigating or participating in the search, [2] its intent and the degree of control it exercises over the search and the private party, and [3] the extent to which the private party aims primarily to help the government or to serve its own interests"). Our court seems to have adopted a two-part variation in United States v. Souza, 223 F.3d 1197 (10th Cir. 2000). Id. at 1201 (asking "1) whether the government knew of and acquiesced in the intrusive conduct, and 2) whether the party performing the search intended to assist law enforcement efforts or to further his own ends"). Still others appear to collapse these same factors into "[o]ne highly pertinent consideration." Ellyson, 326 F.3d at 527.

But in this particular case it doesn't much matter which agency test you might wish to employ. Even under this court's decision in Souza or similar decisions adopted in other circuits it's hard to see how we could avoid deeming NCMEC the government's agent in this case. Souza suggests that we should first ask whether the government "knew of and acquiesced in" NCMEC's putative search. Here we know Congress statutorily required AOL to forward Mr. Ackerman's email to NCMEC; Congress statutorily required NCMEC to maintain the CyberTipline to receive emails like Mr. Ackerman's; Congress statutorily permitted NCMEC to review Mr. Ackerman's email and attachments; and Congress statutorily required NCMEC to pass along a report about Mr. Ackerman's activities to law enforcement authorities. All at the government's expense and backed by threat of sanction should AOL have failed to cooperate. All with special dispensation, too, to NCMEC to possess and review contraband knowingly and intentionally. This comprehensive statutory structure seems more than enough to suggest both congressional knowledge of and acquiescence in the possibility that NCMEC would do exactly as it did here.

Of course and as the government notes, Congress's statutes don't require NCMEC to open and view email and attachments like Mr. Ackerman's. But everyone accepts that Congress has authorized and funded NCMEC to do just that. And everyone accepts that Congress enabled NCMEC to review Mr. Ackerman's email by excepting the Center from the myriad laws banning the knowing receipt, possession, and viewing of child pornography. Nothing about NCMEC's actions could possibly have come as a surprise. Neither does anything in Souza (or any other authority cited to us) suggest that the principal must mandate rather than merely consent to the agent's challenged conduct.

When it comes to Souza's second factor, too, we harbor no doubt. Surely, after all, NCMEC did as it did in this case with some "inten[tion] to assist" law enforcement. As we've seen, Congress authorizes and funds NCMEC to perform the functions it performed here because (and expressly premised on the finding that) they are designed (intended) to help law enforcement. See, e.g., 42 U.S.C. § 5771. And of course NCMEC itself has acknowledged that it undertakes the sort of conduct challenged here precisely because (at least in part) it intends to aid law enforcement. About Us, NCMEC, http://www.missingkids.com/About (last visited July 7, 2016) (explaining that NCMEC "provid[es] assistance to law enforcement and families to find missing children, reduce child sexual exploitation and prevent child victimization").

Bolstering our confidence about all this is the Supreme Court's leading Fourth Amendment agency case, Skinner v. Railway Labor Executives' Ass'n, 489 U.S. 602, 109 S.Ct. 1402, 103 L.Ed.2d 639 (1989). There the Federal Railroad Administration promulgated regulations requiring private railroads to test certain of their employees for illicit drugs and authorizing (but not requiring) railroads to test certain other of their employees. Id. at 609-12, 109 S.Ct. 1402. The government acknowledged that the mandatory testing requirements converted otherwise private railroads into governmental agents for purposes of the Fourth Amendment, but it suggested that the permissive testing requirements did not. The Supreme Court disagreed. Rather than endorsing a rigid multi-part agency test of the sort some lower courts had by that time devised, the Court seemed to follow the common law by asking simply whether "the Government's encouragement, endorsement, and participation" in the permissive testing was enough to render otherwise private railroads agents of the government for Fourth Amendment purposes. Id. at 615-16, 109 S.Ct. 1402. And applying that test here there can be little doubt of the result it yields. For the government surely "encouraged and endorsed and participated" in NCMEC's putative search for the same reasons it "knew of and acquiesced in" that activity: Congress funded the Center, required AOL to cooperate with it, allowed it to review Mr. Ackerman's email by excepting it from various federal criminal laws, and statutorily mandated or authorized every bit of its challenged conduct.

