FBI demands new powers to hack into computers and carry out surveillance
Agency requests rule change but civil liberties groups say 'extremely invasive' technique amounts to unconstitutional power grab
Ed Pilkington in New York
29 October 2014
The FBI is attempting to persuade an obscure regulatory body in Washington to change its rules of engagement in order to seize significant new powers to hack into and carry out surveillance of computers throughout the US and around the world.
Civil liberties groups warn that the proposed rule change amounts to a power grab by the agency that would ride roughshod over strict limits to searches and seizures laid out under the fourth amendment of the US constitution, as well as violate first amendment privacy rights. They have protested that the FBI is seeking to transform its cyber capabilities with minimal public debate and with no congressional oversight.
The regulatory body [1] to which the Department of Justice has applied to make the rule change, the advisory committee on criminal rules, will meet for the first time on November 5 to discuss the issue. The panel will be addressed by a slew of technology experts and privacy advocates concerned about the possible ramifications were the proposals allowed to go into effect next year.
"This is a giant step forward for the FBI's operational capabilities, without any consideration of the policy implications. To be seeking these powers at a time of heightened international concern about US surveillance is an especially brazen and potentially dangerous move," said Ahmed Ghappour, an expert in computer law at University of California, Hastings college of the law, who will be addressing next week's hearing.
The proposed operating changes related to rule 41 of the federal rules of criminal procedure, the terms under which the FBI is allowed to conduct searches under court-approved warrants. Under existing wording, warrants have to be highly focused on specific locations where suspected criminal activity is occurring and approved by judges located in that same district.
But under the proposed amendment, [2] a judge can issue a warrant that would allow the FBI to hack into any computer, no matter where it is located. The change is designed specifically to help federal investigators carry out surveillance on computers that have been "anonymized" – that is, their location has been hidden using tools such as Tor.
The amendment inserts a clause that would allow a judge to issue warrants to gain "remote access" to computers "located within or outside that district" (emphasis added) in cases in which the "district where the media or information is located has been concealed through technological means". The expanded powers to stray across district boundaries would apply to any criminal investigation, not just to terrorist cases as at present.
Were the amendment to be granted by the regulatory committee, the FBI would have the green light to unleash its capabilities – known as "network investigative techniques" – on computers across America and beyond. The techniques involve clandestinely installing malicious software, or malware, onto a computer that in turn allows federal agents effectively to control the machine, downloading all its digital contents, switching its camera or microphone on or off, and even taking over other computers in its network.
"This is an extremely invasive technique," said Chris Soghoian, principal technologist of the American Civil Liberties Union, who will also be addressing the hearing. [3] "We are talking here about giving the FBI the green light to hack into any computer in the country or around the world."
A glimpse into the kinds of operations that could multiply under the new powers was gained this week when Soghoian discovered from documents obtained by the Electronic Frontier Foundation that in 2007 the FBI had faked an Associated Press story [4] as a ruse to insert malware into the computer of a US-based bomb plot suspect. The revelation prompted angry responses from the AP and from the Seattle Times, [5] whose name was also invoked in the documents, though the FBI said it had not in the end imitated the newspaper.
Civil liberties and privacy groups are particularly alarmed that the FBI is seeking such a huge step up in its capabilities through such an apparently backdoor route. Soghoian said of next week's meeting: "This should not be the first public forum for discussion of an issue of this magnitude."
Jennifer Granick, director of civil liberties at the Stanford center for internet and society, said that "this is an investigative technique that we haven't seen before and we haven't thrashed out the implications. It absolutely should not be done through a rule change – it has to be fully debated publicly, and Congress must be involved."
Ghappour has also highlighted [6] the potential fall-out internationally were the amendment to be approved. Under current rules, there are no fourth amendment restrictions to US government surveillance activities in other countries as the US constitution only applies to domestic territory.
However, the US government does accept that it should only carry out clandestine searches abroad where the fourth amendment's "basic requirement of reasonableness" applies. In a letter [7] setting out its case for the rule 41 reform, the department of justice states that new warrants issued to authorise FBI hacking into computers whose location was unknown would "support the reasonableness of the search".
Ghappour fears that such a statement amounts to "possibly the broadest expansion of extraterritorial surveillance power since the FBI's inception". He told the Guardian that "for the first time the courts will be asked to issue warrants allowing searches outside the country".
He warned that the diplomatic consequences could be serious, with short-term FBI investigations undermining the long-term international relationship building of the US state department. "In the age of cyber attacks, this sort of thing can scale up pretty quickly."
Another insight into the expansive thrust of US government thinking in terms of its cyber ambitions was gleaned recently [8] in the prosecution of Ross Ulbricht, the alleged founder of the billion-dollar drug site the Silk Road. Experts suspect that the FBI hacked into the Silk Road server, that was located in Reykjavik, Iceland, though the agency denies that.
In recent legal argument, US prosecutors claimed that even if they had hacked into the server without a warrant, it would have been justified as "a search of foreign property known to contain criminal evidence, for which a warrant was not necessary".
[1] https://www.documentcloud.org/documents/1348429-fbi-committee-hearing.html
[2] https://www.documentcloud.org/documents/1347875-fbi-proposed-amendment-rule-41-1.html
[3] https://www.aclu.org/sites/default/files/assets/aclu_comments_on_rule_41.pdf
[4] http://www.theguardian.com/commentisfree/2014/oct/29/fbi-hacking-press-internet-users
[5] http://seattletimes.com/html/localnews/2024888170_fbinewspaper1xml.html
[7] https://www.documentcloud.org/documents/1347871-fbi-proposed-rule-change.html#document/p5/a184605
[8] https://www.wired.com/2014/10/feds-silk-road-hack-legal/