OTI Joins Over 45 Groups & Companies for Day of Action to Say No to Rule 41 Changes

Today, OTI joins a coalition of over 45 groups and companies who have sent a letter to Congress and mobilized for a day of action to oppose pending changes to Rule 41 of the Federal Rules of Criminal Procedure. Rule 41 governs when federal magistrate judges may issue warrants, and this rule change would drastically expand these powers. The changes, proposed by the Department of Justice and approved by the obscure Advisory Committee on the Federal Rules of Criminal Procedure could significantly expand government hacking, unless Congress stops it from going into effect on December 1, by passing the Stopping Mass Hacking Act (SMH Act; S. 2952; H.R. 5321).

The amendment to Rule 41 would expand the government’s hacking activities in two ways:

• Remove Jurisdictional Requirements: Except for in limited circumstances, judges may only issue a warrant for a search within their jurisdiction. The Rule 41 change would undermine that jurisdictional requirement and let the government go to any federal magistrate judge where “activities related to a crime may have occurred” -- essentially anywhere in the country -- to get a warrant to remotely hack computers.

• Allow Hacking of Innocent Americans: It would allow that government to hack into innocent people’s computers based on the fact that they have already been the victims of  computer crime, such as computers that - unknown to their victims - have been turned into part of a botnet. This means that one warrant from one judge could potentially lead to the government hacking thousands or even millions of innocents’ computers.

The executive branch engaged in overreach when it asked the Advisory Committee to amend Rule 41:

• What the Advisory Committee on Rules of Criminal Procedure does: The Advisory Committee is only authorized to issue procedural rules. However, the amendment would make substantive law. Therefore, by going to the Advisory Committee - an arm of the judiciary - to obtain this rule change instead of seeking legislation from Congress, the Justice Department usurped Congress’ authority to make law and engaged in executive overreach.

• Why the Rule 41 Amendment is substantive and not procedural: The Rule 41 change is substantive because it presumes that hacking is already lawful, despite that fact that Congress has never legislated on whether the government should hack, let alone established necessary rules or protections as it did with wiretap orders. Additionally, the impact of the rule - the vast expansion of government hacking - is itself highly substantive because of the significant impact it would have on Americans’ privacy and cybersecurity.

Finally, the amendment to Rule 41 raises serious constitutional and cybersecurity concerns:

• Harming Innocent Victims of Computer Crime or Third Parties: When the government hacks into a computer that has become part of a botnet in order to “clean” the computer - a term that has not been clearly defined - it could unintentionally destroy data on the owner’s network or device, or otherwise harm the device. Additionally, when the government uses malware, it risks the malicious code spreading to non-targeted networks and devices. Finally, if the government uses a zero-day exploit to hack into targeted devices or networks, but does not disclose that exploit to the developer or the product or service, it prolongs the risk that innocent Internet users will be hacked by malicious third parties who discover that exploit.

• Fourth Amendment Concerns: Telephone calls used to be the primary means by which Americans communicated some of the most private details of their lives. Today, we share and store that and far more personal information on the Internet and on connected devices. Government hacking can reveal detailed information not only of communications contents, but also personal information such as political and religious leanings, financial and medical information, reading interests and hobbies, location information, and much more, and, as such, the practice is far more invasive of Americans’ privacy than wiretaps. However, where wiretaps are subject to strict rules and privacy protections set forth by Congress, the FBI has been using hacking as an investigative technique for well over a decade, even though Congress has never considered whether it is appropriate, let alone what the rules of the road should be to ensure that the FBI and Department of Justice’s investigate technique comply with Fourth Amendment privacy protections.  

• Abuse by Forum Shopping: Without the protections of current jurisdictional requirements, the government could engage in a troubling practice called “forum shopping,” where it purposefully applies for warrants from certain magistrate judges that it believes are most likely to issue a favorable decision, even when those judges would have been unlikely to have jurisdiction, if not for this rule change.  

Congress can stop this dangerous rule change from going into effect. Congress should rein in this act of executive overreach and stop the Rule 41 Amendment from going into effect on December 1 by passing the SMH Act. Whether the government should hack, and if so, what the rules of the road should be, deserves rigorous public debate. It should not be decided by obscure bureaucratic bodies like the Advisory Committee.

Government hacking policies significantly impact the cybersecurity and privacy of all Americans. Though little information has been made public, it appears the FBI has been hacking for over a decade, despite never having sought or received approval from Congress. Additionally, federal magistrate judges that approve the government’s requests to hack often don’t fully understand what it is they are authorizing, and the government uses unexplained phrases like “network investigative techniques” that obscures the fact that the government will be using malware or other common hacking techniques. Given the risks to cybersecurity and privacy, Congress should not wait until after the Rule 41 Amendment has gone into effect and government hacking has significantly expanded to have this necessary public debate. We should have it now.

Join OTI and the dozens of other organizations and companies that oppose the change to Rule 41 by visiting www.NoGlobalWarrants.org to tell your member of Congress to support the SMH Act.