In early December, the final effort in the Senate to delay amendments to Rule 41 of the Federal Rule of Criminal Procedure was blocked, putting the updates into effect and making journalists — who have long been advised by lawyers, civil society groups, and others to use anonymization tools and encryption in newsgathering — even more vulnerable to government surveillance.
While the changes to the Rule have been extensively covered (including on Just Security), the focus has largely been on privacy threats to ordinary citizens. The changes, however, could have an outsized impact on journalists, specifically.
Rule 41 enables the government to employ “remote access” searches of computers with a warrant issued by a magistrate judge. However, under the new changes, the magistrate judge can issue a warrant for a computer located anywhere, even outside the court’s jurisdiction, if (1) the physical location of the information is “concealed through technological means” such as anonymization tools; or (2) a number of computers (located in five or more districts) have been infected with malware, thus creating a botnet, which allows the computers to be controlled as a group without the owners’ knowledge. (A third change requires the government to “make reasonable efforts” to notify the person whose electronically stored information was remotely searched.)
While these changes were made to encourage law enforcements’ pursuit of information through warrants – which is a good thing – they also put the press increasingly at risk. Remote access searches can now be used by law enforcement pursuant to Rule 41 – where anonymization tools are used – threatening the vital trust between source and journalist. In addition, the press is now vulnerable to warrants issued by courts across the country, rather than just from local magistrate judges. These changes also run afoul of longstanding statutory and constitutional protections intended to safeguard journalists.
Persons using anonymization systems (e.g., journalists) could become targets
In recent years, journalists have been repeatedly advised to use anonymization tools to protect the confidentiality of their sources and work product. Groups like the Electronic Frontier Foundation, the American Civil Liberties Union, and others have hammered home the point — and with good reason. For example, the Tow Center for Digital Journalism at Columbia University wrote in its 2014 report, “Digital Security and Source Protection for Journalists,” that tools like the Tor browser or virtual private network (VPN) tools constitute “best practices” because they represent “security by obscurity.” It underscores, “To truly anonymize the location of your Web browsing activity, [ ] Tor Browser Bundle is your best bet.”
The thinking goes that anonymity technology provides protection to the press (and their sources) because it obfuscates who was speaking to whom and where. In essence, these tools serve a similar function of concealing identities as the famed parking garage where Washington Post journalist Bob Woodward obtained tips from Deep Throat to unveil the Watergate scandal. Other tools, like SecureDrop, which allows sources to directly and securely share documents with media organizations, require the use of Tor or other software that enable anonymous communication. Anonymization tools also make it more difficult for law enforcement to describe with particularity, as required under the Fourth Amendment, the information sought pursuant to a warrant, making it less likely that journalists get pulled in as third parties in criminal investigations.
However, under the Rule 41 changes, a district court now has jurisdiction specifically in these circumstances — where the location of the journalist or media organization is “concealed” or obfuscated. The new amendments therefore not only undermine Fourth Amendment requirements, as explained here, but also undermine the best practices recommended to journalists. In essence, Rule 41 now makes using certain secure technological tools a Catch-22 for those in the press: If you use anonymization tools like Tor to protect your sources you may be more vulnerable to a government search. On the other hand, if you don’t use these tools your sources could be discovered through government surveillance.
Jurisdiction is expanded
Under the old version of Rule 41, judges could only order searches within their jurisdictions. Practically speaking, this meant judges typically could not issue warrants to authorize searches of journalists or news organization outside of a few counties. Conversely, news organizations served with warrants could theoretically raise a jurisdictional challenge where a court was not in the territory of the publication.
However, under the new amendments, a district court may grant access to media “located within or outside” its own district – and even outside the United States – when certain criteria are met. Ahmed Ghappour described this international reach as “[p]ossibly the broadest expansion of extraterritorial surveillance power since the FBI’s inception.” Beyond the theoretical problems of expanding jurisdiction for courts, this means in practice prosecutors may “forum shop” by seeking out judges anywhere in the country who are more likely to issue search warrants, and in turn, many more warrants could be issued on individuals, including journalists.
Ignored First Amendment protections imbued within the Fourth Amendment protections
Although the Justice Department has repeatedly stated that the Rule 41 changes do not alter Fourth Amendment protections, these assurances do not address the concerns of the news media because journalists are protected by more than just the Fourth Amendment. Specifically, newsgathering activities are further safeguarded by the First Amendment, statutory protections, and the Justice Department’s own guidelines that go above and beyond the Fourth Amendment.
