Wyden Seeks To Block DOJ-Sought Rule 41 Change Described as Substantive, not Procedural

DOJ said the rule change is needed to combat criminals who use sophisticated anonymizing technology to hide themselves, and remote searches are the only way to find and apprehend them. Currently, DOJ can't get a warrant to search a computer if it doesn't know where that computer is located. But civil liberties and privacy experts, who have been sounding the alarm since at least 2014 when the little-known U.S. Courts Advisory Committee on Criminal Rules was discussing the change, said the amendment grants the government new hacking powers and raises constitutional concerns.

“The bottom line is these are substantive changes," Wyden said in an emailed statement Thursday. "Here a difference in scale is really a difference in kind. Allowing the Justice Department to go to one judge to get a warrant for thousands or millions of computers all over the country is not a small change. It’s a drastic expansion of the government’s authority, and it should be carefully examined by Congress." His office said the issue hadn't received a lot of attention before the proposed Rule 41 amendment was announced in late April (see 1604290057 and 1604280074), and acknowledged that in a presidential election year, there may be little time to focus on the issue.

A DOJ spokesman emailed Thursday that the amendment ensures courts will review warrant applications when it's unclear which judge has authority. "The amendment makes explicit that it does not change the traditional rules governing probable cause and notice," he wrote. "The amendment would not authorize the government to undertake any search or seizure or use any remote search technique not already permitted under current law. Rather, the amendment would merely ensure that some court is available to consider whether a particular warrant application comports with the Fourth Amendment. This rule change would not grant any additional authority to conduct searches outside the U.S.”

Several privacy and civil liberties experts said in interviews over the past week that they were scratching their heads over why the advisory committee agreed with DOJ that it's a procedural, not substantive, change. "The federal rules of procedures normally deal with things like page limits for briefs, time limits for filing, technical issues involving summary judgment proceedings, etc.," said Nathan Wessler, an American Civil Liberties Union staff attorney. "And so it’s relatively unusual that there’s a significant civil liberties issue implicated in a proposal to change the federal rule.”

Ross Schulman, senior policy counsel with New America's Open Technology Institute (OTI), described the advisory committee as an "incredibly obscure" body within the judicial branch that probably wouldn't have dug too deeply into the issue. "And that’s not really a ding on the advisory committee, it’s not really their job to dig into this sort of stuff," he said. "That’s sort of Congress’ job, right?” He is unsure why the committee didn't step back and view the change as more extensive. "It’s tough to say why they didn’t do something. But that exact point is what we’re trying to convey to Congress about this right now," he said. The change is bigger than it was purported to be and Congress should put this on hold and have a more meaty conversation, he added.

DOJ proposed the Rule 41 change to the advisory committee in September 2013, according to minutes from a September 2015 committee meeting. Composed of federal judges, legal scholars and attorneys, the committee debated the change for about two years, including "several hours of public comments" at a November 2014 hearing, according to the minutes, and received more than 40 comments from groups including the ACLU, the Center for Democracy and Technology (CDT) and OTI. In the minutes, the committee said that "arguments that any changes should be left to Congress are unpersuasive. Venue is not substance. It is process, and Congress has authorized the courts 'to prescribe general rules of practice and procedures.'" But the minutes said one unidentified member, who wasn't on the Rule 41 subcommittee, disagreed with that assessment, arguing that the change "has too many substantive effects to be regarded as merely procedural" and that it "opens the door to judges making ex parte decisions about core privacy concerns."

Wessler said the committee in April 2014 scaled back DOJ's original proposal based on public comments. DOJ originally sought a warrant to search not only a physical computer but also any cloud storage accounts associated with that computer, meaning investigators could get into a user's Gmail or Dropbox accounts, he said. This raises several problems, said Wessler, not least of which is it's an "explicit end run around the Electronic Communications Privacy Act (ECPA), which requires a separate warrant to be serve[d] on Google or Yahoo or Microsoft to get materials off their servers."

After the advisory committee voted to recommend the Rule 41 amendment, it eventually was sent to the Supreme Court, which approved the change without any modifications. The high court sent the change April 28 to Congress, which now can either modify it or block it, or it takes effect Dec. 1. While the advisory committee's process was transparent, Wyden's office said, it's also obscure and not well known by most Americans.

CDT Privacy, Surveillance and Security Fellow Jadzia Butler said the proposed change creates several problems such as venue or forum shopping, in which Justice officials could conceivably seek warrants from one or a handful of districts that are more inclined to approve them. She said it also violates the Fourth Amendment's "particularity requirement," which mandates that a to-be-searched place be specifically described; otherwise many other computers that are not targets of their investigation could wind up as collateral damage. And the change if approved also could violate international law by circumventing the mutual legal assistance treaty. Wyden's office said the change would allow the FBI and DOJ to make a "reasonable effort" to notify targets of investigations, but that term isn't defined in the amendment.

While Butler isn't optimistic Congress has enough time to act on legislation to block or modify the proposed rule change, she said DOJ could invoke other procedures until Congress has time to debate the issue. For example, when the 6th U.S. Circuit Court of Appeals ruled in the 2010 U.S. v. Warshak case that ECPA violated the Fourth Amendment by not requiring law enforcement to obtain a warrant, Butler said, DOJ voluntarily changed its policies, out of respect for the court and also as a pragmatic step. "You really can’t control where information is or where you find it, so if it applies to the 6th [Circuit] you might just apply it across the board," she said. "They do things like that all the time. And I don’t think it wouldn't be hard for them to do some of the things we’re asking for.”

Editor's note: This story is the first of a two-part series. The second story will review potential international implications from the proposed Rule 41 change.