PUBLIC HEARING ON

PROPOSED AMENDMENTS TO THE

FEDERAL RULES OF CRIMINAL PROCEDURE

JUDICIAL CONFERENCE ADVISORY COMMITTEE 

ON CRIMINAL RULES

Thurgood Marshall Federal Judiciary Building

Washington, D.C.

November 5, 2014
List of Confirmed Witnesses for the

Public Hearing on Proposed Amendments to the

Federal Rules of Criminal Procedure

Judicial Conference Advisory Committee on Criminal Rules

Thurgood Marshall Federal Judiciary Building

Washington, D.C.

November 5, 2014 – 9:00 A.M.

Witness Name Organization Testimony

1. Nathan Freed Wessler American Civil Liberties Union Tab 1

2. Christopher Soghoian American Civil Liberties Union Tab 1

3. Kevin S. Bankston Open Technology Institute

New American Foundation

Tab 2

4. Joseph Lorenzo Hall Center for Democracy & Technology Tab 3

5. Alan Butler Electronic Privacy Information Center Tab 4

6. Amie Stepanovich Access and the Electronic Frontier 

Foundation

Tab 5

7. Ahmed Ghappour University of California, Hastings College 

of the Law

No testimony 

submitted

8. Robert J. Anello Federal Bar Council Tab 6
TAB 1
MEMORANDUM

To: Members of the Advisory Committee on Criminal Rules

From: American Civil Liberties Union

Date: October 31, 2014

Re: Second ACLU Comment on the Proposed Amendment to Rule 41 Concerning 

“Remote Access” Searches of Electronic Storage Media

Dear Members of the Committee,

The American Civil Liberties Union submits these comments to aid the Committee’s 

consideration of the proposed amendment to Rule 41 concerning “remote access” searches of 

computers and other electronic devices. The amendment was proposed by the Department of 

Justice last year, and modified by the Committee at its April 2014 meeting.1

We appreciate the careful scrutiny that the Committee has given to the proposed 

amendment so far and, in particular, the changes made during the Committee’s April 2014 

meeting. By narrowing the proposed circumstances in which warrants for remote access searches 

may be sought, the Committee addressed many of the problems identified by the ACLU in the 

original proposal. 

Nonetheless, we continue to have serious concerns about the breadth of the proposed 

amendment, and we urge the Committee to reject the proposal in full. 

This comment raises questions about the first prong of the proposal, which would permit 

law enforcement agencies to remotely install surveillance software on a target’s computer if “the 

district where the media or information is located has been concealed through technological 

means.”2 Although the second prong of the proposal, which the government has argued is 

necessary for botnet investigations,3 also raises serious questions, the ACLU leaves it to others to 

flesh out those questions.

4

1 See generally Advisory Comm. on Criminal Rules, Materials for April 7–8, 2014 Meeting 155–266 (“Advisory 

Committee Materials”), available at 

http://www.uscourts.gov/uscourts/RulesAndPolicies/rules/Agenda%20Books/Criminal/CR2014-04.pdf 2 Preliminary Draft of Proposed Amendments to the Federal Rules of Appellate, Bankruptcy, Civil, and Criminal 

Procedure: Request for Comment 338 (Aug. 2014) (“Proposed Amendments Materials”), available at

http://www.regulations.gov/#!documentDetail;D=USC-RULES-CR-2014-0004-0001. 3 See Advisory Committee Materials at 172. 4 Given the technical complexity associated with the botnets, we recommend that the committee solicit input from 

botnet experts from both academia and industry. 

1

 
This comment begins by describing the technological means by which law enforcement 

agencies will likely carry out the “remote access searches” that would be authorized by the 

proposed amendment, and the computer security and policy concerns raised by such operations. 

It then explains that the proposal does not merely regulate procedure, but in fact affects 

substantive rights and substantively expands the government’s investigative power. Finally, it 

argues that the substantive authority sought by the government through its proposal raises serious 

constitutional questions. On the basis of these serious policy and constitutional questions, the 

ACLU recommends that the Committee reject the proposal as going beyond the scope of the 

Rules’ limited purpose and defer to Congress to address this issue in the first instance. 

We very much appreciate the Committee’s consideration of this comment and look forward 

to discussing our concerns with the Committee during the upcoming public meeting.

I. The Means Available to the Government to Conduct “Remote Access” Searches

The proposed amendment to Rule 41 would allow a magistrate judge to issue a warrant 

authorizing law enforcement “to use remote access to search electronic storage media and to 

seize or copy electronically stored information.”5 Neither the proposed amendment nor the 

proposed committee note define “remote access.” Submissions from the Department of Justice to 

the Subcommittee on Rule 41 provide some description of what is meant by “remote access” and 

how such searches might be carried out, but crucial details remain missing.6 In order for the 

Committee to make an informed assessment of the implications of the proposed amendment, we 

begin this comment with a detailed explanation of what the government means by “remote 

access” search, how such surveillance is carried out, and why authorizing use of these techniques 

raises serious technological and policy concerns.

A. Federal law enforcement agencies have used malware for nearly fifteen 

years.

Since at least 2001, federal law enforcement agencies have used sophisticated 

surveillance software as part of criminal and national security investigations.7 This software, 

whether delivered through trickery, by hacking into the computers of targets,8 or through other 

covert techniques, permits agents to track and locate the computers and mobile devices of 

targets, as well as access private information stored on them.

5 Proposed Amendments Materials at 338. 6 See generally Advisory Committee Materials at 179–235. 7 See FBI Sheds Light on 'Magic Lantern' PC Virus, Reuters, Dec. 13, 2001, 

http://usatoday30.usatoday.com/life/cyber/tech/2001/12/13/magic-lantern.htm. 8 The Department of Justice has stressed that it is merely engaging in remote computer searches, not “hacking.” See

Advisory Committee Materials at 245. However, internal FBI emails use the terms “penetration” and “exploit” when 

describing the CIPAV software, which, like hacking, are both terms of art from the computer security community. 

See Email from [redacted] (OTD) (FBI) to [redacted] (OTD) (FBI) et al. (June 20, 2007), available at 

https://www.eff.org/document/fbicipav-08pdf, p. 50; Email from [redacted] (OGC) (FBI) to [redacted] (SL) (FBI) 

(Nov. 20, 2008), available at https://www.eff.org/document/fbicipav-08pdf at p. 154. Using the term “hacking” is 

descriptively accurate.

2

 
In 2001, journalists revealed that the FBI had developed a software suite capable of 

covertly accessing information stored on suspects’ computers.9 In the initial media reports 

revealing the existence of the FBI’s Magic Lantern tool, a spokesperson for the FBI described it 

as a “a workbench project" that had not yet been deployed. One year later, in a then-classified 

memo, a DOJ prosecutor wrote that the tool, later renamed the Computer and Internet Protocol 

Address Verifier (CIPAV), had already entered regular use, and was “being used needlessly by 

some agencies.”10

Although the existence of this tool was first revealed by the press in 2001, it was not until 

2007 that journalists discovered a case in which it had been used.11 Indeed, although the FBI has 

employed similar surveillance software for nearly fifteen years, only a handful of cases have 

come to the public’s attention. This is, we believe, due to a concerted policy by the FBI of 

keeping everything about its use of this technology out of the public eye.12 For now, the only law 

enforcement agency known to use malware13 is the FBI. However, it is likely that other federal, 

state and local law enforcement agencies have also acquired hacking software.14

9 FBI Sheds Light on 'Magic Lantern' PC Virus, Reuters, supra. 10 See Memorandum from [redacted] to CTCs 1 (Mar. 7, 2002), available at https://www.eff.org/document/fbicipav05pdf.

11 See Kevin Poulsen, FBI’s Secret Spyware Tracks Down Teen Who Made Bomb Threats, Wired (July 18, 2007), 

http://archive.wired.com/politics/law/news/2007/07/fbi_spyware?currentPage=all (“The court filing offers the first 

public glimpse into the bureau's long-suspected spyware capability, in which the FBI adopts techniques more 

common to online criminals.”). 12 See Email from [redacted], Unit Chief, FBI Cryptologic and Electronic Analysis Unit to [redacted] (SE) (FBI) 

(July 18, 2007), available at https://www.eff.org/document/fbicipav-08pdf at p.10 (“[W]e try to make every effort 

possible to protect the FBI's sensitive tools and techniques...we want to ensure that the capabilities of the CIPAV are 

minimized [in future media reports], if discussed at all. This and many tools deployed by the FBI are law 

enforcement sensitive and, as such, we request that as little information as possible be provided to as few individuals 

as possible.”); see also Email from [redacted] (OTD) to [redacted] (OTD) (CON) et al. (Aug. 15, 2004), available at 

https://www.eff.org/files/filenode/cipav/fbi_cipav-07.pdf at p.11 (“We never discuss how we collect the 

[information about a target computer obtained by the CIPAV software] in the warrants/affidavits or with case 

agents, AUSAs, squad supervisors, outside agencies, etc.”). 13 “Malware” and “spyware” are terms of art in the computer security community that describe software used to 

covertly gain access to and extract information from the computers of targets. See Zango, Inc. v. Kaspersky Lab, 

Inc., 568 F. 3d 1169, 1171 (9th Cir. 2009) (describing “malicious software, known as ‘malware,’ that can 

compromise the security and functionality of a computer”); see also Morgan Marquis-Boire et al., Police Story: 

Hacking Team’s Government Surveillance Malware, Citizen Lab (July 24, 2014), 

https://citizenlab.org/2014/06/backdoor-hacking-teams-tradecraft-android-implant/ (describing the capabilities of a 

malware tool sold by a commercial surveillance company to law enforcement and intelligence agency customers 

around the world); Worldwide Threat Assessment of the US Intelligence Community: Hearing on Global Security

Threats and Intelligence Operations Before the S. Select Comm. on Intelligence, 113th Cong. 3 (2013) (statement of 

James Clapper, Director of National Intelligence), available at http://intelligence.senate.gov/130312/clapper.pdf

(“[A] handful of commercial companies sell computer intrusion kits on the open market. These hardware and 

software packages can give governments and cybercriminals the capability to steal, manipulate, or delete 

information on targeted systems. Even more companies develop and sell professional-quality technologies to 

support cyber operations—often branding these tools as lawful-intercept or defensive security research products.”). 14 See Cora Currier & Morgan Marquis-Boire, Secret Manuals Show the Spyware Sold to Despots and Cops 

Worldwide, Intercept (Oct. 30, 2014), https://firstlook.org/theintercept/2014/10/30/hacking-team/ (“Hacking Team’s 

efforts include a visible push into the U.S. . . . The company has made at least some sales to American entities . . . 

.”); Kade Crockford, Spy Tech Secretly Embeds Itself in Phones, Monitors and Operates Them from Afar, 

PrivacySOS (Aug. 18, 2012), https://www.privacysos.org/node/789 (describing the capabilities of mobile malware 

sold by a Virginia-based company, Oceans’ Edge, which has apparently sold its software to both the FBI and DEA). 

3

 
B. Capabilities of the FBI’s surveillance software

Like much of the commercially available ‘lawful interception’ malware sold by 

surveillance companies to governments around the world, it appears that the FBI’s malware tools 

have a number of capabilities that can be customized for the particular operation, depending on 

what features are needed, and what the magistrate judge has approved.

In one of the more basic modes of operation, for example, the software can collect the IP 

address of the targeted computer. This is particularly useful when the target is using an 

anonymizing proxy, which hides his or her IP address.15 With an IP address, agents can 

subpoena subscriber information from the Internet Service Provider responsible for that IP 

address, and then search the home or business where the targeted computer is believed to be 

located.

In another mode of operation, the software can collect a long list of information about a 

target computer, including, but not limited to: IP address; MAC address (identifying the WiFi or 

Ethernet card); a list of running programs; the operating system type, version and serial number; 

the default internet browser and version; the registered user of the operating system, and 

registered company name, if any; the current logged-in user name; and the address of the last 

website visited in the user’s web browser.16

If a more thorough search of the computer is required, the FBI has software capable of 

searching a target’s computer to obtain “records of Internet activity, including firewall logs, 

caches, browser history and cookies, ‘bookmarked’ or ‘favorite’ Web pages, search terms that 

the user entered into any Internet search engine, and records of user-typed Web addresses,” as 

well as “saved user names and passwords, documents, browsing history, user profiles, e-mail 

contents, e-mail contacts, chat messaging logs, photographs, and correspondence.”17

In addition to the ability to access essentially any data already stored on the target’s 

computer, the FBI also has the ability to remotely access and enable the GPS chip, microphone,

or webcam in a target’s computer or mobile device.18 As such, the FBI has the capability to 

15 See Application for a Search Warrant at 40, In re Search of Computers that Access the Website “Bulletin Board 

A”, No. 8:12-MJ-356 (D. Neb. Nov. 16, 2012), available at http://www.documentcloud.org/documents/1261620-

torpedo-affidavit.html (listing the types of information to be obtained by the Network Investigative Technique, 

including the “activating” computer's IP address and information about the operating system software running on the 

computer).

16 Poulsen, FBI’s Secret Spyware Tracks Down Teen Who Made Bomb Threats, supra. 17 See In re Warrant to Search a Target Computer at Premises Unknown, 958 F. Supp. 2d 753, 755-56 (S.D. Tex. 

2013). 18 See id. at 3; see also Jennifer Valentino-DeVries & Danny Yadron, FBI Taps Hacker Tactics to Spy on Suspects, 

Wall St. J., Aug. 3, 2013, http://online.wsj.com/articles/SB10001424127887323997004578641993388259674

(“[T]he bureau can remotely activate the microphones in phones running Google Inc.'s Android software to record 

conversations, one former U.S. official said. It can do the same to microphones in laptops without the user knowing, 

the person said.”); see also Craig Timberg & Ellen Nakashima, FBI’s Search for ‘Mo,’ Suspect in Bomb Threats, 

Highlights Use of Malware for Surveillance, Wash. Post, Dec. 6, 2013, 

http://www.washingtonpost.com/business/technology/2013/12/06/352ba174-5397-11e3-9e2ce1d01116fd98_story.html (“The FBI has been able to covertly activate a computer’s camera — without triggering 

4

 
generate location information, to capture audio through the microphone, and to capture 

photographs or videos using the target’s webcam. According to an ex-senior FBI official, the FBI 

even has the capability to disable a webcam’s indicator light, so that there will be no way of 

knowing that the camera is recording.19

C. Methods for infecting the computers of targets with malware

There are several ways in which agents can deliver malicious software to the computer or 

mobile device of a target. We introduce several of the most popular methods here. This is by no 

means an exhaustive list, as law enforcement and intelligence agencies can be extremely creative 

in their efforts to surveil targets and covertly bug computers and mobile devices.

i. Social engineering

In a social engineering operation, agents will send an email or other communication to a 

target, with the goal of convincing the target to take a particular action, such as clicking on a link 

in the message, or opening an attachment.20 Such operations almost always involve some degree 

of deception, as targets are unlikely to perform the desired action if it is clear from the sender 

information (i.e., the “From” line of an email) that it is from a law enforcement agency. As a 

result, agents engaging in such operations are likely to impersonate third parties, such as the 

target’s associates,21 or organizations known to the target. For example, in 2007, FBI agents 

successfully delivered CIPAV surveillance software by sending a link to a fake Associated Press 

article, created by agents for that investigation, to the target of the operation.22 Presumably, as 

soon as the target clicked on the link to the article, the CIPAV was delivered to his computer.

The FBI likely exploited a security vulnerability in his web browser to deliver the CIPAV 

software.

The success of this operation depends on being able to trick the target into taking the 

desired action. For sophisticated targets, particularly those with expertise in computer security, 

this may be difficult.

the light that lets users know it is recording — for several years, and has used that technique mainly in terrorism 

cases or the most serious criminal investigations, said Marcus Thomas, former assistant director of the FBI’s 

Operational Technology Division in Quantico.”).

19 See Timberg & Nakashima, FBI’s Search for ‘Mo,’ Suspect, supra. 20 See Jennifer Valentino-DeVries & Danny Yadron, supra (“Officers often install surveillance tools on computers 

remotely, using a document or link that loads software when the person clicks or views it.”). 21 See T. N. Jagatic et al., Social Phishing, Comm. of the ACM, Oct. 2007, at 94, available at

http://www.indiana.edu/~phishing/social-network-experiment/phishing-preprint.pdf (demonstrating that phishing 

attacks which impersonate a friend of the target are more successful than those in which the sender is not known to 

the target). 

22 See Ellen Nakashima & Paul Farhi, FBI Lured Suspect with Fake Web Page, but May Have Leveraged Media 

Credibility, Wash. Post, Oct. 28, 2014, http://www.washingtonpost.com/world/national-security/fbi-lured-suspectwith-fake-web-page-but-may-have-leveraged-media-credibility/2014/10/28/e6a9ac94-5ed0-11e4-91f7-

5d89b5e8c251_story.html.

5

 
ii. Surreptitious entry

The FBI has a long, controversial history of secretly breaking into the homes or offices of 

targets and installing covert recording devices.23 Surreptitious entry operations, commonly 

known as black bag jobs, are also used to install surveillance software and hardware on the 

computers of targets.

24 The earliest publicly known example of a black bag job was in 1999.25

These operations of course require that agents know the physical location of the target.

iii. Watering hole attacks

Agents wishing to install surveillance software onto the computers of many individuals 

who all share a common interest or association may decide to perform a so called watering hole 

attack. In such operations, agents will install custom code on a website popular with the target 

group, which will infect the computers of everyone who visits the site. This technique has been 

repeatedly used by the FBI,26 as well as by foreign state actors.27 When this technique is used, 

agents may not know the identity of a particular target or targets, and may in fact not know ahead 

of time the identities of any of the targets whose computers will be eventually be compromised.

iv. Third-party service provider-aided delivery of surveillance software

By enlisting the assistance of third-party service providers, such as telecommunications 

and internet service providers, agents can leverage the trusted access that such providers have to 

a target’s communications and, in some cases, their computers or mobile devices.

In a man in the middle attack, surveillance software can be delivered, typically with 

special-purpose surveillance hardware installed in an internet provider’s data center (and thus, 

with the assistance of that company), by intercepting requests from a target’s computer to access 

internet content, impersonating the server the target is attempting to connect to, and then sending 

23 See, e.g., FBI Records: The Vault, Surreptitious Entries (Black Bag Jobs), 

http://vault.fbi.gov/Surreptitious%20Entries%20(Black%20Bag%20Jobs)%20; Senate Select Comm. to Study 

Governmental Operations with Respect to Intelligence Activities, Final Report: Supplementary Detailed Staff 

Reports on Intelligence Activities and the Rights of Americans 355 (1976), available at 

https://web.archive.org/web/20070414214706/http://www.icdc.com/~paulwolf/cointelpro/churchfinalreportIIIf.htm. 24 See Valentino-DeVries & Yadron, supra (“In some cases, the government has secretly gained physical access to

suspects’ machines and installed malicious software using a thumb drive, a former U.S. official said.”). 25 See United States v. Scarfo, 180 F. Supp. 2d 572, 577 (D.N.J. 2001) (“Because the encrypted file could not be 

accessed via traditional investigative means, [the judge’s] Order permitted law enforcement officers to ‘install and 

leave behind software, firmware, and/or hardware equipment which will monitor the inputted data entered on 

[defendant's] computer in the TARGET LOCATION so that the F.B.I. can capture the password necessary to 

decrypt computer files by recording the key related information as they are entered.’”). 26 See Kevin Poulsen, Visit the Wrong Website, and the FBI Could End Up in Your Computer, Wired (Aug. 5, 2014), 

http://www.wired.com/2014/08/operation_torpedo/; see also Kevin Poulsen, FBI Admits It Controlled Tor Servers 

Behind Mass Malware Attack, Wired (Sept. 13, 2013), http://www.wired.com/2013/09/freedom-hosting-fbi/. 27 See Michael Mimoso, Council on Foreign Relations Website Hit by Watering Hole Attack, IE Zero-Day Exploit, 

Threatpost (Dec. 29, 2012), http://threatpost.com/council-foreign-relations-website-hit-watering-hole-attack-ie-zeroday-exploit-122912/77352.

6

 
malicious software back to the target instead.28 This technique exploits the fact that much of the 

content accessed on the web is unencrypted, and thus vulnerable to tampering by third parties. 

There are several companies that sell products designed to deliver surveillance software in this 

manner,29 at least one of which has sold its products to the FBI.30

Another example of third-party-company–aided delivery involves forcing a service 

provider to push surveillance software disguised as a security update to customers. This 

technique has been used by at least one foreign government, using software made by a 

California-based surveillance company.31 

D. The surveillance software infection process

The process of delivering surveillance software to a target’s computer or mobile device 

generally consists of a number of different steps. In order to understand the important public 

policy and legal issues associated with the use of this surveillance technique, it is necessary to 

first understand the way in which this software is delivered to targets.

Step 1: Reconnaissance

In this step, agents determine a selector that can identify each target. For individual 

targets, this might be an email address, username, telephone number or IP address. For watering 

hole attacks, the agents will identify the website or server that will be used. If agents plan to 

infect the target device in-person, through a black bag job, then they must locate the home, office 

or hotel room where the target’s computer or mobile device will be.

Step 2: Attack setup

In this step, agents create the phishing email, prepare the code that will be added to the 

webpage that the user will visit, or customize the surveillance software that will subsequently be 

delivered and run on the target’s device.

Step 3: Delivery / Acquisition

28 See Barton Gellman, U.S. Firm Helped the Spyware Industry Build a Potent Digital Weapon for Sale Overseas, 

Wash. Post, Aug. 15, 2014, http://www.washingtonpost.com/world/national-security/spyware-tools-allow-buyers-toslip-malicious-code-into-youtube-videos-microsoft-pages/2014/08/15/31c5696c-249c-11e4-8593-

da634b334390_story.html (“Merely by playing a YouTube video or visiting a Microsoft Live service page, for 

instance, an unknown number of computers around the world have been implanted with Trojan horses by 

government security services that siphon their communications and files. . . . Network injection allows products 

built by Gamma and Hacking Team to insert themselves into an Internet data flow and change it undetectably in 

transit.”).

