DOJ Pushes to Expand Hacking Abilities Against Cyber-Criminals

Advocatus Diaboli writes with news about the DOJ's push to make it easier to get warrants to hack suspected cyber-criminals. "The U.S. Department of Justice is pushing to make it easier for law enforcement to get warrants to hack into the computers of criminal suspects across the country. The move, which would alter federal court rules governing search warrants, comes amid increases in cases related to computer crimes. Investigators say they need more flexibility to get warrants to allow hacking in such cases, especially when multiple computers are involved or the government doesn't know where the suspect's computer is physically located."

Comments

Cyber?

[Anonymous Coward]

Criminal says it all.

Re: Cyber?

[Anonymous Coward]

No.
"DOJ Pushes to Expand Hacking Abilities" says it all.

Well SURE!

[rmdingler]

There's no need to protect the freedoms of a future investigative target if it is even slightly inconvenient for law enforcement.

After all, they're out there serving and protecting, right?

If you have nothing to hide, you have nothing to fear arguments are becoming more painful than a toothache.

Re:Well SURE!

[ShanghaiBill]

These changes seem reasonable to me. They are getting a warrant with judicial oversight. That is the way the system is supposed to work. If they have probable cause, then there is no reason that I can see for the warrant to specifically tie the search to a geographical location, or to require separate warrants for each machine. Car analogy: Should a search warrant for a vehicle specify that it can only be searched at the suspect's home, but not at his place of work? Should separate warrants be required for the glove compartment and trunk?

Re:Well SURE!

[drainbramage]

In their defense, they already have 'evidence' from the IRS that those Tea Party groups are a bunch of anti-government terrorists representing a greater danger than any previously discovered. They are like a nuke in New Yark.

Re:Well SURE!

[K. S. Kyosuke]

To be honest, compared to physical search warrants, this feels a bit toothless. If you're trying to hack the government and want to prevent the government from hacking you, just secure your systems. Unlike with physical obstacles, you *can* run secure systems if you really want to.

Re:Well SURE!

[CanHasDIY]

These changes seem reasonable to me. They are getting a warrant with judicial oversight. That is the way the system is supposed to work.

No, this is how it's supposed to work:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Mind you, per the Constitution nothing can supersede this rule, outside a legally ratified Constitutional Amendment.

If they have probable cause, then there is no reason that I can see for the warrant to specifically tie the search to a geographical location, or to require separate warrants for each machine.

Really? What part of "particularly describing the place to be searched, and the persons or things to be seized" is unclear?

Car analogy: Should a search warrant for a vehicle specify that it can only be searched at the suspect's home, but not at his place of work? Should separate warrants be required for the glove compartment and trunk?

Separate warrants are required for locked compartments.

So yes to the second question.

Re:Well SURE!

[N0Man74]

In addition to all of those fine points, many of us here are well aware of how loosely defined 'hacker' and 'cyber terrorist' is likely to be (and is already).

Re:Well SURE!

[CanHasDIY]

In addition to all of those fine points, many of us here are well aware of how loosely defined 'hacker' and 'cyber terrorist' is likely to be (and is already).

Indeed; my first thought upon reading the summary was, "Oh, you mean 'cyber-terrorists' like Aaron Schwartz and Weev?"

They have no intention of stopping real terrorism, because real terrorism is a weapon in their toolkit against the rights of the common man. Since incarceration is now a for-profit business, I have no compunction about pointing out the easing of warrant requirements is just another way for the corporate-owned prison system to maintain profitability.

Re:Well SURE!

[silas_moeckel]

If they do not know where it is how can they know they have jurisdiction?? How can the judge? There are reasons why some places elect judges so they can be held responsible. This is an end run around any local authority.

For your analogy should the DOJ be allowed to search a car in Mexico? Nope they could ask Mexico to do it. Other countries have different standards.

Re:Well SURE!

[ultranova]

That is the way the system is supposed to work. If they have probable cause, then there is no reason that I can see for the warrant to specifically tie the search to a geographical location, or to require separate warrants for each machine.

Really? You know no reason why a warrant meant to search Joe BadGuy's server, likely hosted in a datacenter somewhere, shouldn't be a blanket check to search through every machine in every datacenter in the US? Because that's what not being tied to a particular machine or location means, or at least it's close enough that the DOJ will use it to justify doing just that.

Car analogy: Should a search warrant for a vehicle specify that it can only be searched at the suspect's home, but not at his place of work? Should separate warrants be required for the glove compartment and trunk?

No, but it shouldn't be a blanket check to set up a checkpoint anywhere the police wants and search everyone who passes through.

Re:Well SURE!

[KingMotley]

Problem solved. All warrants now specify earth as the location.

Re:Well SURE!

[edibobb]

Computers or smartphones are not required. Be careful if you whistle a tune in public.

Re:Well SURE!

[blue9steel]

I suppose the question is, does an IP address constitute "a place to be searched" or is that restricted to only geographical locations?

