Senator Ron Wyden Wrings His Hands of Over Criminal Rule 41(b)
December 2, 2016 (Fault Lines) – Most of the time lawyers barely pay attention to rule amendments. So, when an amendment to a federal rule hits the mainstream press and involves a back and forth between a U.S. Senator and the Department of Justice, it is noteworthy.
Unlike a state like Ohio, Congress must approve changes to the rules of procedure and evidence. Once the Supreme Court approves the rule, it will become effective unless Congress intervenes. If Congress does nothing, then the rule change will take effect. Thus, an upset Senator is not a trivial matter.
Rule 41 is the procedure for search and seizure of people and property, i.e. arrest and search warrants. The amendment changes section (b), which deals with venue. The changes appear to be relatively small, adding three paragraphs of note.
(b) Venue for a Warrant Application. At the request of a federal law enforcement officer or an attorney for the government:
* * * * *
(6) a magistrate judge with authority in any district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if:
(A) the district where the media or information is located has been concealed through technological means; or
(B) in an investigation of a violation of 18 U.S.C. § 1030(a)(5), the media are protected computers that have been damaged without authorization and are located in five or more districts.
In essence, the amendment allows the magistrate to permit the government to remotely access computers that are related to criminal activity in the district. This change is subject to two qualifications: the suspect was using technological means to conceal the location of the computer, or the investigation into computer hacking involves conduct that occurred in five or more districts.
Seems like reasonable changes. If the government cannot locate the computer because the defendant has taken steps to conceal its location, then it should be able to take more aggressive steps to locate it. Likewise, when the defendant is committing crimes in multiple districts, it makes sense to consolidate that investigation into one warrant. Moreover, the qualification of five or more district minimize “forum shopping,” where the investigators might cherry pick a particularly friendly magistrate.
But not everyone sees this change as, on balance, a good thing. Notably Sen. Ron Wyden. The Department of Justice provided a response, which appeared to stave off Congressional action and allow the Rule go into effect. But Sen. Wyden was not satisfied and said this about the Rule going into effect:
These changes say that if law enforcement doesn’t know where an electronic device is located, a magistrate judge will now have the the [sic] authority to issue a warrant to remotely search the device, anywhere in the world. While it may be appropriate to address the issue of allowing a remote electronic search for a device at an unknown location, Congress needs to consider what protections must be in place to protect Americans’ digital security and privacy.
This is a little bit of insider baseball here. What spurred this rule change was the FBI’s Playpen sting operation. The FBI discovered a child porn site unsuccessfully using Tor to hide its location. Because other users were connecting to this secret site using Tor, the FBI couldn’t track down the child porn downloaders. So, it used the seized site to hack into the downloaders’ computers to locate them. The rub here is the FBI ran a sting by continuing to facilitate a crime. Understandably, it caused many people to question the ethics of this form of investigation.
The problem here is that Sen. Wyden is conflating two issues that were related but not inseparable, or related going forward. It’s certainly prudent for Congress to investigate and review FBI hacking computers to “enforce the law.” We’ve been down this path before, where technology available to law enforcement outstrips the law. So, the Senator is doing the right thing in using Congress to possibly check the Executive.
But until Congress passes such a statute, it behooves the judiciary to respond within its own authority. The federal courts are dealing with a variety of cases filed due to this technique, and its success is likely to invite future uses of this technique. Perhaps the technique violated the old rule, but there’s nothing wrong with conforming the rule to reality.
This is a new and uncertain area of law, so there needs to be full and careful debate. The ACLU has a thorough discussion of the Fourth Amendment ramifications and the technological questions at issue with these kinds of searches.
The second part of the change to Rule 41 would give a magistrate judge the authority to issue a single warrant that would authorize the search of an unlimited number — potentially thousands or millions — of devices, located anywhere in the world. These changes would dramatically expand the government’s hacking and surveillance authority.
Wow, those are large numbers. Panic! First of all, if millions of people in the U.S. are downloading child porn, then the problem is much larger than we imagined. Moreover, they aren’t very sympathetic victims of FBI hacking. What Sen. Wyden appears to be referring to is the ability of the FBI to hack back criminal hackers. When hackers use innocent computer in a botnet attack, the FBI can get a warrant to poke around those computers, even though the computer’s owner had no such criminal intent.
While it is possible that the government could take this data, index it or find evidence of an unrelated crime, it is not clear that electronic plain view would allow a prosecution to go forward, based on this evidence.
In any event, we allow the government to intercept calls, read emails, bug room, and get cell phone location data with either court orders or warrants. Allowing the FBI to insert a small piece of code to reveal the IP address of a computer hacker seems well within the scope of what a search warrant allows. Of course, the Rule doesn’t necessarily limit the scope of the remote hack, but, again, the scope of white hat hacking an issue for Congress to decide. The judiciary reviews applications and approves warrants.
The American public should understand that these changes won’t just affect criminals: computer security experts and civil liberties advocates say the amendments would also dramatically expand the government’s ability to hack the electronic devices of law-abiding Americans if their devices were affected by a computer attack. Devices will be subject to search if their owners were victims of a botnet attack — so the government will be treating victims of hacking the same way they treat the perpetrators.
Sen. Wyden is absolutely correct that the Playpen investigation raised important issues regarding the authority federal agencies should have in hacking computers. Nevermind the ethical issues. But Rule 41(b)(6), by itself, is relatively benign. Probable cause and particularity is still required for the government to get such a warrant. And we want the government to be able to catch criminals. And we’ve given them the latitude in the past to use electronic means to capture potential evidence. So, the real fight should be how Congress crafts the FBI’s authority going forward, not whether a rule of criminal procedure fixes a venue problem that exists now.