Cyberattacks put new focus on search-warrant rule change

The Justice Department is citing last week's internet outages caused by widespread cyberattacks to support allowing U.S. agents to search online devices in faraway locations with approval from a single judge. Lawmakers on Thursday expressed renewed reservations about a change some see as expanding the FBI's authority to hack devices.

An amendment to Rule 41 of the Federal Rules of Criminal Procedure, which governs search warrants, goes into effect on Dec. 1 unless Congress steps in to stop it. Google and civil liberties groups have argued that the amendment grants the government overly broad powers to hack into computers across the country, with potentially unintended consequences.

Sens. Ron Wyden, D-Ore., and Rand Paul, R-Ky., have proposed legislation to stop the amendment from taking effect. On Thursday, 23 lawmakers wrote to Attorney General Loretta Lynch asking how the Justice Department "intends to use its proposed new powers, and the potential consequences to our digital security before these rules go into effect."

The amendment is intended to deal with scenarios where certain technology makes it difficult to determine a computer's physical location, or cases when swarms of private computers, known as botnets, are used to coordinate digital attacks against targets. When the computers can't be located physically to be searched, agents could search them remotely by hacking into them and looking for clues.

The amendment would allow a judge to issue one warrant for computers or devices in multiple districts at once. Generally judges can issue a warrant for a search only in their district.

"Significant botnets operate in every single judicial district in the United States," Assistant Attorney General Leslie Caldwell told The Associated Press. "Absent this amendment we'd have to go through all 94 judicial districts ... to get the judge in each of these districts to sign the exact same search warrant. It would be extremely inefficient and it just doesn't make any sense."

Caldwell said last week's cyberattacks were "exhibit A" for the need for the rule change. The attacks on Dyn DNS Co., which helps internet traffic reach its destination, used an army of 100,000 internet-connected devices around the world, such as DVRs and security cameras, to flood Dyn's connections and cause temporary internet outages to sites that included Twitter, Reddit and Spotify.

Lawmakers including Wyden; Sen. Elizabeth Warren, D-Mass.; Rep. Jason Chaffetz, R-Utah; and Rep. Louie Gohmert, R-Texas, said in their letter to Lynch that the Justice Department should explain how it will prevent judge-shopping, what tests it's conducted to guard against unintended consequences of hacking devices and whether the U.S. government would "clean" infected devices.

Cybersecurity researchers said botnet attacks are expected to grow because there is little incentive for owners or manufacturers to fix vulnerable devices. Attacks are launched against a third party and the unwitting owner usually doesn't realize their computer is infected and taking part in the attack.

The Justice Department said it has always had the power to seek warrants that could impact millions of people as long as it deals with households that fall under a judge's federal district. But now that hackers can commit crimes in multiple districts, department officials said investigators' rapid response could be hampered.

Civil liberties advocates said the change would magnify the Justice Department's investigatory powers because of the interconnected nature of the internet and increasingly large number of internet-connected devices. They believe Congress should weigh in on these questions before a new rule is in place.

"The big policy question going forward is, what do we want the government to do? When the government knows about many thousands of hijacked computers all around the world, what best practices should guide its response?" said Orin Kerr, a law professor at George Washington University, who called for congressional hearings to discuss such policy questions.

Kerr was involved in the amendment process, and he ultimately voted in favor of the rule change.