FBI Flexes Rule 41 Powers, Uses Remote Access Technique To Neutralize Compromised Software All Over The US

from the computers-on-blast dept

Great news, everyone! The FBI has been fighting a cyberwar on your behalf… perhaps utilizing your own computer. Here's Zack Whittaker with some details:

A court in Houston has authorized an FBI operation to “copy and remove” backdoors from hundreds of Microsoft Exchange email servers in the United States, months after hackers used four previously undiscovered vulnerabilities to attack thousands of networks.

The Justice Department announced the operation on Tuesday, which it described as “successful.”

Hundreds of computers have been accessed by the FBI under the theory that these beneficiaries of government tech largesse won't complain too much about the FBI's (however brief) intrusion. This is the DOJ's official coat of gloss:

Authorities have executed a court-authorized operation to copy and remove malicious web shells from hundreds of vulnerable computers in the United States. They were running on-premises versions of Microsoft Exchange Server software used to provide enterprise-level email service.

Through January and February 2021, certain hacking groups exploited zero-day vulnerabilities in Microsoft Exchange Server software to access email accounts and place web shells for continued access. Web shells are pieces of code or scripts that enable remote administration. Other hacking groups followed suit starting in early March after the vulnerability and patch were publicized.

Many infected system owners successfully removed the web shells from thousands of computers. Others appeared unable to do so, and hundreds of such web shells persisted unmitigated. This operation removed one early hacking group’s remaining web shells which could have been used to maintain and escalate persistent, unauthorized access to U.S. networks. The FBI conducted the removal by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell (identified by its unique file path).

So, what does this mean? Well, it means a few things. First of all, it appears Microsoft was unable to mitigate the problem on its own. The threat that remained was due to end users either uninformed or unwilling to take steps to prevent further infection or damage.

Then there's the how. And that has to do with the FBI's expanded powers under Rule 41(b). Prior to 2016, jurisdictional limits were placed on warrants and searches. If the government wanted to search/seize, it had to request a warrant in the jurisdiction where the search/seizure would take place. The government found this too limiting. The jurisdictional limits were causing it trouble in court. Its investigations of dark web child porn servers led to use of network investigative technique -- a search of computers connecting to servers that resulted in the deployment of malware to collect identifying info. Legal challenges were raised under Rule 41, which required warrants to be executed within the court's jurisdiction. The NITs deployed by the FBI were distributed to computers all over the world.

The jurisdictional limits are gone. The FBI's warrant [PDF] says that Rule 41(b) now allows it to travel far outside the Southern District of Texas, where the warrant request was made. No one can say for sure how far the FBI's web shell-targeting efforts traveled. Not even the FBI:

The presumptively U.S.-based Microsoft Exchange Servers, corresponding to the approximately web shells in Attachment A appear to be located in five or more judicial districts, according to publicly available Whois records and IP address geolocation. These districts include, but are not limited to, the following: Southern District of Texas, District of Massachusetts, Northern District of Illinois, Southern District of Ohio, District of Idaho, Western District of Louisiana, Northern District of Iowa and Northern District of Georgia.

There's the presumption. All servers might all be in the US. Then again, they may not. But no one knows for sure until after the warrant is executed and all the data is in.

No one targeted by the Rule 41 warrant is suspected of committing crimes. Instead, they've done nothing more than run unpatched software that presents a security risk to them and anyone else they come in contact with. The FBI has decided it's up to the government to come to the rescue of computer users around the US (and perhaps around the world) to prevent further malicious hacking by suspected Chinese state operatives.

So, where does this leave computer users who'd rather not have the government meddle with their unpatched software? On the outside and in the minority, it would appear. The FBI was able to deactivate backdoors in several targets but estimates "hundreds" of servers remain vulnerable because the FBI's hacking tool was unable to find and eliminate the threat under the confines of the court order it obtained.

Now that the court order has been unsealed, the FBI is reaching out to those whose computers the agency briefly accessed. And it definitely should. Not just because of the unexpected intrusion, but because the FBI could only do so much with its webshell-hunting software.

The Justice Department also said the operation only removed the backdoors, but did not patch the vulnerabilities exploited by the hackers to begin with or remove any malware left behind.

There it is. The attempt to neutralize a threat only neutralized some of it. But the FBI had permission to neutralize whatever it encountered that met its definition of a threat, no matter where the target was located. This is the FBI using its powers for good, which makes this effort pretty benign. But the FBI's definition of "good" is, at some point, going to cause considerable collateral damage because Rule 41(b) no longer limits it to a single jurisdiction. This was a search, as the FBI freely admits. That it was strictly limited in this case speaks more to the operational aspects of the job, rather than the FBI's better judgment. We can only hope in the future -- as the FBI flexes its jurisdictional free pass -- that the agency shows as much restraint in the future when there's more than some unpatched computers at stake.

Filed Under: backdoors, doj, fbi, microsoft exchange, patch, rule 41
Companies: microsoft

Seventh Circuit Appeals Court Hands Fifth 'Good Faith' Win To FBI's Invalid Playpen Warrant

from the fixing-it-in-post dept

It doesn't appear the Supreme Court will have to resolve a circuit split on the FBI's malware warrant used in its Playpen child porn investigation. The same day the Ninth Circuit Appeals Court found in favor of the FBI, the Seventh Circuit reached the same conclusion [PDF], bringing the FBI's "good faith" total to five appellate wins versus zero losses.