29 See Ryan Singel, Law Enforcement Appliance Subverts SSL, Wired (Mar. 24, 2010), 

http://www.wired.com/2010/03/packet-forensics/. 30 See Fed. Bus. Opportunities, Request for Quotations: Network Equipment (FBI Sept. 24, 2014), 

https://www.fbo.gov/index?s=opportunity&mode=form&id=bbec3296f333fa5c8f23973be4882ec7&tab=core&_cvi

ew=0. 31 See John Timmer, UAE Cellular Carrier Rolls Out Spyware as a 3G “Update”, Ars Technica (July 23, 2009), 

http://arstechnica.com/business/2009/07/mobile-carrier-rolls-out-spyware-as-a-3g-update/.

7

 
In this step, agents deliver the government’s surveillance software to the target’s 

computer. If agents use social engineering, agents will send the previously prepared phishing 

message to an address known to be used by the target. In a watering hole attack, agents will 

insert the previously prepared code into the webpage on the site that targets will visit. If agents 

are engaged in a black bag job, in this step, agents will gain covert access to the house, office or 

hotel of the target, and locate the computer or mobile device. 

Step 4: Exploitation

In this step, the exploit shellcode, a special piece of malicious software, is executed on 

the target’s computer, bypassing or circumventing any security software or other built-in 

protections present in the targeted software application.32 If agents use a social engineering 

attack, the shellcode might be executed because the target clicks on a link in the phishing email. 

If a watering hole attack is used, the exploitation will take place merely when the target visits the 

web page that has been modified by the agents. If the agents have conducted a black bag job, the 

agents will install the software themselves, likely using removable media such as a USB thumb 

drive.

In many cases, particularly in so-called drive by download attacks,

33 where the target’s 

computer is infected merely by clicking on a link or visiting a particular website, the exploitation 

step will typically involve the exploitation of one or more security vulnerabilities in the web 

browser, word processor or operating system of the target’s device, infra Part I.C. The use of 

exploits enables the surveillance software to be covertly installed on the target’s computer.

Step 4a: Validation (optional)

In some operations, particularly when agents may not be confident that the device they 

have exploited is the correct target, an optional validation step may take place, in which specific 

information is extracted from the infected computer in order to identify the device and its owner. 

Examples of such information might include, for example, the computer’s IP address, the MAC 

address identifying the WiFi interface, and other permanent device identification numbers.

Step 5: Installation

In this step, the full surveillance software suite, or payload, will be downloaded and

installed on the computer of the target.

Step 6: Exfiltration

32 Amit Klein, Multi-Stage Exploit Attacks for More Effective Malware Delivery, Trusteer Blog (May 2, 2013), 

http://www.trusteer.com/blog/multi-stage-exploit-attacks-for-more-effective-malware-delivery (“Most drive-by 

exploit kits use a minimal exploit shellcode that downloads and runs the final payload. This is akin to a two-stage 

ICBM (InterContinental Ballistic Missile) where the first stage, the exploit, puts the rocket in its trajectory and the 

second stage, the payload, inflicts the damage. In the cybercrime world, the de-coupling of the first stage from the 

payload is designed to make sure that an exploit kit is as generic as possible and can deliver all possible payloads.”). 33 Marco Cova et al., Detection and Analysis of Drive-by-Download Attacks and Malicious JavaScript Code, 

Proceedings of the 19th International Conference on World Wide Web (2010), available at 

http://www.site.uottawa.ca/~nelkadri/CSI5389/Papers/40-Cova_et_al_WWW2010.pdf.

8

 
In this step, the surveillance software collects the desired information on the target and 

then transmits that information back to a server controlled by the government. This may involve 

searching documents or other files on the computer, as well as activating the webcam or 

microphone in the device. In some operations, the surveillance software may collect the 

information sought, transmit it back to the government, and then erase itself from the target’s 

computer. In other cases, where long-term surveillance is desired, the software may remain on 

the target’s computer, collecting data, and regularly transmitting that data back to the 

government.

II. Technological and Policy Concerns

There are a number of serious technical and policy concerns related to the covert 

installation and use of surveillance software by law enforcement agencies.

A. Security flaws in surveillance software can weaken the security of the 

target’s device and expose it to compromise by other unauthorized parties

In 2011, security researchers in Germany obtained a copy of surveillance software that 

the German authorities had, for two years, used to remotely monitor targets in criminal 

investigations. The researchers analyzed the software, and discovered that the developers of the 

software had made elementary programming mistakes,34 the most serious of which exposed 

devices running the surveillance software to remote control by other, unauthorized parties.

35 This 

is not the only example of security vulnerabilities being discovered in surveillance software. 

Indeed, significant security flaws have repeatedly been discovered in several widely used 

interception and surveillance software products.

36

That security vulnerabilities exist in surveillance software is not surprising. All software 

programs have bugs, some of which may eventually be exploited by hackers. But as one leading 

scholar has noted, security flaws in surveillance systems can be particularly problematic, as their 

exploitation can lead to a catastrophic loss of communications confidentiality.37 The risk of these 

34 See Admin, Chaos Computer Club Analyzes Government Malware, Chaos Computer Club (Oct. 8, 2011), 

http://ccc.de/en/updates/2011/staatstrojaner (“The analysis also revealed serious security holes that the trojan is 

tearing into infected systems. The screenshots and audio files it sends out are encrypted in an incompetent way, the 

commands from the control software to the trojan are even completely unencrypted. Neither the commands to the 

trojan nor its replies are authenticated or have their integrity protected. Not only can unauthorized third parties 

assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim 

to be a specific instance of the trojan, and upload fake data. It is even conceivable that the law enforcement agencies' 

IT infrastructure could be attacked through this channel. The CCC has not yet performed a penetration test on the 

server side of the trojan infrastructure.”). 35 Id. 36 See Dan Goodin, Root Backdoor Found in Surveillance Gear Used by Law Enforcement, Ars Technica (May 28, 

2014), http://arstechnica.com/security/2014/05/root-backdoor-found-in-surveillance-gear-used-by-law-enforcement/; 

Micah Sherr et al., Can They Hear Me Now?: A Security Analysis of Law Enforcement Wiretaps, CCS ’09: 

Proceedings of the 16th ACM Conf. on Computer & Comms. Security (2009), at 512-523, available at

http://www.crypto.com/papers/calea-ccs2009.pdf. 37 Stephanie K. Pell, Jonesing for a Privacy Mandate, Getting a Technology Fix -- Doctrine to Follow, 14 N.C. J. L.

& Tech. 489 (2013).

9

 
flaws being exploited is not theoretical. Sophisticated state actors have hacked into 

communications surveillance systems and databases on multiple known occasions,

38 in some 

cases using security flaws in the surveillance software itself.39

B. The US government, and the FBI in particular, do not have a strong track 

record of technical excellence.

If the US government had a strong track record of creating and deploying secure 

software, perhaps the risks associated with security flaws in government surveillance software 

could be ignored. Unfortunately, the government’s track record is less than solid. The 

government’s information technology (IT) procurement process is widely acknowledged to be 

broken, leading to the government paying far too much money for poorly written, often flawed 

software.40 Examples of botched IT procurement can be found in practically every agency. Highprofile instances include Healthcare.gov41 and the FBI’s Sentinel case management system.42

Federal government agencies have a particularly poor track record when it comes to data 

security. Agencies struggle with the most basic security practices, such as using good passwords,

updating anti-virus software, and encrypting internet traffic on their websites.

43 The results are 

predictable: data breaches by federal agencies are now routine—there were a staggering 25,000 

38 See, e.g., Vassilis Prevelakis & Diomidis Spinellis, The Athens Affair, IEEE Spectrum (June 29, 2007), 

http://spectrum.ieee.org/telecom/security/the-athens-affair (describing how “hackers broke into a [Greek] telephone 

network and subverted its built-in wiretapping features for their own purposes . . . . While the hack was complex, the 

taps themselves were straightforward. When the [Greek] prime minister, for example, initiated or received a call on 

his cellphone, the exchange would establish the same kind of connection used in a lawful wiretap—a connection to a 

shadow number allowing it to listen in on the conversation."); see also Ellen Nakashima, Chinese Hackers Who 

Breached Google Gained Access to Sensitive Data, U.S. Officials Say, Wash. Post, May 20, 2013, 

http://www.washingtonpost.com/world/national-security/chinese-hackers-who-breached-google-gained-access-tosensitive-data-us-officials-say/2013/05/20/51330428-be34-11e2-89c9-3be8095fe767_story.html. 39 See Nat’l Sec. Agency, DOCID No. 352694, Phone Freaks Can Invade Your Privacy (1976), available at 

http://explodingthephone.com/docs/db904 (declassified NSA memo describing how interfaces used by phone 

company employees to determine if a line was busy were subverted by outsiders to listen to phone conversations). 40 See, e.g., Craig Timberg & Lena H. Sun, Some Say Health-Care Site’s Problems Highlight Flawed Federal IT 

Policies, Wash. Post, Oct. 9, 2013, http://www.washingtonpost.com/business/technology/some-say-health-caresites-problems-highlight-flawed-federal-it-policies/2013/10/09/d558da42-30fe-11e3-8627-c5d7de0a046b_story.html

(“[T]he root cause is not simply a matter of flawed computer code but rather the government’s habit of buying 

outdated, costly and buggy technology. The U.S. government spends more than $80 billion a year for informationtechnology services, yet the resulting systems typically take years to build and often are cumbersome when they 

launch.”). 41 See Amy Goldstein, Poor Planning and Oversight Led to HealthCare.gov Flaws, GAO Finds, Wash. Post, July 

30, 2014, http://www.washingtonpost.com/national/health-science/poor-planning-and-oversight-led-tohealthcaregov-flaws/2014/07/30/2f1a04aa-1814-11e4-9e3b-7f2f110c6265_story.html. 42 See Evan Perez, FBI Files Go Digital, After Years of Delays, Wall St. J., Aug. 1, 2012, 

http://online.wsj.com/articles/SB10000872396390444130304577561361556532528. 43 See Minority Staff of the Homeland Sec. & Governmental Affairs Comm., 113th Cong., The Federal 

Government’s Track Record on Cybersecurity and Critical Infrastructure 7 (2014), available at 

http://www.hsgac.senate.gov/download/?id=8BC15BCD-4B90-4691-BDBA-C1F0584CA66A.

10

 
data breaches reported by federal agencies in 2013.

44 Foreign governments have repeatedly 

penetrated federal systems,

45 with the White House’s network being the latest to be breached by

foreign hackers.46

Given the extreme difficulty of writing secure software and the federal government’s 

poor track record in securing its own systems, it is extremely likely that the surveillance software 

that federal law enforcement agencies deploy will not be secure and will leave the computers of 

targets vulnerable to compromise by other parties.

C. Law enforcement agencies will increasingly need zero-day exploits

In order to exploit a security vulnerability in the software on a target’s computer, the 

target’s computer must either be running out-of-date software with a known software 

vulnerability, or agents must know of a vulnerability for which no update exists. As such, targets 

that regularly patch their software (or use software that automatically updates) may be much 

harder to infect with malware.

In order to be able to successfully compromise the computers of targets with up-to-date 

software, law enforcement and intelligence agencies are increasingly seeking to purchase or 

discover so called “zero-day” (or “0-day”) software exploits. Zero-day exploits are special 

computer code that exploits vulnerabilities in software that are not known to the manufacturer of 

the software program, and thus, for which no software update exists.47 Zero day exploits are 

extremely valuable, because there is no defense against them.48

U.S. law enforcement and intelligence agencies have, in recent years, increasingly turned 

to zero-day exploits in order to gain access to the computers of high value targets. 49 This has in 

44 Jeryl Bier, Security Breaches of Personal Information at Federal Agencies More than Doubles Since 2009, Wkly. 

Standard (Apr. 3, 2014), http://www.weeklystandard.com/blogs/security-breaches-personal-information-federalagencies-more-doubles-2009_786450.html. 45 See Fred Barbash, Chinese Hackers May Have Breached the Federal Government’s Personnel Office, U.S. 

Officials Say, Wash. Post, July 10, 2014, http://www.washingtonpost.com/news/morningmix/wp/2014/07/09/report-chinese-hacked-into-the-federal-governments-personnel-office/. 46 See Ellen Nakashima, Hackers Breach Some White House Computers, Wash. Post, Oct. 28, 2014, 

http://www.washingtonpost.com/world/national-security/hackers-breach-some-white-housecomputers/2014/10/28/2ddf2fa0-5ef7-11e4-91f7-5d89b5e8c251_story.html. 47 See Leyla Bilge & Tudor Dumitras, Before We Knew It: An Empirical Study of Zero-Day Attacks in the Real

World, Proceedings of the 2012 ACM Conference on Computer and Communications Security (2012), available at 

http://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf (“A zero-day attack is a cyber attack 

exploiting a vulnerability that has not been disclosed publicly. There is almost no defense against a zero-day attack: 

while the vulnerability remains unknown, the software affected cannot be patched and anti-virus

products cannot detect the attack through signature-based scanning.”). 48 The Digital Arms Trade, Economist, Mar. 30, 2013, http://www.economist.com/news/business/21574478-marketsoftware-helps-hackers-penetrate-computer-systems-digital-arms-trade (“It is a type of software sometimes 

described as ‘absolute power’ or ‘God’. Small wonder its sales are growing.”).

49 See Craig Timber & Ellen Nakashima, FBI’s Search for ‘Mo,’ Suspect in Bomb Threats, Highlights Use of

Malware for Surveillance, Wash. Post, Dec. 6, 2013, http://www.washingtonpost.com/business/technology/fbissearch-for-mo-suspect-in-bomb-threats-highlights-use-of-malware-for-surveillance/2013/12/06/352ba174-5397-

11e3-9e2c-e1d01116fd98_story.html (describing the use of a zero-day exploit by the FBI to take over webcams

without the indicator light turning on); see also Liam Murchu, Stuxnet Using Three Additional Zero-Day

11

 
turn fueled a largely unregulated market for zero-day exploits, in which government agencies are 

active and are often the highest bidder.50

Governments spend a lot of money to acquire zero-day exploits. Although there is little 

verifiable data about the market for such exploits, anecdotal reports suggest that the cost of 

commercial exploits can be in the hundreds of thousands of dollars.51 These vulnerabilities are 

their most effective when no one else knows about them, so rather than alerting the companies 

whose software can be exploited, governments, including the United States, quietly exploit 

them.52 Quite simply, governments that rely on zero-day exploits have prioritized offense over 

defense.

Although zero-days undoubtedly make it easier to deliver malware to targets and to gain 

access to difficult-to-penetrate systems, there are significant collateral costs associated with the 

purchase and use of zero-days by governments. That is, by exploiting these vulnerabilities rather 

than notifying the companies responsible for the software, governments are putting their own 

citizens at risk.53 Several senior ex-U.S. government officials have acknowledged these risks, 

including ex-NSA/CIA director Michael Hayden,54 and ex-‘cyber czars’ Howard Schmidt55 and 

Richard Clarke.56

Vulnerabilities, Symantec Official Blog (Jan. 23, 2014), http://www.symantec.com/connect/blogs/stuxnet-usingthree-additional-zero-day-vulnerabilities (describing the use of zero days in Stuxnet, a piece of malware attributed to

the US and Israeli governments); David Sanger, Obama Orders Sped Up Wave of Cyberattacks Against Iran, N.Y.

Times, June 1, 2012, http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacksagainst-iran.html?pagewanted=all. 50 See, e.g., The Digital Arms Trade, supra (“Other reputable customers, such as Western intelligence agencies, 

often pay higher prices. Mr Lindelauf reckons that America’s spies spend the most on exploits. . . . [B]risk sales are 

partly driven by demand from defence contractors that see cyberspace as a “new battle domain”, says Matt Georgy, 

head of technology at Endgame, a Maryland firm that sells most of its best exploits for between $100,000 and 

$200,000.”); Nicole Perlroth & David E. Sanger, Nations Buying as Hackers Sell Flaws in Computer Code, N.Y. 

Times, July 13, 2013, http://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computerflaws.html?pagewanted=1&_r=1 (“But increasingly the businesses are being outbid by countries with the goal of 

exploiting the flaws in pursuit of the kind of success. . . that the United States and Israel achieved. . .”); Joseph 

Menn, Special Report: U.S. Cyberwar Strategy Stokes Fear of Blowback, Reuters, May 10, 2013, 

http://www.reuters.com/article/2013/05/10/us-usa-cyberweapons-specialreport-idUSBRE9490EL20130510 (“Even 

as the U.S. government confronts rival powers over widespread Internet espionage, it has become the biggest buyer 

in a burgeoning gray market where hackers and security firms sell tools for breaking into computers.”). 51 See Perlroth & Sanger, Nations Buying as Hackers Sell Flaws in Computer Code, supra (describing hackers 

searching for “secret flaws in computer code that governments pay hundreds of thousands of dollars to learn about 

and exploit”). 52 Joseph Menn, U.S. Cyberwar Strategy Stokes Fear of Blowback, Reuters, May 10, 2013, 

http://www.reuters.com/article/2013/05/10/us-usa-cyberweapons-specialreport-idUSBRE9490EL20130510 (“The 

core problem: Spy tools and cyber-weapons rely on vulnerabilities in existing software programs, and these hacks 

would be much less useful to the government if the flaws were exposed through public warnings. So the more the 

government spends on offensive techniques, the greater its interest in making sure that security holes in widely used 

software remain unrepaired.”). 53 Id. (“The strategy is spurring concern in the technology industry and intelligence community that Washington is 

in effect encouraging hacking and failing to disclose to software companies and customers the vulnerabilities 

exploited by the purchased hacks.”). 54 Id. (“Acknowledging the strategic trade-offs, former NSA director Michael Hayden said: ‘There has been a 

traditional calculus between protecting your offensive capability and strengthening your defense. It might be time 

now to readdress that at an important policy level, given how much we are suffering.’”).

12

 
Indeed, at a time when cyber-attacks are, according to government officials, one of the 

biggest threats faced by this country,57 the collateral damage associated with exploiting, rather 

than fixing, security vulnerabilities is a topic of considerable debate. For example, the 

President’s NSA Review Group observed last year that “[a] vulnerability that can be exploited on 

the battlefield can also be exploited elsewhere”58 and recommended that “US policy should 

generally move to ensure that Zero Days are quickly blocked, so that the underlying 

vulnerabilities are patched on US Government and other networks.”59 Moreover, “in almost all 

instances, for widely used code, it is in the national interest to eliminate software vulnerabilities 

rather than to use them for US intelligence collection. Eliminating the vulnerabilities—‘patching’

them—strengthens the security of US Government, critical infrastructure, and other computer 

systems.”60

Because so little is known about how the FBI currently delivers malware to surveillance 

targets, we have no way of knowing how frequently it uses zero-days, or how many it has 

purchased or otherwise acquired. Even so, as the technology industry moves steadily towards 

automatic security updates,61 a practice largely motivated by cybersecurity concerns, the FBI 

55 Id. (“‘It's pretty naïve to believe that with a newly discovered zero-day, you are the only one in the world that's 

discovered it,” said Schmidt, who retired last year as the White House cybersecurity coordinator. ‘Whether it's 

another government, a researcher or someone else who sells exploits, you may have it by yourself for a few hours or 

for a few days, but you sure are not going to have it alone for long.’”); see also Perloth & Sanger, Nations Buying as 

Hackers Sell Flaws in Computer Code, supra (“Governments are starting to say, ‘In order to best protect my 

country, I need to find vulnerabilities in other countries,’” said Howard Schmidt, a former White House 

cybersecurity coordinator. ‘The problem is that we all fundamentally become less secure.’”). 56 Menn, U.S. Cyberwar Strategy Stokes Fear of Blowback, supra (“Former White House cybersecurity advisors 

Howard Schmidt and Richard Clarke said in interviews that the government in this way has been putting too much 

emphasis on offensive capabilities that by their very nature depend on leaving U.S. business and consumers at risk. 

‘If the U.S. government knows of a vulnerability that can be exploited, under normal circumstances, its first 

obligation is to tell U.S. users,’ Clarke said. ‘There is supposed to be some mechanism for deciding how they use the 

information, for offense or defense. But there isn’t.’”). 57 James Clapper, the Director of National Intelligence, and James Comey, the Director of the FBI, have both told 

Congress that cyber-attacks are the most serious national security threat faced by the United States. See Jim 

Garamone, Clapper Places Cyber at Top of Transnational Threat List, Armed Forces Press Service, Mar. 12, 2013, 

http://www.defense.gov/news/newsarticle.aspx?id=119500; Greg Miller, FBI Director Warns of Cyberattacks; 

Other Security Chiefs Say Terrorism Threat Has Altered, Wash. Post, Nov. 14, 2013, 

http://www.washingtonpost.com/world/national-security/fbi-director-warns-of-cyberattacks-other-security-chiefssay-terrorism-threat-has-altered/2013/11/14/24f1b27a-4d53-11e3-9890-a1e0997fb0c0_story.html (“FBI Director 

James B. Comey testified Thursday that the risk of cyberattacks is likely to exceed the danger posed by al-Qaeda 

and other terrorist networks as the top national security threat to the United States and will become the dominant 

focus of law enforcement and intelligence services.”). 58 Review Grp. on Intelligence and Commc’n Techs., Liberty and Security in a Changing World 187 (2013), 

available at http://www.whitehouse.gov/sites/default/files/docs/2013-12-12_rg_final_report.pdf. 59 Id. at 37, 219. 60 Id. at 220. 61 See Ellen Messmer, Microsoft to Start Automatic Updates of IE Without Asking the User, Network World (Dec. 

15, 2011), http://www.networkworld.com/article/2184071/windows/microsoft-to-start-automatic-updates-of-iewithout-asking-the-user.html; see also Gregg Keizer, Google’s Chrome Now Silently Auto-Updates Flash Player, 

Computer World (Apr. 1, 2010), http://www.computerworld.com/article/2516595/networking/google-s-chromenow-silently-auto-updates-flash-player.html; Thomas Duebendorfer & Stefan Frei, Why Silent Updates Boost 

Security (2009), available at http://www.tik.ee.ethz.ch/file/ef72343372ca8659a9ae8a98873167c0/TIK-Report302.pdf. 

13

 
may increasingly need zero-days in the future, as it will no longer be able to rely on targets 

running out of date, insecure software.