Even if all that is true, and a finding of agency would be consistent with the common law at the time of the founding, the test this court articulated in Souza, and the test the Supreme Court applied in Skinner, the government suggests that our prior decision in United States v. Poe, 556 F.3d 1113 (10th Cir. 2009), still precludes us from holding that NCMEC acted as its agent in this case. In Poe, this court faced the question whether bounty hunters who searched a home qualified as governmental agents by virtue of the fact that the state of Oklahoma regulated the bail bonds industry. Poe held not. Both because the mere licensing and regulation of an industry wasn't enough to suggest that the government knew of or acquiesced in the particular search in question. And because the bounty hunters' purpose or intention in searching the house was to find a bail-jumping suspect and so receive a reward from the bail bondsman that employed them. Given that, Poe thought it fair to conclude that the bounty hunters intended to help themselves or their employer (their true principal) but "did not intend to assist law enforcement" at all. Id. at 1124.

Neither of the grounds on which Poe rested is present here. As we've already acknowledged, a governmental licensing and regulation regime does not always suffice to render the licensed or regulated party a governmental entity or agent. After all private lawyers, doctors, and accountants are all licensed and regulated by the state, yet they don't (usually) qualify as governmental entities or agents. But as we've already observed, too, in this case we don't face a general licensing or regulatory regime open to all qualified applicants but a statutory grant of special law enforcement authority to a single entity and no other, authorizing and encouraging it to perform functions no other private person or entity may lawfully undertake. And as we've seen, helping law enforcement is at least part of NCMEC's intentions when it reviews emails pursuant to its statutory tipline authority.

Admittedly, the government reads Poe differently than we do. It reads the decision as suggesting that a private party who bears any private purpose cannot serve as a governmental agent. But this reading is a misreading. After all, and as we've seen, the common law recognized that agents routinely intend to serve their principals with the further intention to make money for themselves. In Skinner, too, the fact that the private railroads had private (economic) reasons for seeking to curb drug abuse by railroad employees — and had sought to do so before the government promulgated its regulations, 489 U.S. at 606-07, 109 S.Ct. 1402 — was no barrier to the Court's determination that the statutory scheme converted the railroads into governmental agents. And in United States v. Leffall, 82 F.3d 343 (10th Cir. 1996), this court likewise expressly explained that the agency question cannot be resolved "simply" by "evaluat[ing] the private person's state of mind — whether his motive to aid law enforcement preponderates." Id. at 347. Neither do we read Poe as disagreeing with any of this standard stuff but as suggesting instead and much more modestly that a question about a claim of agency may arise when a private party bears no intention to assist the government. Or put another way, when the agent serves a different principal and not the government. Nothing like that complication is present here.

One final wrinkle remains to unfold on the agency question. The government insists that whether NCMEC is a governmental agent is a question of fact, permitting this court to reverse the district court's determination only if it clearly erred. For our part, we readily agree that this court is obligated to give great deference to the district court's findings of historic fact — something we have done in our analysis above and find little difficulty doing, for the historic facts are (materially) undisputed in this case. But having said that much, we cannot agree with the government if it means to suggest that the deference we owe to the district court's factual findings extends to its definition of the "legal concept" of agency, Restatement (Second) of Agency § 1 cmt. b, or to the question whether the facts the district court found are sufficient to satisfy it. It is for this court to decide (de novo) what the law is and whether the facts (as found by the district court and so long as they are not clearly erroneous) satisfy its demands. See Ornelas v. United States, 517 U.S. 690, 694-99, 116 S.Ct. 1657, 134 L.Ed.2d 911 (1996) (holding that appellate courts must review a district court's determination of reasonable suspicion and probable cause de novo, with deference to its findings of historic fact); United States v. Ginglen, 467 F.3d 1071, 1074 (7th Cir. 2006) (acknowledging Ornelas's relevance to review of a governmental agency determination). Nothing in the case the government purports to rely upon abandons these stolid principles of appellate review found most everywhere in the law. To the contrary, it explains quite rightly that "[w]e review the district court's findings of fact" relevant to an agency determination "under a clearly erroneous standard," but "review de novo the ultimate question of constitutional law," Leffall, 82 F.3d at 347 — and the Fourth Amendment agency question is unquestionably one of constitutional law.