The Seventh's reasoning echoes that of the other circuits: the warrant may have been invalid (seeing as its jurisdiction limits were immediately violated by the FBI's malware deployment), but the FBI was correct to rely on the magistrate's screwup.

Federal Rule of Criminal Procedure 41(b)(1) authorizes a magistrate judge “to issue a warrant to search for and seize a person or property located within the [magistrate judge’s] district.” This warrant, they say, extended to people and property located outside the magistrate’s district. Defendants contend that a void warrant is tantamount to no warrant at all, nullifying the good-faith exception.

We disagree. Even if the warrant were void ab initio, we would treat this like any other constitutional violation. We see no reason to make the good-faith exception unavailable in such cases.

I'm sure the Seventh didn't mean to make it sound like it would excuse "any other constitutional violation," but that's kind of how it reads. What the court is saying is that it won't suppress the evidence obtained with an invalid warrant. It doesn't go as far as other courts have and find that there's no deterrent effect in suppressing evidence because the illegal actions engaged in by the FBI were made legal after the fact. But it does say suppression is unreasonable because it punishes the FBI for the magistrate judge's error.

The deterrence rationale for the exclusionary rule aims at the conduct of the police, not the conduct of the magistrate judge. See Davis, 564 U.S. at 238 (focusing the cost-benefit analysis in exclusion cases on the “flagrancy of the police misconduct” at issue). Thus, whether the magistrate judge lacked authority has no impact on the rule. As Leon explains, “[p]enalizing the officer for the magistrate’s error, rather than his own, cannot logically contribute to the deterrence of Fourth Amendment violations.”

What's more troubling is that its discussion of the FBI's "good faith" grants credence to one of the FBI's more disingenuous arguments: that the malware it sent was a "tracking device" rather than a search, making its deployment from a seized server in Virginia constitutional because the FBI obviously can't control where tracking devices end up after they're deployed. This legal theory has been criticized in other courts even while finding the FBI, overall, acted in good faith. Here's a quote from the Third Circuit's decision, which calls out the FBI for its appellate-level goalpost moving.

We need not resolve Werdene’s contention that the Government waived this argument because we find that the Government’s tracking device analogy is inapposite. As an initial matter, it is clear that the FBI did not believe that the NIT was a tracking device at the time that it sought the warrant. Warrants issued under Rule 41(b)(4) are specialized documents that are denominated “Tracking Warrant” and require the Government to submit a specialized “Application for a Tracking Warrant.” See ADMINISTRATIVE OFFICE OF U.S. COURTS, CRIMINAL FORMS AO 102 (2009) & AO 104 (2016). Here, the FBI did not submit an application for a tracking warrant – rather, it applied for, and received, a standard search warrant. Indeed, the term “tracking device” is absent from the NIT warrant application and supporting affidavit.

The Seventh Circuit gives the government credit where none is due.

Perhaps the warrant impermissibly allowed the search of computers outside the magistrate judge’s district, as the defendants suggest. But the government suggests another theory. It notes that under Rule 41(b)(4), a magistrate judge can issue a warrant for the installation of a “tracking device” within the district that can track movement outside the district. Fed. R. Crim. P. 41(b)(4). The government characterizes the NIT as such a device, maintaining that its installation occurred in-district because the defendants were accessing servers located in that district. Choosing between these frameworks has split district courts across the country, which underscores the difficulty of the question.

Having done that, the court declares it won't discuss the "tracking device" any further because it has already said suppression would punish the FBI for the magistrate's error. The evidence remains in play and the convictions of all three defendants are affirmed.

The problem with these decisions is they tacitly encourage law enforcement to ask judicial permission for illegal searches because if it's granted, it's the magistrate's fault, not the officers', and evidence obtained illegally won't be suppressed. When the FBI asked for permission to engage in extraterritorial searches, the DOJ was pushing for removal of Rule 41 jurisdiction limits. It's impossible the agent swearing out the warrant was unaware of this fact. It was a bad faith request converted to "good faith" by the magistrate's approval, whitewashing the FBI's actions and making the evidence unassailable in court.

Filed Under: 4th amendment, 7th circuit, doj, fbi, good faith, playpen, rule 41

Ninth Circuit Aligns With Other Circuits: The FBI's Playpen Warrant Was Bad, But The FBI's Faith Was Good

from the winning-by-losing dept

The Ninth Circuit Court of Appeals is the latest appeals court to find the FBI's warrant for malware deployment during a child porn investigation to be invalid, but still close enough for government work. The FBI's NIT (Network Investigative Technique) was sent to visitors of a dark web child porn site called Playpen. The hitchhiking software then traveled out of the district the server was housed in (Virginia) to send back identifying info from computers and devices all over the world.

At the time the warrant was sought, warrants were only valid in the district they were issued. Multiple courts found the FBI's malware was a search under the Fourth Amendment. A smaller subset found the extrajurisdictional search unsupported by current law and the underlying warrant invalid from the moment it was issued. Challenges to the extrajurisdictional searches have all run into dead ends at the appellate level.

The First, Eighth, and Tenth Circuits have all refused to suppress evidence, even if the courts found the search warrant invalid. The reasoning? There was no deterrent effect served by suppressing the evidence because the law changed after the warrant was issued and the malware deployed to allow the FBI to engage in extrajurisdictional searches. In essence, this is retroactive application of a law that changed after the warrant was sought, giving it the sort of blessing courts won't extend to victims of law enforcement misconduct that happened to occur before precedential decisions explicitly declared that particular form of misconduct unconstitutional.