For example, the FBI has performed several successful watering hole attacks targeting 

visitors to websites that could only be accessed using Tor.62 In at least one of these operations, 

the FBI’s malware was delivered with code that exploited a security vulnerability for which a fix 

existed, and had been included in an update to the Tor Browser Bundle software that was made 

available a month before the FBI’s operation.63 Until September of 2014, the Tor Browser 

Bundle did not include a built-in security update mechanism.64 When updates were available, 

users had to go to the Tor Project website and download the updates for themselves. Many users 

did not do this, and so it is not surprising that FBI was able to successfully deliver malware to a 

number of Tor users without needing to exploit a zero-day vulnerability. Earlier this year, The 

Tor Project introduced a mechanism to more easily update the Tor browser software, and the 

organization has long been working on making security updates automatic.65

The Department of Justice has told this Committee that one of the primary motivations 

for its proposal is the problem posed by anonymizing technologies like Tor.66 However, once the 

Tor Project completes the planned automatic security update feature, the successful compromise 

of Tor users will require zero day security vulnerabilities. This committee should therefore 

understand that if it wishes to provide law enforcement agencies the ability to identify and locate 

Tor users, then that ability will necessarily require blessing the exploitation of zero day 

vulnerabilities as a law enforcement technique. The raises significant public policy concerns. 

D. The tech industry’s embrace of cloud computing significantly complicates 

watering hole attacks.

In August 2013, all of the websites hosted by Freedom Hosting—a service that hosted 

websites through the Tor network— began serving an error message with hidden code embedded 

62 See Poulsen, FBI Admits It Controlled Tor Servers Behind Mass Malware Attack, supra; Poulsen, Visit the Wrong 

Website, and the FBI Could End Up in Your Computer, supra. “Tor ‘is a network of virtual tunnels that allows 

people to improve their privacy and security.’ Originally developed by the Naval Research Lab and subsequently 

funded by the Defense Advanced Research Projects Agency (‘DARPA’) to facilitate anonymous online activities by 

government personnel. Tor is an ‘onion routing’ technology which hides a user’s IP address, making it appear to 

originate from a Tor server rather than the actual address from which the user is connecting to the Internet.” Pell, 

supra, at 38 (citations omitted). 63 See Posting of Andy Isaacson, adi@hexapodia.org, to liberationtech@ lists.stanford.edu (Aug. 5, 2013) (available 

at https://mailman.stanford.edu/pipermail/liberationtech/2013-August/010498.html) (stating that the fix to the 

exploit had been included in an update to the Tor Browser Bundle released on June 26, 2013).

64 See mikeperry, Tor Browser 3.6.5 and 4.0-alpha-2 Are Released, Tor Blog (Oct. 30, 2014), 

https://blog.torproject.org/blog/tor-browser-365-and-40-alpha-2-are-released (describing the new update mechanism 

included in the 4.0 alpha-2 release of the Tor Browser bundle). 65 See phobos, Google Funds an Auto-Update for Vidalia, Tor Blog (June 6, 2008), 

https://blog.torproject.org/blog/google-funds-auto-update-vidalia; see also Tor Browser Launcher, Micah Lee’s 

Blog, https://micahflee.com/torbrowser-launcher/ (describing an independent effort to create an automatic Tor 

security update delivery mechanism)

66 See Advisory Committee Materials at 171 (“The proposed amendment would better enable law enforcement to 

investigate and prosecute botnets and crimes involving Internet anonymizing technologies, both which pose 

substantial threats to members of the public.”); id. at 160 (“Currently, the Department obtains remote access 

warrants primarily to combat Internet anonymizing techniques.”).

14

 
in the page.67 That code was specifically designed to exploit a security flaw in a version of the 

Firefox web browser used to access Tor hidden servers.

68 According to an FBI agent who later 

testified in an Irish court, the Freedom Hosting service hosted at least 100 child pornography 

websites.69 But the service also hosted a number of legitimate sites, including TorMail, a webbased email service that could only be accessed over the Tor network, and the Hidden Wiki, 

which one news site described as the “de facto encyclopedia of the Dark Net.”70 Even though 

these sites were serving lawful content, the FBI’s watering hole attack was performed in an 

overbroad manner, forcing all of the Freedom Hosting sites to deliver malware to visitors, not 

just those sites that were engaged in the distribution of illegal content.

We are now firmly in the age of cloud computing, in which hundreds of websites may 

share resources provided by the same powerful servers. Law-abiding Internet users have no way 

of knowing if the sites that they are visiting are hosted on the same physical server as a site that 

facilitates illegal conduct. That websites with a potential connection to illegal conduct are hosted 

on the same server as legitimate websites is not sufficient reason to permit law enforcement 

agencies to hack into the computers of every person who interacts with a particular server. 

The court order that the FBI presumably obtained before launching watering hole attacks 

from the many Freedom Hosting websites is not public. As such, it is impossible to know what 

the FBI agents told the court, or what the court authorized. We do not know if the judge 

authorized watering hole attacks against all visitors to all sites running on the server owned by 

Freedom Hosting, or if the FBI agents exceeded the scope of the warrant. In any event, this 

episode demonstrates the importance of strict limits on bulk delivery of remote access malware, 

including through watering hole attacks.

III. The Proposed Amendment Substantively Expands the Government’s Powers 

and Should Be Addressed by Congress in the First Instance

The Federal Rules of Procedure are limited to “regulating procedure.” Sibbach v. Wilson 

& Co., 312 U.S. 1, 10 (1941). They may not “abridge, enlarge or modify any substantive right.” 

28 U.S.C. § 2072(b). Although the proposed Committee Note purports to leave “constitutional 

questions” to be addressed in future case law,71 in practice the amendment will enlarge the 

government’s substantive power to conduct searches and will decide contested questions of law 

sub silentio. 

By amending Rule 41, the government seeks to obtain the power to conduct a category of 

searches that it is currently barred from conducting. Where the government seeks to remotely 

search a computer the location of which is unknown, it does not now have a venue in which to 

67 See Kevin Poulsen, FBI Admits It Controlled Tor Servers Behind Mass Malware Attack, Wired (Sept. 13, 2013), 

http://www.wired.com/2013/09/freedom-hosting-fbi/. 68 See Goodin, FBI Admits It Controlled Tor Servers Behind Mass Malware Attack, supra.

Attackers Wield Firefox Exploit to Uncloak Anonymous Tor Users, Ars Technica (Aug. 5, 2013), 

http://arstechnica.com/security/2013/08/attackers-wield-firefox-exploit-to-uncloak-anonymous-tor-users/. 69 Poulsen, FBI Admits It Controlled Tor Servers Behind Mass Malware Attack, supra. 70 Patrick Howell O’Neill, An In-Depth Guide to Freedom Hosting, the Engine of the Dark Net, The Daily Dot (Aug. 

4, 2013), http://www.dailydot.com/news/eric-marques-tor-freedom-hosting-child-porn-arrest/. 71 Proposed Amendments Materials at 341.

15

 
apply for a warrant. In re Warrant to Search a Target Computer at Premises Unknown [“In re 

Warrant”], 958 F. Supp. 2d 753, 756–58 (S.D. Tex. 2013). In effect, the government lacks the 

substantive authority to conduct remote access searches in such circumstances. For that reason, 

the proposed amendment will almost certainly result in a marked increase in government use of 

remote hacking techniques and zero-day exploits. What looks like a procedural change actually 

creates a new substantive power: to use zero-day exploits, malware, spyware, and other software 

packages to circumvent privacy-protective proxy services, including at least one, Tor, which was 

created by the US government, and continues to receive US government funding.

The government’s desire to augment the investigative tools available to it is 

understandable, but the best, and indeed the proper way to address the government’s asserted 

needs is for it to present its demand to Congress. Lawmakers can then craft a legislative solution 

to any gap in the government’s search powers. As the Supreme Court has remarked, “In 

circumstances involving dramatic technological change, the best solution to privacy concerns 

may be legislative.” United States v. Jones, 132 S. Ct. 945, 964 (2012) (Alito, J., concurring in 

the judgment) (citing Orin Kerr, The Fourth Amendment and New Technologies: Constitutional 

Myths and the Case for Caution, 102 Mich. L. Rev. 801, 805–806 (2004)); see also City of 

Ontario, Cal. v. Quon, 560 U.S. 746, 759 (2010) (“The judiciary risks error by elaborating too 

fully on the Fourth Amendment implications of emerging technology before its role in society 

has become clear.”). 

When presented with similar questions of invasive technological searches and 

surveillance, Congress has opted to step in and set detailed legislative rules. This was true of the 

wiretapping and bugging of wire, oral, and electronic communications through Title III of the 

Omnibus Crime Control and Safe Streets Act of 1968 (“Title III” or the “Wiretap Act”), 18 

U.S.C. § 2518, and the Foreign Intelligence Surveillance Act, 50 U.S.C. § 1804. It was likewise 

true of searches of the contents of stored electronic communications and other digital data in the 

Stored Communications Act, 18 U.S.C. § 2703, and of real-time individualized telephony 

metadata collection in criminal and national security investigations in the two acts addressing

pen registers, 18 U.S.C. § 3123 and 50 U.S.C. § 1842. Congress clearly has the capacity and the 

will to legislate in this area, and legislative action is preferable because it lends itself to setting 

substantive limits on questionable search practices in a way that procedural rulemaking does not.

Indeed, members of Congress have begun to take note of this proposed amendment,72 and would 

likely welcome the chance to hold hearings and contemplate legislative reform. The Federal 

Rules should not be amended to give the government new power to conduct remote access 

searches using zero-day exploits and spyware to defeat privacy-protective tools like Tor. 

Congress should be given the opportunity to weigh the competing constitutional and policy 

concerns that the government’s proposal raises, and to craft detailed statutory language 

regulating how, when, and where the government may conduct “remote access” searches.

Instead of using the procedural rulemaking process to suddenly and substantially increase 

the government’s use of remote hacking techniques in criminal investigations, the Committee 

should reject the proposed amendment and leave the government to present its case to Congress 

and the American people. 

72 See Letter from Sen. Patrick Leahy to Attorney General Eric Holder (Oct. 30, 2014), available at 

https://www.documentcloud.org/documents/1349789-leahy-to-holder-re-fbi-fake-ap-article.html.

16

 
IV. The Proposed Amendment Raises Significant Constitutional and Statutory 

Concerns.

A. Use of Zero-Day Exploits and Malware May Constitute an Unreasonable 

Search.

Under the Fourth Amendment, use of zero-day exploits or malware may constitute an 

unreasonable search. It is well established that some searches in the physical world are too 

intrusive, destructive, or dangerous to be reasonable:

The general touchstone of reasonableness which governs Fourth Amendment 

analysis governs the method of execution of the warrant. Excessive or 

unnecessary destruction of property in the course of a search may violate the 

Fourth Amendment, even though the entry itself is lawful and the fruits of the 

search are not subject to suppression.

United States v. Ramirez, 523 U.S. 65, 71 (1998) (citation omitted).

Surgically removing evidence from a suspect’s body,73 using a powerful motorized 

battering ram to break into a residence,74 and “employ[ing] a flashbang device [to enter a house] 

with full knowledge that it will ‘likely’ ignite accelerants and cause a fire”75 have all been ruled 

unreasonable under the Fourth Amendment. Zero-day exploits may well pose analogous 

concerns. When the government unleashes zero-day exploits and malware, it will rarely be able 

to control who can intercept the code in transmission, whether it will reach its intended target, 

whether it will be copied and reused by others, and whether it will spread virally across the 

internet and cause damage to innocent persons and businesses.76 See Part II, supra. These factors 

are relevant to individual warrant applications, but also to the Advisory Committee’s 

consideration of the proposed Rule amendment, because these outcomes are entirely predictable 

as a natural result of the kinds of searches the government wants the authority to conduct.

For example, when the United States and Israel launched the Stuxnet cyber-attack against 

Iranian nuclear enrichment facilities several years ago, it quickly spread beyond the targeted 

73 Winston v. Lee, 470 U.S. 753, 759, 766–67 (1985) (holding that the health risks posed by the “compelled surgical 

intrusion into an individual's body for evidence” make that search unreasonable under the Fourth Amendment); see 

also Schmerber v. California, 384 U.S. 757, 771–72 (1966) (requiring that a search involving drawing a suspect’s 

blood be “performed in a reasonable manner,” including that it be carried out by medical personnel in a medical 

environment); Rochin v. California, 342 U.S. 165, 172 (1952) (conduct by agents trying to obtain swallowed 

evidence, including “the forcible extraction of [the defendant’s] stomach’s contents,” violates due process). 74 Langford v. Superior Ct. of L.A. Cnty., 729 P.2d 822, 827 (Cal. 1987) (holding that, because a motorized battering 

ram can cause “potential danger from collapse of building walls and ceilings or through rupture of utility lines,” 

which could cause fires that “could threaten the safety not only of occupants, but of entire neighborhoods,” “routine 

deployment of the ram to enter dwellings must be considered presumptively unreasonable unless authorized in 

advance by a neutral magistrate, and unless exigent circumstances develop at the time of entry”). 75 Bing ex rel. Bing v. City of Whitehall, Ohio, 456 F.3d 555, 570 (6th Cir. 2006). 76 E.g., Rachel King, Stuxnet Infected Chevron’s IT Network, Wall St. J., Nov. 8, 2012, 

http://blogs.wsj.com/cio/2012/11/08/stuxnet-infected-chevrons-it-network/.

17

 
computer systems.77 Major U.S. companies, including Chevron, discovered that the Stuxnet 

software had infected their networks as well.78 If a piece of targeted malware developed with the 

vast resources of defense and national security agencies can go astray in this way, there is no 

reason to think law enforcement surveillance malware won’t do so too.

Although it took several years before Stuxnet was discovered by security researchers,79

the Stuxnet code and the zero-days it leveraged were extensively analyzed by a world-wide 

network of security experts. Although Microsoft rushed to develop and distribute patches for 

these vulnerabilities, criminals also took note, and exploited the same vulnerabilities for their 

own nefarious purposes.80

More broadly, the use of malware and zero-day exploits is more invasive than other 

forms of permissible searches because the consequences and collateral damage associated with

their use are inherently unpredictable and often irreversible. Because computers and the software 

they run are incredibly complicated systems, the consequences of their surreptitious penetration 

and exploitation by the government are inherently unpredictable. Malware can cause computer 

systems to fail in many unintended ways, causing the loss of property entirely unrelated to the 

government’s searches. For example, a piece of malware could—whether through poor design or 

unpredictable interaction with other software on the target’s computer—cause the destruction of 

data (such as family photos or document drafts) or the corruption of the operating system. The 

resulting data loss might or might not be reversible, depending on the circumstances. 

The technological and internet-security implications of remote access searches are 

unavoidably complex. Before courts wade into the constitutional questions that the use of 

malware and zero-day exploits raise, it would be best for Congress to affirmatively address the 

wisdom and parameters of their use after informed public discussion. The policy and 

constitutional concerns that remote access searches raise are better suited to comprehensive 

legislative regulation than to authorization through procedural changes to the Federal Rules. 

B. The Proposed Amendment Authorizes Searches That Can Only Be Carried 

Out Pursuant to a Title III Wiretap Order, and Would Be Illegal if 

Authorized by a Simple Rule 41 Warrant

Depending on the means used to conduct remote access searches and the information 

gathered, such searches may only be permissible pursuant to an order issued under the Wiretap 

Act, 18 U.S.C. § 2518, or a surveillance warrant containing equivalent protections. A normal 

warrant application submitted under Rule 41 may be constitutionally insufficient and infirm.

77 Sanger, supra (“An error in the code, they said, had led it to spread to an engineer’s computer when it was hooked 

up to the centrifuges. When the engineer left Natanz and connected the computer to the Internet, the American- and 

Israeli-made bug failed to recognize that its environment had changed. It began replicating itself all around the 

world.”). 78 King, Stuxnet Infected Chevron’s IT Network, supra. 79 David Kushner, The Real Story of Stuxnet, IEEE Spectrum (Feb. 26, 2013), 

http://spectrum.ieee.org/telecom/security/the-real-story-of-stuxnet. 80 Pierluigi Paganini, Kaspersky Revealed that Stuxnet Exploits Is Still Used Worldwide, Security Aff. (Aug. 19, 

2014), http://securityaffairs.co/wordpress/27633/cyber-crime/stuxnet-flaw-still-targeted.html.

18

 
The Wiretap Act, also known as Title III, applies when the government seeks to intercept 

wire, oral, or electronic communications in real time. Because this sort of electronic surveillance

raises, “understandably, a deep-seated uneasiness and apprehension that this capability will be 

used to intrude upon cherished privacy of law-abiding citizens,” special protections are required. 

United States v. U.S. District Ct., 407 U.S. 297, 312 (1972). Under Title III, these protections 

include requirements that the government particularly describe the place and person to be 

surveiled, that the government show it has exhausted other investigative procedures prior to 

seeking a Title III order, and that the court limit the duration of the surveillance and require 

minimization of interception of non-pertinent communications. 18 U.S.C. § 2518(1)–(5).

Moreover, unlike with search warrant applications, attorneys at DOJ’s Office of Enforcement 

Operations review each wiretap application before it is submitted to a court.

81 Courts have also 

imposed Title III’s requirements on applications for warrants to authorize surreptitious video 

surveillance, even though such surveillance is not technically covered by the statute. See, e.g.,

United States v. Cuevas–Sanchez, 821 F.2d 248, 250 (5th Cir. 1987); United States v. Biasucci, 

786 F.2d 504, 510–11 (2d Cir. 1986); United States v. Torres, 751 F.2d 875, 884 (7th Cir. 1984).

These requirements, for both wiretapping and video surveillance, derive from and are required 

by the Fourth Amendment. See Berger v. New York, 388 U.S. 41, 58–59 (1967) (wiretapping); 

Torres, 751 F.2d at 884 (video surveillance).

Remote access searches can raise identical or analogous concerns. Certainly, if the 

government seeks to activate the built-in camera on a target computer, it must meet the 

heightened requirements for video surveillance. In re Warrant, 958 F. Supp. 2d at 759–61. If the 

government’s remote access surveillance software is configured to turn on the target computer’s 

microphone or to collect the contents of incoming or outgoing electronic or wire 

communications (such as emails, instant messages, or internet-based phone calls), Title III 

procedures would be required. See 18 U.S.C. § 2518. Further, “[s]oftware that can retrieve [other 

stored] information—Internet browser history, search terms, e-mail contents and contacts, ‘chat’, 

instant messaging logs, photographs, correspondence, and records of applications run, among 

other things”—also calls for heightened Fourth Amendment protections, because surreptitious 

and remote retrieval of such a “volume of information” raises constitutional concerns. In re 

Warrant, 958 F. Supp. 2d at 760. Electronic surveillance that “is identical in its indiscriminate 

character to wiretapping and bugging” cannot be authorized by a normal Rule 41 warrant. 

Torres, 751 F.2d at 885 (emphasis omitted). 

Indeed, as explained above, remote access searches raise even more significant concerns 

in that malware and the exploitation of zero-day flaws can cause entirely unpredictable and 

irreversible damage to a target’s computer or data. Reducing the likelihood of, or mitigating the 

harms of, such unintended consequences would require significant technical expertise and 

81 H.R. Rep. No. 112-546, at 10 (2012), available at http://www.gpo.gov/fdsys/pkg/CRPT-112hrpt546/pdf/CRPT112hrpt546.pdf (“In a letter to Chairman Issa, the Deputy Attorney General acknowledged that the Office of 

Enforcement Operations (OEO), part of the Justice Department’s Criminal Division, is ‘primarily responsible for the 

Department’s statutory wiretap authorizations.’ According to the letter, lawyers in OEO review these wiretap 

packages to ensure that they ‘meet statutory requirements and DOJ policies.’ When OEO completes its review of a 

wiretap package, federal law provides that the Attorney General or his designee—in practice, a Deputy Assistant 

Attorney General in the Criminal Division—reviews and authorizes it. Each wiretap package includes an affidavit 

which details the factual basis upon which the authorization is sought.”).

19

 
regulation of the manner in which the government develops and deploys its remote access 

software. Courts are ill-suited to oversee such mitigation efforts in the first instance.

Any malware, spyware, or other government software that remains on a target computer 

and collects information on an ongoing basis also implicates these concerns. Clandestine entry 

into a person’s computer, installation of software there, and use of that software to conduct realtime surveillance should require the heightened showing of a Title III order. A warrant issued 

under normal Rule 41 procedures that authorizes an ongoing search will necessarily violate the 

Fourth Amendment; restrictions are needed “to guarantee that . . . [these searches] occur[] only 

when there is a genuine need for [them] and only to the extent that [they are] needed.” Dalia v. 

United States, 441 U.S. 238, 250 (1979). Yet, it is clear that the government is already collecting 

information about computer users on an ongoing basis using remote access malware without 

obtaining a Title III order or equivalent judicial process. Approving the proposed amendment 

would give sanction to this highly problematic practice.

In an investigation in Washington State in 2007, the FBI applied for a hybrid order to 

justify its installation and monitoring of the CIPAV surveillance software: a Rule 41 warrant to 

authorize transmission and installation of the software and its one-time use to collect location, 

identification, and other data from the target computer, combined with a pen register order to 

authorize ongoing collection of “routing and destination addressing information for electronic 

communications originating from the activating computer.”82 A hybrid order of this type cannot 

substitute for the strictures of Title III.

A pen register order is intended to be served on a “person or entity providing wire or 

electronic communication service,” 18 U.S.C. § 3123(a)(1), to compel their assistance in turning 

over “dialing, routing, addressing, or signaling information,” id. § 3127(3). Installation of 

spyware on a person’s computer and contemporaneous monitoring of information about all types 

of electronic communications originating from that computer is a good deal more invasive, 

because it relies on entry into a person’s private space and maintenance of a presence there to 

collect information. This is, in effect, a trespassory search. Cf. United States v. Jones, 132 S. Ct. 

945, 949 (2012) (holding that a Fourth Amendment search occurred when “[t]he Government 

physically occupied private property for the purpose of obtaining information”). It is also the 

kind of unusually intrusive surveillance to which the heightened standard of Title III applies. The 

government appears to want to use the pen register statute to authorize what a Rule 41 warrant 

cannot standing alone, but that defies common sense. As Judge Stephen Smith explained while 

rejecting a variant of the government’s hybrid order theory in another context, “[s]urely if these 

various statutory provisions were intended to give birth to a new breed of electronic surveillance, 

one would expect Congress to have openly acknowledged paternity somewhere along the way. 