III

Assuming NCMEC is a governmental entity or agent, its actions still implicate the Fourth Amendment only if a "search" took place here. On first blush, the answer to that question might seem obvious. No one in this appeal disputes that an email is a "paper" or "effect" for Fourth Amendment purposes, a form of communication capable of storing all sorts of private and personal details, from correspondence to images, video or audio files, and so much more. See United States v. Cotterman, 709 F.3d 952, 964 (9th Cir. 2013) (en banc); cf. United States v. Lichtenberger, 786 F.3d 478, 489 (6th Cir. 2015). The undisputed facts show, too, that NCMEC opened Mr. Ackerman's email, found four attachments, and proceeded to view each of them.6 And that sort of rummaging through private papers or effects would seem pretty obviously a "search." After all, if opening and reviewing "physical" mail is generally a "search" — and it is, Ex Parte Jackson, 96 U.S. 727, 733, 24 L.Ed. 877 (1877); United States v. Van Leeuwen, 397 U.S. 249, 251, 90 S.Ct. 1029, 25 L.Ed.2d 282 (1970) — why not "virtual" mail too?

Admittedly, it's an open question whether the Supreme Court's so-called "third-party doctrine" might undermine any claim to Fourth Amendment protections when someone (like Mr. Ackerman) engages a private agent (like AOL) to deliver his correspondence. The Court has, after all, suggested that individuals lack any reasonable expectation of privacy and so forfeit any Fourth Amendment protections in materials they choose to share with third parties like banks or telephone companies. See, e.g., United States v. Miller, 425 U.S. 435, 440-43, 96 S.Ct. 1619, 48 L.Ed.2d 71 (1976); Smith v. Maryland, 442 U.S. 735, 742-46, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979). And lower courts have only begun to consider whether (and to what extent) the doctrine should be extended to email where (as here) a subscriber relies on a commercial ISP to store and deliver it. Compare United States v. Forrester, 512 F.3d 500, 510-11 (9th Cir. 2007) (finding no Fourth Amendment protection for the "to/from addresses of e-mail messages"), with United States v. Warshak, 631 F.3d 266, 283-88 (6th Cir. 2010) (finding Fourth Amendment protection for email contents). But the district court didn't rely upon third-party doctrine in ruling against Mr. Ackerman. Exactly to the contrary, throughout its decision the court assumed that Mr. Ackerman had a reasonable expectation of privacy in his email. And though we may of course affirm the district court's judgment on any basis the record supports, we think making the attempt here imprudent given that the district court has yet to make any factual findings relevant to Mr. Ackerman's subjective expectations of privacy or the objective reasonableness of those expectations in light of the parties' dealings (e.g., the extent to which AOL regularly accessed emails and the extent to which users were aware of or acquiesced in such access). Facts that could well impact the legal analysis. See, e.g., Harper v. P. Urbano, P.A., 342 Fed.Appx. 380, 382 (10th Cir. 2009).

