Hacker News Reader

This isn't just about the district where the judge is based. There is also the bigger question of whether or not judges should be authorizing bulk hacking operations.

The three Tor watering hole operations (Freedom Hosting, Torpedo and Playpen) are the only cases we know of where DOJ has obtained a warrant from a single judge which it then used to conduct searches on hundreds or thousands of computers. DOJ did not seek new powers to conduct bulk searches/hacks from Congress, they just went ahead and got an ex-parte warrant from a judge. In the case of Freedom Hosting, it looks like they also screwed up and then hacked the computers of innocent people visiting other, non contraband sites, hosted on the same server.

I think that reasonable people can disagree about whether or not it makes sense to allow a judge to sign a warrant to hack a single computer in an unknown location which is probably outside of his or her district. Bulk hacks are very, very different, and a very new thing for our legal system.

I'm much less sanguine about bulk hacking than I am about targeted hacking, and so I'm sympathetic to this argument.

However, I'm compelled to point out that the courts routinely order searches on parties that turn out to be uninvolved with a case, or even to the wrong people already. The standard of accuracy here is much lower than you make it out to be.

I've researched this issue extensively, and I've not found a case before where a thousand people in the same place were searched pursuant to a single search warrant, let alone a thousand people or items located in different places around the country.

On the issue of courts authorizing the searching of wrong people, we don't know if the court in Freedom Hosting even knew that the government would deliver the malware to innocent people who were merely visiting other websites hosted from the same server as the contraband sites targeted by the warrant. We don't know this, because three years later, the freedom hosting search warrant is still sealed.

That fact should be alarming, and you should find that offensive...

If the courts are routinely signing search warrants on parties that are not involved in cases or criminal activity that highlights how much of a rubber stamp the warrant process as become, and how little "probable cause" means any more

Probable cause has become "Judge we want to search this place"

Why should I have a problem with "judge we want to search this place?"

The point of a search warrant isn't to establish guilt! It's merely to ensure that the search is connected to a legitimate investigation --- and legitimate dragnet investigations are common! --- and not as an instrument of harassment.

>>legitimate dragnet investigations are common

They should not be, that is my point

The purpose of the 4th amendment is to require the police to have a probable reason that a crime has been committed, AND to define what EXACTLY they are looking for, and where EXACTLY they are looking for it at

the fact that judges can sign warrants for all computers in the nation, or entire city blocks should be considered unconstitutional

That is a General Warrant something the Founders were very very very very much opposed to

> not as an instrument of harassment.

General Warrants, which is what is being talked about here, are infact a instrument of harassment

Rubber Stamping Warrants with out any actual probable cause is also a instrument of Harassment

If you believe having your door busted down by armed men at 3am because you tossed the loose leaf tea in the trash bin is not harassment than I shutter to thing what your definition would be

Does the bulk hacking have anything to do with these Rule 41 changes? Sounds like a judge could issue a warrant for a thousand computers under the existing rules.

The real issue seems to be what evidence you need to have probable cause to search a thousand computers. I'm willing to believe the standard being applied is too low, but the Rule 41 changes don't change that standard one way or the other.

> rules make it hard to get a warrant today

Procedural or otherwise, rules that make getting a warrant hard is a feature, not a bug. Perhaps "hard" is too strong; the 4th Amendment requirement for specific warrants is intended to add a burdeon to the warrant process. Preventing generalizations that make search and seizure easier is the very reason the 4th Amendment was written.

> require you to get warrants in every district

If a search is to be performed in many districts, they yes, that is what the constitution requires. As for Tor hidden services, I'm going to echo Susan Landau's advice to congress during the recent FBI/Apple backdoor hearings. The FBI needs to update their investigative methods. Modern technology provides many new ways to investigate. We already know that the NSA, for example, is very adept at using side channels and metadata.

Your "Tor hidden service" example assumes that giving these powers are the only way to prosecute some criminal cases. It's basically demonstrating a lack of creativity.

> inaccessible

Warrants are a permission to conduct a search and seize certain items if they find them. It is not a guarantee that the search will be successful; nor should it be. Besides, it isn't going to be inaccessible in many cases anyway. You already know the power of timing attacks and traffic analysis. That should be enough, in many cases, to figure out which jurisdiction(s) should be searched. The only reason you would need a warrant in "every" district is if nobody even bothered investigating.