This is especially so given that no other form of electronic surveillance has th[is] mixed statutory 

parentage.” In re Application for Pen Register and Trap/Trace Device with Cell Site Location 

Authority, 396 F. Supp. 2d 747, 764–65 (S.D. Tex. 2005). Invasive monitoring carried out by 

82 Affidavit of Norman B. Sanders Jr. at 4, 13, In re Search of Any Computer Accessing Electronic Message(s)

Directed to Administrator(s) of MySpace Account “Timberlinebombinfo” and Opening Message(s) Delivered to that 

Account by the Government, MJ-07-88 (W.D. Wash. June 12, 2007), available at 

https://www.eff.org/document/fbicipav-08pdf.

20

 
installing malware on a target’s computer should require a Title III order—or new congressional 

legislation—not a cobbled-together patchwork of lesser permissions.

Adopting the proposed amendment to Rule 41 risks facilitating violations of Title III and 

deciding by administrative rulemaking a question better left to Congressional regulation—how to 

regulate and circumscribe the controversial and invasive search techniques at issue here.

C. The Proposed Amendment Will Facilitate Violations of the Fourth 

Amendment’s Particularity Requirement and Will Result in Searches of 

Non-Suspects as to Whom There is No Probable Cause.

The proposed amendment would allow police to remotely search many people’s 

computers using a single warrant, often without particularly describing those computers or 

demonstrating probable cause as to their owners or users. A warrant that does not particularly 

describe the place to be searched and things to be seized is invalid. Groh v. Ramirez, 540 U.S. 

551, 557 (2004) (citing U.S. Const. amend IV). For this reason, courts have been skeptical of 

warrants authorizing searches of multiple locations not owned by the same person.83 In the 

context of physical searches, “[t]he general rule is that a warrant for a building that has multiple 

units must specify the individual unit that is the subject of the search to satisfy the particularity 

requirement.”84 The same concerns and rules should apply when police search digital 

“occupancies.” Indeed, “[t]he need for particularity . . . is especially great in the case of 

eavesdropping.” Berger, 388 U.S. at 56. So, too, for remote access hacking.

Further, a search warrant that demonstrates probable cause as to one suspect or location 

does not thereby justify any search anywhere. See Zurcher v. Stanford Daily, 436 U.S. 547, 554 

(1978) (second emphasis added) (“[V]alid warrants may be issued to search any property, 

whether or not occupied by a third party, at which there is probable cause to believe that fruits, 

instrumentalities, or evidence of a crime will be found.”).85 The Wiretap Act illustrates 

application of this principle to warrants authorizing invasive electronic surveillance: the 

government must demonstrate not only that there is probable cause of commission of a 

qualifying criminal offense, but also that there is probable cause for belief “that particular 

communications concerning that offense will be obtained through such interception” and that the 

facilities or places to be wiretapped or bugged are being used in connection with the offense or 

83 “[I]n the case of multi-location search warrants, the magistrate must be careful to evaluate each location 

separately. ‘A search warrant designating more than one person or place to be searched must contain sufficient 

probable cause to justify its issuance as to each person or place named therein.’” Greenstreet v. Cnty. of San 

Bernardino, 41 F.3d 1306, 1309 (9th Cir. 1994) (quoting People v. Easely, 671 P.2d 813, 820 (Cal. 1983)). 84 Orin S. Kerr, Applying the Fourth Amendment to the Internet: A General Approach, 62 Stan. L. Rev. 1005, 1045

n.173 (2010) (citing Jacobs v. City of Chicago, 215 F.3d 758, 767 (7th Cir. 2000)). See also United States v. Hinton, 

219 F.2d 324, 325–26 (7th Cir. 1955) (“For purposes of satisfying the Fourth Amendment, searching two or more 

apartments in the same building is no different than searching two or more completely separate houses.”); United 

States v. Clark, 638 F.3d 89, 98 (2d Cir. 2011) (warrant defective where issuing judge was not informed of 

building’s size or number of residential units and was incapable of making probable cause determination of 

defendant’s control of entire multi-family building). 85 See also, e.g., Commonwealth v. Cefalo, 409 N.E.2d 719, 726 (Mass. 1980) (“In the case of a search warrant, . . . 

the affidavit must, in order to establish probable cause, contain enough information for the issuing magistrate to 

determine that the items sought are related to the criminal activity under investigation, and that they may reasonably 

be expected to be located in the place to be searched.” (emphasis added)). 

21

 
used by the targeted person. 18 U.S.C. § 2518(3)(a)–(d). Remote, surreptitious computer 

searches should be held to the same standard.

Authorizing the kinds of remote access searches that the government seeks to conduct 

threatens to violate the Fourth Amendment’s particularity and probable cause requirements in 

several ways. First, if the government configures a website or server to deliver malware to the 

computer of every person who visits it (a watering hole attack), it will likely end up searching the 

computers of people who it cannot particularly identify or describe and as to whom it lacks 

probable cause. There do exist a small subset of websites or servers where all access may violate 

the law (websites that do nothing more than distribute child pornography might qualify).

However, issuing a search warrant authorizing the surreptitious delivery of malware onto the 

computers of an unknown number of targets raises serious legal and policy questions. Moreover, 

even if orders for bulk installation of malware are deemed to be proper, the vast majority of 

websites or servers that the government might commandeer to deliver malware to visitors’ 

computers will be visited by both legitimate targets and non-targets alike. For example, members 

of the press, researchers, policymakers, and attorneys regularly visit websites associated with 

terrorist groups, cyber-criminals, and drug dealers.

86 Were courts to authorize the installation of 

malware to all visitors to these and other types of websites, the government would undoubtedly 

end up searching the computers of innocent people who are not engaged in any crime, who have 

a perfectly valid reason to have visited the site, and as to whom there is no probable cause.

The same may be true of more targeted delivery of remote access hacking software. For 

example, when the government delivered spyware to a suspect in a 2007 investigation in 

Washington, it did so by creating a fake Associated Press story and then sending a link to one of 

the suspect’s social media accounts.87 “When the suspect clicked on the link, the hidden FBI 

software [installed itself on his computer and] sent his location and Internet Protocol information 

to agents.”88 Had the suspect forwarded the link to acquaintances, posted it on social media, or 

otherwise distributed it, people as to whom the government lacked probable cause would likely 

have clicked on the link and triggered a search of their computers. The same would have 

happened if the government had posted the link to a public portion of the suspect’s social media 

account (it is not known whether the government did so because public information about the 

search is limited). Likewise, if an internet search engine had indexed the fake page,89 any 

internet user could have happened upon the link during a search, clicked on it, and triggered a 

search of their computer. Once released into the world, government malware is difficult to

contain.90 A warrant could not have authorized these collateral, but foreseeable searches because 

86 Indeed, the reason the American public learned about the Target data breach (and many others) is because a 

journalist regularly reads invitation-only cyber-crime forums. See Brian Krebs, Cards Stolen in Target Breach Flood 

Underground Markets, Krebs on Security (Dec. 20, 2013), http://krebsonsecurity.com/2013/12/cards-stolen-intarget-breach-flood-underground-markets/#more-24093. 87 Gene Johnson, FBI Says It Faked AP Story to Catch Bomb Suspect, Associated Press, Oct 28, 2014, 

http://bigstory.ap.org/article/29ae75189b254e47bfb79c3a0de256ec/ap-seattle-times-upset-about-fbi-impersonation; 

see also Mike Carter, FBI Created Fake Seattle Times Web Page to Nab Bomb-Threat Suspect, Seattle Times, Oct. 

27, 2014, http://seattletimes.com/html/localnews/2024888170_fbinewspaper1xml.html. 88 Carter, supra; see also Johnson, supra. 89 See Google, Crawling & Indexing, http://www.google.com/insidesearch/howsearchworks/crawling-indexing.html

(“We use software known as ‘web crawlers’ to discover publicly available webpages.”).

90 See, e.g., Rachel King, Stuxnet Infected Chevron’s IT Network, Wall St. J., Nov. 8, 2012, 

http://blogs.wsj.com/cio/2012/11/08/stuxnet-infected-chevrons-it-network/.

22

 
the government would have lacked probable cause as to the people searched, and could not have 

particularly described the places to be searched or digital files to be seized.

Individual magistrate judges reviewing warrant applications may be able to address some 

of these concerns in some cases. But because these defects will pervade remote access warrant 

applications and are entirely predictable, the best course is to reject the proposed amendment and 

allow Congress the opportunity to set detailed rules concerning particularity and probable cause.

D. The Proposed Amendment Weakens Rule 41’s Notice Requirement

The proposed amendment modifies Rule 41’s notice requirement so that for remote 

access searches the government “must make reasonable efforts to serve a copy of the warrant on 

the person whose property was searched or whose information was seized or copied.”91 The 

means of service must be “reasonably calculated to reach that person.”92 This departs from the 

normal requirement that “[t]he officer executing the warrant must give a copy of the warrant and 

a receipt for the property taken to the person” subject to the search. Fed. R. Crim. P. 41(f)(1)(C)

(emphasis added). 

The proposed language clearly contemplates searches for which no notice can be 

provided. Indeed, the circumstances in which the government will likely seek authority to 

conduct remote access searches all but guarantee that notice will be difficult if not impossible to 

provide in many or most cases. If, for example, the government seeks to learn the identity and 

location of a particular internet user, it might often be the case that all it learns is that the user is 

connected to the internet from an IP address associated with a coffee shop in a large urban area. 

It is not at all clear that any means would be available to the government to reliably provide 

notice in that likely typical scenario.

But failure to provide notice “casts strong doubt on [a warrant’s] constitutional 

adequacy.” United States v. Freitas, 800 F.2d 1451, 1456 (9th Cir. 1986) (citing Berger, 388 

U.S. at 60). As the Ninth Circuit has explained, 

[a] warrant [i]s constitutionally defective [if it] fail[s] to provide explicitly for 

notice within a reasonable, but short, time subsequent to the surreptitious 

entry. . . . We take this position because surreptitious searches and seizures of 

intangibles strike at the very heart of the interests protected by the Fourth 

Amendment. The mere thought of strangers walking through and visually 

examining the center of our privacy interest, our home, arouses our passion for 

freedom as does nothing else. That passion, the true source of the Fourth 

Amendment, demands that surreptitious entries be closely circumscribed.

Id.; see also United States v. Villegas, 899 F.2d 1324, 1337 (2d Cir. 1990) (“[I]f a delay in notice 

is to be allowed, the court should nonetheless require the officers to give the appropriate person 

notice of the search within a reasonable time after the covert entry.”). 

91 Proposed Amendments Materials at 340 (emphasis added).

92 Id. (emphasis added).

23

 
Surreptitious entry into a repository of a person’s electronic files, containing digital 

analogues of her diaries, address books, letters, and photo albums, raises no less important 

concerns. See United States v. Payton, 573 F.3d 859, 861–62 (9th Cir. 2009) (“There is no 

question that computers are capable of storing immense amounts of information and often 

contain a great deal of private information. Searches of computers therefore often involve a 

degree of intrusiveness much greater in quantity, if not different in kind, from searches of other 

containers.”). Even when police seek to search only a limited set of data on a computer, the 

importance of notice is paramount. Computers “store and intermingle a huge array of one’s 

personal papers in a single place[, which] increases law enforcement’s ability to conduct a wideranging search into a person's private affairs.” United States v. Otero, 563 F.3d 1127, 1132 (10th 

Cir. 2009). And even if no data is copied during the search, the surreptitious entry itself raises 

concerns, particularly when it is achieved using means that may expose the computer user to 

malicious incursions by other actors taking advantage of the government’s means and method of 

entry.

93

Another problem with the proposed amendment is that it will allow the government to 

provide notice to either “the person whose property was searched or whose information was 

seized or copied.”94 When those are different people, notice should be given to both. If, for 

example, the government were to conduct a remote access search of a computer owned by one 

person but used by others, it could interpret the rule to allow it to provide notice to only the 

owner, but not to the person whose files (“information”) were actually seized or copied. This 

would be so even if the seized files were located in a password-protected folder and were clearly 

identifiable as being the property of someone other than the computer’s owner. The computer’s 

owner may fail to, or be ordered not to, inform the target of the search upon receiving notice 

from the government. Thus, the target might never learn of the search, and therefore never be 

able to challenge its constitutionality. To avoid this problem, “or” should be replaced with “and.”

Finally, even in situations where the government’s efforts to provide notice to the proper 

person eventually succeed, notice will often be delayed. An increase in delayed-notice searches 

occasioned by the proposed amendment raises concerns. In the context of Title III, Congress has 

implicitly authorized covert entry and delayed notice when installing and operating surveillance

equipment, but only when the government complies with “detailed restrictions” that “guarantee 

that wiretapping or bugging occurs only when there is a genuine need for it and only to the extent 

that it is needed.” Dalia, 441 U.S. at 250; see 18 U.S.C. § 2518 (imposing duration and 

minimization requirements on wiretap orders). Similar safeguards have been imposed by courts 

to regulate video surveillance. See, e.g., Biasucci, 786 F.2d at 510–11. Delayed notice may be 

permissible if it is of short duration and reviewed by a judge, but it has the potential to interfere 

with substantive Fourth Amendment rights if too heavily, widely, or extensively used. To the 

extent “remote access” searches are permissible at all, any delay of notice must be specifically 

93 The proposed amendment may also violate the knock-and-announce rule. As the Supreme Court has explained, 

the Fourth Amendment does not “permit[] a blanket exception to the knock-and-announce requirement for [an] 

entire category of criminal activity.” Richards v. Wisconsin, 520 U.S. 385, 388 (1997). Neither the government nor 

courts may “dispens[e] with case-by-case evaluation of the manner in which a search [is] executed,” including when 

it comes to knock-and-announce. Id. at 392. To the extent that remote access search warrants are permissible at all, 

unannounced searches may sometimes be justified by a specific factual showing under the circumstances of a 

particular case. But a categorical rule permitting unannounced searches may violate the Fourth Amendment.

94 Proposed Amendments Materials at 340 (emphasis added).

24

 
justified in the individual case, notice must be given “within a reasonable time after the covert 

entry,” and the restrictions currently imposed on wiretap and video surveillance warrants must be 

observed. Villegas, 899 F.2d at 1336–37.

It is perhaps for the very reason that remote access searches raise intractable notice 

problems that neither Congress nor the courts have yet seen fit to permit the government the 

general authority to search individuals whose locations are entirely unknown. It may be that the 

inability to guarantee notice in the mine-run of remote access searches could be overcome in 

some technological or legislative manner. But that possibility is best left to congressional inquiry 

in the first instance.

V. The Proposed Amendment Raises Wide-Ranging Questions That the Committee 

Should Consider Now, Because Those Questions are Unlikely to Be Addressed in 

Individual Cases for Years to Come

The Advisory Committee should proceed with extreme caution before expanding the 

government’s authority to conduct remote electronic searches. As explained above, the proposed 

amendment would significantly expand the government’s authority to conduct searches that raise 

troubling and wide-ranging constitutional, statutory, and policy questions. If the Committee 

approves the proposed amendment, courts are unlikely to address these questions in individual 

cases, at least not in the foreseeable future. Therefore, it is vital that the Committee carefully 

consider all of the implications of the proposed amendment now. If those implications cannot be 

adequately addressed through a change to the Federal Rules—which they cannot—the 

Committee’s best course would be to reject the proposal and leave it to Congress to take up the 

question.

Even if the Advisory Committee determines that the proposed amendment will “govern[] 

only ‘the manner and the means’ by which the litigants’ rights are ‘enforced,’” and will not 

“alter[] ‘the rules of decision by which [the] court will adjudicate [those] rights,’” Shady Grove 

Orthopedic Assocs., P.A. v. Allstate Ins. Co., 559 U.S. 393, 407 (2010) (second and third 

alterations in original), it should still be reticent to approve the amendment. The constitutional 

questions raised by the amendment include what limitations the particularity, probable cause, and 

reasonableness requirements of the Fourth Amendment impose on remote access searches. These 

will likely not be addressed by courts for years, if ever. Moreover, important policy questions 

involving cybersecurity and government exploitation of internet and software vulnerabilities are 

implicated, as are conflicts with the text and intent of the Wiretap Act. In order to prevent 

violations of the Fourth Amendment and an unchecked expansion of government power, this 

Committee should grapple with these issues now. The Department of Justice should request the 

authority it seeks from Congress, so as to permit a public debate about the propriety of the 

intrusive techniques it proposes to use and about possible alternatives that Congress would be in 

a unique position to craft.

There are several reasons why courts are unlikely to address Fourth Amendment limits on 

remote access searches in the near future. For one, warrant applications are considered by judges 

ex parte and without adversarial argument. While magistrate judges are experienced in assessing 

general questions of particularity and probable cause in run-of-the-mill warrant applications, they 

25
are likely to be ill-equipped to provide robust review of applications for remote access warrants 

without adversarial briefing, particularly when the search warrant applications do not make clear 

that agents are seeking permission to hack into the computers of surveillance targets. Full 

appraisal of these applications requires technical expertise about electronic data storage issues, 

internet architecture, and cybersecurity. Applications that appear reasonable on their face in light 

of a magistrate judge’s limited technical understanding may in fact fail the particularity and 

reasonableness requirement upon closer study. But without detailed technical knowledge—or 

adversarial briefing explaining the issues—many of these concerns will go unnoticed and 

unaddressed. 

Further, orders granting or denying warrants are rarely published and are usually sealed.95

The likelihood of magistrate judges sua sponte publishing detailed opinions analyzing Fourth 

Amendment issues involved in electronic searches is particularly low when they are unable to 

independently identify the constitutional infirmities of the warrant application. Indeed, although 

the government has already sought warrants to authorize remote access searches,

96 there is only 

one published opinion of a magistrate judge grappling with the Fourth Amendment issues 

involved. See In re Warrant, 958 F. Supp. 2d 753. There is no telling how long it will be until 

there is another.

Additionally, notice may be delayed for significant periods of time, thus forestalling the 

time when the target of a remote access search could challenge its constitutionality. See Fed. R. 

Crim. P. 41(f)(3); 18 U.S.C. § 3103a(b)–(c). And even when notice is given, ex post judicial 

review is limited by doctrines precluding or discouraging a ruling on the constitutionality of the 

government’s conduct. In criminal prosecutions, defendants may challenge the constitutionality 

of a search through motions to suppress. In response to such motions, the government is likely to 

argue that investigating officers were relying in good faith on a facially valid warrant when 

conducting the search. See United States v. Leon, 468 U.S. 897 (1984). Courts frequently address 

the good-faith exception before—and to the exclusion of—the substantive Fourth Amendment 

claim when denying motions to suppress.97 Thus, even in cases where a remote access warrant 

fails the particularity, probable cause, or reasonableness requirements of the Fourth Amendment, 

courts will generally avoid ruling on the issue.

The doctrine of qualified immunity functions in much the same way to preclude 

substantive adjudication in suits seeking damages for violations of Fourth Amendment rights.98

95 See Laura Donahue, Professor, Georgetown Univ. Law Ctr., Remarks at Panel on the Legal and Policy 

Implications of Hacking by Law Enforcement at Yale Law School (“Remarks by Laura Donahue”), at 18:00–21:40 

(Feb. 18, 2014), http://vimeo.com/88165230 (stating knowledge of dozens of cases involving government use of 

hacking tools, but explaining that most of the relevant magistrate judge orders are sealed). 96 Id. 97 See, e.g., United States v. Clay, 646 F.3d 1124, 1128 (8th Cir. 2011) (“[T]he district court properly denied [the 

defendant’s] motion to suppress based on the Leon good-faith exception. In light of this conclusion, we need not 

reach the underlying question of probable cause.”); United States v. Woodbury, 511 F.3d 93, 99 (1st Cir. 2007) (“We 

need not address [the defendant’s] particularity arguments because we find that the Leon good faith exception 

applies.”); United States v. Cherna, 184 F.3d 403, 407 (5th Cir. 1999) (“If [the Leon good faith exception applies], 

we end our analysis and affirm the district court's decision to deny the motion to suppress. . . . If the good-faith 

exception applies, we need not reach the question of probable cause.”).

98 See Bivens v. Six Unknown Named Agents of Fed. Bureau of Narcotics, 403 U.S. 388 (1971). Suits for injunctive 

and declaratory relief are likely to be barred by standing doctrine, on the basis that a person targeted by a remote 

26

 
Qualified immunity “protects government officials from liability for civil damages insofar as 

their conduct does not violate clearly established statutory or constitutional rights of which a 

reasonable person would have known.” Pearson v. Callahan, 555 U.S. 223, 231 (2009) (internal 

quotation marks omitted). Courts have discretion to address qualified immunity before 

determining whether the government has violated a plaintiff’s constitutional rights, id. at 236, 

and they frequently do so. Courts often dispose of cases seeking relief for Fourth Amendment 

violations by concluding that there was no clearly established law at the time of the search which 

would have put law enforcement on notice that their conduct was unconstitutional. See, e.g., 

Messerschmidt v. Millender, 132 S. Ct. 1235 (2012) (finding qualified immunity and declining to 

rule on whether facts stated in a warrant application established probable cause). The issues 

raised by warrants for remote, extra-district electronic searches are necessarily novel because the 

Federal Rules have not heretofore authorized them. Therefore, the government will almost 

certainly argue that qualified immunity applies. Perversely, the very absence of case law 

addressing these searches will mean there is likely to be little development of case law 

addressing the constitutionality of these searches in the future. 

Accordingly, the time to address the constitutional concerns raised by the proposed 

amendment is now. Speculation that these important issues will be fully dealt with in future case 

law is unlikely to prove correct, at least in the near future. The significant issues involved 

counsel caution, and the right course is to reject the proposed amendment and let Congress act.

These problems are exacerbated by the government’s lack of candor about the nature of 

its remote access searches. The DOJ’s explanations of its remote access search capability in the 

sample warrant applications,99 in warrant applications actually filed in federal court,100 and in its 

recent memoranda to this Committee fail to fully describe the nature and invasiveness of its 

contemplated and completed remote access searches. As described above, one use of the 

proposed amendment will be to enable searches involving malware or spyware that take 

advantage of zero-day vulnerabilities and that travel over the open internet. But nothing in the 

government’s descriptions of its “network investigative techniques”101 or “remote network 

techniques”102 would put a magistrate judge (or, for that matter, a member of this Committee) on 

notice that the government seeks to hack into the computers of targets, exploiting publicly 

unknown security flaws in the software on those devices using techniques that may create 

significant cybersecurity collateral damage to the target and to others, and that may fail the 

reasonableness and particularity requirements of the Fourth Amendment.103

access search in the past will not be able to prove a likelihood that they will be subjected to such a search again in 

the future. See City of L.A. v. Lyons, 461 U.S. 95 (1983). 99 See Advisory Committee Materials at 181–235. 100 See, e.g., Affidavit of Justin E. Noble in Support of Application for Search Warrant, In re Search of Network 

Investigative Technique (“NIT”) for E-mail Address 512SocialMedia@gmail.com, No. 12-mj-748-ML (W.D. Tex. 

