The American Civil Liberties Union, along with Secret International, a similar organization based in the United Kingdom, now snake 11 federal agencies, records asking about how those agencies engaged in so-called “law enforcement.”
Activist groups filed Freedom of Information Act complaints against the FBI, the Drug Enforcement Administration, and nine others. No one responded in a serious way.
“Law enforcement’s use of hacking presents a unique threat to individual privacy,” ACLU arguing in its lawsuit, which was filed Friday in federal court in New York state.
“We can use hacking to obtain volumes of personal information about individuals that would never have been available to law enforcement.”
In recent years, there have been a few incidents when the public has learned about the government’s attempts to hack websites, including its pursuit of Freedom Hosting, a Tor-hidden hosting company, back in 2013.
Last year, federal prosecutors filed at least two pornographic cases connected to a popular Tor-hidden site, Playpen. As Ars previously reported, to unlock Playpen users, federal authorities took over and operated the site for 13 days before shutting it down. During the time, the The FBI deployed a Tor exploit that allowed them to uncover the real IP addresses of those users. Using Tor, which exposes and anonymizes IP addresses and browser user agents, makes tracking individuals online much more difficult. With abuse, it is much easier for suspects to identify and locate.
The DOJ has called this exploit a “network investigative technique” (NIT), while many security experts have referred to it as “malware.” The source code of that particular exploit has been classifieddoing it all but it is impossible for everyone to know exactly how it works.
Because of this secrecy, lawmakers have a hard time verifying how these tools work.
As the ACLU continues arguing :
For example, the public does not know when law enforcement agencies believe they can use hacking without obtaining a warrant or other judicial authority. Citizens don’t even know whether many agencies have internal rules or regulations governing hacking. Without more information, the public is unable to exercise meaningful democratic oversight of the new law enforcement power and intrusion. Even criminal defendants may not fully know whether the government has engaged in hacking to search their devices, or the scope and methodology of those searches. This level of privacy creates significant opportunities for misuse and abuse.
The FBI did not immediately respond to Ars’ request for comment.