A

Even so, the government says there's another Fourth Amendment doctrine that compels a ruling in its favor, one the district court did cite and rely upon, this one called the "private search" doctrine and often associated with United States v. Jacobsen, 466 U.S. 109, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984). In that case, FedEx employees opened a damaged package, found suspicious plastic bags of white powder inside, and passed the parcel to the government, along with a description of what they'd found. Id. at 111, 104 S.Ct. 1652. A DEA agent then repeated the same investigation, opening the package and examining its contents. Id. Finally, he subjected the white powder to a chemical drug test to confirm it was cocaine. Id. at 111-12, 104 S.Ct. 1652. Considering all this, the Supreme Court held that no "search" implicating the Fourth Amendment had taken place because there was a "virtual certainty" that (but for one thing) the government could have discovered "nothing else of significance" in the package nor learned anything beyond what it had "already ... been told" by a private party. Id. at 119, 104 S.Ct. 1652.

The one thing, of course, was the drug test. FedEx didn't test the chemical composition of the white powder and the government did. And so you might well ask, why isn't at least that a search implicating the Fourth Amendment? The Court acknowledged that the drug test promised to (and surely did) reveal information previously unknown to FedEx. Yet the Court proceeded to hold that the drug test still didn't qualify as a Fourth Amendment search because it "merely disclose[d]" whether the powder was contraband "and no other arguably `private' fact." Id. at 123, 104 S.Ct. 1652. In these circumstances, the Court announced, the government's apparent search was no search at all because it compromised no "legitimate privacy interest" within the meaning of Katz v. United States, 389 U.S. 347, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967). Jacobsen, 466 U.S. at 123, 104 S.Ct. 1652.

Accepting our obligation as a lower court to apply both aspects of Jacobsen's private search doctrine faithfully, we fail all the same to see how they might help the government in this case. Yes, AOL ran a search that suggested a hash value match between one attachment to Mr. Ackerman's email and an image AOL employees had previously identified as child pornography. But AOL never opened the email itself. Only NCMEC did that, and in at least this way exceeded rather than repeated AOL's private search. Neither is there any doubt NCMEC's search of the email itself quite easily "could [have] disclose[d]" information previously unknown to the government besides whether the one attachment contained contraband. Id. at 122, 104 S.Ct. 1652. Indeed, when NCMEC opened Mr. Ackerman's email it could have learned any number of private and protected facts, for (again) no one before us disputes that an email is a virtual container, capable of storing all sorts of private and personal details, from correspondence to other private (and perfectly legal) images, video or audio files, and beyond. See, e.g., Warshak, 631 F.3d at 284. And we know, too, that this particular container did contain three additional attachments, the content of which AOL and NCMEC knew nothing about before NCMEC opened them too. As far as anyone knew at the time, they could have revealed virtually any kind of noncontraband information to the prying eye.

Our view about the inapplicability of Jacobsen's private search doctrine finds support in at least two related cases. In United States v. Place, 462 U.S. 696, 103 S.Ct. 2637, 77 L.Ed.2d 110 (1983), the Court held that a dog sniff of luggage by a "well-trained narcotics detection dog" didn't offend the Fourth Amendment because it didn't "require opening the luggage" and could have suggested only the presence or absence of "contraband items." Id. at 707, 103 S.Ct. 2637 (quoted in Jacobsen, 466 U.S. at 124, 104 S.Ct. 1652). Meanwhile, in Walter v. United States, 447 U.S. 649, 100 S.Ct. 2395, 65 L.Ed.2d 410 (1980), the Court held law enforcement's projection and viewing of films did implicate the Constitution because the prior private search was much narrower, involving only the visual inspection of the labels on the outside of the film boxes. See id. at 656-60, 100 S.Ct. 2395 (opinion of Stevens, J.). As interpreted by the Court in Jacobsen, the analytical thread stitching together these results and its own is the question whether "the governmental conduct could [have] reveal[ed] nothing about noncontraband items." 466 U.S. at 124 n.24, 104 S.Ct. 1652. In Place and Jacobsen, the government's conduct could have revealed nothing about noncontraband items, so no "search" took place within the meaning of the Fourth Amendment. In Walter, by contrast, the government's conduct could have revealed something previously unknown about noncontraband items, so a constitutionally triggering "search" did take place. And by the same reasoning the same result should follow here.