Dec. 18, 2012); Third Amended Affidavit of William A. Gallegos In Support of Application for Search Warrant, In 

re Search of Network Investigative Technique (“NIT”) for Email Address texan.slayer@yahoo.com, No. 12-sw05685-KMT (D. Colo. Dec. 11, 2012). 101 See, e.g., Advisory Committee Materials 200–03. 102 See, e.g., id. 216. 103 See Remarks by Laura Donahue, supra, at 21:45–22:17 (“Often [the government’s] applications do not include 

detailed technology, or technological explanation as to how it is actually going to be executed, enter the computer, 

exactly what information is going to be obtained, which other devices might be infected, how many devices may be 

infected, and so on.”).

27

 
It is crucial that the government provide full and accurate information to magistrate 

judges (and to this Committee) when seeking authority to conduct novel and invasive 

searches.104 The Advisory Committee should not authorize new search powers without ensuring 

that the duty of candor has been and will be satisfied. At a minimum, the Advisory Committee 

Notes accompanying the proposed amendment should speak to this issue. 

VI. Recommendations

The ACLU recommends that the Committee reject the proposed amendment to Rule 41. 

The proposed amendment raises myriad technological, policy, and constitutional concerns. Some 

of those might be addressed through careful regulation; others are inherent in even the most 

circumscribed versions of the proposal. The dramatic expansion of investigative power that the 

government seeks should not be authorized through a change to the Rules of Procedure. Rather, 

if the government wants this power, it should seek congressional action.

Should Congress decide that remote access searches in the situations covered by the 

proposed amendment are to be permitted, the ACLU would recommend a set of restrictions to 

mitigate its concerns, including:

• Require a Title III order for any remote access search that collects information on 

an ongoing basis or forces a target’s device to generate or collect new data (such 

as by turning on a computer’s webcam or microphone);

• Only permit use of malware against specific and particularly described persons. 

Watering hole attacks, particularly when performed against sites that share 

computing resources with other innocent websites, present significant public 

policy and legal issues which make such attacks problematic;

• Require that the government make explicit in warrant applications that it intends 

to conduct a remote access search using malware and that it will exploit security 

vulnerabilities in the software on the target’s device to do so, and require the 

government to describe in detail how the malware will work, how many 

computers it will affect, how long it will remain installed on those computers, 

what code will remain on those computers indefinitely, the extent to which there 

may be irreversible changes or damage to devices, the extent to which insertion of

the malware requires the assistance of a third party service provider, what impact 

there will be on the security of computers of targets and non-target third parties, 

whether it is reasonably foreseeable that government malware could malfunction, 

target the wrong people, or fall into the wrong hands, what technical experts have 

104 Comprehensive Drug Testing, Inc., 621 F.3d at 1178 (Kozinski, C.J., concurring) (“[O]mitting . . . highly 

relevant information [about a search of electronic data] is inconsistent with the government's duty of candor in 

presenting a warrant application. A lack of candor in this or any other aspect of the warrant application must bear 

heavily against the government in the calculus of any subsequent motion to return or suppress the seized data.”); cf. 

Stephanie K. Pell & Christopher Soghoian, A Lot More than a Pen Register, and Less than a Wiretap: What the 

Stingray Teaches Us About How Congress Should Approach the Reform of Law Enforcement Surveillance 

Authorities, 16 Yale J. L. & Tech. 134, 162 (2013) (discussing government’s lack of candor to judges when seeking 

authority to use “Stingray” cell phone tracking devices).

28

 
been consulted prior to submission of the application, and the basis for the 

determinations made with regards to the issues above;

• Prohibit the impersonation of third parties by law enforcement agencies in their 

efforts to deliver malware to targets, unless those third parties provide informed 

consent in writing;

• Require that any assistance of a service provider in delivering the malware be 

consensual or explicitly required by the warrant;

• Require law enforcement malware to include identifying markings in the 

computer code, such that if the code is subsequently discovered by security 

researchers, they will know who to contact if, for example, the malware 

malfunctions, spreads, or ends up on the computers of non-suspects;

• Prohibit the use by law enforcement of zero-day exploits in general-use software 

and hardware; and

• Prohibit the approval of warrants in which there is a reasonable likelihood that 

execution of the warrant will result in damage to third parties who are not the 

intended law enforcement target.

Many of these proposed constraints are beyond this Committee’s power to enact. The 

ACLU recommends that the Committee not adopt the proposed amendment and allow the 

government to seek legislation in Congress. 

* * * * * * *

Thank you for your consideration of these comments. 

Respectfully,

Nathan Freed Wessler

Christopher Soghoian

Alex Abdo

American Civil Liberties Union

Speech, Privacy, and Technology Project

125 Broad Street, 18th Floor

New York, NY 10004

(212) 549-2500

nwessler@aclu.org

29
TAB 2
1

Testimony	of	Kevin	S.	Bankston,

Policy	Director	of	New	America’s	Open	Technology	Institute

On	Proposed	Amendments	to	Rule	41

of	the	Federal	Rules	of	Criminal	Procedure

Before	The	Judicial	Conference	Advisory	Committee	

on Criminal	Rules

November	5,	2014

Members	of	the	Committee,

Thank	you	for	allowing	New	America’s	Open	Technology	Institute

(“OTI”)1 to	testify	and	share	our	concerns	about	the	proposed	

amendment	to	Federal	Rule	of	Criminal	Procedure	41	regarding	

“remote	access”	searches	of	electronic	devices.

2

I	am	here	today	to	question	the	basic	and	quite	substantive	premise	

implicit	in	the	proposed	amendment:	that	“remote	access”	searches by	

the	government—or	more accurately,	the	government’s	surreptitious

hacking	into	computers or	smartphones	in	order	to	plant	malware that	

will	send	data	from	those	devices back	to	the	government—are	allowed	

by	the	Fourth	Amendment.		

Based	on	precedent	almost	half	a	century	old,	we	believe	the	proposed	

amendment authorizes	searches	that	are unconstitutional	for	lack of	

adequate	procedural	protections	tailored	to	counter	those searches’	

extreme	intrusiveness—much like	the New	York	state	electronic	

																																																							 1 New	America’s	Open	Technology	Institute	(“OTI”),	http://newamerica.org/oti/.	 2 Preliminary	Draft	of	Proposed	Amendments	to	the	Federal	Rules	of	Appellate,	

Bankruptcy,	Civil,	and	Criminal	Procedure:	Request	for	Comment (Proposed	

Amendments	Draft),	338-342	(Aug.	2014),	available	at

http://www.regulations.gov/#!documentDetail;D=USC-RULES-CR-2014-0004-0001

(authorizing	issuance	of	warrants	“to	use	remote	access	to	search	electronic	storage	

media	and	to	seize	or	copy	electronically	stored	data”	in	cases	where	the	target	

computer’s	location	“has	been	concealed	by	technological	means”	or	in	a	computer	

crime	investigation	where	the	computers	to	be	searched	“have	been	damaged	

without	authorization	and	are	located	in	five	or	more	districts”).
2

eavesdropping	law	that	was	struck	down	as	unconstitutional	by	the	

Supreme	Court	in	Berger	v.	New	York nearly	50	years	ago.

3 There, the	

court	held	that	because	electronic	eavesdropping	“by	its	very	

nature...involves	an	intrusion	on	privacy	that	is	broad	in	scope,”	

authority	to	conduct	such	surveillance	should	only	be	granted	“under	

the	most	precise	and	discriminate	circumstances”	in	order	to	ensure	

that	the	Fourth	Amendment’s	particularity requirement	is	met.4

In	response	to	that	1967	case,	Congress	in	1968	passed	the	federal	

wiretapping	statute	often	referred	to	as	Title	III. 5		There,	Congress

addressed the	Supreme	Court’s	Fourth	Amendment	concerns	by	

providing	a	precise	and	discriminate warrant	procedure	for	

wiretapping	and	electronic	eavesdropping,

6 with procedural	safeguards	

so	demanding	that	commentators routinely	refer to	Title	III	orders as	

“super-warrants.”7		

Foremost among	those	Title	III	safeguards	are	the	four that	are	intended	

to	enforce	the	Fourth	Amendment’s	particularity	requirement	

consistent	with	the	Berger decision,	which	held	that	“[t]he	need	for	

particularity...is	especially	great	in	the	case	of	eavesdropping.”8		The	

court	in	US	v.	Torres,

9 the	first	of	many	circuit	courts to	find	that	these

four Berger-derived	requirements	are	also	constitutionally	required	for

video	surveillance,

10 summarized	them	well:

																																																							 3 388	U.S.	41	(1967).

4 Id.	at	56.

5 Title	III	of	the	Omnibus	Crime	Control	and	Safe	Streets	Act	of	1968	(“Title	III”	or	

the	“Wiretap	Act”),	18	U.S.C.	§	2510	et	seq. 6 Id.	at	§2518.

7 See,	e.g.,	Orin	S.	Kerr,	Lifting	the	"Fog"	of	Internet	Surveillance:	How	a	Suppression	

Remedy	Would	Change	Computer	Crime	Law,	54	Hastings	L.J.	805,	815 (2003).

8 Berger,	388	U.S.	at	56.

9 United	States	v.	Torres, 751	F.2d	875	(7th	Cir.	1984),	cert.	denied,	470	U.S.	1087	

(1985).

10 See	United	States	v.	Biasucci,	786	F.2d	504,	508-10	(2d.	Cir.	1986),	cert.	denied,	479	

U.S.	827	(1986),	United	States	v.	Cuevas-Sanchez,	821	F.2d	248,	251-52	(5th	Cir.	

1987),	United	States	v.	Mesa-Rincon,	911	F.2d 1433,	1436-39	(10th	Cir.	1990),	United	

States	v.	Koyomejian,	970	F.	2d	536,	538-42 (9th	cir.	1991)	(en	banc),	cert.	denied,	

506	U.S.	1005	(1992),	United	States	v.	Falls,	34	F.3d	674,	678-80	(8th	Cir.	1994),	and	

United	States v.	Williams,	124	F.3d	411,	416	(3rd	Cir.	1997).
3

[T]he	judge	must	certify	that	[1]	“normal	investigative	procedures	

have	been	tried	and	have	failed	or	reasonably	appear	to	be	

unlikely	to	succeed	if	tried	or	to	be	too	dangerous,”	18	U.S.C.	§	

2518(3)(c),	and	that	[2]	the	warrant	must	contain	“a	particular	

description	of	the	type	of	communication	sought	to	be	intercepted,	

and	a statement	of	the	particular	offense	to	which	it	relates,”	§	

2518(4)(c),	[3]	must	not	allow	the	period	of	interception	to	be	

“longer	than	is	necessary	to	achieve	the	objective	of	the	

authorization,	nor	in	any	event	longer	than	thirty	days”	(though	

renewals are	possible),	§	2518(5),	and	[4]	must	require	that	the	

interception	“be	conducted	in	such	a	way	as	to	minimize	the	

interception	of	communications	not	otherwise	subject	to	

interception	under	[Title	III].11

As	the	Torres court	concluded,	“Each	of	these	four	requirements	is	a	

safeguard	against	electronic	surveillance	that	picks	up	more	

information	than	is	strictly	necessary	and	so	violates	the	Fourth	

Amendment's	requirement	of	particular	description.”12

Title	III,	consistent	with	Berger and	the	Fourth	Amendment’s	demand	of	

reasonableness,	also	includes	a	clear	requirement	of	service	of	notice	on

the	target	of	the	surveillance	soon	after	the	surveillance	is	completed—

with no	exceptions	for	failure	to	notify.13		And	finally,	Title	III	includes	a	

number	of	additional	“super-warrant”	checks	and	balances	intended	by	

Congress to	further	ensure	the	reasonableness	of	the	surveillance	to	

balance	its	intrusiveness,	including	a	requirement	that	such	surveillance	

only	be	used	in	the	investigation of	specifically	identified	serious	

crimes.

14		Only	with	such	super-warrant	protections	in	place	have	

warrants	for	electronic	surveillance	been	found	constitutional	under	the	

Fourth	Amendment.

Today,	nearly	half	a	century	later,	we	are	faced	with	a	digital

surveillance	technique	that	is	substantially	more	invasive	than	the	

analog	electronic	surveillance	techniques	of	the	past.		Yet	this	

																																																							 11 Torres,	751	F.2d	at	883-84.

12 Id.	at	884.

13 18	U.S.C.	§2518(8)(d).

14 18	U.S.C.	§2516(1);	see	also	Torres,	751	F.2d at	890-91	(summarizing	additional	

Title	III	requirements).
4

Committee,	without	any	support	from	Congress	or	the	courts,	is	poised	

to	explicitly	authorize	warrants	for	such	remote	access	searches with	no	

additional	protections	at	all	and	with	a	constitutionally	novel	allowance	

for	no	notice	in	certain	cases.		This	is	particularly	concerning	because	

the	procedural	protections	required	in	cases	of eavesdropping,	

wiretapping	and	video	surveillance	are	even	more	necessary	here,	when	

the	devices	to	which	the	government	seeks	access	can	contain	an	

unprecedented	wealth	of	private	data—our digital	“papers	and	effects.”

Indeed,	the	one	published	decision	to	address	a	warrant	application	

regarding	a	remote	access	search—Magistrate	Judge	Smith’s	opinion	in	

Houston	last	year,	the	In	Re	Warrant case—rejected	the	application	

based	not	only	on	Rule	41	considerations	but	also	based	on	a	failure	to	

satisfy	the	Fourth	Amendment’s	particularly	requirement,	including	the	

enhanced	Berger/Torres particularity	requirements	typically	applied	to	

electronic	surveillance.

15

The	proposed	amendment,	in	attempting	to	address	the	Rule	41	issue	

raised	by	Judge	Smith’s	opinion,	necessarily	also	makes	a	substantive	

judgment	regarding	the	Fourth	Amendment’s	application	to	remote	

access	searches.		It	does	so	first	by	authorizing remote	access	searches	

where	the	location	of	the	target	computer	is	unknown—a	type	of	search	

that	Judge	Smith	found	was	a	per	se violation	of	the	requirement	that	

the	“place	to	be	searched”	be	particularly	described16—and	second	by	

choosing	not	to	insist that	remote	access	searches	meet	the	

Berger/Torres requirements	that undoubtedly	apply.

Those	requirements	undoubtedly	apply,	as	Judge	Smith	held,17 because	

remote	access	searches	implicate	and	amplify	all	of	the	same	problems	

as	electronic	surveillance, by	virtue	of	providing	access	to	an	even	

greater	wealth	of	private	information.		As	he	described,	computers	

contain—and	the	government’s	remotely	installed	software	has	the	

capacity	to	access—“Internet	browser	history,	search	terms,	e-mail	

contents	and	contacts,	‘chat’,	instant	messaging	logs,	photographs,	

correspondence,	and	records	of	applications	run,	among	other	

																																																							 15 In	Re	Warrant	to	Search	a	Target	Computer	at	Premises	Unknown,	958	F.	Supp.	2d	

753,	758-61	(S.D.	Tex.	2013).

16 Id.	at	758-760.

17 Id at	760-61
5

things....”18		Not	only	can	government	software	secretly	“search	the	

computer's	hard	drive,	random	access	memory,	and	other	storage	

media,”	but	it	can	also	“activate	the	computer's	built-in	camera[,]

generate	latitude	and	longitude	coordinates	for	the	computer's	

location[,]	and[]	transmit [all	of	that] extracted	data to	the	FBI....”19

Like	Judge	Smith,	the	Supreme	Court	recently	recognized	the	

unprecedented	amount	of	private	data	that	may	be	stored	on	an	

electronic	device	such	as	a	computer	or a	smartphone.		As	the	Court	

explained	in	this	year’s	Riley	v.	California decision	regarding	searches	of	

cell	phones	incident	to	arrest,	many	cell	phones	“are	in	fact	

minicomputers	that	also	happen	to	have	the	capacity	to	be	used	as	a	

telephone.	They	could just	as	easily	be	called	cameras,	video	players,	

rolodexes,	calendars,	tape	recorders,	libraries,	diaries,	albums,	

televisions,	maps,	or	newspapers.”20		These	devices,	with	“immense	

storage	capacity,”	can	hold	“every	picture	[their	users]	have	taken,	or	

every	book	or	article	they	have	read,”	and	“even	the	most	basic	phones	

that	sell	for	less	than	$20	might	hold	photographs,	picture	messages,	

text	messages,	Internet	browsing	history,	a	calendar,	a	thousand-entry	

phone	book,	and	so	on.”21		Stand-alone	computers	that	could	be	reached	

by	a	remote	access	search	can	store	even	more—and	even	more	types—

of	private	data	than	the	smartphones	that	the	Supreme	Court	sought	to	

protect	against	unreasonable	searches.		Ultimately,	as	the	Supreme	

Court	explicitly	held,	the	search	of	a	modern	electronic	device	such	as	a	

smartphone	or	a	computer	is	more	privacy	invasive	than	even	“the	most	

exhaustive	search	of	a	house”.22

In	this	technological	context,	the	constitutional	necessity	of	applying	the	

Berger/Torres particularity	requirements to	remote	access	searches is	

clear.		That	need—especially	in	regard	to	minimizing	the	search	of	

devices	or	the	seizure	of	data	that	are	not	particularly	identified	in	the	

warrant—is	amplified	even	further	by	several	other	risks that	have	

been	discussed	at	length	by	other	commentators	as	well	as	Judge	

																																																							 18 Id.	at	760.

19 Id.	at	755.

20 Riley	v.	California,	134	S.	Ct.	2473,	2489	(U.S.	2014). 21 Id.

22 Id.	at	2491.
6

Smith.

23 These	risks	include	the	privacy	risk	to	non-suspects	who	share	

the	target	computer,	which	might be	a	public	terminal	at	a	library	or	a	

café;24 the	risk	that	the	government’s	software	may	spread	to	non-target	

computers;25 the	possibility,	in	cases	of	botnet	investigations	or	socalled	“watering	hole”	attacks, that	thousands	or	even	millions	of	

computers	may	be	infected with	remote	access	software;26 and	the	risk

that	software	used	to	remotely	access	any	of	those	computers	may	end	

up	causing	damage,	either	by	altering	or	deleting	data	or	creating	

security	vulnerabilities	that	may	be	exploited	by	others.27

Indeed,	it	may	be	that	remote	access	searches carry	so	many	risks	that	

they	are unreasonable under	the	Fourth	Amendment or	as	a	policy	

matter	even	if	they	satisfy	the	Berger/Torres requirements;	notably,	

neither	the	courts	nor	Congress	have	yet	addressed	those	questions.		

This brings	us	back	to	my	starting	proposition:	that	by	explicitly	

authorizing	remote	access	searches,	the	proposed	amendment	

represents	a	substantive	judgment	regarding	the	constitutionality	of	

those	searches and	a	policy	judgment	regarding	the	appropriateness	of	

such	searches,	regardless	of	the	Committee	Note’s	claim	that	“[t]he	

amendment	does	not	address	constitutional	questions.

28

The	proposed	amendment’s	explicit	authorization of	remote	access	

searches	where	the	computer	location	is	not	known,	in	the	face	of	the	

one	published	decision	on	the	matter	finding	that	such	searches	are	per	

																																																							 23 In	Re	Warrant,	958	F.	Supp.	2d at	759.

24 Id. 25 Id. 26 See,	e.g.,	Second	ACLU	Comment	on	the	Proposed	Amendment	to	Rule	41	

Concerning	“Remote	Access”	Searches	of	Electronic	Storage	Media	at 6-8,	14-15(Oct.	

31,	2014),	available	at

https://www.aclu.org/sites/default/files/assets/aclu_comment_on_remote_access_

proposal.pdf (“ACLU	Comments”)	(discussing	“watering	hole”	attacks	on	visitors	to	

popular	websites);	Written	Statement	of	the	Center	for	Democracy	&	Technology	

Before	the	Judicial	Conference	Advisory	Comm.	on	Criminal	Rules	at	8,	10	(Oct.	24,	

2014),	available	at https://cdt.org/insight/testimony-for-the-judicial-conferencesadvisory-committee-on-criminal-rules-rule-41/ (“CDT	Comments”)	(discussing	how	

botnet	investigations	may	implicate	millions	of	computers).

27 See,	e.g.,	ACLU	Comments	at	9-10,	17-18;	CDT	Comments	at	8-9.

28 Proposed	Amendments	Draft	at	341.
7

se violations	of	the	Fourth	Amendment’s	particularity	requirement,	

represents	a substantive	legal	judgment.

The	proposed	amendment’s	unprecedented	allowance for	situations	

where	notice	may	not	reach	the	target,	in	the	context	of	case	law	that	

has	never	provided	any	exception	to	the	rule	that	notice	must	be	served,	

is	a	substantive	legal	judgment.

The	proposed	amendment’s	authorization	of remote	access	searches	

without	requiring	satisfaction	of	the	Berger/Torres particularity	

requirements,	contrary	to the	one	published	decision	finding	that	those	

requirements	do	apply,	is	a	substantive	legal	judgment.		So	too would	it

be	a	substantive	legal	judgment	for	the	Committee	to	include	those	

requirements,	which	just	further	demonstrates	how	the	substantive	and	

procedural	questions	on	this	issue	are	inextricably	intertwined.

Ultimately,	such	substantive	expansions	of	the	government’s	authority

as	those	represented	in	this	proposed	amendment are	not	the	province	

of	this	Committee.		We	therefore	urge	that	this	Committee	reject	the	

proposed	amendment	to	Rule	41	and	leave	these	substantive	

constitutional	and	policy	questions	where	they	belong,	in the	courts	and

in Congress.