Re:Well SURE!

[davester666]

Not even an IP address. They are talking about sending malware via email, because they have no idea where on the planet the person might be.

Plant the evidence...

[cronostitan]

This will make it very easy to implicate *anyone* in a cybercrime by just planting the evidence on their computer/device as you are hacking it anyway.
Totalitarians, here we come!

Re:Plant the evidence...

[avandesande]

Not to mention that if their machine is proven to be 'hackable', then maybe it already has been hacked.

Re:Plant the evidence...

[david_thornley]

It also makes it easy for a defense attorney to object to any evidence gathered from a computer. Provided the case goes to trial, of course.

Honeypot their "attack"

[stiggle]

So if you were targeted by the "law enforcement" and you Honeypoted their hacking attempt would they then come at you for interfering with their investigation?

Re:Honeypot their "attack"

[Curunir_wolf]

So if you were targeted by the "law enforcement" and you Honeypoted their hacking attempt would they then come at you for interfering with their investigation?

Naturally. In fact, you don't even need to be a target. Maybe their target attempted to hack one of your computers, that puts you into the pool of computers being swept up in one of these broad warrants. So your honeypot now gets you an obstruction of justice charge, and you were never even suspected of a crime.

Re:International warrants?

[K. S. Kyosuke]

Apparently, at least according to NSA, you don't *need* a search warrant for international computers.

402 pages?

[Anonymous Coward]

Seriously, 402 pages?! It is no wonder the erosion of our constitution is happening. No one has time to read and research this type of thing with a full time job.

My question about this is who are the contrators and their employed lobbyists seeking these law changes? I am no expert but the federal money available for those soliciting and being awarded government contracts for providing services to prisions/jails etc (https://www.fbo.gov/index?s=opportunity&mode=list&tab=list&keywords=bop). I question any group that advances their career and financial situation from steping on others by either changing laws to benefit their activities (such as trying to take away the 4th amendment) as well as recieving financial gains with regards to pay raises, and or career advancement by trumping up charges on hard working people because they "have a hunch".

But then again maybe I am biased.

This will be used against everyone

[stewsters]

If you give an agency the ability to hack, they will want to hack all US citizens. See the NSA for a recent example.

Letting the FBI change things on computers of people it is investigating is a recipe for disaster. How long before they too get a general warrant that allows them to hack any computer in the world? Remember, these are just people suspected, not people found guilty. If you don't think they could get that warrant, then you have not been following the NSA revelations closely enough.

What can they not get from the average criminal by just confiscating his computer when they arrest him? With the ability to upload and download files to people's computers, they will be able to blackmail anyone they want. If they want to eliminate a senator who is trying to cut their funds, they just hack into his computer, make some racist/sexist comments on his twitter account, and he wont be re-elected. Or they could add evidence of other activities, that even if no one can prove, would still would destroy them politically.

Re:This will be used against everyone

[kilfarsnar]

A cynic might even suspect that this particular expansion is a way to take the heat off the NSA by moving its domestic operations to a different agency.

That way they could shut down the NSA program to great fanfare and quieted fears. Brillinant, I love it!

Re:This will be used against everyone

[DanielOom]

Now law enforcement will effectively be cybercriminals, so it should become easier for citizens to get warrants to break into police and government computers.

Good luck

[ArcadeMan]

My computer isn't even physically connected to the Internet. I use wi-fi!

Related question (serious)

[Ranbot]

What would happen if while law enforcement was hacking into a suspect's computer, or multiple suspected computers as proposed by the DOJ in the article, evidence of a different type of criminal activity was observed than originally suspected under the warrant? I can understand that with current technology law enforcement could justify broader warrants to hack into multiple computers potentially related to a suspect, but that would also exponentially increase the chances of finding other unrelated criminal activities on those computers. It sounds like this could easily be abused into essentially cyber-fishing for criminals. Does anyone know how law enforcement would have to deal with that situation? I'm not intimately familiar with cyber-law, but I would assume there's something in the law books already for hacking into a single computer that would be a precedent. Sarcastic, flame-bait responses are unnecessary...

Would this make regular security illegal?

[knorthern knight]

It's not just a matter of using Linux versus Windows. I get the occasional spam with poisoned executable attachments inside zipfiles. I view zipfile headers, and often see stuff like the following 2 examples...

PK^C^D^T^@^@^@^H^@^Y^?|DT^Z^F^[¾`^G^@^@\236^@^U^@^@^@OrderDetails.pdf.scr

PK^C^D^T^@^@^@^H^@^\WzD~\224®ÂM^\^@^@^@J^@^@;^@^@^@~apbnet00~50~44b76b05-3e01-414a-8469-04f234689df3~Email.exe

".scr" is executable in Windows http://filext.com/file-extensi... so I assume that's a trojan-planting attempt. One possible legal defense is that it's impossible to tell whether you're blocking a trojan sent by police or by foreign criminals.