U.S. high court approves rule change to expand FBI hacking power | Hacker News Reader

U.S. high court approves rule change to expand FBI hacking power

reuters.com

155 pointslucasjans62 comments

The actual proposed edits are here: http://www.supremecourt.gov/orders/courtorders/frcr16_8mad.p... (page 6 of the documents after the letters).

Note that "jurisdiction" in this context is primarily referring to "venue." Venue is a set of rules within the federal courts' rules of procedure that specify which of the 94 judicial districts within the federal court system particular matters must be brought to. Generally, a warrant must be issued by the court in the district where the person or property to be searched may be found. This change relaxes that requirement under specific circumstances: 1) the location of the computer to be searched has been concealed by some technological means; or 2) for cases under 18 U.S. Code § 1030 (fraud in connection with computers). In that case, a judge in any jurisdiction where some of the criminal activity occurred can issue the warrant.

Your facts and legal insights are always appreciated.

> The U.S. Justice Department, which has pushed for the rule change since 2013, has described it as a minor modification needed to modernize the criminal code for the digital age, and has said it would not permit searches or seizures that are not already legal.

So... "Don't worry about this seemingly bad change, because it will have no effect!"?

I have a counter-proposal then: Let's not make the change, as that will also have no effect, and everyone will be happy.

There is a different between "legal to do" and "within one's jurisdiction".

They are clearly lying through indirection unfortunately. :P

Congress gave the FBI the role to hack any computer anywhere in the world, no matter who those computers were suspected to belong to.

When it needed a warrant it had a pretty complicated process, and frequently resorted to gaining cooperation with the local authorities in another country and getting dual local warrant equivalents in another country. A costly redundancy and not always achievable.

The FBI is just getting the US court system to help with the mandate Congress already gave them.

Or, rephrased, Congress gave the FBI a mandate they couldn't legally fulfil.

Can you be more specific here? Normally, when Congress tasks an agency with something, that tasking defines the contours of what is and isn't legal. Defining "legal" is Congress's job.

that's not true at all.

The FBI has had no problem hacking computers around the world, getting the legal cooperation required domestically and abroad, and winning court cases.

This change simply streamlines the process

I don't think that's quite right. As I understand it, the FBI could get a search warrant for non-US computers from courts essentially anywhere in the US they liked under the old rules. What they couldn't do was get a warrant from a judge and use it to hack computers in the US that were outside that judge's jurisdiction.

hey, the rules I was referring to were the old rules, not today's article.

Can you point me to the statutory language that "gave the FBI the role to hack any computer anywhere in the world, no matter who those computers were suspected to belong to"? Thanks.

sure I'll see if I can find it, I had looked into this for the Silk Road case, where they hacked into a computer in Reykjavik Iceland

I found it at that point in time

Nowhere in your quote does the FBI say it will "have no effect." It says that "it would not permit searches or seizures that are not already legal." All the rule changes is which court the FBI has to go to for the warrant, and even then only under specific circumstances.

So it doesn't change what is legal, just who determines what is legal. Which is arguably worse given how fast (and presumably biased) some districts are, i.e rocket docket, https://en.wikipedia.org/wiki/United_States_District_Court_f...

What makes you presume E.D. Va. is "biased?" Towards who?

Cases like http://lavabit.com/ which give a defendant little to no time to prepare. Which is all to say the FBI wanted this for a specific reason, and many courts give them a lot more leeway and less transparency for the public.

The FBI wanted this for the reason that it's often very difficult to figure out where something or someone on the Internet is physically located.

It's manifestly false that "it would not permit searches or seizures that are not already legal." Currently if all I have is a warrant issued in Venue A then it is illegal for me to do a search in Venue B on the basis of that warrant. But after the change under some circumstances, the Venue A warrant makes it legal for me to do a search in Venue B.

Thus searches that were illegal are now legal.

Otherwise why bother making any change?

Let's admit it, we are at the stage where we are discussing nothing but semantics anymore.