Thank	you	for	you	consideration,	and	I	welcome	your	questions.
TAB 3
Center for Democracy & Technology 1

Written Statement 

Of 

The Center for Democracy & Technology

Before

The Judicial Conference 

Advisory Committee on Criminal Rules

Friday, October 24, 2014

Members of the Committee, thank you for allowing the Center for Democracy & Technology 

(CDT) to testify on proposed changes to Rule 41 of the Federal Rules of Criminal Procedure 

(FRCrmP).1 CDT is a nonprofit public interest organization dedicated to promoting policies and 

technical standards that protect civil liberties such as privacy and free expression globally. 

CDT recognizes that law enforcement faces legitimate challenges in determining how to issue 

search warrants for computers with concealed locations in investigations. We also recognize 

the negative impact of malware, botnets, and illicit online activities undertaken using anonymity 

techniques that may obfuscate location. However, we believe the solution to this complex 

problem should arise through public and legislative debate. The proposal before the Advisory 

Committee on Criminal Rules to modify Rule 41 of the FRCrmP has significant implications for 

open legal and policy issues, as well as broad technological consequences affecting the 

privacy of computer users worldwide. We believe the Judicial Conference should withdraw the 

proposed changes to Rule 41 from its rulemaking process, and that the proposal should

instead be deliberated in Congress.

I. The Proposed Amendment

Rule 41 of the FRCrmP is of fundamental importance to how the Fourth Amendment warrant 

requirement for government search and seizure applies in practice. Any changes to the Rule 

should be viewed in this context and carefully avoid creating new risks to privacy and security. 

However, the proposed modifications to FRCrmP Rule 41 would have significant legal and 

technical implications, described below, that merit open consideration by Congress, rather than 

a rulemaking proceeding of the Judicial Conference.

Under the current FRCrmP Rule 41, magistrates with authority in a particular district can issue 

warrants for the search and seizure of property:

a. Located within the district at the time of the search;

 

1 Preliminary Draft of Proposed Amendments to the Federal Rules of Appellate, Bankruptcy, Civil, and Criminal 

Procedure, Committee on Rules of Practice and Procedure, Judicial Conference of the United States, pgs. 338-

339, Aug. 2014, www.uscourts.gov/uscourts/rules/preliminary-draft-proposed-amendments.pdf.
Center for Democracy & Technology 2

b. Located within the district at the time the warrant is issued, but which may move 

outside the district prior to the search;

c. Located within or outside the district in terrorism cases if the magistrate has authority 

in a district in which activities related to terrorism may have occurred;

d. Via tracking device, if the tracking device is installed in the district, even if it 

continues to function outside the district; and,

e. Located outside the jurisdiction of any district, but within a U.S. territory, possession, 

commonwealth, or diplomatic mission.2

The proposed amendment to FRCrmP Rule 41 would provide magistrates with new powers to 

authorize warrants to remotely search and seize or copy electronic media located outside the 

magistrate’s district.

3 Per the proposal, magistrates would be able to exercise this power in two 

circumstances:

a. When the physical location of the media or information is “concealed through 

technological means,” or

b. In an investigation of 18 U.S.C. 1030(a)(5), when the damaged protected computers 

are located in five or more districts.4

II. Legal Implications

The proposed modification to FRCrmP Rule 41 would make policy decisions about important 

questions of law that are not currently settled and would best be resolved through legislation. 

A. The proposed Rule 41 amendment would authorize searches that 

violate the particularity requirement of the Fourth Amendment.

If the physical location of the electronic media to be searched is unknown, the search may not 

satisfy the particularity requirement of the Fourth Amendment, which requires that the “place to 

be searched” be particularly described.5 In In Re Warrant to Search a Target Computer at 

Premises Unknown, the magistrate judge rejected a government application for a warrant to 

search and copy information from a computer, the location of which was unknown at the time 

of the application. The court concluded that the application did not satisfy the particularity 

requirement of the Fourth Amendment because the application did not describe the place to be 

searched.6 The court also noted that, because the computer’s location and owner were 

 

2 Rule 41(b)(1)-(5), Search and Seizure, Federal Rules of Criminal Procedure.

3 Supra, fn 1.

4 Under 18 U.S.C. 1030(e), the term “damage” means any impairment to the integrity or availability of data or a 

system, and the term “protected computer” means any computer affecting interstate or foreign communication –

including computers located outside the United States. 

5 “[...] no warrants shall issue, but upon probable cause [...] and particularly describing the place to be searched, 

and the persons or things to be seized.” Fourth Amendment to the United States Constitution. 

6 In Re Warrant to Search a Target Computer at Premises Unknown, F. Supp. 2d , 2013 WL 1729765 (S.D. Tex. 

Apr. 22, 2013). “The court concludes that the revised supporting affidavit does not satisfy the Fourth 

Amendment’s particularity requirement for the requested search warrant for the Target Computer.”
Center for Democracy & Technology 3

unknown, the search could easily affect multiple innocent parties.7 The court’s determination 

that the application was insufficient on Fourth Amendment grounds was wholly independent of 

the court’s consideration of whether the current text of Rule 41 allows for warrants that 

authorize searches of computers in unknown locations.

The proposed FRCrmP Rule 41 modification includes a note that states: “The amendment 

does not address constitutional questions, such as the specificity of description that the Fourth 

Amendment may require in a warrant for remotely searching electronic storage media [...]

leaving application of this and other constitutional standards to ongoing case law 

development.”8 While we appreciate the fact that the Committee does not seek to address 

such questions in this rulemaking, the proposed modification to Rule 41 nonetheless does 

have direct bearing on these very questions since it specifically contemplates the issuance of 

warrants for computers in concealed locations.

B. The proposed Rule 41 amendment would authorize extraterritorial 

searches that circumvent the MLAT process and may violate 

international law.

If the physical location of a computer is concealed through technological means, the computer 

is potentially anywhere in the world. In commentary, the Department of Justice states that the 

proposed amendment does not purport to authorize courts to issue warrants that authorize the

search of electronic media located in foreign countries.9 However, given the global nature of 

both the Internet and anonymizing tools,

10 in practice the warrants will very likely be used to 

authorize searches of electronic media located outside the United States.

If the computer from which data is searched or copied is located abroad, then the search takes 

place abroad. Several cases hold that a seizure occurs when and where data is copied, even if 

the warrant to remotely search electronic media is issued in the United States, or if the agent 

reviewing data extracted remotely from electronic media is located in the United States. The 

Second Circuit, for example, held that the act of copying electronic data constitutes a seizure, 

even before an agent searches through the extracted data.11 Other courts have held that a 

search or seizure of data occurs where the electronic storage media is located.12

 

7 Id. “The Government’s application offers nothing but indirect and conclusory assurance that its search technique 

will avoid infecting innocent computers or devices[...] What if the Target Computer is located in a public library, an 

Internet café, or a workplace accessible to others? What if the computer is used by family or friends uninvolved in 

the illegal scheme?”

8 Supra, fn 1, at pg. 341.

9 Letter from Mythili Raman, U.S. Department of Justice, to Reena Raggi, Advisory Committee on the Criminal 

Rules, Sept. 18, 2013. Available at 

http://www.uscourts.gov/uscourts/RulesAndPolicies/rules/Agenda%20Books/Criminal/CR2014-04.pdf (pg. 174).

10 As an example, more than 85% of the users of Tor – a popular service that conceals computer location – are 

located outside the United States. Tor, Tor Metrics: Users, Top-10 countries by directly connecting users, 

https://metrics.torproject.org/users.html (last accessed Oct. 22, 2014).

11 U.S. v. Ganias, 12-240-CR, 2014 WL 2722618 (2d Cir. June 17, 2014). See also U.S. v. Comprehensive Drug 

Testing, Inc., 621 F.3d 1162, 1177 (9th Cir. 2010).

12 U.S. v. Gorskhov, No. CR00-550C, 2001 WL 1024026 (W.D. Wash. May 23, 2001).
Center for Democracy & Technology 4

Extraterritorial searches today typically take place in coordination with foreign governments 

under the Mutual Legal Assistance Treaty (MLAT) process.13 The issue of whether U.S. 

magistrates may circumvent MLATs and issue warrants to search data stored abroad is still 

under litigation.14 Yet the proposed amendment could be interpreted to authorize U.S. law 

enforcement to unilaterally search media located abroad, so long as the location is unknown at 

the time of the search. In practice, this will likely result in U.S. law enforcement agencies 

circumventing the MLAT process far more often than in present circumstances. 

Unilateral extraterritorial searches may violate the international obligations of the United 

States. Established and binding customary international law provides that a state (i.e., a 

nation) may not exercise its power in any form in the territory of another state without that 

state’s consent. As a corollary of this rule, U.S. law enforcement officers may only exercise 

their functions in the territory of another state with the consent of the other state, given by duly 

authorized officials of that state, and in compliance with the laws of both the United States and 

the other state.15 The Restatement (Third) of the Foreign Relations Law of the United States 

describes this stricture as “universally recognized.”16 The proposed changes to FRCrmP 

Rule 41 could put U.S. law enforcement agencies at risk of violating this binding rule of 

sovereignty, as well as the principle of comity, when they unilaterally conduct searches of 

electronic media outside U.S. territory. Computer users abroad would have little or no remedy 

for an improper search by the U.S. government, including if that search or seizure damages 

the user’s computer. 

C. The proposed Rule 41 amendment would make changes through 

judicial rulemaking that have thus far occurred through legislation.

The proposed amendment to FRCrmP Rule 41 would authorize magistrates to issue warrants 

to search property that is located outside of their districts both when the warrant is issued and

when the search occurs. Currently, Rule 41 grants magistrates limited authority to issue 

warrants to search property outside their districts. Only under subsections (b)(3) and (b)(5) of 

the Rule do magistrates have authority to issue warrants for property that is not located in the 

district both at the time when the warrant is issued and when the search is performed.17 In 

comments, the Department of Justice has analogized the language of the proposed 

amendment to Rule 41 to the current language in subsections (b)(3) and (b)(5) of Rule 41.18

 

13 MLATs and Mutual Legal Assistance Agreements (MLAA) allow for the exchange of evidence in criminal 

matters between nations party to the treaty or agreement. The United States has an MLAT or MLAA in place with 

a large number of foreign nations. See 2012 International Narcotics Control Strategy Report: Treaties and 

Agreements, Dept. of State, Mar. 7, 2012, available at http://www.state.gov/j/inl/rls/nrcrpt/2012/vol2/184110.htm.

14 See, e.g., Stipulation Regarding Contempt Order, In the Matter of a Warrant to Search a Certain E-Mail 

Account Controlled and Maintained by Microsoft Corporation, Case Nos. 13-MAG-2814, M9-150, S.D.N.Y. (Sep. 

2014), available at http://media.scmagazine.com/documents/91/microsoft_contempt_filing_22623.pdf.

15 Restatement (Third) of the Foreign Relations Law of the United States, §§ 432(2), 433.

16 Ibid. at § 432, comment (b).

17 Rule 41(b)(1)-(5), Search and Seizure, Federal Rules of Criminal Procedure.

18 Supra, fn 9.
Center for Democracy & Technology 5

However, both (b)(3) and (b)(5) have legislative roots not present in the newly proposed 

amendment to Rule 41.

Subsection (b)(3) of Rule 41 allows magistrates in any district in which terrorism-related 

activities have occurred to issue warrants for a person or property outside the district during 

investigations of domestic or international terrorism. This subsection was a Congressional 

amendment to Rule 41 as part of the USA PATRIOT Act of 2001.

19

Subsection (b)(5) of Rule 41 was adopted in 2008 by the Judicial Conference as a rulemaking 

to allow magistrates to issue warrants for searches in areas under U.S. jurisdiction but outside 

of federal judicial districts, such as U.S. diplomatic or consular missions, located in foreign 

nations. However, U.S. jurisdiction in the areas listed in subsection (b)(5) was authorized by 

Congress. The Committee Notes to subsection (b)(5) state: “The rule is intended to authorize a 

magistrate judge to issue a search warrant in any of the locations for which 18 U.S.C. §7(9) 

provides jurisdiction.”

20 Accordingly, the language of subsection (b)(5) mirrors that of 18 U.S.C. 

§7(9), which was first codified through the USA PATRIOT Act of 2001.

21

The Electronic Communications Privacy Act (ECPA) authorizes multi-district searches of 

computers.

22 However, this too was an explicit grant of authority from Congress, not an 

instance of judicial rulemaking. 

The proposed changes to FRCrmP Rule 41 are not a Congressional amendment, nor do they 

implement a direct expansion of extraterritorial jurisdiction codified in statute. Congress has not 

authorized extraterritorial or multi-district searches for computers with concealed locations or 

during investigations under 18 U.S.C. 1030(a)(5), as the proposed modification to Rule 41 

contemplates. The proposed modification attempts to expand magistrates’ Rule 41 authority in 

a manner that has historically been accomplished by Congressional action. The proposed 

modification should be handled through Congress rather than judicial rulemaking.

D. The proposed Rule 41 amendment raises new risks of forum 

shopping.

Authorizing the government to obtain a warrant from any district to search or seize multiple 

computers located in any district raises a significant risk of forum shopping. The proposed 

change to Rule 41 would incentivize agents to seek out and reuse districts that were more 

inclined to approve warrant applications. In practice, this may frequently result in warrants 

issued in districts remote from the individual whose electronic media is searched or seized, 

making it prohibitively inconvenient or expensive for the individual to appear in the district to 

exercise her right to contest the warrant.

 

19 Sec. 219, Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and 

Obstruct Terrorism (USA PATRIOT) Act of 2001, Pub. Law 107-56, 107th Cong.

20 Title 18, U.S. Code, Appendix, Federal Rules of Criminal Procedure, Title VIII, Rule 41, Committee Notes.

21 Id., fn 19, Sec. 804.

22 18 U.S.C. 2703(a), as modified by Sec. 220 of the USA PATRIOT Act of 2001.
Center for Democracy & Technology 6

III. Technological Implications

The proposed modification to Rule 41 would enable the U.S. government to gain authorization 

from any district in the United States to spread invasive malware – code that may penetrate, 

search, and copy electronic media without user authorization – to potentially any computer 

worldwide. This is essentially allows law enforcement to hack computers with few restrictions 

on where an intrusion can take place and how many devices to which they may gain entry. It is 

tailored poorly and can reach practically any computing device while it also implicates many 

types of common and lawful methods of using the Internet. Finally, the act of intrusion into 

these devices may substantially damage the devices, the data resident on them, or the 

functions the devices mediate.

A. “Concealed through technological means” is overly broad.

The trigger language in the proposed amendment that the location of a target device be 

“concealed through technological means” before a warrant can be issued is overly broad, 

encompassing legitimate Internet use globally, not just within the United States, on devices for 

which the primary function is unknown to the government.

The Internet and software that interacts with it – email clients, web browsers, apps, etc. – have 

developed many ways to conceal a user’s location, either intentionally to protect privacy but 

often as a side effect of accomplishing another goal, such as confidentiality. The intent of this 

part of the rule amendment seems to be to allow agents of law enforcement to de-anonymize 

users of online anonymity tools, such as the Tor network. However, there is a much larger 

ecosystem of similar technologies that encompass technical methods that effectively re-route 

traffic over the Internet. Close to half of all U.S. businesses use Virtual Private Network (VPN) 

technologies or other forms of secure proxies.23 VPNs and secure proxies seek to ensure that 

a user can interact with sensitive data – e.g., trade secrets, medical data, financial data – even 

when they are forced to use potentially hostile local networking environments, such as the 

unencrypted free wireless Internet access offered at hotels, airports, and coffee shops. These 

technologies establish an fully encrypted secure connection with a trusted server on the 

Internet, and that trusted server “proxies” their network activity – meaning it appears as if all 

network traffic comes from the proxy server instead of the user’s real network location.

There exist additionally a set of techniques that are designed to misreport identifiers that may 

associate a user’s identity with their activity online. For example, to protect the privacy of the 

hundreds of millions of users of Apple’s iOS mobile operating system from forms of in-store 

retail tracking that can follow shoppers from store to store, Apple has begun randomizing a 

common network identifier – the MAC address.

24 This will have the effect of “concealing 

through technical means” the network location of a device. Finally, the proposed amendment 

 

23 42% of U.S. business respondents across company size segments use VPNs. See, Nav Chander, “Choosing 

the Best Enterprise IP VPN or Ethernet Communication Solution for Business Collaboration,” International Data

Corporation (whitepaper produced for AT&T, Inc.), (June 2014), available at: 

http://www.business.att.com/content/whitepaper/vpn_ethernet.pdf (pg. 2).

24 Lee Hutchinson, “iOS 8 stymie trackers and marketers through MAC address randomization,” Ars Technica

(June 9, 2014), available at: http://arstechnica.com/apple/2014/06/ios8-to-stymie-trackers-and-marketers-withmac-address-randomization/ (last accessed October 23, 2014).
Center for Democracy & Technology 7

seems to reach somewhat trivial forms of location obfuscation that are not technically technical

but could be construed as such. For example, if a user of a social network service such as 

Facebook misreports the city in which they live, or if a user of a web browser modifies how the 

browser reports their native language, these seem to qualify as “concealing through technical 

means” the user’s location. Legitimate uses of technology that have the effect of “concealing 

through technological means” a user’s location, e.g., using a VPN or Apple’s iOS mobile 

operating system, should not trigger the ability for a judge to issue a Rule 41 warrant.

The pervasive nature of technical means that have the purpose or effect of concealing the 

user’s location is indicative that concealment does not necessarily indicate a crime. In fact, the 

core technology this rule amendment seeks to reach, the Tor network and Tor Broswer 

software, was developed primarily for two purposes that are fundamentally legitimate: the need 

of law enforcement as well as military and civilian intelligence agencies to access information 

services in hostile environments and the need of dissidents in repressive regimes to 

communicate with the larger, outside world.

25 Additionally, users that may be concerned about 

their privacy or security given threats online or to their person also use proxy technologies that 

securely obfuscate their location; this can encompass stalking victims and public servants that 

face threats of physical harm. Employees of businesses that deal in sensitive data such as 

finance or medicine may be required to use these kinds of technologies within the scope of 

their employment; for example, some businesses require their employees to route all traffic 

through a proxy that can detect viruses or malware, examine traffic for attempts to exfiltrate 

valuable intellectual property, or even a “caching proxy” that seeks to ease the load on a 

network by storing commonly retrieved resources such as images, videos, or other large files. 

Finally, we cannot rule out the possibility that an attempt to conceal location could actually be a 

simple misconfiguration or other error such that details like a computer’s Internet Protocol (IP) 

address may be misreported.

Of course, technically, a device that uses any of the techniques mentioned above can be 

anywhere in the world, and the context of the device’s true function (or contents) will in general 

be uncertain. As we outline above in Section II.B, this legally extends U.S. law enforcement 

jurisdiction globally. To the extent U.S. law enforcement uses this rule to hack into devices 

around the world, we should not be surprised when law enforcement entities from other nations 

conclude they should have this ability as well. Outside the question of the compatibility of legal 

regimes that are best dealt with in formal MLAT processes, there are serious questions about 

the uncertain functional context of a target device. That is, if the location of a device is 

unknown, concealed, or uncertain, we should expect that the purpose of the device will also be 

equally if not more uncertain. Law enforcement will have little data from which to ascertain how 

careful they need be while executing the search and seizure, lest they irreversibly damage the 

device, connected devices, or critical functionality the device may mediate. Unlike in the 

physical world, where the implications of an intrusion into a premises are relatively certain and 

easy to understand, the consequences in cyberspace can be very difficult to estimate. By way 

of analogy, in the physical world, agents of law enforcement can be reasonably confident that 

breaking and entering into premises won’t cause the entire building to fall down. Similarly, they 

can also be reasonably confident that such an intrusion won’t also cause the collapse of a 

 

25 See, e.g., “Who uses Tor?” available at: https://www.torproject.org/about/torusers.html.en.
Center for Democracy & Technology 8

series of nearby buildings or, for that matter, that a building they thought was a typical family 

home isn’t actually the control system for a nuclear power plant. In cyberspace we cannot be 

so confident.

B. “Damaged” computers, under 18 U.S.C. 1030(a)(5), covers a very 

large quantity of machines.

The proposed changes to Rule 41 would allow the government to obtain a warrant in any 

district to remotely search five or more “damaged” computers during investigations of 18 

U.S.C. 1030(a)(5). The justification for this proposal has been discussed in context of law 

enforcement action against botnets – networks of private computers infected with malware that 

enables an unauthorized party to use or control all or parts of the infected computers 

remotely.

26 As the FBI notes, millions of infected computers can be part of a botnet.27

However, 18 U.S.C. 1030(a)(5) does not only encompass botnets. 

18 U.S.C. 1030(a)(5) prohibits causing “damage” to protected computers intentionally without 

authorization or recklessly. “Damage” is defined broadly under the statute to include any 

malware, virus, Trojan, or even benign code that impairs “the integrity or availability of data.”28

While botnets may involve using infected computers to commit additional crimes (such as 

distributed denial-of-service attacks), computers infected with viruses are not necessarily 

committing any subsequent crime – though the act of damaging the computer by infecting it 

with a virus is a crime under 1030(a)(5).

Because the proposed modification to Rule 41 would apply to investigations into any violation 

of 1030(a)(5), not just botnets, the proposed modification would enable the government to 

more easily remotely search computers infected with any virus or other damaging code. 

Approximately 30 percent of all computers worldwide, as well as in the United States, are 

estimated to be infected with some type of malware.

29 The number of computers that may 

therefore be subject to multidistrict searches under the proposed Rule 41 amendment is 

massive.

C. Data stored on devices is increasingly sensitive and intrusion may 

damage the device, its data, and/or dependent systems.

The language of the proposed amendment that allows law enforcement to “use remote access 

to search electronic storage media to seize or copy electronically stored information” will allow 

access to data of an exceedingly sensitive nature in many cases.

While the particularity of a warrant under the 4th Amendment requires the government to 

specify exactly the materials they seek to search for and seize, the proposed amendment 

would grant access to a panoply of sensors on modern computing platforms. Desktop 

 

26 Supra, fn 9, pg. 172. 

27 Botnets 101, Federal Bureau of Investigation, Jun. 5, 2013, available at 

http://www.fbi.gov/news/news_blog/botnets-101/botnets-101-what-they-are-and-how-to-avoid-them.

28 18 U.S.C. 1030(e)(8).

