Legislators Demand Answers From DOJ On Expanded Hacking Powers It's Seeking

There's only a couple of months left until the DOJ's proposed Rule 41 changes become law. All Congress has to do is nothing. This is a level of effort Congress is mostly amenable to. If this becomes law, worldwide deployments of malware/spyware during investigations will be unable to be challenged in court. In addition, the DOJ wants to be part of the cyberwar. It's seeking permission to remotely access zombie computers/devices used in cyberattacks to "clean" them.

The rule changes would also add a presumption of guilt to an activity performed by millions of computer users around the world:

Opponents of the pending change to Rule 41 say that it unlawfully confers a new authority that changes substantive rights. First off, they contend that it adds a criminal taint to a perfectly legal practice: using location to cloak your location.

"There are countless reasons people may want to use technology to shield their privacy," wrote the Electronic Frontier Foundation earlier this year. "From journalists communicating with sources to victims of domestic violence seeking information on legal services, people worldwide depend on privacy tools for both safety and security."

The DOJ has argued that these Rule 41 amendments are just "clarifications" of existing law:

"The amendment would not authorize the government to undertake any search or seizure or use any remote search technique not already permitted under current law," the DOJ told Consumerist in May, noting that law enforcement would still need to demonstrate probable cause.

This statement obviously isn't true considering how many federal judges have agreed the warrant it used in the Playpen investigation exceeded existing jurisdictional limits.

Fortunately, there are legislators pushing back against the DOJ's proposed changes. Ron Wyden has sent a letter [PDF] to the DOJ -- co-signed by 22 other legislators -- asking for clarification on the DOJ's interpretation of the changes it's seeking.

One of the questions the group has is how the DOJ can produce probable cause to search thousands of devices.

Please describe any differences in legal requirements between obtaining a warrant for a physical search versus obtaining a warrant for a remote electronic search. In particular, and if applicable, please describe how the principle of probable cause may be used to justify the remote search of tens of thousands of devices. Is it sufficient probable cause for a search that a device merely be "damaged" and connected to a crime?

The letter also raises the issue of forum shopping. With jurisdictional limits removed, federal law enforcement officers are free to find judges more willing to sign off on their warrant requests, rather than being forced to work with those in the locality the alleged criminal activity took place.

The DOJ's proposed botnet cleaning efforts raise a whole set of new troubling questions, ones that Wyden and co. would like to see answered before allowing the rule changes to slide by unopposed. First, there's the question of unforeseen collateral damage -- efforts that hurt more than help.

We are concerned that the deployment of software to search for and possibly disable a botnet may have unintended consequences on internet-connected devices, from smartphones to medical devices. Please describe the testing that is conducted on the viability of "network investigative techniques" to safely search devices such as phones, tablets, hospital information systems, and internet-connected video monitoring systems.

Then there's the question about the proposed "cleaning" efforts. Under what authority will law enforcement break into Americans' computers and screw around with their software and hardware?

Will law enforcement use authority under the proposed amendments to disable or otherwise render inoperable software that is damaging or has damaged a protected device? In other words, will network investigative techniques be used to "clean" infected devices, including devices that belong to innocent Americans? Has the Department ever attempted to "clean" infected computers in the past? If so, under what legal authority?

Good questions. Hopefully, we'll see the answers sometime before December 31st.