In addition to the retroactive application of Rule 41 jurisdictional changes, these appeals courts have also granted the government "good faith." Somehow, it's believed an FBI agent seeking a warrant for a search that he knew would violate Rule 41 limits when executed wasn't the FBI rolling the dice on favorable rulings and a potential future mooting by changes to the law.

There's more of the same in the Ninth Circuit decision [PDF]. The court says the warrant was bad but the faith was good, so no harm, no foul, no suppression. (h/t Brad Heath)

We agree with Henderson that Rule 41(b) is not merely a technical venue rule, but rather is essential to the magistrate judge’s authority to act in this case.

[...]

The Federal Magistrates Act, 28 U.S.C. § 636, defines the scope of a magistrate judge’s authority, imposing jurisdictional limitations on the power of magistrate judges that cannot be augmented by the courts.

[...]

Relevant here, § 636 authorizes magistrate judges to exercise “all powers and duties conferred or imposed” by the Federal Rules of Criminal Procedure. 28 U.S.C. § 636(a)(1). In turn, Rule 41(b) has been asserted as the sole source of the magistrate judge’s purported authority to issue the NIT warrant in this case. But, as we have explained, in issuing such warrant, the magistrate judge in fact exceeded the bounds of the authority conferred on magistrate judges under Rule 41(b). Thus, such rule plainly does not in fact confer on the magistrate judge the authority to issue a warrant like the NIT warrant. Without any other source of law that purports to authorize the action of the magistrate judge here, the magistrate judge therefore exceeded the scope of her authority and her jurisdiction as defined under § 636.

Thus endeth the bad news for the government -- bad news severely tempered by the fact the government still gets to keep its evidence. Even though the court recognizes the warrant was invalid the moment it was signed, it still gives the government points for effort. The Ninth says it's ok for law enforcement to rely on invalid warrants, so long as they've been signed by a magistrate. And good faith or not, the court says there's no reason to suppress the evidence because the house always wins there's no future misconduct to deter.

[T]here is no evidence that the officers executing the NIT warrant acted in bad faith. “To the extent that a mistake was made in issuing the warrant, it was made by the magistrate judge, not by the executing officers.”

[...]

Further, suppression of the evidence against Henderson is unlikely to deter future violations of this specific kind, because the conduct at issue is now authorized by Rule 41(b)(6), after the December 2016 amendment. The exclusionary “rule’s sole purpose, we have repeatedly held, is to deter future Fourth Amendment violations,” Davis v. United States, 564 U.S. 229, 236–237 (2011), and we see no reason to deter officers from reasonably relying on a type of warrant that could have been valid at the time it was executed—and now would be.

With four circuits weighing in and reaching the same conclusions, it seems unlikely any further appellate challenges will upset the FBI's malware apple cart. And if the same conclusions continue to be reached, there will no compelling reason for the Supreme Court to weigh in. Add to that the post-facto codification of the tactics used by the FBI in this investigation and you've got dozens of unconstitutional searches being laundered into Fourth Amendment compliance by courts unwilling to penalize the FBI for overstepping its bounds.

Filed Under: 4th amendment, 9th circuit, doj, fbi, good faith, jurisdiction, nit, playpen, rule 41, warrants

Good Faith Beats Bad Warrant In Another Win For FBI's World-Traversing NIT Malware

from the this-should-keep-this-out-of-the-Supreme-Court's-hands dept

Another challenge of the NIT (Network Investigative Technique) warrant used by the FBI during its investigation of a dark web child porn website has hit the appellate level. A handful of district courts have found the warrant used invalid, given the fact that its reach (worldwide) exceeded its jurisdictional grasp (the state of Virginia, where it was obtained). That hasn't had much of an effect on appeals court rulings, which have all found the warrant questionable to varying degrees, but have granted the FBI "good faith" for violating the jurisdictional limits the DOJ was attempting to have rewritten (Rule 41 -- which governs warrant jurisdictional limits, among other things) to allow it to do the things it was already doing.

Even though the FBI had to have known searches performed all over the world using one Virginia-based warrant violated Rule 41 limits, appellate judges have declared the FBI agent requesting the warrant wasn't enough of a legal expert to know this wasn't allowed. Two appeals courts have stated suppressing the evidence is pointless because the law changed after the jurisdiction limit violation took place. The appellate decisions have been troubling to say the least, providing further evidence that the good faith exception is the rule, rather than the outlier.

The latest decision [PDF] dealing with the NIT warrant comes from the Third Circuit Appeals Court. It, too, finds the warrant questionable. And it states the government has agreed the warrant was not valid under Rule 41(b).

The Government conceded below that “[a]lthough Rule 41 does authorize a judge to issue a search warrant for a search in another district in some circumstances, it does not explicitly do so in these circumstances.” App. 91 (Government Br. in Opposition to Motion to Suppress) (emphasis added).

The opinion goes on to note the government, having admitted its warrant was bad, then argued it was good because it was apparently thinking of a different part of Rule 41 when it applied for a warrant, even though none of this thought made its way into the affidavit as words.

On appeal, however, the Government curiously has reversed course, and now contends that the NIT was in fact explicitly authorized by Rule 41(b)(4), which provides that a magistrate judge may “issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both.” Fed. R. Crim. P. 41(b)(4) (emphasis added).