Why should it be made difficult to get a warrant? I don't understand.

Making it difficult for law enforcement to casually search things without oversight is a good thing. But making it harder for the courts themselves to direct searches seems like... I don't know, a bad thing?

> made difficult

> making it harder

It's not being "made difficult". Nobody is making the warrant process harder. You're trying to reframe the status quo as a new difficulty in the warrant process.

The old rules make it proceedurally hard to get warrant, not substantively hard. You could have a website openly selling sex slaves hidden behind TOR and you couldn't get a warrant because nobody knows where the site is located.

Meanwhile, the Feds can easily get a warrant some some innocuous stuff like selling raw milk because locating a real business is easy.

This just deals with an issue of where you know the specific server or network of servers you want to search but can't know where they are physically located. This just enable a dragnet to go search random computers.

The constitution has nothing to say about which districts must issue a warrant. The constitution doesn't even require there be different districts. Congress could abolish all the lower federal courts tomorrow and create one giant district court for the whole country.

As Ray says, when you say "If a search is to be performed in many districts, they yes, that is what the constitution requires.", this is just gobbledygook. Please cite any part of the constitution that says anything about this.

Kind of sounds like a way for law enforcement to go judge shopping where they will start taking all their computer crime cases to judges they know are sympathetic to them and get a warrant to do something the judge in the actual jurisdiction might have been skeptical of.

It might be someplace whose laws don't recognize the authority of that court---say, Beijing. And now the US FBI has put a NIT on a non-US computer. That's a problem.

It might be someplace that doesn't let governments use NITs at all.

There is another way to go: warrants for the Tor exit node, then middle node, then guard. And if you can't justify those---especially hard for the middle node---that's not just a procedural issue, but a substantive problem.

Just so I understand you here, your position is that simply by dint of having used a Tor hidden service, you are entitled to having your information shielded from a warrant unless the court can deliver and execute warrants to the entire Tor infrastructure?

That's how these things work in the physical world, why should the internet be treated any differently?

What's the physical-world analog for a something that makes it trivial for a criminal to instantaneously conceal evidence across hundreds of jurisdictions? And how do the courts handle that thing?

Series of anonymous (anonymity can be achieved with various means, some more legal than others) shell companies used to launder money aren't exactly unheard of.

There's very little courts can do, besides issuing countless of subpoenas and search warrants, which has been the standard way of handling criminal investigations for decades now.

Here's a telephony related example: http://www.nytimes.com/2015/11/29/magazine/the-serial-swatte... ctrl+f subpoenas

Those shell companies are also bad!

Not questioning that, it just seems weird that internet specifically needs such legislation.

This isn't legislation; it's the Federal Rules of Criminal Procedure. They're the rules judges agree to follow.

If, in the process of attempting to track down material covered by a warrant, law enforcement wants to obtain information from a system owned by someone not originally party to the warrant, they should be required to serve a warrant to the operator of that system, from a court with jurisdiction over the operator of that system. Doing any less would imply that the operator of that system is less entitled to due process than the alleged criminal being pursued.

I don't fundamentally have a problem with the part of the ruling that allows serving a warrant to a specific party of unknown jurisdiction, based on evidence of criminal activity; however, I do think the terms of the warrant should require that as soon as an appropriate jurisdiction is determined the warrant must be re-issued from a court with that jurisdiction before any evidence can be used. (At the very least, that would result in most such warrants going to a federal court, rather than some local court. Wouldn't help much for international cases, but it's a step in the right direction.)

I do have a problem with the idea that a blanket warrant could be issued to "all operators of Tor nodes", just as I have a problem with the idea that a warrant could be issued to "all operators of Internet routers". Mass surveillance isn't any more acceptable with a warrant than without one.

It seems like if you take proactive steps to hide what jurisdiction you are in the options are that you are effectivly in everyone's jurisdiction or no one's. The public good is IMO best served by being able to catch criminals who use tor, so we have to go with the former. The downside is that Iran can legitimately hack you if you say bad things about Mohammad from behind tor, but there isn't much of an alternative.

But that's not how it works in finance, why should it work like that for the internet?

I can do the real world equivalent of using tor by setting up a secure corporate structure and then commit for example insider trading.