The Power of Perspectives

The Canadian Bar Association

Mariane Gravelle

US extraterritorial hacking warrants in effect

December 12 2016 12 December 2016


As the landscape of our society has changed significantly with the advent of the internet, it should come as no surprise that an extensive amount of criminal activity takes place online. This poses new challenges to law enforcement agencies as the development of rules and regulations has not been as quick to evolve as technology has.

In April 2016, however, the Supreme Court of the United States approved changes to rule 41 of the Federal Rules of Criminal Procedure, which came into effect last month, that allow law enforcement agencies to obtain search warrants that are enforceable in extraterritorial jurisdictions. Simply put, this will allow American law enforcement agencies to, amongst other things, hack into the computers of individuals located outside of the jurisdiction they operate in. These changes came into effect Thursday December 1st, 2016.

Of the changes, Motherboard contributor Joseph Cox writes:

Legal experts have described the move as the broadest expansion of extraterritorial surveillance power since the FBI's inception, an agency that has already embarked on international hacking operations. The Department of Justice, meanwhile, has defended the changes, arguing they are crucial for policing crime in an age of anonymization technology such as Tor.

The move centers around Rule 41 of the Federal Rules of Criminal Procedure, which regulates when and under what particular circumstances judges can issues warrants for searches and seizures, including remote searches of suspects’ computers.

According to the Department of Justice, the problem is that when a criminal suspect is using Tor—perhaps to post child pornography on a dark web site—it's very difficult to know where the person is currently located.

In a blog post appropriately titled “Ensuring Tech-Savvy Criminals Do Not Have Immunity from Investigation”, Assistant Attorney General Leslie R. Caldwell weighed in on this issue on behalf of the United States Department of Justice writing, amongst other things, that

We believe technology should not create a lawless zone merely because a procedural rule has not kept up with the times.  That is why, for almost three years, the Justice Department has followed the process set by Congress to fill this gap in the Rules by making clear which courts are available to consider whether a particular warrant application comports with the Fourth Amendment.  The amendments do not create any new law enforcement authority, or make any change to what constitutes a crime or what must be shown to a court in order to investigate crime.  Nor do they change in any way the traditional protections under the Fourth Amendment, such as the requirement that investigators establish probable cause before each search.  They simply do what the Rules were always intended to do: identify a judge who can consider whether to grant or deny a warrant application.

Jennifer Daskal addresses concerns about privacy:

That said, there is no doubt that the amendment makes it a whole lot easier for the government to seek and get approval for remote searches and the use of network investigative techniques that enable it to install malware on a target computer.  It both makes explicit the authority to engage in these types of remote searches and clears jurisdictional and logistical hurdles that otherwise make it difficult  (or impossible) for federal agents to obtain judicial approval. There is also no doubt that the amendment will, at least in some circumstances, result in remote searches of—and the installation of malware on—data and devices located extraterritorially.

These developments raise important security, privacy, and foreign relations considerations.   They thus point to the critical importance of rigorous court review, meaningful internal, executive-branch controls, and further congressional action.

First, at the same time that remotely accessing a device may provide the only way to effectively identify perpetrators, protect attacked devices, and gather information, the use of such hacking tools carries risks. Among the concerns, network investigative tools developed and employed by the government can be co-opted and used by criminals; malware designed to protect attacked devices can inadvertently spread and infect additional devices; and multi-target searches may, and in fact are likely to, lead to the search and seizure of the data of wholly innocent persons.

Courts are on the front lines in protecting against these risks. They have a critical role to play in assessing the specific tools being employed, ensuring that the constitution’s requirement of particularity is being complied with (which requires an understanding of where and how the tool is to be applied), insisting on effective minimization procedures to protect against the retention and dissemination of non relevant information, and, whenever possible, demanding that the government provide meaningful notice to the target of the search or seizure.  But understanding and assessing what the government is seeking to do requires at least some technological expertise.

Obviously, this new development could very well impact Canadians. One needn’t worry that the FBI will come knocking the minute the latest episode of Game of Thrones has finished downloading onto their computer. Search warrants coming from the U.S. will still be subject to approval by the Minister of Justice upon ex parte application for a search warrant (Mutual Legal Assistance in Criminal Matters Act).

It will take time to gain a clear understanding of how these changes will affect those living outside of the U.S. Still, this is clearly an active step towards identifying individuals operating criminally and anonymously online.

No comments

Leave message

 Security code