At this point you might wonder about a similar but different scenario than the one we confront today. What if NCMEC hadn't opened Mr. Ackerman's email but had somehow directly accessed (only) the (one) attached image with the matching hash value? Could the government have argued that, in that case, NCMEC's actions didn't risk exposing any private information beyond what AOL had already reported to it? Or might even that have risked exposing new and protected information, maybe because the hash value match could have proven mistaken (unlikely if not impossible) or because the AOL employee who identified the original image as child pornography was mistaken in his assessment (unlikely if maybe more possible)? See Salgado, supra, at 45-46. Interesting questions, to be sure, but ones we don't have to resolve in this case. We don't because the undisputed facts before us indicate that NCMEC opened Mr. Ackerman's email first and did so before and in order to view not just the attachment that was the target of AOL's private search but three others as well. And as we've seen, each of these steps — opening the email and viewing the three other attachments — was enough to risk exposing private, noncontraband information that AOL had not previously examined.

B

Our conclusion about this is confirmed by yet another and distinct line of authority. Jacobsen said no "search" implicating the Fourth Amendment took place even when officers exceeded the scope of the search previously performed by the private party and removed and destroyed a small amount of powder to conduct a drug test. In doing so, Jacobsen invoked Katz and held there was no "reasonable expectation of privacy" in concealing whether something is or isn't contraband. See 466 U.S. at 122-23, 104 S.Ct. 1652. But after United States v. Jones, ___ U.S. ___, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012), there's reason to wonder about that conclusion. After all, Jones held that the Katz formula is but one way to determine if a constitutionally qualifying "search" has taken place. Id. at 949-51. In light of the Fourth Amendment's original meaning, Jones explained that government conduct can constitute a Fourth Amendment search either when it infringes on a reasonable expectation of privacy or when it involves a physical intrusion (a trespass) on a constitutionally protected space or thing ("persons, houses, papers, and effects") for the purpose of obtaining information. So the fact the government's conduct doesn't trigger Katz doesn't mean it doesn't trigger the Fourth Amendment. Id. at 950 ("Fourth Amendment rights do not rise or fall with the Katz formulation.... [F]or most of our history the Fourth Amendment was understood to embody a particular concern for government trespass upon the areas... it enumerates. Katz did not repudiate that understanding.").

Reexamining the facts of Jacobsen in light of Jones, it seems at least possible the Court today would find that a "search" did take place there. After all, the DEA agent who performed the drug test in Jacobsen took and destroyed a "trace amount" of private property, 466 U.S. at 125, 104 S.Ct. 1652, a seeming trespass to chattels. Neither is there any question that the purpose and effect of the agent's action was to obtain information. See id. at 122-23, 104 S.Ct. 1652. And while the destruction of only a "trace amount" of private property might not amount to a trespass under modern tort law, even less was required to establish a claim of trespass to chattels at the time of the founding — and we know the Fourth Amendment is no less protective of persons and property against governmental invasions than the common law was at the time of the founding. Jones, 132 S.Ct. at 950, 953; id. at 957 n.2 (Alito, J., concurring in the judgment) ("At common law, a suit for trespass to chattels could be maintained if there was a violation of `the dignitary interest in the inviolability of chattels,' but today there must be `some actual damage to the chattel before the action can be maintained.'" (quoting W. Keeton et al., Prosser & Keeton on Law of Torts § 14, at 87 (5th ed. 1984))).

