Like it or not, government hackers gonna hack
Amie Stepanovich, Passcode, December 2, 2016
As of yesterday, the FBI now enjoys a dramatically expanded ability to hack into your devices. In fact, with just one warrant from a cherry-picked magistrate judge, federal law enforcement can now hack into millions of devices.
You might have missed the shift. It happened without any congressional hearings or votes. And the president didn’t sign a thing.
This is all thanks to the Committee on the Federal Rules of Criminal Procedure and a little change to Rule 41.
Typically, in order for a federal agency like the FBI to receive new authority to conduct invasive operations, Congress first has to pass a law that grants it to them. This means both houses must vote to approve a bill and then the president must sign it.
But Rule 41 was significantly changed by this obscure committee run by the judiciary. Because rule changes like this are supposed to be procedural and not make substantive changes to government authority, they are designed to go into effect automatically so long as Congress doesn’t proactively pass a law to stop them.
Spoiler alert: That didn’t happen. And it was a big mistake.
There are several major problems here. Although the FBI has secretly been hacking for over a decade, they have no specific legal authority to do it. When Congress passed rules to allow law enforcement to conduct wiretaps, it came with recognition that the activity was incredibly invasive and was designed to protect the rights and privacy of innocent people. And hacking is potentially much, much more invasive than a wiretap.
However, Congress arguably just blessed FBI hacking on a massive scale without any consideration of the privacy rights of innocent people. And even worse--they did it through an obscure process that minimized public debate.
The change to the rule essentially has implicitly authorized the FBI to hack into your devices. Additionally, in a move that that technical experts argue is overly broad, unnecessary, and incredibly risky for digital security, the rule changes also increase magistrate judges’ authority to issue warrants in certain investigations under the oft-criticized Computer Fraud and Abuse Act. All this will give the FBI berth to secretly hack into and search the devices of innocent individuals, without their knowledge or consent, if the devices have been potentially infected by a botnet.
Not only do these changes encourage forum shopping--the practice of choosing jurisdictions friendly to your side of a case--but they also allow a single warrant issued by a single judge of the government’s choosing to potentially impact the privacy and security of millions of people globally.
The Department of Justice argues that we shouldn’t be concerned about what this rule change authorizes because the FBI has no plans to use its new authority improperly.
This ignores the fact that the FBI has already conducted improper hacking operations. After all, it’s been more than a decade since the FBI started hacking. These operations have targeted criminal fugitives, people who have made bomb threats, and users of child pornography websites, but they have also gone after people who are using services for innocent, legitimate communications.
For many years the FBI kept these operations mostly secret, and the little information that we had in those early years was only available thanks to Freedom of Information Act (FOIA) requests by journalists at Wired and tech advocates. These FOIA documents reveal that even then, FBI hacking had a broad scope. In fact, one document shows that agents were chastised for overusing the tools because the FBI thought that if they hacked too often, they wouldn’t be able to keep the hacking secret.
As of Thursday, the FBI now has the procedural ability to get a warrant to hack--even though Congress has never actually given them specific authority to do so.
Most troubling, because Congress has failed to act, the FBI can, and will, argue the body has implicitly given its permission for this kind of hacking.
