New rules helping the feds hack computers to begin at midnight

The final opportunity to stop controversial changes to rules governing law enforcement’s use of hacking came and went on Wednesday, leaving the new rules to take effect at midnight.

{mosads}Changes to Rule 41 of the Criminal Procedure will make it easier for law enforcement to get warrants to hack computers. The new provisions were backed by the Justice Department and approved by the Supreme Court and were set to automatically start on December 1 without congressional action.

“Everyone was hopeful at the very least they would delay implementation a few months, to allow for minimal hearings,” said Gabe Rottman, Deputy Director of the Freedom, Security and Technology Project at the Center for Democracy and Technology.

On Wednesday, Sens. Ron Wyden (D-Ore.), Steve Daines (R-Mont.) and Chris Coons (D-Del.) put up a last stand against the updates to Rule 41, attempting to pass two different bills by unanimous consent to delay or outright stop the new provisions from taking hold. On a third attempt, they attempted to garner unanimous consent for a traditional vote.

Majority Whip John Cornyn (R-Texas) objected to all three, ending the bid.

There are two controversial new provisions to Rule 41 that go into practice Thursday. The first permits law enforcement to apply for a warrant with any judge to hack a computer that uses technical means to disguise its location. Without a change in procedure, law enforcement would need to apply for a warrant in the same jurisdiction as the computer, which they could only do if they already could locate it.

A second provision is targeted at botnets — vast networks of hacked computers that can be used to flood targets with enough traffic to knock them offline. The updates to Rule 41 would allow law enforcement to use a single warrant application to hack five or more computers, rather than apply for each individually.

Opponents to the Rule 41 shift say that allowing law enforcement to go to any judge to get a warrant would allow law enforcement to cherry-pick which judges across the whole of the U.S. take the case. They also worry that, since users seldom know their computers have been roped into botnets, granting governments ability to hack those computers means the government will be hacking innocent victims.

The Department of Justice posted a number of entries to its blog over the past week defending the rule. The hacking powers granted to the government have always been there, it argued, the new rule only concerns what venue law enforcement applies for warrants to take advantage of those powers.

“Saying it’s about venue doesn’t detract from the issues that have been raised,” said Rottman.

Digital rights advocates and the lawmakers backing a delay to Rule 41 worry that the issue might not have received the attention that it deserved from lawmakers.

“Congress has never held a hearing on government hacking. That’s ridiculous,” said Nate Cardozo, an attorney with the Electronic Frontier Foundation.

In part, said Cardozo, that was because the rule change came in an election year, when “Congress wasn’t going to get anything done.”

But many suggest the battle was lost because it was fought in the wrong field. The process to amend criminal procedure is time-consuming and deliberate, but outside the public eye. Though it took three years for the changes to be approved by the courts, most only recently took notice of the issue.

“We lost this fight when the rules committee decided this was a procedural change and not a substantive one,” he said.

Rottman, Cardozo and others stress that Congress can halt changes to Rule 41 even after the changes take effect.

“Obviously, congressional inaction is disappointing,” said Robyn Greene, Policy Counsel and Government Affairs Lead at the Open Technology Institute. “This is the type of thing Congress should express oversight over — something they still can express oversight over.”

Greene said that while this skirmish might have been lost, just having Congress take note of the broader issue of law enforcement hacking is a minor victory. It is a point she believes activists can build on.

And Cardozo is “optimistic” that the new Congress will see the issue through.

“If we can get the GOP to come back to its roots and be the party of small government and individual liberty, we can at least get hearings,” he said.