There are many, many recent, high-profile examples of the U.S. government’s hacking into user-facing devices and services. Yet, they raise important questions about the government’s use of hacking to gather evidence and the lack of legal safeguards to protect innocent users’ rights. And if Congress doesn’t act soon, the frequency of these incidents will continue to grow. These hacking incidents are shrouded in opaqueness: 1) we have almost no information about what is going on; and 2) whether any of it meets human rights standards.
Ideally, whenever law enforcement seeks new investigatory powers, there is a process. The Congress, specifically the House and Senate judiciary committees, typically create the rules after public debate concerning topics like human rights and civil liberties. Yet, there has been no such discussion about government hacking. In fact, Congress has made no conscious decision that the FBI should have these powers at all.
Without intervention, we are going to see it become even easier for government to use its hacking powers. In December, a change to Rule 41 of the Federal Rules of Criminal Procedure will go into effect. The change to this rule will have far-reaching consequences, and it will allow law enforcement agencies to expand the use of sophisticated hacking tools called network investigative techniques (NIT). These “techniques” could be implemented in order to collect your computer IP address, or to do something as invasive as activate your built-in microphone or camera. Furthermore, the change would allow expansive authorizations, letting law enforcement remotely search the computers of people outside of the United States, including the devices not just of perpetrators but also the innocent victims of “botnets” — which could include thousands or millions of users.
The U.S. Department of Justice and the FBI have claimed that the change to Rule 41 is part of a procedural, modernization effort to align investigative techniques with 21st century crimes. But the change of Rule 41 is anything but “procedural.” It inherently involves substantive changes to our laws, and opens the door to violations of internet users’ rights globally.
Congress must step up and take action. Access Now has sent letters to every member of the relevant House and Senate committees to highlight the risks of this change to Rule 41 and to urge them to hold hearings on the expansive powers involved with this rule change. These committees are the venues that Congress itself has established to discuss these delicate issues. If the Congress fails to open this critically important discussion in a democratic venue, we will all suffer the impact of a policy developed and implemented without the people the American people elected to represent us.
The time to act is now. We hope that members of the House and Senate judiciary committees take responsibility to protect innocent users — and do the job they’re supposed to do — before it is too late.