According to the Government, under this Rule, “the NIT warrant properly authorized use of the NIT to track the movement of information—the digital child pornography content requested by users who logged into Playpen’s website—as it traveled from the server in [EDVA] through the encrypted Tor network to its final destination: the users’ computers, wherever located.”

Wrong again, says the court, noting the disingenuousness of the government's goalpost move. (All emphasis added by me and not the court from this point forward.)

We need not resolve Werdene’s contention that the Government waived this argument because we find that the Government’s tracking device analogy is inapposite. As an initial matter, it is clear that the FBI did not believe that the NIT was a tracking device at the time that it sought the warrant. Warrants issued under Rule 41(b)(4) are specialized documents that are denominated “Tracking Warrant” and require the Government to submit a specialized “Application for a Tracking Warrant.” See ADMINISTRATIVE OFFICE OF U.S. COURTS, CRIMINAL FORMS AO 102 (2009) & AO 104 (2016). Here, the FBI did not submit an application for a tracking warrant – rather, it applied for, and received, a standard search warrant. Indeed, the term “tracking device” is absent from the NIT warrant application and supporting affidavit.

The court also helpfully finds that computer users have an expectation of privacy in their IP addresses and other identifying info housed in their computers. It points out the government obtained this directly from targets' computers rather than third parties, making this a Fourth Amendment search rather than a Third Party Doctrine case.

But that's where the good news ends for the defendant. The appeals court says the warrant was invalid the moment it was issued, but that this can't be held against the FBI. It rationalizes its opinion this way: suppression of evidence is for deterrence, not for righting the government's wrongs. So, it's OK for the FBI to rely on an invalid warrant because the judge made the error approving it. The FBI was not wrong to rely on the warrant, even though it very likely knew its request violated Rule 41 jurisdictional limits. Then it arrives at this conclusion -- one reached previously by another appeals court:

More importantly, the exclusionary rule “applies only where it ‘result[s] in appreciable deterrence.’” Herring, 555 U.S. at 141 (quoting Leon, 468 U.S. at 909) (emphasis added). Thus, even though Rule 41(b) did not authorize the magistrate judge to issue the NIT warrant, future law enforcement officers may apply for and obtain such a warrant pursuant to Rule 41(b)(6), which went into effect in December 2016 to authorize NIT-like warrants. Accordingly, a similar Rule 41(b) violation is unlikely to recur and suppression here will have no deterrent effect.

In other words, because it's now impossible for the FBI to engage in this violation of Rule 41, there's nothing to be gained by suppressing the evidence. In essence, the court is saying that if the DOJ can get laws changed quickly enough to codify earlier statutory violations, defendants challenging evidence based on legal violations that occurred before the law was changed are shit out of luck. Compare and contrast this to civil rights lawsuits where the courts have awarded good faith to law enforcement for apparent rights violations because they occurred before such acts were declared unconstitutional by precedential opinions. It's "heads I win, tails you lose" in federal courts, thanks to the good faith exception.

More cases will reach the appellate level but it hardly seems likely any of those will result in suppressed evidence for Playpen defendants. These findings will be reached despite most appellate judges declaring the underlying warrants void from the moment they were issued. Defendants asking for suppression are going to run into judges willing to forgive the FBI both before and after the fact, which means there's very little justice left in the justice system's tanks.

Filed Under: 4th amendment, doj, fbi, good faith exception, nit, playpen, rule 41, third circuit, warrant

Court Finds FBI's 'Malware' Deployment To Be Perfectly Constitutional

from the well...-the-darkweb-is-like-an-unlit-highway... dept

The US court system has hosted a large number of lively discussions about the tactics used by the FBI in its Playpen child porn investigation. A lot of new ground was broken by the FBI, not all of it good. First, the agency kept a darkweb child porn site running for two weeks after it seized it. It did this to facilitate the distribution of malware designed to uncover information about the computers (and users) accessing the site.

Adding to the mess was the malware itself. The FBI's Network Investigative Technique (NIT) was deployed across the US (and across the globe) via a single warrant signed by a magistrate judge in Virginia. Plenty of courts have declared the FBI's warrant invalid, as the search performed violated Rule 41's jurisdictional limitations. (Those limitations no longer exist, so chalk up a win for the DOJ.) Many have also called the NIT's extraction of IP addresses and device-identifying info a search. But very few judges have seen fit to suppress the evidence obtained, either finding no privacy expectations in IP addresses or granting the FBI "good faith."

At the appellate level, only two Playpen cases have been heard, but both courts returned decisions in favor of the government. The process continues in full force at the lower levels, where the DOJ is still working its way through the dozens of cases springing from its NIT deployment.

In Texas, a federal judge has decided [PDF] against suppressing evidence obtained with the FBI's NIT. But Judge Xavier Rodriguez does so while using a descriptive term the government vehemently disagrees with. [h/t Brad Heath]

In December 2014, the Government became aware of a website named Playpen that contained child pornography. One of the servers for that website was in North Carolina. Ultimately the Government seized that server pursuant to a warrant, relocated the server to Virginia, and assumed the role of administrator. When the Government was unable to identify the identity of the approximate 150,000 members of the website, the Government obtained a warrant on February 20, 2015 to deploy Network Investigative Technique (NIT) malware. The warrant authorized the search for persons located in the Eastern District of Virginia. The malware, however, reached all computers accessing the website, including Defendant Halgren’s computer in San Antonio, Texas.

