Search warrant change sparks backlash

A battle is brewing on Capitol Hill over a seemingly small change to federal hacking powers that critics say will authorize sweeping government surveillance. 

Unless Congress moves by December to block the change, judges will be allowed to grant a single warrant for multiple electronic searches in different locations — even when investigators don’t know the physical location of a device.

{mosads}The fight is being waged against the backdrop of a massive government hack into one of the largest child pornography sites on the dark Web. 

A judge in Massachusetts has already thrown out evidence in a case against users of the site, because without the proposed change, U.S. District Judge William Young ruled, the warrant the government used to search users’ computers was invalid.

The case underscores the stakes for the Justice Department, which has been quietly campaigning for the amendment for years.

But the stakes are equally high for opponents of the change. Sen. Ron Wyden (D-Ore.), who is expected to introduce legislation blocking the proposal next week, has blasted the warrant proposal as a “sprawling expansion of government surveillance.” 

At issue is a criminal procedure rule known as Rule 41 that governs search and seizure. In the physical world, prosecutors must seek search warrants in the jurisdiction in which a search is carried out.

The DOJ argues that the search powers must be broadened to keep pace with the rapidly progressing technology that criminals use to mask their identities online.

But civil liberties advocates — and some tech companies — are horrified by the proposal. Allowing multi-district, multi-computer searches, they say, would allow the government to conduct bulk hacking with very little oversight.

“The proposed amendment substantively expands the government’s current authority and raises a number of monumental and highly complex constitutional, legal and geopolitical concerns,” lawyers for Google wrote in a 14-page comment opposing the rule change.

Critics say that the amendment — requested by DOJ and approved by the Supreme Court last month — is the kind of policy change that should be decided by Congress, not the court system’s policy-making body.

DOJ has pushed back, arguing that the changes it requested are a minor procedural tweak and characterizing opposition as “a misunderstanding of current law, the scope of the amendment, and the serious problems that it addresses.”

“It’s true that it will allow the government to probably conduct more surveillance, but it’s all surveillance that already comports with the Fourth Amendment and the requirements for a search warrant,” one former DOJ official told The Hill.

The amendment makes two key changes to Rule 41, each with their own set of concerns for critics.

The first change, which would allow judges to issue a warrant when the location of the computer in question is unknown, brings the law for computer searches in line with searches of online accounts. A judge in Virginia, for example, can issue a warrant for a user’s account with an email provider headquartered in California.

There are concerns that allowing agents to seek warrants from any district would incentivize what’s called “forum shopping,” where investigators identify and reuse judges who are inclined to issue more invasive warrants.

Others worry that the change would violate a provision of the Fourth Amendment that requires a search location to be specifically described, potentially allowing the government to hack victims as well as perpetrators.

Other critics are more focused on the second change to Rule 41, which would allow the government to seek a single warrant for relevant computers in five or more districts.  

The change was designed to help the DOJ investigate computer viruses that might infect thousands of computers, so-called “botnets” that can drain millions of dollars from victims across the globe.

DOJ officials say the change would save valuable time and free up resources that are spent filing dozens of identical warrant applications in jurisdictions across the country. 

Opponents say it would authorize the government to deploy controversial and largely secret hacking techniques across potentially thousands of computers — causing unknown harm to botnet victims — with little to no oversight. 

“If the government is able to establish probable cause for a variety of computers in a single warrant, that starts looking like a general warrant and gives us cause for concern,” a Republican Senate aide told The Hill.

Like many tech privacy issues, the Rule 41 change has made strange bedfellows on Capitol Hill, uniting civil libertarians from the right with privacy advocates on the left.

Sen. Rand Paul (R-Ky.) will be joining Wyden’s bill fighting the changes as a co-sponsor, a Paul spokesman told The Hill.

“I don’t think this is a partisan thing,” Rep. Darrell Issa (R-Calif.) said Thursday.

The same Republican Senate aide said that while his office will not be joining the Wyden-Paul effort to scrap the entire change, they are weighing whether parts of the new rule should be amended.

“Maybe part of this can be retained,” the aide said. “There’s reason to believe the second piece can be changed in a way that might mitigate our concerns.”

Opponents of the amendment will be fighting an uphill battle. Many lawmakers The Hill spoke to — including members of the Judiciary Committee in both chambers — weren’t even aware of the rule change.

And in order for opponents to roll back the new rule, which goes into effect in December, Congress would have to pass affirmative legislation amending it — something onlookers say will be difficult during an election year, no matter what the issue is. 

“The chance of Congress passing affirmative legislation on anything this year is pretty slim,” said Christopher Soghoian, chief technologist at the American Civil Liberties Union.

Some opponents of the change are more hopeful, believing they have the ear of a powerful advocate.

Sen. Chuck Grassley (R-Iowa) last summer asked FBI Director James B. Comey a number of probing questions about the DOJ’s request to amend Rule 41.

“The FBI’s use of spyware and the DOJ’s proposed changes to the legal framework through which the FBI receives judicial approval to do so raise several important questions,” the chairman of the Senate Judiciary Committee wrote.

But Grassley has not tipped his hand since the Supreme Court approved the changes last month.

Meanwhile, former DOJ officials say the government has the perfect example to lobby its position. 

In February 2015, FBI investigators seized control of the computer server running Playpen, a child pornography site that at its height averaged 11,000 unique visitors each week.

But instead of shutting the site down, investigators ran Playpen for two weeks, during which time they hacked the thousands of different users accessing the site, pursuant to a single search warrant.

The government has brought numerous cases against users of the site it was able to identify through remote access, many of whom are now challenging the warrant.

Last month, a Massachusetts defendant in the case successfully persuaded Judge Carney that the warrant “was issued without jurisdiction and thus was void.”

Other defendants have been quick to react. At least one defense lawyer is even seeking to withdraw his client’s guilty plea.

With its case potentially unraveling, the Department of Justice is under pressure to shepherd the Rule 41 change through Congress.

And there’s no question that the optics are in its favor in the Playpen case.

“When DOJ wants to go up to the Hill and get something, we have to give the use cases,” a former Justice official told The Hill. “It’s a widely-known secret: Child pornography cases are the best ones to get changes in legislation for. Who’s against catching child predators?”

–This piece was updated on Monday at 4:50 p.m.