Anyone who's actually followed and understood the Snowden leaks knows that the government will get all the data it wants, legally or not. And it wants all of it.

Unless somebody like Snowden gets elected President and credibly rolls back the surveillance state we have now, we have absolutely no right to privacy anymore and have become completely manipulable.

> somebody like Snowden gets elected President

It's hard to predict what exact conditions would be required to make a difference, but a privacy/security-aware President is not sufficient. We need a more educated population and congressional representatives (and perhaps supreme court) far more than the presidency.

We are headed for something bad with the cavalier way we treat data, the only real question is how terrible the consequences will be when it happens.

I am not a lawyer but I am curious what affect this will have. Does this mean that the FBI can cherry pick to it's favorite judges to get any wiretap subpoena they need?

Is there a source of public information to monitor judges actions in giving out these subpoenas?

If it worked for Patent Trolls and Texas, why wouldn't it work for the FBI?

Doesn't law enforcement already cherry pick judges for the different warrants that they want?

No, they've got to deal with the jurisdiction that is able to issue a warrant; until December 1st, 2016.

I was meaning in a general sense of the jurisdiction they are in; this new thing only adds to that ability.

Possibly with a little nudge, Congress can be convinced to get behind blocking this. Provided the argument against is framed as, would you Congress-person be okay with a judge in (county / state across the country) having the legal authority to hack in to your machine here in (home county / state)? Because unless I'm confused, this law would apply to Congress-people as well as citizen Joe.

The problem I see is the "it won't happen to me!" attitude. That's how these bills get passed in the first place, and Congress think they are so high up the food chain that it won't affect them.

Remind them of NSA spying on the Senate Intelligence Committee.

If they did it to us that would be state-sponsored cyber-terrorism!

Why do they need to hack? What's wrong with them showing up at the door with a gun and a warrant and walking off with everything they need?

My guess is this expansion is for doing things in secret. If they show up at the door of a civil liberties office and issue a warrant people are going to get pissed.

You don't have to guess... you could read the article to answer your own question.

What if someone is routing through Tor and they don't have an address but they do know they are visiting a certain webpage?

I wonder if this is related to Microsoft's case (which has also been going on since 2013)?

https://en.wikipedia.org/wiki/Microsoft_Corporation_v._Unite...

It is related to the Silk Road case as well as Playpen users

This and other stories lately are making it clear that the FBI is becoming a military organization instead of a police organization. But the real problem is that their enemy is the American people.

The title of the submission isn't clear. "[A]ny jurisdiction" implies those extralegal jurisdictions outside of the United States.

We changed the title to that of the article, as the HN guidelines request when the article title is neither misleading nor linkbait. The submitted title was 'US judges can now issue warrants for computers located in any jurisdiction'.

Submitters: please don't rewrite an article's title to make a point. That's editorializing and not allowed in post titles here. You're welcome to share what you think is important about a piece by posting a comment in the thread.

This is the realistic solution to fighting encryption. Not banning encryption.

I don't know why this took so long to be clarified in law. Even though they've been doing it for quite some time.

The "Going Dark" thing was always bullshit. They just have greater difficulty doing passive surveillance now... and actually have to do targeted searches of peoples computers now using warrants. Things like Stingrays can't be used to warrantlessly intercept SMS (as people move to WhatsApp) and most internet traffic is becoming HTTPS. Additionally, warrant-based wiretaps on ISPs and mobile traffic is becoming less useful. Mostly thanks to Snowden.

This is a good sign IMO, which means that encryption is finally becoming widespread enough that law enforcement has to up their game. It means law enforcement will be forced to do targeted searches, similar to searching houses, and dragnets become less effective.

My first thought on reading the headline is: Everyone use full-disk encryption so they need to order the user to unlock it. You know, since they seem to think the electronic world is separate from people in the real world. But upon reading TFA it sounds like they're hacking them anyway, so no user intervention required.