Through the malware the Government discovered that a user named “Platch” accessed the site, and the Government discovered the IP address associated with “Platch.” Defendant Halgren was the user associated with the IP address.

The FBI has argued its NIT isn't malware, even though it seems to fit the description. It's a payload designed to reveal IP addresses and device info without the target's permission or awareness. If deployed by anyone else other than the government, the government would take issue with the exploit's operation and delivery method.

Thus ends the things the government won't like in this opinion. The judge goes a route few others have, treating the malware like a tracking device. By casting it as something it really isn't, the judge is able to sustain the warrant's viability. If the NIT is a tracking device, no jurisdictional violations occurred. The tracking device simply "traveled" out of the jurisdiction and that can't possibly be the government's fault.

Magistrate Judges have authority “within the district in which sessions are held by the court that appointed the magistrate judge . . . and elsewhere as authorized by law.” 28 U.S.C. § 636(a). Former Rule 41 that was in effect in 2015 authorized a Magistrate Judge “to issue a warrant to search for and seize a person or property located within the district.” The Former Rule 41 provided “exceptions to this jurisdictional limitation for property moved outside of the jurisdiction, for domestic and international terrorism, for the installation of a tracking device, and for property located outside of a federal district. None of these exceptions [in 2015] expressly allow[ed] a magistrate judge in one jurisdiction to authorize the search of a computer in a different jurisdiction.”

But see United States v. Darby, 190 F. Supp. 3d 520, 536 (E.D. Va. 2016) (“Rule 41(b)(4) allows a magistrate judge to issue a warrant for a tracking device to be installed in the magistrate's district. Once installed, the tracking device may continue to operate even if the object tracked moves outside the district. This is exactly analogous to what the NIT Warrant authorized. Users of Playpen digitally touched down in the Eastern District of Virginia when they logged into the site. When they logged in, the government placed code on their home computers. Then their home computers, which may have been outside of the district, sent information to the government about their location. The magistrate judge did not violate Rule 41(b) in issuing the NIT Warrant.”)

Even if the court would have found the warrant invalid (which it didn't), it still would have allowed the FBI to keep the evidence because the Fourth Amendment doesn't cover IP addresses.

Given that the Defendant’s IP address was required to be disclosed to various third parties and Playpen to access the website, any subjective expectation of privacy the Defendant may have possessed was not objectively reasonable.

And if that wasn't enough, good faith is also granted, so any lack of a valid warrant still wouldn't have resulted in evidence suppression.

The warrant was not void at its issuance. Even if it had been, the Court concludes that the good faith exception would apply and that suppression would not be warranted.”); but see Levin, 186 F. Supp. 3d at 44 (NIT Warrant was issued without jurisdiction and thus was void ab initio and the good-faith exception is inapplicable). This Court disagrees with Levin and the three or four other courts that have ordered suppression. If a judge signed a warrant without the necessary probable cause determination that warrant was akin to being void. But if an officer reasonably relies upon that signing and acts in good faith, Leon holds that the evidence seized should not be suppressed.

This will almost certainly be appealed. There's still plenty of appeals courts left that haven't explored these issues. The first two tries went the government's way, but more eyes on more cases may actually result in a successful suppression effort. The problem is the rules (well, Rule 41 anyway) have changed. Courts may see little value in suppressing evidence the government can now acquire lawfully with last year's Rule 41 changes. The Eighth Circuit Appeals Court came to exactly that conclusion earlier this year.

The thing is, the government should still be deterred from breaking rules they know still exist, even if governing statutes may change in the future. The government hasn't stopped locking up marijuana users and dealers even though legalization in a majority of US states seems inevitable. This standard should be applied to the government by the only entities capable of doing it: the US courts.

Filed Under: doj, fbi, malware, nit, playpen, rule 41

FBI Tries New Rule 41 Changes On For Size In Fight Against Long-Running Botnet

from the one-warrant;-all-the-computers dept

The DOJ is proud to announce it's flexing its new Rule 41 muscle. The changes proposed in 2015 sailed past a mostly-uninterested Congress and into law, giving the FBI and other DOJ entities permission to hack computers anywhere in the world with a single warrant.

With the new rules, the law has finally caught up with the FBI's activities. It deployed a Network Investigative Tool -- the FBI's nifty nickname for intrusive malware that sends identifying info from people's computers to FBI investigators -- back in 2012 during a child porn investigation and mostly got away with it. It tried it again in 2015 and ran into a bit more resistance.

Rule 41's (former) jurisdictional limitations meant the FBI wasn't supposed to be able to "search" computers all over the US using a single warrant issued in Virginia. This activity was supposed to be confined to the state of Virginia. The aftermath of the Playpen investigation has led to a multitude of conflicting judicial opinions. Some have found the warrant invalid and the evidence obtained worthless. Others have granted good faith exceptions or determined no privacy violation took place. In at least one case, the government has dismissed the charges rather than expose any information about its Rule 41-flouting NIT.

In this case, the FBI isn't hacking computers to uncover child porn site visitors. Instead, it's going to be fiddling with a lot of computers to take down a botnet. The DOJ press release makes particular note of how lawful this all is now, post-Rule 41 amending:

In seeking authorization to disrupt and dismantle the Kelihos botnet, law enforcement obtained a warrant pursuant to recent amendments to Rule 41 of the Federal Rules of Criminal Procedure. A copy of this warrant along with the other court orders are produced below.   The warrant obtained by the government authorizes law enforcement to redirect Kelihos-infected computers to a substitute server and to record the Internet Protocol addresses of those computers as they connect to the server. This will enable the government to provide the IP addresses of Kelihos victims to those who can assist with removing the Kelihos malware including internet service providers.

