A Department of Justice proposal to amend Rule 41 of the Federal Rules of Criminal Procedure would make it easier for domestic law enforcement to hack into computers of people attempting to protect their anonymity on the Internet. The DOJ has explicitly stated that the amendment is not meant to give courts the power to issue warrants that authorize searches in foreign countries—but the practical reality of the underlying technology means doing so is almost unavoidable.
The result? Possibly the broadest expansion of extraterritorial surveillance power since the FBI’s inception.
This post highlights key issues raised by the international aspect of the DOJ proposal, in the attempt to encourage wider public debate before the FBI is granted such expansive powers.
The FBI Brand of Hacking: Network Investigative Techniques
Broadly, the term “Network Investigative Techniques,” (NIT) describes a method of surveillance that entails “hacking,” or the remote access of a computer to install malicious software without the knowledge or permission of the owner/operator. Once installed, malware controls the target computer.
The right Network Investigative Technique can cause a computer to perform any task the computer is capable of—covertly upload files, photographs and stored e-mails to an FBI controlled server, use a computer’s camera or microphone to gather images and sound at any time the FBI chooses, or even take over computers which associate with the target (e.g. by accessing a website hosted on a server the FBI secretly controls and has programmed to infect any computer that accesses it).
Network Investigative Techniques are especially handy in the pursuit of targets on the anonymous Internet—defined for the purposes of this post as those using Tor, a popular and robust privacy software, in order to obscure their location (and other identifying information), and to utilize so-called “hidden” websites on servers whose physical locations are theoretically untraceable.
Since Network Investigative Techniques work by sending surveillance software over the Internet, the physical location of the target computer is not essential to the execution of the search. Indeed, the DOJ proposal is justified as the only reasonable way to confront the use of anonymizing software, “because the target of the search has deliberately disguised the location of the media or information to be searched.”