We’re Suing the Government to Learn Its Rules for When It Hacks Into People’s DevicesHacking by the government raises grave privacy concerns, creating surveillance possibilities that were previously the stuff of science fiction. It also poses a security risk, because hacking takes advantage of unpatched vulnerabilities in our devices and software.
By hacking into a phone, laptop, or other device, federal agents can obtain all kinds of sensitive, confidential information. They can even activate a device’s camera and microphone, log keystrokes, or otherwise hijack a device’s functions. Often, users are completely unaware that they are being surveilled.
Given the serious issues at stake, the public has a right to know the nature and extent of the government’s hacking activities and, importantly, the rules that govern these powerful surveillance tools. But so far, most of what we know is based on scattered news accounts.
That’s why on Friday, the ACLU, Privacy International, and the University at Buffalo Law School’s Civil Liberties & Transparency Clinic filed a Freedom of Information Act lawsuit demanding disclosure of basic information about government hacking. We’re suing seven federal criminal and immigration enforcement agencies, including the FBI, Immigration and Customs Enforcement, and the Drug Enforcement Administration.
The lawsuit demands that the agencies disclose which hacking tools and methods they use, how often they use them, the legal basis for employing these methods, and any internal rules that govern them. We are also seeking any internal audits or investigations related to their use.
The little that we do know about government hacking is very troubling. In one case, the government commandeered an internet hosting service in order to set up a “watering hole” attack that may have spread malware to many innocent people who visited websites on the server. In another case, an FBI agent investigating fake bomb threats impersonated an Associated Press reporter in order to deploy malware on a suspect’s computer. The agent, posing as a reporter, created a fake story and sent a link to the story to a high school student. When the student visited the website, it implanted malware on his computer in order to report back identifying information to the FBI.
https://www.aclu.org/blog/privacy-technology/internet-privacy/were-suing-government-learn-its-rules-when-it-hacks-peoples
