The US Congress has seven months to block a potentially massive expansion of the government's ability to hack into suspects' computers.
At the FBI’s request this week, the supreme court ruled that federal judges should be able to issue hacking warrants to federal law enforcement for anywhere in the US if the suspect has tried to hide their location, as criminal suspects are wont to do.
Additionally, the FBI could get authority to infiltrate any computer - regardless of the owner - if it has already been taken over by bad hackers.
The changes to so-called “rule 41” go into effect on December 1st unless Congress acts to block them.
The move has set up a showdown with Senator Ron Wyden, the most senior Democrat on the Senate intelligence committee, who is marshaling the opposition on Capitol Hill.
He told the Guardian on Friday that he plans to introduce a bill blocking the court’s move.
The debate offers a unique window into the struggle to maintain America’s protections against unreasonable searches in the digital age.
Many of the rules were written for a world based on searching physical spaces, like a desk, and at distinct locations, like an office.
Such rules often don’t adapt well to the era of the internet and ubiquitous online services, where it is also possible to, in theory, search millions of computers at the same time.
The issue flared up earlier this week when two judges struck down search warrants for suspected users of child sex abuse websites. The FBI had taken over the website in an attempt to trap users and eventually searched hundreds of computers after a federal magistrate in Virginia issued a warrant to hack all visitors to the website.
The government reasoned this was permissible, in part, because visitors to the site were trying to conceal their location by using the Tor browser, which can help anonymise internet users.
In this case, the FBI had found a way to hack the service to unmask visitors to the sex abuse website.
Civil liberties advocates, acknowledging the ickiness of the case, cried foul. Not because they wanted to defend child sex abuse material, but because, they said, domestic law enforcement shouldn’t be able to search potentially millions of computers based on the authority of one judge’s order.
Judges in Oklahoma and Massachusetts have ruled that the Virginia warrant targeting suspects in their territories is invalid and the evidence that they visited the sex abuse website consequently is inadmissible.
And without digital proof that the suspects visited the criminal websites, there isn’t much of a case against them.
Wyden, without getting into the specifics of the case, said he agreed US law enforcement shouldn’t be able to conduct such bulk surveillance.
“One warrant for one judge can, in effect, reach millions of computers,” he said on Friday. “This is really a big issue when you’re talking about expanding the government’s hacking and surveillance authority.”
Guardian