Without holding a single hearing, Congress granted law enforcement sweeping new surveillance powers, allowing changes to the obscure Rule 41 of the Federal Rules of Criminal Procedure to take effect at midnight on Thursday. The updates greatly expand the U.S. government’s ability to spy on Americans and people around the world; to hack millions of computers without users’ knowledge or consent.
As digital rights advocate Brett Soloman explained earlier this year, the changes to Rule 41 are threefold:
The first allows a judge to approve an order for hacking to extend to any jurisdiction regardless of the location of the device, so long as the end user has attempted to obfuscate that location. This would include people who use a virtual private network, or VPN, to protect their data and people who use the Tor browser. Some criminals do use these sorts of tools to hide their location — but so too do human rights defenders and marginalized people who seek to protect themselves from harm. The second part allows a single order to issue for an entire network of computers, such as devices belonging to victims infected with botnet malware. Finally, the change modifies the notice requirements for court orders.
The updates are ostensibly geared towards investigating and preventing botnets — networks of hijacked computers used to launch cyberattacks.
Law enforcement can now seek warrants from a single judge to hack suspected devices, rather than from multiple magistrates in differing jurisdictions. Rule 41 does not specify which judges are empowered to grant the surveillance warrants, meaning the government can cherry-pick judges favorable to its requests. Journalists, activists, targets of trolling and stalking — anyone, anywhere, who has obscured their location online is now suspect under Rule 41. Victims of botnets can also be hacked without notification.
The DoJ sought and received updates to the rule from the Supreme Court, which ruled in its favor in April over loud objections from civil libertarians that it violates Fourth Amendment protections against unreasonable search and seizure.
“We simply can’t give unlimited power for unlimited hacking,” Sen. Steve Daines (R-Mont.) argued Wednesday.
Daines, together with Sens. Ron Wyden (D-Ore.) and Chris Coons (D-Del), was part of a last-ditch attempt in Congress to vote on or, at a minimum, suspend the changes to Rule 41 in order to allow for debate. The lawmakers each introduced bills to halt the rule from taking effect but Majority Whip John Cornyn (R-Texas) prevented all three pieces of legislation from coming to a vote.
Fretting over government surveillance under Donald Trump’s control, Wyden observed that the incoming president has expressed a desire to “to hack his opponents the same way Russia does.”