The search warrant [PDF] application leads off with this as well, waving it in front of its unusual request like a wary vampire hunter's cross.

I make this affidavit in support of an application for a warrant under Federal Rule of Criminal Procedure 41 to authorize an online operation to disrupt the Kelihos botnet currently under the control of Peter Yuryevich LEVASHOV, a criminal hacker. The operation, which is particularly described in Attachment A and Attachment B, involves the distribution of updated peer lists, job messages and/or IP filter lists, further described in Attachment B, to the TARGET COMPUTERS currently infected with the Kelihos botnet malware in violation of Title 18, United States Code, Sections 1030, L343, and 2511, as described in Attachment A. This operation will also obtain the Internet Protocol addresses and associated routing information of those infected computers, and those addresses are evidence of crimes committed by LEVASHOV. A PRTT order has been requested for the purpose of attaining those IP addresses and associated routing information. This operation will not capture content from the TARGET COMPUTERS or modify them in any other capacity except limiting the TARGET COMPUTERS' ability to interact with the Kelihos botnet.

The intent here is to dismantle the botnet by freeing zombie computers. All well and good, except it's not the government pointing victims to malware removal tools, but rather letting themselves into the "house" to size up infections before passing this info on to third parties to actually perform the removals.

This new form of intrusion raised concerns in Congress, but the DOJ insisted the changes were innocuous and please let's all stop talking about this before someone stops the Rule 41 amendments slow roll to tacit approval.

Here it is in action: thousands of computers temporarily hosting digital G-men. We're in unknown territory right now with the FBI's anti-botnet work. The FBI itself doesn't even appear all that sure about the extent of its new Rule 41 powers. As is noted in the warrant, the FBI also applied for a Pen Register/Trap and Trace (PRTT) order [PDF] just in case.

Other than the three elements described above, federal law does not require that an application for an order authorizing the installation and use of a pen register and a trap and trace device specify any facts. The following additional information is provided to demonstrate that the order requested falls within this Court's authority to authorize the installation and use of a pen register or trap and trace device under 18 U.S.C. g 3123(a)(1).

This is the FBI basically saying the law doesn't require this application, but here it is anyway. A CYA PRTT for the interception of communications metadata that might help identify botnet victims. And for all its talismanic waving of Rule 41, the FBI isn't even sure it's really required to seek a warrant to perform this botnet cleanup. From the warrant affidavit:

To effectively combat the P2P structure of the Kelihos botnet, the FBI with assistance of private partners will participate in the exchange of peer lists and job messages with other infected computers. The FBI's communications, however, will not contain any commands, nor will they contain IP addresses of any of the infected computers. Instead, the FBI replies will contain the IP and routing information for the FBI's "sinkhole" server. As this new routing information permeates the botnet, the Kelihos infected computers will cease any current malicious activity and learn to only communicate with the sinkhole. The effect of these actions will be to free individual infections from exchanging information with the Kelihos botnet and with LEVASHOV. This will stop Kelihos's most immediate harm, the harvesting of personal data and credentials, and the transmittal of that data to servers under LEVASHOV's control.

Another portion of the Kelihos job messages is a list, known as the IP filter list. This list functions as a type of blacklist, preventing communication with those IPs contained within the filter list. If necessary, the FBI also seeks authorization to send a filter list to TARGET COMPUTERS to block Kelihos infected computers from continuing to communicate with router nodes.

The footnote attached to this reads:

The law is unsettled as to whether the operation authorized by the proposed warrant constitutes a search or seizure. However, in an abundance of caution, the United States is seeking a warrant.

It looks like the FBI is tentatively exploring its new powers, making sure it has the paper trail it needs to stave off courtroom challenges. If it sticks to disrupting a botnet, it shouldn't face any. If it takes advantage of its new access privileges, it might.

Filed Under: botnet, doj, fbi, hacking, nit, rule 41, warrant

Thanks To Months Of Doing Nothing, Senate Allows DOJ's Rule 41 Changes To Become Law

from the do-nothing-lawmakers-manage-to-accomplish-something dept

The amendments to Rule 41 are now law, thanks to Sen. John Cornyn, who prevented bills opposing the immediate adoption of the changes from being debated.

Sens. Ron Wyden (D-Ore.), Steve Daines (R-Mont.) and Chris Coons (D-Del) took to the floor and unsuccessfully asked for unanimous consent to either pass or formally vote on three bills to delay or prevent updates to the process used by law enforcement to get a warrant to hack suspects' computers.

“We simply can’t give unlimited power for unlimited hacking,” Daines argued.

[...]

But the bid to prevent the imminent changes to Rule 41 ended quickly. After Wyden spoke, Majority Whip John Cornyn (R-Texas) immediately objected to all three bills, without waiting to hear from Coons and Daines.

But Cornyn alone can't be blamed for this outcome. A vast majority of senators did nothing to prevent the proposed changes from becoming law -- even though the decision has been in their hands since the Supreme Court's approval in April.

The FBI and others will be able to take advantage of the removal of jurisdictional limits to search computers anywhere in the world using a single warrant issued by a magistrate judge. It will also be granted the same power for use in the disruption of botnets -- in essence, searches/seizures of devices owned by US citizens suspected of no wrongdoing.