Given the uncertain status of Jacobsen after Jones, we cannot see how we might ignore Jones's potential impact on our case. And its impact here seems even clearer than in Jacobsen. After all, we are not dealing with a governmental drug test that destroyed but a trace amount of potential contraband. We are dealing instead with the warrantless opening and examination of (presumptively) private correspondence that could have contained much besides potential contraband for all anyone knew. And that seems pretty clearly to qualify as exactly the type of trespass to chattels that the framers sought to prevent when they adopted the Fourth Amendment. See, e.g., 1 Thomas M. Cooley, The General Principles of Constitutional Law in the United States of America 212 & n.2 (1880); Thomas M. Cooley, A Treatise on the Constitutional Limitations Which Rest upon the Legislative Power of the States of the American Union 306 n.2 (1868); Ex parte Jackson, 96 U.S. at 733. Of course, the framers were concerned with the protection of physical rather than virtual correspondence. But a more obvious analogy from principle to new technology is hard to imagine and, indeed, many courts have already applied the common law's ancient trespass to chattels doctrine to electronic, not just written, communications. See, e.g., eBay, Inc. v. Bidder's Edge, Inc., 100 F.Supp.2d 1058, 1063, 1069-70 (N.D. Cal. 2000); CompuServe Inc. v. Cyber Promotions, Inc., 962 F.Supp. 1015, 1019, 1027 (S.D. Ohio 1997); Thrifty-Tel, Inc. v. Bezenek, 46 Cal.App.4th 1559, 1565-67, 54 Cal.Rptr.2d 468 (1996). So it seems that, whether we analyze the "search" question through the lens of the government's preferred authority — Jacobsen and Katz — or through the lens of the traditional trespass test suggested by Jones, they yield the same (and pretty intuitive) result: NCMEC conducted a "search" when it opened and examined Mr. Ackerman's email.

IV

Having determined that NCMEC is a governmental entity or agent and that it searched Mr. Ackerman's email without a warrant, at this point you might wonder whether the government could argue that NCMEC's search still qualifies as a "reasonable" one because of, say, exigent circumstances or the "special needs" doctrine. Or whether any Fourth Amendment violation in opening the email or the three other attachments was too attenuated from the discovery of incriminating evidence in the matching hash value attachment to justify exclusion as the appropriate remedy. Or whether suppression might also be an inappropriate remedy because NCMEC acted in "good faith." But the government argues none of these points in this appeal, seeming instead to accept that if NCMEC was a governmental entity or agent and if its opening of the email was an unwarranted search, then its subsequent discovery of four attached images of child pornography was "fruit of a poisonous tree" and should be suppressed. Indeed, the closest the government comes to briefing any of these questions is to tell us it incorporates by reference the good faith arguments it presented to the district court. Even though this court has repeatedly instructed (both in rule and case law) that this sort of mechanical "[i]ncorporating by reference portions of lower court or agency briefs or pleadings" is insufficient to preserve a point for appellate review. 10th Cir. R. 28.4; see also Gaines-Tabb v. ICI Explosives, USA, Inc., 160 F.3d 613, 623-24 (10th Cir. 1998).

So with that, our encounter with this case comes to an end — at least for now. Surely hard questions remain to be resolved on remand, not least the question whether the third-party doctrine might preclude Mr. Ackerman's claim to the Fourth Amendment's application, a question the government has preserved and the district court and we have reserved. But about one thing we can be very certain. There can be no doubt that NCMEC does important work and that its work can continue without interruption. After all, it could be that the third-party doctrine will preclude motions to suppress like Mr. Ackerman's. Or that changes in how reports are submitted or reviewed might allow NCMEC to access attachments with matching hash values directly, without reviewing email correspondence or other attachments with possibly private, noncontraband content — and in this way perhaps bring the government closer to a successful invocation of the private search doctrine. Or it may be possible that the government could cite exigent circumstances or attenuation doctrine or special needs doctrine or the good faith exception to excuse warrantless searches or avoid suppression in at least some cases. But even if not a single one of these potential scenarios plays out — and we do not mean to prejudge any of them — we are confident that NCMEC's law enforcement partners will struggle not at all to obtain warrants to open emails when the facts in hand suggest, as they surely did here, that a crime against a child has taken place.

The district court's denial of the motion to suppress is reversed. The case is remanded for further proceedings consistent with this opinion.