The FBI Can Now Legally Hack Everywhere Around the World

"Legally"? Seriously misleading title, a foreign nation state hacking people has not been made legal outside the US at all. It might be legal in the US, but surely it's still computer crime where it's committed.

Does anyone know whether the Supreme Court has provided any clarification about whether the amended rules purport to allow American officials to search computers in foreign countries? Or whether the Justice Department has indicated how it will interpret the new rules?

I asked this question in a thread here when the rules were proposed earlier this year, but received no replies because the topic was deleted as a duplicate. In the months since then, I've seen plenty of speculation in reporting on the issue, but nothing close to an answer to the question—so let me repeat it:

Do these new rules expand the claimed foreign jurisdiction of US federal courts, or not?

The amended rules provide new authorities for issuing warrants when "the district where the media or information is located has been concealed through technological means". In other words, the new rules seem to expand the authority of federal courts when there is a question of which district court has jurisdiction. But what do these new rules mean for cases in which the location of the information is clearly outside of the jurisdiction of any US federal district court, or when there is a question of whether it might be?

Apparently the rules were previously amended to remove the definition of "district court" [0], making this question still more subtle. Note also that the rules explicitly expand the jurisdiction of US federal courts to issue warrants "inside or outside" the geography of their districts in cases of terrorism, but not explicitly otherwise. I believe that rule has been interpreted to mean that federal courts may issue warrants worldwide, without regard to sovereign geography, in terrorist cases.

0. See the note pertaining to Rule 1(b) of the 2002 amendment, at https://www.law.cornell.edu/rules/frcrmp/rule_1

The FBI couldn't be trusted to take down Silk Road without lining the pockets of their agents. This is a recipe for massive corporate espionage.

"[...] the FBI can now legally hack [...], and even overseas, [...]"

I don't think that's really true. If for instance a FBI agent hacks into a computer located in Brazil and owned by a Brazilian citizen, he is still breaking Brazilian law, no matter what a USA judge says.

I'm no lawyer but this does not say the FBI can hack anyone anywhere in the world. It explicit says a judge may authorize the search warrant if, among other things (mostly related to where the target is within the US):

(B) the premises—no matter who owns them—of a United States diplomatic or consular mission in a foreign state, including any appurtenant building, part of a building, or land used for the mission's purposes; or

(C) a residence and any appurtenant land owned or leased by the United States and used by United States personnel assigned to a United States diplomatic or consular mission in a foreign state.

So it says clearly "owned, leased, used by... US diplomatic or consular mission in a foreign state". Not that any laws have prevented the FBI/NSA from doing any of this already.

Apparently, citizens of other countries should not be worried (with this particular law). Could anyone with more knowledge in this area double check this?

Probably again making legal what has been going on illegally for a long time.

Almost everyone who analyzes the change to rule 41 just looks at the change to Rule 41(b). There is also a change to Rule 41(f)(1)(C), which concerns serving a warrant. The pre-change version is:

> The officer executing the warrant must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.

The post-change version appends another sentence to that:

> For a warrant to use remote access to search electronic storage media and seize or copy electronically stored information, the officer must make reasonable efforts to serve a copy of the warrant on the person whose property was searched or whose information was seized or copied. Service may be accomplished by any means, including electronic means, reasonably calculated to reach that person.

I once had this idea that all these revelations done with the documents given by Snowden could be done on purpose by the government itself in order to make what was previously secretly done common knowledge and thus easier to use later on. There would be a period of time of outrage and maybe some regulation that wasn't there before, but in the end they could do more or less the same thing publicly and everybody would be like "yeah sure, that is what it is like". Not that i believe this is really what happened but it certainly feels like this is where it is going to.

While this is sub-optimal, I would suggest that everyone should assume this is where most countries will eventually land. I would not waste too much energy debating this, in my humble opinion.

Even if we don't all end up in dystopian bubbles that have some legal tie back to the U.S., the focus should be around proper architecture, defense in depth, plausible deniability by design, etc. If you are not required to keep logs, then don't. If you are, encrypt them with half of a key. You get half of the key and your customers get half of the key. Yes, logs per tenant. This is getting _somewhat_ easier to do these days. Design decentralized or partially centralized systems that permit delegation of control over encryption of data so that lawful intercept is less useful and so that hacking a thing is less effective both technically and legally. I.e. encrypted data-stores that you and your customers can partake in the legal custody of the data. Once you receive the NSL, you won't be able to talk about it and warrant canaries may not always be feasible either, so design your systems with that in mind.