Cornyn, who prevented any debate over the "updates" to Rule 41, seems closely aligned with the DOJ's views -- that these changes will have "little effect" on civil liberties because the FBI, etc. "will still have to get a warrant."

Sure, warrants are still involved, but the scope of what can be accessed with a single warrant has been expanded greatly. And the DOJ has yet to explain how it's going to prevent law enforcement agencies from shopping around for the most compliant magistrates, now that they're not required to perform searches in the issuing court's jurisdiction. The DOJ also hasn't adequately explained what sort of notification process it will use when performing its botnet cleanups.

What it has done, however, is issue a statement saying the ends justify the means.

In an effort to address concerns, U.S. Assistant Attorney General Leslie Caldwell wrote a blog post this week arguing that the benefits given to authorities from the rule changes outweighed any potential for "unintended harm."

The DOJ wanted fewer restrictions, more power, and the opportunity to treat any appearance of anonymization software as an excuse to deploy these newly-granted powers. The Senate -- for the most part -- gave it everything it wanted by doing nothing at all to stop it.

Filed Under: doj, fbi, hacking, john cornyn, nit, ron wyden, rule 41, surveillance, warrants

Senators Not Impressed By DOJ's Answers On Rule 41 Changes

from the answer-the-damn-question dept

The DOJ has finally responded to questions posed by several senators about its interpretation of the proposed Rule 41 changes, due to go into effect on December 1st. Arriving shortly before the deadline -- and during the Thanksgiving holiday Black Friday news rush -- the DOJ's letter [PDF] contains a few explanations of its jurisdiction limitation-stripping and roving botnet warrants.

Unfortunately, not much is clarified other than that the DOJ still feels its proposal is nothing more than Rule 41 64-bit -- an update of existing law more in line with today's connected reality. (The DOJ offers no insight on its reluctance to update other outdated laws like the CFAA…) It also appears to believe the Fourth Amendment impact of its "one warrant, thousands of searches" proposal will be minimal and that it will maintain the same level of respect it has shown for privacy protections (also minimal) under the updated rule.

Needless to say, Sen. Wyden and co. aren't impressed by the DOJ's response.

Wyden and Coons were among 11 senators and 12 House members who queried DOJ about the hacking powers expansion last month. The department’s reply, which arrived today, should be “a big blinking warning sign about whether the government can be trusted to carry out these hacks without harming the security and privacy of innocent Americans’ phones, computers and other devices,” Wyden wrote.

The DOJ is still dodging a few questions. One question in particular was completely unaddressed in the DOJ's response. Wyden and his co-signers asked what the DOJ was going to do to prevent forum shopping for compliant judges -- something that would become far more common with jurisdictional limits removed.

The letter does not recount any specific department policies or training that would prevent forum shopping. It does stress police will only be able to seek warrants in districts where activity related to a crime has occurred and that the revised rule uses the same language as existing out-of-district warrant authorities for terrorism cases.

The DOJ either can't answer this or won't answer this. In either case, the lack of response indicates the DOJ isn't interested in preventing law enforcement agencies (like the FBI) from shopping for judges. If there's nothing in place now, it's highly unlikely any guidance will be in place by December 1st. If there is something in place, it's apparently nothing more than a suggestion that law enforcement seek warrants in their own jurisdictions. If the DOJ was truly interested in shutting down forum shopping, it would have begun putting policies in place at any point over the last couple of years while it pursued this "update" of Rule 41.

The letter does say law enforcement agencies won't be able to peek at private files while mucking about the insides of citizens' computers to shut down botnets. But the letter (and the Constitution) both say a lot of things that are great in theory, but less so in practice. Fourth Amendment violations can only be cured by visits to courtrooms, but it's something that's prohibitively expensive and subject to a large number of "GET OUT OF VIOLATION" cards (good faith, plain view, close-but-no-suppression, etc.) issued by presiding judges.

The redux of the changes is still this: if anonymization efforts are made by anyone targeted in a criminal investigation, the FBI, etc. can go find the most compliant judge available to sign off on a single warrant that can be used to search thousands of computers worldwide. It can also do this under the pretext of fighting botnets, performing the same sort of limited search for identifying info, even when all the hundreds or thousands of targets are not suspected of any wrongdoing.

Pretty much the only thing standing between the DOJ's proposal and the December 1st implementation is Congressional members' decision to "opt in" to a shutdown fight -- something the DOJ is clearly hoping won't happen. Wyden's recently-introduced bill would push the adoption back until the middle of next year, but it still requires representatives to express some sort of opinion (yes/no) on rule changes that could easily coast into existence while everyone in Congress is distracted by upcoming holidays and annual budget battles.

Filed Under: chris coons, doj, fbi, hacking, jurisdiction, malware, nit, ron wyden, rule 41

Bill Introduced To Push Back Approval Of DOJ's Proposed Rule 41 Changes

from the buying-time dept

Unless someone steps up to push this off course, the DOJ's proposed changes to Rule 41 will become law December 1. That's the key part: doing something. All that has to happen is nothing for the changes to become law. The December 1st date plays right into the DOJ's hands, arriving between two major holidays when legislators have other things on their minds, including the annual Congressional fisticuffs over the federal budget.

