Rule 41 Change Likely to Take Effect Barring Congressional Action, Say Experts
A proposed judiciary procedural rule change that would allow federal law enforcement officials to go to any magistrate judge for a warrant to search thousands of computers outside their jurisdictions likely will take effect Dec. 1, "barring some extremely unlikely events," said George Washington University Law School professor Orin Kerr during a Privacy and Security Forum panel Tuesday. Kerr was a member of the U.S. Courts Advisory Committee on Criminal Rules that considered and ultimately approved the amendment to Rule 41 of the Federal Rules of Criminal Procedure. Many privacy and civil liberties groups oppose the change, which they say would allow the government to hack computers anywhere in the world, including those owned by innocent people that are part of a botnet.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
Congress can pass a law to prevent the rule from taking effect, an effort being led by Sen. Ron Wyden, D-Ore. (see 1605120016 and 1608310021). Kevin Bankston, director of New America's Open Technology Institute, which has campaigned against the change, said in an interview that "considering Congress can't pass a law on a good day to do anything, I think that's unlikely." He told us he didn't want to rule out "late in the day deal of some kind," but the most likely outcome is the rule change is going to happen.
Despite diminishing chances to stop the rule change from taking effect, Bankston said the issue gives the public and lawmakers an opportunity to have a conversation about government hacking (see 1609190041) "and what the rules of the road should be now that it's becoming an even more routine practice." Between Rule 41 and the encryption debate (see 1608150061), he said he hopes there will be a "significant and substantive debate in Congress about what the scope of the government's hacking authority should be, next year."
During the panel discussion, Kerr said the government used Rule 41 in the "Playpen" case, which was a child porn website hosted on the Tor network, to seize the website and continued to operate it last year for a couple of weeks to find out who was visiting it. Since Tor was blocking the visitors' actual IP addresses, the government used a "network investigative technique" to effectively hack into site users' computers and get information, namely their IP addresses. As a result of the operation, a couple of hundred or so cases against alleged child porn users are being litigated in several dozen U.S. District courts, he said.
The Electronic Frontier Foundation has written extensively about the Playpen operation and the use of Rule 41. EFF, which opposes the rule change, said in a recent blog post and FAQs the government violated the Fourth Amendment, which protects against search and seizure, because it carried out thousands of searches of computers using a single warrant. "The particularity requirement of the Fourth Amendment was designed to prevent precisely this type of sweeping authority," EFF said. The group said Rule 41 now authorizes magistrate judges to issue warrants only for searches in their judicial district.
Kerr said the particularity of the warrant is an interesting issue. Does the Fourth Amendment permit a mass-scale warrant, he asked. He said good arguments are on both sides, but he said if the Fourth Amendment doesn't allow such a technique, the "tricky question" is, what's the government going to do next. He said he suspects the circuit courts of appeal eventually may uphold the particularity of the searches.
Nathan Judish, senior counsel with DOJ's Computer Crimes and Intellectual Property Section, said during the panel discussion that the department knew there was ambiguity in Rule 41. When there was an opportunity to find child porn users in the Playpen case, he said officials jumped in because the department "identified and rescued at least 38 kids who were subject to ongoing and, in some cases, absolutely horrific sexual abuse." He said it was "absolutely the right thing to do, and in my view, the best reading of Rule 41 in this case."
Kerr and Judish said nothing prevents Congress from modifying Rule 41 if the change takes effect, or imposing further limits. Judish said the government ought have a mechanism to get a warrant to go after people using internet anonymizing techniques.