Senators Ron Wyden and Rand Paul will introduce a bill this week to halt implementation of a rule easing the government’s ability to hack untold numbers of devices around the world. They argue the rule is too broad and was approved without public debate.
“This is a major policy change,” Senator Wyden (D-Oregon) told the Los Angeles Times. “This has been buried from the public and from their elected officials. And they should know about it. This is not just a modest administrative change.”
The amendment contested by Wyden and Senator Paul (R-Kentucky) was requested by the Department of Justice to update Rule 41 of the Federal Rules of Criminal Procedure. Adopted by the Supreme Court last month and passed on to Congress for review, it would create a sweeping expansion of law enforcement’s ability to engage in hacking and surveillance.
Wyden’s legislation will be co-sponsored by Paul, who has also been critical of the expansion of government surveillance powers in the past. It was Paul who occupied the Senate floor for 10-and-a-half hours in May of 2015 to highlight his opposition to extending key parts of the PATRIOT Act that were set to expire. Wyden aided Paul in his filibuster by taking to the Senate floor to ask him questions.
Under the rule change, a judge could issue a single warrant for law enforcement to remotely access, search, seize, or copy data when “the district where the media or information is located has been concealed through technological means.”
You need to know: ‘Rule 41 is…a massive expansion of surveillance state. Yet Congress wasn’t even a participant.” https://t.co/8656oTv1ez
— Arab American Inst. (@AAIUSA) May 6, 2016
Privacy advocates such as The Electronic Frontier Foundation have come out against the rule change. In a recent blog posting, EFF wrote that this new power could “override privacy-protection tools to safeguard one’s location…such as Tor…or [those] people who deny access to location data for smartphone apps because they don’t like sharing their location with ad networks.”
If the rule goes into effect, it could threaten the work of journalists wanting to protect the identity of their sources, political dissidents, and those seeking privacy for security and safety reasons.
The rule change also means federal judges in any jurisdiction would be able to issue warrants for searches and seizures of computers “damaged without authorization” and “located in five or more districts.”
EFF said the second part of the rule would authorize a judge to issue a search warrant allowing computers that may be part of a botnet to be hacked into, “[meaning] victims of malware could find themselves doubly infiltrated: their computers infected with malware and used to contribute to a botnet, and then government agents given free rein to remotely access their computers as part of an investigation.”
“This is a dangerous expansion of powers,” said EFF’s Rainey Reitman.
Privacy advocates and Senator Wyden are also concerned that the Justice Department will seek “friendly” judges to obtain warrants and are skeptical about the department’s assertion that the rule change is merely a procedural fix to address crime fighting challenges in the internet age.
“The department has been less than forthcoming about the extent of its hacking, which raises concerns about the proposal,” Neema Guliani, a lawyer for the ACLU told the Los Angeles Times. “They’re saying they have a problem in cases where they don’t know where the computer is, or think someone is trying to hide it. But the rule change is a lot broader than that. If they want to address that issue, they could have narrowed the rule by saying they could conduct the search only to locate the computer.”
The FBI maintains that they will still have to get a search warrant, show probable cause, and explain what they are doing to the court.
It is uncertain what reception Wyden’s bill will receive. Senator Charles Grassley (R-Iowa) told the LA Times that the Senate Judiciary Committee, which he chairs, will analyze the reasoning behind the rule change.
If Congress doesn’t act, the rule amendment will go into effect on December 1, 2016.
At the time the rule change was announced, Wyden said, “These are complex issues involving privacy, digital security and Fourth Amendment rights, which require thoughtful debate and public vetting. Substantive policy changes like these are clearly a job for Congress, the American people and their elected representatives, not an obscure bureaucratic process.”