Federal Agents' Mass Hacking Rule Targets Networked Devices

Federal agents can now use changes in a mass hacking rule to greatly expand searches of networked computers and other devices by making it easier to obtain warrants.

Opponents tried and failed to head off the rule change in Congress.

The Supreme Court ruled earlier this year that federal judges can issue warrants outside of their jurisdiction in cyber-related cases that involve multiple districts and countries, according to the tech website ZDNet.

"Simply put: all it takes is for the FBI to ask a friendly judge to sign off on a search warrant that would let the agency use its so-called network investigative techniques – or NITs – to carry out hacks and conduct searches on computers and devices potentially anywhere in the world," Zack Whittaker said on the ZDNet blog Zero Day.

"We've seen good uses of that hacking effort, such as catching users of a dark web child porn site, but one prominent privacy-minded lawmaker said in a statement that the rule change 'would allow the government to get a single warrant to hack an unlimited number of Americans' computers if their computers had been affected by criminals, possibly without notifying the victims.'" Whittaker continued.

Federal prosecutors say the update to what is called Rule 41 will help authorities investigate criminals' increased use of botnets, said USA Today.

"This change would not permit indiscriminate surveillance of thousands of victim computers," said Assistant Attorney General Leslie Caldwell.

Authorities must make "reasonable efforts" under the new rule to tell law-abiding citizens that they have been hacked by the government, but privacy activists charged that the notification is too weak.

"It's unfortunate that Congress refused to consider changes to Rule 41 before they go into effect, but this is far from the end of the conversation," Nathan White, the senior legislative manager at Access Now told the International Business Times.

"Changes to Rule 41 were sought to make it easier for law enforcement to conduct hacking operations. However, Congress has never explicitly authorized government hacking at all. In fact, in many cases hacking is inconsistent with human rights and the United States' international treaty obligations."