Suspect jailed indefinitely for refusing to decrypt hard drives

https://news.ycombinator.com/item?id=11590421

I'm sure President Trump will be a wise steward of his new security apparatus.

https://xkcd.com/538/

https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29

But that person had a choice, and the warrant was probably issued locally.

Does it only apply to computers within the borders of the US or also outside of it ?

This applies to computers outside of the US.

The FBI has already been doing this, Congress authorized the FBI to conduct all of the state sponsored hacking. It was just a little complicated.

That makes absolutely no sense - how are they doing to enforce this rule for countries like china or russia ?

They typically don't because there are consequences for the US if it tried. It is all the other countries where they do enforce it.

Its okay, everyone believes what you believe, this isn't reality though.

I believed it was CIA and NSA that operated beyond u.s. borders. But of course, patterns that fbi finds could lead to other countries as well.

they do.

although the FBI is a domestic enforcement agency, Congress specifically gave it the ability to hack any computer anywhere in the world.

Despite whatever concepts you have ever heard about any agency's mission or limitations, Congress has the ability to delegate tasks to whatever agency it thinks have resources, and then those laws stay on the books.

In the 1990s, the FBI and NSA did a lot of good work persuing organized computer crime operations around the world. Back then they also seemed to care more about the security of US infrastructure.

> This applies to computers outside of the US.

No US law applies outside the US (or US flagged ships etc).

The USA might like this to apply, but that doesn't make it true.

> No US law applies outside the US

"no" is a bit strong there.

https://www.justice.gov/criminal-ceos/citizens-guide-us-fede...

> Federal law provides “extraterritorial jurisdiction” over certain sex offenses against children. Extraterritorial jurisdiction is the legal authority of the United States to prosecute criminal conduct that took place outside its borders.

Its okay, everyone believes what you do. That doesn't limit the US in any way from creating court orders against non-US persons located outside of the US, it doesn't limit them from extraditing them, raiding their property, hacking and altering their property, and convicting them in US courts and jailing them, and winning appeals.

Typically regarding raids and property seizures they collaborate with local authorities in foreign countries, with one FBI agent present to make sure the raid is compliant with US laws.

Sometimes such compliance violates the local laws, and merely delays extradition proceedings. But the US typically gets the result it wants by freezing the property and preventing the person from continuing their behavior, and if they get the person to the US for jail and trial that is just icing on the cake.

I think this makes sense at one level -- say they are investigating a crime in NYC where players are located in NYC, North Jersey, Ulster County NY, and Connecticut. It seems weird that 4 judges should be involved in that sort of thing.

On the other hand, if routine motions to squash or otherwise deal with a case in NYC need to be filed and litigated in Northern Oklahoma or Hawaii, obviously that becomes a big overreach that makes doing business with the court a major hassle and very expensive, as you need lawyers accredited in multiple places.

Whether the latter scenario motivated this change or not, it will be the dominant result of this change. FBI are nationwide; few of their targets are. The fact that any particular suspect has the means to challenge a warrant on the other side of the country will be used as proof that suspect is sitting on a pile of ill-gotten gains that ought to be frozen. The fact that any other particular suspect doesn't have such means will be used as proof that the warrant is valid.

Freedoms/rights only go in one direction, they slowly erode unless reset and fought for.

People lose sight of why it is important to have privacy for short term reasons, and why the Constitution and Bill of Rights are what they are.

It will eventually come back around to these FBI guys (and politicians), we'll all be burned by it one day. Even the ones taking away rights/freedoms/privacy, they all have something to hide because they like personal privacy, one day they won't have it.

Anyone able to explain why explicitly not an attempt to circumvent due process and create a kangaroo court:

https://en.m.wikipedia.org/wiki/Kangaroo_court

I assume this affects Federal judges, is that correct? I couldn't tell for sure from article.

Yes, federal magistrate judges.

So, how do you keep the FBI out of your computer?

This is pretty scary, but highly preferable to gag warrants.

May not work in NK/China

Reply on news.ycombinator.com