Policy —

In two weeks, it will be easier for Uncle Sam to search your computer [Updated]

Under Rule 41, warrants allow searches of multiple devices—without naming the suspects.

In two weeks, it will be easier for Uncle Sam to search your computer [Updated]

Update 1:52pm EST: New legislation was just proposed to delay implementation of Rule 41. Its passage is questionable.

Original story:
Beginning December 1, the US surveillance state will expand—all without a congressional vote.

Earlier this year, a new Federal Rule of Criminal Procedure was amended after three years of study by an unelected advisory committee. It was signed by the US Supreme Court and allows judges to sign warrants to allow the authorities to hack into computers outside a judge's jurisdiction. Rule 41 also grants judges the power to use one warrant to search multiple computers anywhere instead of requiring warrants for each computer. Absent the rule, federal judges may only authorize electronic searches within their own judicial district.

While this may seem bureaucratic or like a technicality, in practice, the new rule will have a big impact on investigating cybercrime, according to the Justice Department. Evidence has been suppressed in some child pornography prosecutions because a Virginia magistrate allowed the FBI to seize and operate the Tor-hidden site Playpen for 13 days. Investigators also deployed malware that disrupted Tor's privacy protections and revealed more than 1,000 true IP addresses, which led to 137 prosecutions nationwide. In a few of those prosecutions, judges tossed cases because of the jurisdiction rule that Rule 41 now cures.

"For example, if agents are investigating criminals who are sexually exploiting children and uploading videos of that exploitation for others to see—but concealing their locations through anonymizing technology—agents will be able to apply for a search warrant to discover where they are located," according to Leslie Caldwell, the assistant attorney general.

Months-old proposed legislation to thwart the new rule, which can lead to the wanton surveillance of innocent people, has gone nowhere—meaning the changeover will likely take force two weeks from today on December 1. Civil rights groups and a handful of lawmakers are opposed to the new measure because a warrant would not have to say with any particularity who and what the authorities are searching for. And the requirement that the government provide the target with a notice that a search took place presents new challenges.

Sen. Ron Wyden (D-OR) is backing proposed legislation to unwind Rule 41. It hasn't gotten a committee hearing, and neither has a House companion bill. The proposals have been dead on arrival.

Wyden, however, claims that such a dramatic policy change should be decided by Congress, not an unelected advisory committee working in conjunction with the Supreme Court.

"For law enforcement to conduct a remote electronic search, they generally need to plant malware in — i.e. hack — a device," Wyden wrote recently on Medium about the new rule. "These rule changes will allow the government to search millions of computers with the warrant of a single judge. To me, that’s clearly a policy change that’s outside the scope of an 'administrative change,' and it is something that Congress should consider."

For now, no changes have been enacted, and the deadline is ticking before Rule 41 becomes law.

Sen Christopher Coons, a Delaware Democrat, proposed legislation Thursday afternoon that would delay Rule 41 from becoming law for at least six months.

"The proposed changes are serious and present significant privacy concerns that warrant careful consideration and debate," Coons said.

Channel Ars Technica