29 Panda Security, Annual Report PandaLabs, 2013 Summary, pg. 5, available at press.pandasecurity.com/wpcontent/uploads/2010/05/Annual-Report-PandaLabs-2013.pdf.
Center for Democracy & Technology 9

computers, laptop computers, tablet computers and mobile computing devices contain an 

increasing array of sensors capable of reading current environmental and personal data – for 

example, microphones, cameras, motion sensors, and more complex accessories such as 

fitness tracking devices that measure fine-grained body data. Using these sensors, these 

devices store a multitude of sensitive data over time – personal photographs and videos,

financial data, medical records, educational materials. As the Supreme Court recognized 

recently, networked devices like smartphones increasingly hold “a digital record of nearly every 

aspect of [our] lives – from the mundane to the intimate.”

30 As mentioned above, the target 

device can be potentially any device attached to the Internet from personal computing devices 

to industrial control systems to Internet voting systems. Allowing law enforcement a broad 

remit to remotely access such sensitive information systems will have grave consquences for 

personal privacy and liberty, as well as the integrity of critical systems.

The acts of intrusion onto a device and/or seizing data may result in impairment of the device

or data resident on the device. Intrusion methods necessarily exploit weakness in the defenses 

of a device to gain access. Practically speaking, “network investigative techniques” employ 

flaws or bugs in software like web browsers such that law enforcement can gain access to the 

larger system. Vulnerabilities or flaws in a system are by definition features the designers of 

the system did not plan the system’s functionality to take into account. “Network investigative 

techniques” used by law enforcement can vary from relatively simple Computer and Protocol 

Address Verifier (CIPAV) tools that seek to assess and report network identifiers and 

information back to law enforcement agents to deeper forms of persistent access where 

invasive methods like rootkits – i.e., programs designed to completely evade system defenses 

and be highly resistant to removal – which can potentially permanently damage a device.

Further, it is unclear from the text of the proposed amendment and relevant jurisprudence if the 

extent of “seizing” data does not merely copy the data but may also render it unusable by the 

user. If seizing and copying are distinct in this manner, a seizure of data could potentially 

deprive the user of critical data or system functionality without due process before a finding of 

guilt has been made.

The act of intrusion and installing a “network investigative technique” can not only harm the 

device but also potentially result in further follow-on damage due to vulnerabilities introduced 

into the system or exacerbated by the technical act of gaining entry. To the extent the intrusion 

technique causes damage or triggers malware that causes ancillary damage, the device itself 

may be no longer functional, along with any data it holds and any actions in the real world it 

performs. There are examples of adversarial network investigation that resulted in taking an 

entire country off the Internet31 as well as buggy law enforcement intrusion code that left 

targeted devices seriously vulnerable to subsequent malicious attacks.

32

 

30 Riley v. California, 573 U. S. ____ (2014) at 19.

31 Spencer Ackerman, “Snowden: NSA accidentally caused Syria's Internet blackout in 2012,” The Guardian

(August 13, 2014), available at: http://www.theguardian.com/world/2014/aug/13/snowden-nsa-syria-internetoutage-civil-war (last accessed October 23, 2014).

32 Chaos Computer Club, “Chaos Computer Club analyzes government malware,” (October 8, 2011), available at: 

https://www.ccc.de/en/updates/2011/staatstrojaner (last accessed October 23, 2014).
Center for Democracy & Technology 10

D. Concealment of the location of “information” can potentially reach 

even more devices.

The proposed amendment does not just trigger on concealing the location of a device with 

technical means but also concealment of the location of information. Similarly to the discussion 

above in Section III.A of the variety of activities that by their nature obscure the location of a 

device, there are a number of modern computing techniques that obscure the location of 

information, mostly for efficiency gains related to data mining and analysis.

For example, rather than keeping very large databases of information in a single location, 

many modern computing techniques rely on a technique called “sharding,” or the process of 

breaking up individual pieces of a database and redistributing them across disparate 

computing facilities. If a target machine has information sharded across tens or hundreds of 

additional machines, the proposed amendment would appear to reach all of those devices as 

well. There are more exotic types of data structures – for example, hash tables and bloom 

filters – that do similar things from the perspective of technically concealing the location of 

information; some of these techniques are very difficult – by design – to map onto a physical 

location or the specific device on which the data may be stored.

IV. Practical implications

In addition to the legal and technical implications, we are concerned that a slew of negative 

practical implications may be relevant once law enforcement gains the abilities contemplated 

by the proposed rule. 

First, the rule essentially eliminates existing practical limits on law enforcement search and 

seizure in networked computing. The Department of Justice indicated that under the current 

Rule 41, agents seeking authority to search computers in multiple districts must obtain 

warrants with magistrates in every district in which the computers are known to be located 

(except in cases of domestic or international terrorism).33 As a practical matter, agents

currently must be judicious in deciding which computers to remotely search. However, if the 

requirement to obtain warrants from each district in which the property is known to be located 

were removed, the likely effect would be for far more remote searches of far more machines. 

As we argue above, the number of computers for which location is concealed, or which are 

“damaged” may well run to many millions. The potential for abuse or overzealous and sloppy 

law enforcement hacking is very real.

Further, there are follow-on implications from this collapsing of practical limitations. Authorizing 

law enforcement to operate in this manner may lead to more intrusive methods being brought 

to bear. If malware that reveals computer location is easily bypassed or rendered ineffective, 

law enforcement may have to use more powerful techniques that are more likely to threaten 

the integrity of the target device or information. For example, a simple web beacon that can 

report a device’s IP address back to law enforcement can be blocked by common software 

(e.g., Little Snitch) that prohibits network requests to unknown addresses. The government 

 

33 Supra, fn 9, pg. 173.
Center for Democracy & Technology 11

may then attempt more intrusive – necessarily less reasonable – searches of the contents of 

media to gather clues regarding location. 

Finally, the proposed rule amendment and the law enforcement hacking that may result has 

the potential to spark a deadly arms race. Malicious hackers may begin to purposefully stage 

attacks from computers running critical infrastructure and applications. If an intrusion renders 

these devices inoperable – either by design or accident – the implications for just one such 

incident could be profound for society. We may very well see staging of malware on critical 

infrastructure coupled with “trip wires” that are armed to cause damage and havoc when an 

attempted intrusion is detected.

V. This is an issue for Congress

Law enforcement clearly faces challenges in remotely searching electronic media in concealed 

locations. However, the proposed rule has important technical, legal, and practical implications 

that necessitate the deliberation of Congress. We recommend that the Judicial Conference 

reject the proposed changes to Rule 41 and instead urge Congress to address the issue of 

remote searches of electronic media located in multiple districts or in unknown locations. 

END
TAB 4
Testimony and Statement for the Record of

Alan Butler

Senior Counsel

Electronic Privacy Information Center

on

Proposed Amendments to Rule 41 

of the Federal Rules of Criminal Procedure

before the

Judicial Conference Advisory Committee on Criminal Rules

November 5, 2014
EPIC Testimony November 5, 2014

Proposed Amendments to Fed R. Crim. P. 41 Advisory Committee on Criminal Rules

2

Judge Raggi, Members of the Advisory Committee on the Federal Rules of Criminal 

Procedure, thank you for the opportunity to participate in today’s hearing on the proposed 

amendments. My name is Alan Butler and I am Senior Counsel at the Electronic Privacy 

Information Center (“EPIC”).

EPIC is a non-partisan research organization in Washington, D.C., established in 1994 to 

focus public attention on emerging privacy and civil liberties issues.1 We work with a 

distinguished panel of advisors in the fields of law, technology, and public policy.2 EPIC has 

previously filed amicus briefs in cases concerning the core procedural protections granted under 

the Fourth Amendment: notice and the opportunity to challenge the scope of a government 

search. For example, in 2002 EPIC filed a brief in United States v. Bach, arguing that the Fourth 

Amendment requires officer presence during the execution of a warrant and that it was therefore 

unlawful to serve a warrant on an Internet Service Provider via facsimile.3

EPIC has a particular interest in ensuring that Fourth Amendment privacy rights are not 

eroded by the use of emerging surveillance technologies. As Justice O’Connor famously 

addressed in Arizona v. Evans, “[w]ith the benefits of more efficient law enforcement 

mechanisms comes the burden of corresponding constitutional responsibilities.”4 In an effort to 

maintain these constitutional responsibilities, EPIC routinely participates as amicus curiae in 

major Supreme Court cases addressing Fourth Amendment rights in the context of emerging 

technologies. 

For example, in 2011 EPIC, joined by thirty legal scholars and technical experts, filed a 

brief in United States v. Jones, arguing that the use of invasive GPS tracking systems is a search 

requiring a warrant under the Fourth Amendment.5 The Court ultimately found that the 

warrantless installation and use of a GPS device to track an individual over 30 days violated the 

Fourth Amendment.6 In 2012, EPIC, joined by thirty-two legal scholars and technical experts, as 

well as eight transparency organizations, filed a brief in Clapper v. Amnesty International, USA, 

arguing that the NSA’s Signals Intelligence capabilities have expanded to the point where it 

would be reasonable for United States persons to assume that all of their communications sent 

abroad are being routinely collected.7

In 2013, EPIC, joined by twenty-four legal scholars and technical experts, filed a brief in 

Riley v. California, arguing that modern cell phones provide access to a wealth of sensitive 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1 About EPIC, EPIC, https://epic.org/epic/about.html.

2 EPIC Advisory Board, EPIC, http://epic.org/epic/advisory_board.html.

3 See Brief of Amicus Curiae EPIC in Support of Appellee, United States v. Bach, 310 F.3d 1063 (8th Cir. 

2002) (No. 02-1238).

4 514 U.S. 1, 17-18 (1995); see also EPIC, Sandra Day O’Connor’s Legacy, 

https://epic.org/privacy/justices/oconnor/.

5 See Brief of Amici Curiae EPIC and Legal Scholars and Technical Experts in Support of the 

Respondent, United States v. Jones, 132 S. Ct. 945 (2012) (No. 10-1259).

6 Jones, 132 S. Ct. at 949.

7 See Brief of Amici Curiae EPIC, Thirty-two Technical and Legal Scholars, and Eight Transparency 

Organizations in Support of Respondents, Clapper v. Amnesty Int’l, USA, 133 S. Ct. 1138 (2013) (No. 

11-1025).
EPIC Testimony November 5, 2014

Proposed Amendments to Fed R. Crim. P. 41 Advisory Committee on Criminal Rules

3

personal data and that phones should not be subject to warrantless searches incident to arrest.8 In 

Riley, the Court unanimously held that officers may not search the contents of a cell phone 

without a warrant, even where that phone is seized during a lawful arrest.9 The Court in Riley 

addressed the importance of the procedural protections established by the Fourth Amendment. 

Rejecting the government’s argument that law enforcement protocols would suffice to limit 

access to certain sensitive information, the Court emphasized that “the Founders did not fight a 

revolution to gain the right to government agency protocols.”10 The Court also found that cell 

phone searches could be particularly invasive because they would allow the inspection of 

remotely stored files.11

We appreciate the Committee’s important work in maintaining the Federal Rules of 

Criminal Procedure. In my statement today, I will: (1) describe the history of two key Fourth 

Amendment requirements relevant to Rule 41: notice and officer presence upon execution of a 

warrant; (2) discuss the history of and limitations on “covert entry” warrants; and (3) recommend 

that the proposed amendment not be adopted because it would authorize unreasonable law 

enforcement practices and inhibit the development of Fourth Amendment standards for remote 

access searches.

I. It is Well Established That Notice, Officer Presence, and Other Formalities Are Key 

to Fourth Amendment Reasonableness

The Fourth Amendment was adopted to ensure that there were procedural safeguards

against the arbitrary exercise of governmental authority, “securing to the American people, 

among other things, those safeguards which had grown up in England to protect the people from 

unreasonable searches and seizures . . . .”

12 The Supreme Court’s decision in Weeks v. United 

States heralded the dawning of the age of constitutional criminal procedure, in which the Court 

established the exclusionary rule, prohibiting introduction of evidence obtained in violation of 

the Fourth Amendment, and identified the core practices and formalities that now circumscribe 

lawful searches. The exclusionary rule was essential to the protection of Fourth Amendment 

rights because introduction of unlawfully obtained evidence at trial would “affirm by judicial 

decision a manifest neglect if not an open defiance of the prohibitions of the Constitution, 

intended for the protection of the people against such unauthorized action.”

13

The Court in Weeks recognized that prohibiting the government’s use of improperly 

obtained evidence was necessary to ensure that the formalities and procedural safeguards 

required by the Fourth Amendment were followed. “The effect of the 4th Amendment is to put 

the courts of the United States and Federal officials, in the exercise of their power and authority, 

under limitations and restraints as to the exercise of such power and authority. . . .”

14 Relaxing 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 8 See Brief of Amicus Curiae EPIC and Twenty-four Technical Experts and Legal Scholars in Support of 

Petitioner, Riley v. California, 134 S. Ct. 2473 (2014) (No. 13-132).

9 Riley, 134 S. Ct. at 2494.

10 Id. at 2491.

11 Id. (citing Brief for Electronic Privacy Information Center in No. 13-132, at 12-14, 20).

12 Weeks v. United States, 232 U.S. 383, 391 (1914).

13 Id. at 394.

14 Id. at 393.
EPIC Testimony November 5, 2014

Proposed Amendments to Fed R. Crim. P. 41 Advisory Committee on Criminal Rules

4

well-established procedures would lead to “gradual depreciation of the rights secured by [the 

Fourth Amendment] by imperceptible practice of courts or by well-intentioned but mistakenly 

over-zealous executive officers.”

15

Even where an officer conducts a search pursuant to an authorized warrant, the Fourth 

Amendment requires that certain procedural formalities be followed to protect against abuse. 

Since the 1700s, United States law has required an officer’s presence during the service of a 

search warrant.16 An officer’s presence discourages government abuse of power and unwarranted 

intrusion upon privacy by ensuring guarantees of trustworthiness and accountability. The 

Supreme Court has long recognized the importance of strict adherence to procedural safeguards 

in the execution of search warrants, because “[i]t may be that it is the obnoxious thing in its 

mildest and least repulsive form; but illegitimate and unconstitutional practices get their first 

footing . . . by silent approaches and slight deviations from legal modes of procedure.”

17

Therefore, “[i]t is the duty of the courts to be watchful for the constitutional rights of the citizen, 

and against any stealthy encroachment thereon.”

18

But officer presence alone is not sufficient to make the service of a warrant reasonable 

under the Fourth Amendment; the method of entry into the place to be searched is also an 

important consideration. As the Supreme Court stated, “we have little doubt that the Framers of 

the Fourth Amendment thought that the method of an officer’s entry into a dwelling was among 

the factors to be considered in assessing the reasonableness of a search or seizure.”

19 In fact, the 

Court has held that notice provided in advance of a search is an important element of Fourth 

Amendment reasonableness.

In Wilson v. Arkansas, the Court found that advanced notice was a clearly established 

requirement of a reasonable search based on the common law history and practice.

20 The Court

also found that its own cases supported the principle of prior notice as being “embedded in 

Anglo-American law.”

21 The Court unanimously held that the “common-law ‘knock and 

announce’ principle forms a part of the reasonableness inquiry under the Fourth Amendment,”

specifically stating that “an officer’s unannounced entry into a home might be unreasonable 

under the Fourth Amendment.”

22

Notice, officer presence, and other formalities are necessary to guarantee accountability 

and trustworthiness in the exercise of police power. As the Supreme Court has emphasized, 

“[t]he value judgment that [has historically] motivated a united democratic people fighting to 

defend those very freedoms from totalitarian attack is unchanged.”23 Procedural formalities are 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 15 Gouled v. United States, 255 U.S. 298, 304 (1921).

16 See Boyd v. United States, 116 U.S. 616, 624 (1886) (detailing the history of search and seizure law 

and procedure).

17 Boyd, 116 U.S. at 633. (emphasis added).

18 Id.

19 Wilson v. Arkansas, 514 U.S. 927, 934 (1995).

20 Id. at 931.

21 Id. at 934 (quoting Miller v. U.S. 357 U.S. 301, 313 (1958)).

22 Id. at 929, 934.

23 Watchtower Bible & Tract Soc’y of N.Y., Inc. v. Vill. of Stratton, 122 S. Ct. 2080, 2091 (2002).
EPIC Testimony November 5, 2014

Proposed Amendments to Fed R. Crim. P. 41 Advisory Committee on Criminal Rules

5

critical in preserving our privacy in order to maintain cherished values of humanity and civil 

liberty. In McVeigh v. Cohen, which addressed unauthorized access to electronic 

communications, the court stated:

In these days of “big brother,” where through technology and 

otherwise the privacy interests of individuals from all walks of life 

are being ignored or marginalized, it is imperative that statutes 

explicitly protecting these rights be strictly observed.24

Fundamental principles “established by years of endeavor and suffering” cannot be 

sacrificed to the needs or convenience of law enforcement.”

25 Notice and officer presence are 

key elements of reasonableness under the Fourth Amendment and courts should only allow 

deviation from these requirements with caution and under very strict and limited conditions.

II. Courts Have Only Allowed Delayed Notice and Permitted Covert Entry Warrants

in Limited Circumstances

In certain limited circumstances, courts have held that law enforcement officers may 

execute search warrants through covert means and without prior notice to the subject.26 The 

authority to conduct “surreptitious searches and seizures”27 has been limited to cases where (1) 

delayed notice and covert entry is necessary, and (2) notice will be provided within a reasonable 

time after the search.28 This is consistent with the Supreme Court’s holding that notice is an 

element of Fourth Amendment reasonableness.

29

The judicial authorization of surreptitious searches, initiated without prior notice to or 

confrontation of the subject, is a relatively new development in the history of Fourth Amendment 

law. Covert entry warrants were not contemplated during the founding era, and no published 

opinions in the United States addressed them until 1985. In United States v. Frietas, the Ninth 

Circuit found the Fourth Amendment requires that “surreptitious entries be closely 

circumscribed.”30 Drawing on the limitations on wiretapping outlined in Title III of the Omnibus 

Crime Control and Safe Streets Act of 1968, 18 U.S.C. §§ 2510-2520, the court in Frietas found 

that both “the necessity for the surreptitious seizure and the subsequent notice” were an 

important element of the Fourth Amendment reasonableness analysis.31

The Ninth Circuit in Frietas noted that the Fourth Amendment does not prohibit all 

surreptitious entries, as the Supreme Court’s held in Dalia v. United States,

32 but that “absence of 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 24 983 F. Supp. 215, 220 (D.D.C. 1998).

25 Weeks, 232 U.S. at 393.

26 See Jonathan Witmer-Rich, The Rapid Rise of Delayed Notice Searches, and the Fourth Amendment 

“Rule Requiring Notice,” 41 Pepp. L. Rev. 509, 519-25 (2014).

27 Also referred to as “sneak and peek” or “sneak and steal” warrants.

28 See United States v. Villegas, 899 F.2d 1324, 1337 (2d Cir. 1990).

29 Wilson v. Arkansas, 514 U.S. 927, 929 (1995).

30 United States v. Frietas, 800 F.2d 1451, 1456 (9th Cir. 1985).

31 Id. 32 441 U.S. 238 (1979). 
EPIC Testimony November 5, 2014

Proposed Amendments to Fed R. Crim. P. 41 Advisory Committee on Criminal Rules

6

any notice requirement in the warrant casts strong doubt on its constitutional adequacy.”33 The 

Court in Dalia rejected a defendant’s argument that officers’ covert entry into his office to install 

“bugging equipment” violated the Fourth Amendment.34 The Court found that “[t]he Fourth 

Amendment does not prohibit per se a covert entry performed for the purpose of installing 

otherwise legal electronic bugging equipment.”35 However, in its finding that the surreptitious 

entry was constitutional, the Court relied upon the lower court finding that the “safest and most 

successful method of accomplishing the installation of the wiretapping device was through 

breaking and entering [the office].”36 The Court also found that delayed notice equivalent to that 

provided under Title III would be a “constitutionally adequate substitute for advance notice” in 

the case of a covert entry warrant.37

The U.S. Court of Appeals for the Second Circuit later addressed the validity of 

surreptitious search warrants in a series of cases beginning in 1990. In United States v. Villegas, 

the Second Circuit considered a defendant’s challenge to a surreptitious search of his farmhouse, 

executed pursuant to a warrant but without notice until his arrest two months later.38 The court 

found that “certain safeguards are required where the entry is to be covert,” but concluded 

“appropriate conditions were imposed” in that case.39 Specifically, the court found that “two 

limitations on the issuance of warrants for covert-entry searches for intangibles are 

appropriate.”40 The first requirement is that officers show a “reasonable necessity” for not 

providing advance notice of the search.41 The second requirement is that delayed notice must be 

given “within a reasonable time after the covert entry.”42 The court agreed with the Ninth 

Circuit’s finding in Frietas that “as an initial matter, the issuing court should not authorize a 

notice delay of longer than seven days,” but may grant extensions thereafter based on a “fresh 

showing of the need for further delay.”43 Subsequent lower court decisions, addressing covert 

entry warrants, have failed to recognize that notice is an important element of Fourth 

Amendment reasonableness, as the Supreme Court found in Wilson v. Arkansas.

44

Congress later authorized the issuance of delayed notice warrants in Section 213 of the 

USA PATRIOT Act, but only in certain circumstances.45 The law includes three express 

limitations on the issuance of delayed notice warrants, similar to those imposed by the Ninth 

Circuit in Freitas and the Second Circuit in Villegas: first, the issuing court must find 

“reasonable cause to believe that providing immediate notification of the execution of the 

warrant may have an adverse result,” second, the warrant must prohibit the seizure of tangible 

property and electronic files, “except where the court finds reasonable necessity for the seizure,” 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 33 Frietas, 800 F.2d 1456.

34 Dalia, 441 U.S. at 241-42.

35 Id. at 248.

36 Id. at 248 n.8.

37 Id. at 248.

38 899 F.2d 1324, 1336 (2d Cir. 1990).

39 Id. 40 Id. at 1337.

41 Id. 42 Id. 43 Id. 44 See Witmer-Rich, supra, at 524 n.86.

45 18 U.S.C. § 3103a.
EPIC Testimony November 5, 2014

Proposed Amendments to Fed R. Crim. P. 41 Advisory Committee on Criminal Rules

7

and finally, the warrant must provide for notice within a “reasonable period not to exceed 30 

days.”46 Prior to the enactment of the Patriot Act, some courts had held that the failure to provide 

notice is not per se unconstitutional,47 but these decisions do not fully address the fact that notice 

is a core element of Fourth Amendment reasonableness, as the Court found in Wilson.