The DOJ says the changes are no big deal. Just an "update" on outdated laws. Oddly, it's never shown any interest in updating any other outdated laws (like the CFAA) or pushed for a reconsideration of the Third Party Doctrine, which traces back nearly four decades. When it comes to expansions of power, though, it's apparently time for some "updating."

The proposed changes would allow the FBI to hack thousands of computers around the world with a single warrant, much like it already did during two child porn investigations. Unfortunately for the FBI, its warrant is being met with successful challenges because the agency clearly violated Rule 41 jurisdictional limitations.

In addition, the DOJ wants permission to break into "compromised" computers and poke around inside them without the permission or knowledge of the owners of these computers. It also wants to treat anything that anonymizes internet users or hides their locations to be presumed acts of a guilty mind. The stripping of jurisdictional limits not only grants the FBI worldwide access for digital seizures and searches, but also encourages it to go venue shopping for judicial rubber stamps.

Earlier this year, Sen. Ron Wyden introduced a bill aimed at stopping the DOJ's Rule 41 push. Not much has been heard about this bill since, so Wyden (along with Sens. Coons, Lee, Franken, and Daines) has introduced another bill seeking to prevent a "do nothing" approval of expanding hacking/search powers. The "Review the Rule Act" [PDF] is about as succinct as legislation gets. Here's the complete summary of the proposed legislation (via Naked Security):

To delay the amendments to rule 41 of the Federal Rules of Criminal Procedure.

Wyden's earlier bill hasn't gained any traction and the hopes of a complete rejection before December 1st are nearly nonexistent. So, this bill just asks for a little more time to discuss the implications of the changes. This would move the default approval date back seven months to July 1, 2017.

This would allow representatives more time to fully consider the DOJ's proposal, freed from the time crunch of major holidays and annual federal budget discussions. There's far too much at stake to simply allow the DOJ to roll its Rule 41 ball downhill and past a distracted Congress. Many legislators like procrastination as much as they like not doing anything, so signing off on this proposal shouldn't require much effort, mental or otherwise.

Filed Under: congress, doj, fbi, hacking, nit, ron wyden, rule 41, warrant

Legislators Demand Answers From DOJ On Expanded Hacking Powers It's Seeking

from the the-first-rule-of-the-new-Rule-41:-there-are-no-rules dept

There's only a couple of months left until the DOJ's proposed Rule 41 changes become law. All Congress has to do is nothing. This is a level of effort Congress is mostly amenable to. If this becomes law, worldwide deployments of malware/spyware during investigations will be unable to be challenged in court. In addition, the DOJ wants to be part of the cyberwar. It's seeking permission to remotely access zombie computers/devices used in cyberattacks to "clean" them.

The rule changes would also add a presumption of guilt to an activity performed by millions of computer users around the world:

Opponents of the pending change to Rule 41 say that it unlawfully confers a new authority that changes substantive rights. First off, they contend that it adds a criminal taint to a perfectly legal practice: using location to cloak your location.

“There are countless reasons people may want to use technology to shield their privacy,” wrote the Electronic Frontier Foundation earlier this year. “From journalists communicating with sources to victims of domestic violence seeking information on legal services, people worldwide depend on privacy tools for both safety and security.”

The DOJ has argued that these Rule 41 amendments are just "clarifications" of existing law:

“The amendment would not authorize the government to undertake any search or seizure or use any remote search technique not already permitted under current law,” the DOJ told Consumerist in May, noting that law enforcement would still need to demonstrate probable cause.

This statement obviously isn't true considering how many federal judges have agreed the warrant it used in the Playpen investigation exceeded existing jurisdictional limits.

Fortunately, there are legislators pushing back against the DOJ's proposed changes. Ron Wyden has sent a letter [PDF] to the DOJ -- co-signed by 22 other legislators -- asking for clarification on the DOJ's interpretation of the changes it's seeking.

One of the questions the group has is how the DOJ can produce probable cause to search thousands of devices.

Please describe any differences in legal requirements between obtaining a warrant for a physical search versus obtaining a warrant for a remote electronic search. In particular, and if applicable, please describe how the principle of probable cause may be used to justify the remote search of tens of thousands of devices. Is it sufficient probable cause for a search that a device merely be "damaged" and connected to a crime?

The letter also raises the issue of forum shopping. With jurisdictional limits removed, federal law enforcement officers are free to find judges more willing to sign off on their warrant requests, rather than being forced to work with those in the locality the alleged criminal activity took place.

The DOJ's proposed botnet cleaning efforts raise a whole set of new troubling questions, ones that Wyden and co. would like to see answered before allowing the rule changes to slide by unopposed. First, there's the question of unforeseen collateral damage -- efforts that hurt more than help.

We are concerned that the deployment of software to search for and possibly disable a botnet may have unintended consequences on internet-connected devices, from smartphones to medical devices. Please describe the testing that is conducted on the viability of "network investigative techniques" to safely search devices such as phones, tablets, hospital information systems, and internet-connected video monitoring systems.

Then there's the question about the proposed "cleaning" efforts. Under what authority will law enforcement break into Americans' computers and screw around with their software and hardware?

Will law enforcement use authority under the proposed amendments to disable or otherwise render inoperable software that is damaging or has damaged a protected device? In other words, will network investigative techniques be used to "clean" infected devices, including devices that belong to innocent Americans? Has the Department ever attempted to "clean" infected computers in the past? If so, under what legal authority?

Good questions. Hopefully, we'll see the answers sometime before December 31st.

Filed Under: congress, doj, fbi, hacking, oversight, rule 41