Privacy advocates in Congress are preparing a last-ditch effort to block the Justice Department from pushing through a change in procedure that they say will vastly expand federal law enforcement’s ability to hack into computers worldwide.
Sen. Ron Wyden, D-Oregon, is planning to introduce legislation this week with Kentucky Republican Sen. Rand Paul that would block a change to what’s known as Rule 41, a Justice Department regulation of criminal procedure that governs how and where federal law enforcement can get warrants, including to remotely access — or hack — computers.
The Justice Department began a process nearly two years ago to make a small change to the rule that it says is a simple matter of venue. The problem with current rules, DOJ says, is that judges can only issue warrants to search property in their districts, or in crimes that involve their districts.
When a computer or device involved in a crime is from an unknown or concealed location, investigators should be able to get a warrant to remotely search the devices from any magistrate judge in the country, the rule change says.
But privacy advocates say the seemingly small adjustment to criminal procedure amounts to a massive expansion of federal hacking powers — and could open a Pandora’s Box of consequences.
“This is not a minor administrative change, this is a huge technology judgment,” Wyden said in an interview. “When you’re letting the government to get a single warrant to hack into an unnumbered amount of computers across immeasurable districts, you’re not talking about a minor administrative change, you’re talking about major policy.”
The Supreme Court signed off on the changes in late April. That set off a timer: If Congress does not pass a bill blocking or modifying the change by Dec. 1, the rule change will take effect.
That means Wyden and Paul will need to rally their colleagues to pass legislation in the middle of an election year and get the President to sign the bill, blocking a request from his own Justice Department.
The White House said it would not comment on draft legislation.
The Justice Department has maintained throughout the process that it is only seeking a minimal change to procedure, and individual judges will be the ones to weigh the thorny constitutional questions involved in computer searches.
“Criminals now have ready access to sophisticated anonymizing technologies to conceal their identity while they engage in crime over the Internet, and the use of remote searches is often the only mechanism available to law enforcement to identify and apprehend them,” said Justice Department spokesman Peter Carr in a statement to CNN when asked about the congressional effort. “This amendment ensures that courts can be asked to review warrant applications in situations where is it currently unclear what judge has that authority. The amendment makes explicit that it does not change the traditional rules governing probable cause and notice.”
Judiciary Committee Chairman Chuck Grassley, R-Iowa responded to a question about whether they would support hearings on Rule 41. Ranking member Patrick Leahy, D-Vermont, has said he would support hearings.
Grassley offered a statement saying he appreciates the work that has already gone into evaluating the change.
“We’ll be reading the meeting minutes, comments and documents submitted to the Judicial Conference in an effort to learn more about the proposed changes to Rule 41 that have been approved by the Supreme Court and forwarded to Congress for additional review,” he said.
He did send a lengthy list of questions to the FBI last summer about federal law enforcement’s use of spyware, software that can be surreptitiously installed on Americans’ devices to track their activity, in the context of the FBI seeking the changes to Rule 41 to let spyware be deployed more easily. The committee did not answer whether that letter was answered.
Critics of the Justice Department’s move say there are a number of dangerous implications of the rule change. For one, Wyden is concerned about going after unnumbered computers with one warrant. In cases involving so-called botnets — networks of computers secretly running malicious software without their owners’ knowledge — the FBI could be remotely accessing scores or hundreds of victims’ computers, Wyden says.
Regarding botnets, DOJ says it needs the change to be able to effectively bring down the malicious networks without having to go to judges all over the country in a time-consuming process.
Privacy advocates are also concerned about federal officials shopping for favorable judges to grant their warrants, about judges not fully understanding the implications of warrants, and about U.S. law enforcement unknowingly accessing computers abroad outside of their jurisdiction.
Another worry is about the requirement to notify individuals of a search warrant. The rule requires officers to make a “reasonable effort” to give notice to the person whose computer is being searched, though in cyberspace that is far more difficult than posting a note on a door.
“These are complicated issues and the Justice Department is huffing and puffing about how this is modest, non-policy making stuff, but that’s what Congress is for, to have a robust discussion of these issues,” Wyden said. “An agency like the Department of Justice shouldn’t just be able to wave its arms around a little bit and grant itself enormous powers.”