The Supreme Court — at the behest of the US government — has announced changes to "Rule 41," a crucial procedure of the US court system, which will give law enforcement sweeping powers to hack into computers anywhere in the world, including victims' computers, with drastically reduced oversight.
Wired's Kim Zetter has written an excellent, thorough analysis of the pending changes. It's a prime example of how extremely dull rules are very good places to hide extremely important changes, and Zetter does a great job of beating back the boring. Senator Ron Wyden [D-OR] has vowed to introduce legislation to block the changes, but if he can't get it passed in the next seven months, it'll be too late.
The changes to Rule 41 relate to the kinds of warrants that magistrate judges — the lowest judges in the federal judicial system, notorious for their lack of technical acumen — can issue. There are three significant changes at issue:
1. A rule to allow cops to hack computers that have been anonymized through Tor or other technologies.
2. A rule to allow cops to hack multiple computers on the same warrant (for example, by putting malware on a Tor hidden service to infect all the people who visit it), including the computers of victims of electronic crime (for example, computers that have been incorporated into botnets).
3. A rule relaxing the "notice" provision of search warrants: cops usually have to ensure that the people whose property is searched are clearly notified; under the new rule, a short email that might get lost in a spam folder will suffice.
Surveillance software can harm computers.
Surveillance software installed on computers carries potential consequences that are difficult to estimate and don't really exist with traditional, physical searches.
"[I]n the physical world, agents of law enforcement can be reasonably confident that breaking and entering into premises won't cause the entire building to fall down," the Center for Democracy and Technology wrote in comments objecting to the amendments. "In cyberspace we cannot be so confident."
Bellovin and his two colleagues noted that given the stealth characteristics that remote search software must have—it must run with the highest administrative privileges on a machine in order to hide itself and examine hidden parts of a machine—"it is more likely to cause unanticipated problems….[and] if it is used on enough machines, [for example] when doing a large-scale search of bots, there almost certainly will be problems on some of them."
So … Now the Government Wants to Hack Cybercrime Victims [Kim Zetter/Wired]
(Image: CourtGavel, Jonathunder, CC-BY-SA)
