Law enforcement does not need a warrant to hack someone’s computer, according to a just-unsealed court order written by a federal judge in Virginia.
This case, United States v. Matish, is one of at least 135 cases currently being prosecuted nationwide stemming from the FBI’s investigation of the Tor-hidden child pornography site called “Playpen.”US District Judge Henry Coke Morgan, Jr. further explained in the order on Thursday that warrantless government-sanctioned hacking “resembles” law enforcement looking through broken blinds.
In this case, however, a warrant was sought and obtained. Judge Morgan found that even if the warrant did not exist—or was found to be invalid—the search would have been valid.
As Ars has reported before, to breach the security normally afforded by Tor, the FBI deployed a “network investigative technique” (NIT).
In a related case prosecuted out of New York, an FBI search warrant affidavit described both the pornography available to Playpen’s 150,000 members and the NIT’s capabilities. As a way to ensnare users, the FBI took control of Playpen and ran it for 13 days in 2015 before shutting it down.
During that period, with many users’ Tor-enabled digital shields down—revealing their true IP addresses—the government was able to identify and arrest the 135 child porn suspects.
Edward Matish and his lawyers unsuccessfully tried to dismiss the charges. However, unlike a recent case in Washington state, the validity of the authorizing warrant in Matish’s case was not in question.
The warrant was both issued in and targeted a search in the Eastern District of Virginia.
Bad news for privacy?
In the 58-page order, the judge concluded that the deployment of the NIT, which was targeted to merely make the user’s computer cough up its real IP address, did not constitute a search. Judge Morgan wrote:
Just as Justice Breyer wrote in concurrence that a police officer who peers through broken blinds does not violate anyone’s Fourth Amendment rights, jd. at 103 (Breyer, J., concurring), FBI agents who exploit a vulnerability in an online network do not violate the Fourth Amendment. Just as the area into which the officer in Carter peered—an apartment—usually is afforded Fourth Amendment protection, a computer afforded Fourth Amendment protection in other circumstances is not protected from Government actors who take advantage of an easily broken system to peer into a user’s computer. People who traverse the Internet ordinarily understand the risk associated with doing so.
Thus, the deployment of the NIT to capture identifying information found on Defendant’s computer does not represent a search under the Fourth Amendment, and no warrant was needed.
Here, the balance weighs heavily in favor of surveillance.
The Government should be able to use the most advanced technological means to overcome criminal activity that is conducted in secret, and Defendant should not be rewarded for allegedly obtaining contraband through his virtual travel through interstate and foreign commerce on a Tor hidden service.
In a blog post, the Electronic Frontier Foundation called the decision “dangerously flawed” and said it does not believe the decision will be upheld on appeal.
“The implications for the decision, if upheld, are staggering: law enforcement would be free to remotely search and seize information from your computer, without a warrant, without probable cause, or without any suspicion at all,” Mark Rumold, an EFF attorney, wrote. “To say the least, the decision is bad news for privacy.”
Matish is set to go to trial in October in Newport News, Virginia.