Existing precedents do not support the conclusion that surreptitious warrants may be 

issued without first establishing that delayed notice is necessary and providing for future notice 

within a reasonable period of time.

III. The Proposed Amendment to Rule 41 Would Depart from Established Precedent 

and Inhibit the Future Fourth Amendment Development

Because it would authorize the issuance of digital surreptitious search warrants without 

requiring a showing that such methods are necessary or that notice be given within a reasonable 

amount of time after the search, the proposed amendment to Rule 41 would be inconsistent with 

well-established Fourth Amendment precedents.

The rule would grant magistrates the authority to “issue a warrant to use remote access to 

search electronic storage media and to seize or copy electronically stored information” if either 

(1) “the district where the media or information is located has been concealed through 

technological means” or (2) “in an investigation of a violation of 18 U.S.C. § f1030(a)(5), the 

media are protected computers that have been damaged without authorization and are located in 

five or more districts.”

An officer applying for a remote access warrant under the proposed revision of Rule 41 

would not have to make any showing that the delay in notifying the target of the search is

reasonably “necessary” for the investigation. Rather, the Rule would authorize issuance of a 

surreptitious search warrant in any case where the target of the search has used an online proxy 

tool. There may be some cases where a court would find it is reasonably necessary to use remote 

access tools, but that will not be the case in every instance where the target is using a proxy 

service. Without a requirement that the requesting officer establish necessity as required for all 

other covert search warrants, the proposed rule will be overbroad.

Furthermore, the proposed amendment to Rule 41(f)(1) would not require an officer to 

provide notice within a reasonable time. Instead, the rule would require that the officer “make 

reasonable efforts” to serve a copy of the warrant. That is certainly necessary, but it is not 

sufficient, as the Court established in Wilson and circuit courts recognized in Frietas and 

Villegas. Even the delayed notice provision in the Patriot Act, which has been widely criticized 

for being overbroad, provides for notice within a “reasonable period not to exceed 30 days,” with 

a requirement that any further extensions be independently justified. 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 46 18 U.S.C. § 3103a(b).

47 See, e.g., United States v. Simons, 206 F.3d 392, 402-03 (4th Cir. 2000); United States v. Pangburn, 

983 F.2d 440, 455 (2d Cir. 1993).
EPIC Testimony November 5, 2014

Proposed Amendments to Fed R. Crim. P. 41 Advisory Committee on Criminal Rules

8

As drafted, the amended Rule 41 would authorize the issuance of overly broad covert 

search warrants and would not require sufficiently prompt notice to satisfy Fourth Amendment 

scrutiny.48

The proposed amendments to Rule 41 would not only be constitutionally defective, they 

would also inhibit development of Fourth Amendment law in the area of remote electronic 

searches. Fourth Amendment law develops primarily through suppression motions filed by 

defendants in response to the use of new law enforcement techniques.49 However, this process 

breaks down where the exclusionary rule is not available as a remedy to the defendants who 

might seek to challenge a new investigative technique.50 The exclusionary rule is not an available 

remedy when the officer relied in good faith upon a warrant issued by a magistrate, even when

that warrant is later deemed invalid.51

It would therefore be improper to grant new warrant authority by amending Rule 41 

without first establishing that proposed rule is consistent with the Fourth Amendment. Future 

defendants who are subject to a search authorized under the amended rule would have no 

available remedy, and therefore no incentive to challenge potentially unconstitutional intrusions 

into their computer networks. In that case, the amendment itself would resolve the constitutional 

question before it is properly presented in an individual case.

Conclusion

The proposed amendments to Rule 41 would authorize searches beyond the scope 

permissible under the Fourth Amendment. Specifically, the rule would allow for surreptitious 

searches without the required showing of necessity, and the resulting warrants would not include 

the requirement that notice be served within a reasonable time after the search. For these reasons, 

the Committee should not adopt the proposed amendments as drafted.

Thank you for the opportunity to participate in today’s hearing. I will be pleased to 

answer your questions.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 48 For example, the Seattle Times recently reported that the FBI used a link to a fake version of the 

newspaper’s webiste to remotely install surveillance software on a suspect’s computer. Mike Carter, FBI 

Created Fake Seattle Times Web Page to Nab Bomb-threat Suspect, (Oct. 27, 2014), 

http://seattletimes.com/html/localnews/2024888170_fbinewspaper1xml.html. The FBI special agent in 

charge was quoted as saying the FBI only uses remote access techniques “when there is sufficient reason 

to believe it could be successful in resolving a threat.” Id. 49 Orin Kerr, Good Faith, New Law, and the Scope of the Exclusionary Rule, 99 Geo. L. J. 1077, 1090 

(2011).

50 Id. at 1092-95.

51 See United States v. Leon, 468 U.S. 897, 925 (1984).
TAB 5
1

Testimony of Amie Stepanovich

Senior Policy Counsel, Access

on behalf of 

Access and the Electronic Frontier Foundation

Before the Advisory Committee on Criminal Rules

on the Matter of Proposed Amendments to Federal Rules of Criminal Procedure, Rule 41

I would like to thank the members of the Committee on Rules of Practice and Procedure 

of the Judicial Conference of the United States for allowing me to testify in front of you today. 

My name is Amie Stepanovich and I am Senior Policy Counsel with Access, an international 

digital rights non-governmental organization.1 Founded in the wake of the 2009 Iranian postelection crackdown, Access seeks to defend and extend the digital rights of users around the 

world.2 Today I am also testifying on behalf of the Electronic Frontier Foundation.3 The 

Electronic Frontier Foundation, or EFF, was founded in 1990 and champions user privacy, free 

expression, and innovation through impact litigation, policy analysis, grassroots activism, and 

technology development.4

Introduction

My testimony today will focus on the second proposed change to Federal Rule of 

Criminal Procedure 41.5 Specifically, the proposed change I would like to discuss grants 

magistrate judges authority to issue warrants within an investigation under the Computer Fraud 

 1 Access, https://www.accessnow.org (last visited Oct. 29, 2014).

2 About Us, Access, https://www.accessnow.org/about (last visited Oct. 29, 2014). I would like to thank 

Access Junior Policy Counsel Drew Mitnick, Access Policy Intern Jack Bussell, and Access Tech Policy 

and Programs Manager Michael Carbone for their contributions to this testimony.

3 Electronic Frontier Foundation, https://www.eff.org (last visited Oct. 29, 2014).

4 About EFF, Electronic Frontier Foundation, https://www.eff.org/about (last visited Oct. 29, 2014). EFF 

Staff Attorney Hanni Fakhoury, Senior Staff Technologist Seth Schoen, Senior Staff Attorney Jennifer 

Lynch, and Senior Staff Attorney Lee Tien contributed to this testimony. 

5 Preliminary Draft of Proposed Amendments to the Federal Rules of Appellate, Bankruptcy, Civil and 

Criminal Procedure, 338-42 (August 2014), available at 

http://www.uscourts.gov/uscourts/rules/preliminary-draft-proposed-amendments.pdf. 
2

and Abuse Act to remotely search protected computers that have been damaged without 

authorization and to seize or copy electronically stored information on those computers when 

the computers are located in five or more districts and are not otherwise within that magistrate’s 

jurisdiction.6 As discussed in the relevant Committee Note, this change specifically involves the 

creation and control of “botnets.”7 Today, I will provide to the committee some technical 

background on botnets, the unique natures of botnets that would cause the rule change to have 

an overbroad, substantive impact on computing, and how the Department of Justice’s 

interpretation of the Computer Fraud and Abuse Act,8 or CFAA, could compound these impacts. 

I will end discussing how the proposed change could cause more harm than good in practice. 

Instead, we propose that a statutory solution is pursued to address the special challenges of 

unlawful botnets.

What are botnets?

The term “botnet” is short for “robot network.” A botnet is a network of computers that 

have been linked together.9 Botnets can consist of anywhere from a few computers to several 

million, as was the case with the Mariposa botnet, which was shut down in 2009,10 as well as 

the most infamous botnet, the Conficker, first discovered in 2008.11 Unlawful botnets are created 

when computers are infected with malicious code, known as malware.12 The type of malware 

that creates a botnet allows the infected computer to be remotely access and controlled by a 

 6 Id.

7 Id. 8 Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (2014).

9

Build you own botnet with open source software, WIRED, 

http://howto.wired.com/wiki/Build_your_own_botnet_with_open_source_software#Business_Usages (last 

visited Oct. 29, 2014). 

10 John Leyden, How FBI, police busted massive botnet, The Register (Mar. 3, 2010), available at 

http://www.theregister.co.uk/2010/03/03/mariposa_botnet_bust_analysis/. 

11 The ‘Worm’ That Could Bring Down The Internet, NPR (Sept. 27, 2011 12:12 PM ET), 

http://www.npr.org/2011/09/27/140704494/the-worm-that-could-bring-down-the-internet. 

12 Malware, Norton by Symantec, http://us.norton.com/security_response/malware.jsp (last visited Oct. 

29, 2014). 
3

third party, often without the owner’s knowledge.13 The infected computers in a botnet are 

sometimes known as “zombies.”14

Botnet malware may sit stagnant on an infected computer for months or years without 

causing any additional harm to the computer itself or any other system, and without coming to 

the attention of the computer’s owner or operator. Some botnets may never actually be utilized 

and may be patched without incident. In the case of Conficker, the botnet went largely unused 

despite its massive size, resiliency, and duration.15

Not all networked computers are intended for malicious or unlawful purposes. Lawful 

systems that closely resemble botnets in structure also exist and are used for communication 

and coordination.16 In business contexts, these systems may be used to create a cloud 

computing system, to capitalize on spare computing resources, to balance application loads, 

and for testing purposes.17 They may also be created and used to harness processing power in 

order to conduct scientific experiments or monitor emerging weather patterns.18

Substantive impacts of the proposed Rule 41 amendment

On account of their distributed nature, investigations of unlawful botnets undoubtedly 

pose a significant barrier to law enforcement. Access and EFF empathize with these challenges 

and are willing to work with members of Congress and leaders in law enforcement to develop an 

 13 Bots and Botnets--A Growing Threat, Norton by Symantec, http://us.norton.com/botnet/ (last visited 

Oct. 29, 2014). 

14 Id.

15 One version of the botnet was eventually utilized to download and install additional malware. 

Conflicker, Wikipedia.org, https://en.wikipedia.org/wiki/Conficker#End_action (last visited Oct. 29, 2014). 

16 About Eggdrop, Eggsheads Development Team (Oct. 2, 2011), 

http://cvs.eggheads.org/viewvc/eggdrop1.6/doc/ABOUT?view=markup. Additionally, other lawful 

computer networks are encompassed under the terms of the proposed rule, namely systems of protected 

computers located in five or more districts. Examples are CDNs, P2P systems, and websites run on 

shared resources.

17 Build you own botnet with open source software, WIRED, 

http://howto.wired.com/wiki/Build_your_own_botnet_with_open_source_software#Business_Usages (last 

visited Oct. 29, 2014). 

18 ATLAS@Home, CERN, http://atlasathome.cern.ch/ (last visited Oct. 29, 2014); Katherine Smyrk & Liz 

Minchin, How your computer could reveal what’s driving record rain and heat in Australia and NZ, The 

Conversation (March 25, 2014, 11:24 EDT), http://theconversation.com/how-your-computer-could-revealwhats-driving-record-rain-and-heat-in-australia-and-nz-24804. 
4

appropriate and rights-respective response. However, due to the same considerations, the 

proposed rule change presented today as a procedural modification would have a significant 

substantive impact, including on rights otherwise guaranteed under the Fourth Amendment and 

international law. Accordingly, we urge the rejection of the proposed amendment to Rule 41 in 

favor of pursuit of a statutory solution promulgated democratically in an open, public, and 

accountable legislative process.

The CFAA, initially passed in 1986, has traditionally been used to prosecute the theft of 

private data or damage to systems by way of malicious hacking.19 The CFAA was designed to 

provide justice for victims of these activities by offering a remedy against the perpetrators - the 

plain text of the relevant section of the CFAA clearly focuses on knowing or intentional malicious 

activity.20 Using this authority, magistrate judges issue warrants against those who create and 

use unlawful botnets, controlling the infected computers of otherwise innocent users.21

However, the proposed amendment unilaterally expands these investigations to further 

encompass the devices of the victims themselves - those who have already suffered injury and 

are most at risk by the further utilization of the botnet.22 And, as noted, a single botnet can 

include millions (or tens of millions) of victim’s computers, which may be located not only across 

the United States, but anywhere around the world.23

Victims of botnets include journalists, dissidents, whistleblowers, members of the 

military, lawmakers and world leaders, or protected classes. Each of these users, and any other 

user subject to search or seizure under the proposed amendment, has inherent rights and 

 19 See, e.g., United States v. Norris, 928 F.2d 504, (2nd Cir. 1991); United States v. Nosal, 676 F.3d 854 

(9th Cir. 2012). 

20 See 18 U.S.C. § 1030(a)(5) for “knowingly” and “intentionally” language.

21 See Microsoft Corp. v. Does 1-18, No. 1:13cv139 (LMB/TCB), 2014 WL 1338677, (E.D. Va. April 2, 

2014).

22 Supra note 5. The proposed amendment would permit law enforcement to “. . . use remote access to 

search electronic storage media [when] the media are protected computers . . . “ 

23 Notably, the provision in the CFAA relevant to the rule change addresses harm to a single computer -

each provision in 18 U.S.C. § 1030(a)(5) addresses access to a “protected computer” - that is, one single 

computer, or, perhaps in some circumstances, a small network of computers operated by a single entity. 

A “protected computer” has been, at its most expansive, a corporate or government computer network.
5

protections under the U.S. Constitution, the International Covenant on Civil and Political Rights, 

and/or other well-accepted international law.24 Without reference to or regard for these rights 

and protections, the proposed change would subject any number of these users to state access 

to their personal data on the ruling of any district magistrate. This is a substantive expansion of 

the CFAA. Today we are in the midst of a national, not to mention global, conversation about 

the appropriate scope of government surveillance. The U.S. Congress is actively considering a 

number of proposals to reform both international and domestic surveillance activities.25 The 

proposed amendment is an end run around this process. 

Further complicating matters, the proposed change being considered here today will 

likely have ramifications for a large number of users who are not even a part of a botnet. These 

users may be tangentially connected to a botnet through any number of means, such as the use 

of a common shared server or service provider. For example, earlier this year Microsoft applied 

to a federal judge for a court order to assist in dismantling a pair of botnets that encompassed a 

total of about 18,000 computers.26 The resulting action led to the disruption of service for nearly 

5,000,000 legitimate websites or devices on which 1,800,000 additional non-targeted users 

 24 See, e.g., Scope: Extra-territorial Application of Human Rights Treaties, Necessary and Proportionate, 

https://en.necessaryandproportionate.org/LegalAnalysis/scope-extra-territorial-application-human-rightstreaties (last visited Oct. 29, 2014). 

25 See, e.g., Kurt Opsahl & Rainey Reitman, A Floor, Not a Ceiling: Supporting the USA FREEDOM Act 

as a Step Towards Less Surveillance, Electronic Frontier Foundation (Nov. 14, 2013), 

https://www.eff.org/deeplinks/2013/11/floor-not-ceiling-supporting-usa-freedom-act-step-towards-lesssurveillance; The USA FREEDOM Act’s Long Road, Access, https://www.accessnow.org/pages/usafreedom-act (last visited Oct. 29, 2014); Amie Stepanovich, Virtual Integrity: Three steps toward building 

stronger cryptographic standards (Sept. 18, 2014 4:43am), 

https://www.accessnow.org/blog/2014/09/18/virtual-integrity-the-importance-of-building-strongcryptographic-standards (“U.S. Representative Alan Grayson and other lawmakers have introduced 

legislation to remove the mandatory requirement for NIST to consult with NSA (though still permit the 

consultation) and strictly prohibit the NSA from artificially weakening standards.”).

26 The court order applied to 18,000 subdomains. Many of these were likely individual personal 

computers, though it is possible that a small percentage were actually not individual computers. Microsoft 

Corp. v. Mutairi et al., No. 14-cv-0987, 

(D. Nev. June 19, 2014) (Brief in support of App. for TRO), available at 

http://www.noticeoflawsuit.com/docs/Brief%20in%20Support%20of%20Ex%20Parte%20Application%20f

or%20a%20TRO.pdf#page=9. For clarity, we will refer to each subdomain as an individual computer.
6

were engaging in legitimate, constitutionally protected speech.27 These other users had no 

connection to the botnets nor were they known to have broken any law, and instead were only 

guilty of using the same service as the botnet operators, a fact that caused a public outcry 

among the public and civil society.28

While the Microsoft case was a civil action, and not pursued in a criminal context, it is a 

good example of the unsettled legal nature of these issues and the difficulty in crafting narrowlytailored and appropriate remedies. This potential for far-flung damage requires a careful 

balancing of rights and responsibilities that is best accomplished through the public legislative 

process. 

Overbroad application of the CFAA

The above problems are exacerbated by overbroad interpretations of the CFAA itself. 

Federal prosecutors have forcibly expanded the scope of the CFAA through the overuse of the 

“without authorization” prong to encompass a range of unanticipated, and patently 

inappropriate, activities: users have been charged with violating the CFAA for violating online 

terms of service, researching website vulnerabilities, and lying on social media profiles.29

Aaron’s Law - so named for technologist Aaron Swartz who was aggressively 

prosecuted under the CFAA eventually leading to his suicide - has been introduced in the 

House of Representatives by Representative Zoe Lofgren with six co-sponsors to restrict these 

overuses.30 However, until either Congress or the U.S. Supreme Court are able to permanently 

 27 Natalie Goguen, Update: Detail on Microsoft Takeover, noip.com (July 10, 2014), 

http://www.noip.com/blog/2014/07/10/microsoft-takedown-detailsupdates/?utm_source=email&utm_medium=notice&utm_campaign=microsoft-takedown-update. 

28Id.; Nate Cardozo, What Were They Thinking? Microsoft Seizes, Returns Majority of No-IP.com’s 

Business, Electronic Frontier Foundation (July 10, 2014), 

https://www.eff.org/deeplinks/2014/07/microsoft-and-noip-what-were-they-thinking; Brandon Moss, So 

many botnets, so little time: U.S. Senate holds a hearing to combat “thing-bots,” Access (July 18, 2014 

4:03pm), https://www.accessnow.org/blog/2014/07/18/the-senate-holds-a-hearing-to-combat-thing-bots. 

29 See, e.g., United States v. Nosal, 676 F.3d 854 (9th Cir. 2012); United States v. Drew, 259 F.R.D. 449 

(C.D. Ca. 2009); see also Declan McCullagh, From ‘WarGames’ to Aaron Swartz: How U.S. anti-hacking 

law went astray, C|NET (March 13, 2013 4:00 AM PDT), Dhttp://www.cnet.com/news/from-wargames-toaaron-swartz-how-u-s-anti-hacking-law-went-astray/.

30 Aaron’s Law Act of 2013, H.R. 2454, 113th Cong. (2013). 
7

rectify these mis-applications of the CFAA, there is a danger that the proposed amendment 

could be used in a shocking number of unintended instances. This is particularly concerning 

because, as explained above, there are several properly-established and otherwise lawful 

computer networks that the proposed rule would likely encompass. Increasing the potential 

impact of the proposed amendment, any small networked group of computers may be subject to 

invasive surveillance at the whim of an overzealous prosecutor and a compliant judge. Further, 

as also explained above, since the proposed amendment targets victim computers and not the 

devices of bad actors, it would be enough for a computer connected to a lawful network to carry 

a virus or to have violated a standard shrinkwrap agreement to justify this surveillance, a move 

that carries heavy implications for constitutional rights and rights under international law.

The proposed amendment in practice

I have described how the proposal could bring an enormous number of computers 

belonging to innocent users into the purview of the CFAA and subject them to law enforcement 

surveillance. In applying the proposed amendment, it is likely that law enforcement could cause 

more harm to these users than the botnet it has seeks to investigate. Specifically, the use of the 

word “seizure” in the proposal, an undefined term, could authorize any amount of invasive 

activity. For example, as in the Microsoft case described above, law enforcement could intercept 

and re-route legitimate internet traffic. Further, the ambiguity in the language could potentially 

be interpreted to encompass a level of government hacking into private networks. Even groups 

that are supportive of this type of government activity concede that it necessarily requires 

statutory authorization.31

The range of offensive cybersecurity measures available to law enforcement vary from 

passive measures like beaconing - causing files to broadcast back to a preordained location - to 

 31 The IP Commission Report, 82, (May 2013), available at 

http://ipcommission.org/report/IP_Commission_Report_052213.pdf “Statutes should be formulated that 

protect companies seeking to deter entry into their networks and prevent exploitation of their own network 

information while properly empowered law-enforcement authorities are mobilized in a timely way against 

attackers.”
8

active and potentially harmful measures that interfere with the operation of the computer or its 

communications with other devices. The proper limits for use of offensive measures should be 

subject to public debate. While limits have been raised through various statutory vehicles in 

recent years, none have gained significant public support, and one has received not one, but 

two veto threats from the White House.32 It is not the place to pre-empt these continued 

conversations through implementation of a procedural measure.

Conclusion

The proposed amendment before the Committee today is a substantive change to 

federal law masquerading as a procedural measure. Once again, I urge you to reject the 

proposal and to, instead, support the exploration of appropriate statutory solutions for any legal 

gaps in the investigation, pursuit, and prosecution of those responsible for unlawful botnets. 

Thank you. I look forward to your questions.

 32 See, e.g., Hayley Tsukayama, CISPA critics bolstered by veto threat, Washington Post (April 17, 2013), 

available at http://www.washingtonpost.com/business/technology/cispa-critics-bolstered-by-vetothreat/2013/04/17/2c2f761e-a76b-11e2-8302-3c7e0ea97057_story.html. See also Brandon Moss, Access 

calls for President Obama to pledge to veto CISA, Access (July 15, 2014 9:30 am), 

https://www.accessnow.org/blog/2014/07/15/access-calls-for-president-obama-to-pledge-to-veto-cisa; 

and Letter from Access and Civil Liberties Groups to President Obama (July 15, 2014), available at

https://www.accessnow.org/page/-/Veto-CISA-Coalition-Ltr.pdf. 
TAB 6