If you code products that folks will use to protect their families freedom and/or way of life, then please consider the attack vectors and generalize your way out of them and/or create really easy to read docs that people can take away action items from and implement.

I only mention this because HN is full of intelligent creative thinkers, engineers, architects and highly experienced attorneys. Hopefully a few doc/tech writers too!

...now back to my really bad coffee.

Growing up under an authoritian government I learned the subtle difference between rule of law, where everyone has to obey the laws we enact in our society, and rule by law, whereby the powers that be enact laws that allow them to do whatever they want. It seems that in the US the distinction is quickly eroding, if it ever existed in the first place. And of course the establishment will call it rule of law. The law is convenient in this case. If it were not they'd just ignore it. The numerous leaks that came out within the past decade demonstrate this.

Server down?

-> https://motherboard.vice.com/read/us-judges-can-now-sign-glo...

There is a lot of ink being spilled on what is really a pretty minor technical change. The FBI can break into your house so long as it gets a search warrant. So why shouldn't it be able to hack into your computer with a warrant too? What the rule changes do is just change the jurisdictional requirements for obtaining those warrants. Those changes make sense: the FBI may have no idea what district a particular computer is in. Under those circumstances, the rules permit the FBI to get a warrant from a judge in any district.

I'm sure that President Trump will be a wise and careful steward of his all-pervasive intelligence apparatus.

Will let's ignore this definition of "legal" this rule only pertains if the location of the server has been deliverability hidden, or if computers in more than five districts have been affected. This is not a blanket "hack anyone, anywhere"

My doubt is how do they hack the computers and how do they know the ip of the target? Maybe they have a secret list of vulnerabilities of linux and windows?

cached (google): http://webcache.googleusercontent.com/search?q=cache:iVy8YRl...

Who signs off on this stuff, btw?

It seems even the president isn't fully aware of whats going on.

It's amazing, on the back of technical ignorance they have combined unprecedented powers (this isn't merely a "search") with a crass reduction in warrant requirements. It's squaring the circle, do more with even less oversight.

The relevant part of article six of the United States Constitution.

"This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.

The Senators and Representatives before mentioned, and the Members of the several State Legislatures, and all executive and judicial Officers, both of the United States and of the several States, shall be bound by Oath or Affirmation, to support this Constitution; but no religious Test shall ever be required as a Qualification to any Office or public Trust under the United States."

Therefor, being that such a warrant system is in violation of the fourth amendment (they key here, for those naively claiming this isn't such a big deal, is the interpretation by the executive that such warrants give them the power to hack thousands of computers without description of their location, their probable cause, and the person that owns them):

"The right of the people to be secure in their persons, houses, papers, and effects,[a] against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The FBI and every congress-scumbag who passed this, or blocked the delays, is very close to being in violation of their oath, technically and in spirit. Now, for congress they must sign an affidavit that (5 U.S.C. 3333) will not violate their oath while in office, the punishment of which (18 U.S.C. 1918) is removal from office and confinement or a fine, but the criteria is hard to pin down legally.

(5 U.S. Code § 7311) "An individual may not accept or hold a position in the Government of the United States or the government of the District of Columbia if he— (1) advocates the overthrow of our constitutional form of government; (2) is a member of an organization that he knows advocates the overthrow of our constitutional form of government; (3) participates in a strike, or asserts the right to strike, against the Government of the United States"

My question is, are the executive officers also supposed to sign that affadavit? If so, that's a starting point, but if not, what punishment is there, what legal recourse, to get rid of people in the executive or judicial who are pushing or acquiescing to blatantly unconstitutional expansions of power?

Bonus question: does the third amendment apply here as well, since they are putting their own malware in our houses?

"No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law."

Here come the tin foil hats with the extremist title that is intentionally misrepresenting the truth.

Information distribution on the web is broken. Where's the startup to fix that?