Indeed, the historical link between the First and Fourth Amendments demonstrates that First Amendment protections go beyond Fourth Amendment protections. The Fourth Amendment prohibits unreasonable searches, a requirement that arose in part from the government targeting publishers during the colonial era and threatening rights that are now covered by the First Amendment. See Stanford v. Texas, 379 U.S. 476, 482 (1965) (stating the history of the Fourth Amendment is “largely a history of conflict between the Crown and the press.”). Accordingly, the Supreme Court has emphasized the “consideration of First Amendment values in issuing search warrants” and has held that where the First Amendment is implicated, Fourth Amendment requirements must be applied with “scrupulous exactitude.” Zurcher v. Stanford Daily, 436 U.S. 547, 564–65 (1979). And yet, the Rule 41 changes do not consider whether the targeted information implicates the First Amendment. Therefore, it is impossible for the magistrate judge to know when to apply this “scrupulous exactitude.”
Even though the government and courts must consider First Amendment values in the context of a remote access search, First Amendment values appear to have been entirely ignored in the passage of the Rule 41 changes.
Rule 41 is Inconsistent with the Privacy Protection Act
As The Reporters Committee for Freedom of the Press (our employer) has previously explained, remote access searches of journalists’ data also runs into conflict with existing statutory protections. According to its own text, Rule 41 may “not modify any statute regulating search or seizure,” but the changes to Rule 41 drastically threaten the protections afforded to journalists under the Privacy Protection Act (“PPA”), 42 U.S.C. § 2000aa.
Congress enacted the PPA in 1980 in response to the Supreme Court’s holding in Zurcher v. Stanford Daily (mentioned above). In that case, police searched the Stanford Daily newsroom for photographic evidence that could be useful in a criminal investigation. The Supreme Court found that the search was permissible because the Fourth Amendment provided adequate safeguards to the press. Congress, however, appeared to disagree: It enacted the PPA to protect “the press and certain other persons not suspected of committing a crime with protections not provided currently by the Fourth Amendment.” The PPA achieves this goal by requiring law enforcement officers to seek a court subpoena before obtaining journalists’ work and documentary materials, and generally bars such searches when the documents are related to newsgathering, thereby “lessen[ing] greatly the threat . . . to the vigorous exercise of First Amendment rights.”
However, the expansion of Rule 41 further threatens this law. Even before the changes, Rule 41 permitted law enforcement to perform remote access searches that could reveal reporters’ confidential sources, notes, and communications — quintessential journalistic work protected under the PPA. However, these searches were reserved for limited circumstances, such as in cases of national security. Unfortunately, the changes to Rule 41 now expand the use of this technique to all circumstances where anonymizing tools are used. Creating an even greater potential for the harms induced by such searches. Over the past few years, surveillance of journalists has had a well-documented chilling effect on members of the press and their sources. Indeed, as Justice Sotomayor stated in her concurring opinion in United States v. Jones, “Awareness that the Government may be watching chills associational and expressive freedoms.”
Perhaps even worse than surveillance of journalists’ recorded information, these techniques can also be used to manipulate the computer. In essence, this technology gives law enforcement the ability to conduct itself as the owner. As Ghappour explains,
Once installed, the right malware can cause a computer to…covertly upload files, photographs and stored e-mails to a server controlled by law enforcement, use a computer’s camera or microphone to gather images and sound at any time the executing agent chooses, or even take over computers which associate with the target (e.g. by accessing a website it hosts).
Using these features on a computer, a law enforcement officer could hypothetically impersonate the journalist who owns it. This is especially problematic because “rank and file” investigators are able to request the warrant without further checks and balances, as required in other circumstances. Indeed, the FBI has used techniques to impersonate the media, since at least 2002. However, approval by senior officials is required in those circumstances. If employed, these aggressive tactics could risk compounding the chilling effect on speech by endangering journalists, jeopardizing trust of the news media, and undermining the media’s credibility and ability to independently report on the government.
Expanding Rule 41 exacerbates these problems and clashes with protections under the PPA and the First Amendment.
Risks Departure from the Justice Department’s Own Guidelines
In addition to the First Amendment and PPA protections, the Justice Department’s own guidelines afford extra protections to journalists that go beyond what is guaranteed by the Fourth Amendment. Specifically, Justice Department guidelines codified at 28 C.F.R. § 50.10, and explained further in the U.S. Attorneys’ Manual 9-13.400, set out safeguards for when the Justice Department seeks to subpoena telephone toll records of members of the news media. The guidelines were promulgated in 1970 with a strong statement of intent to protect newsgathering, and have been significantly reformed to strengthen protections for journalists in recent years. Today’s guidelines state, among other things, that the government must try “alternative sources before considering issuing a subpoena to a member of the news media;” provide “reasonable and timely notice” of the request before issuance; pursue “[n]egotiations with the media . . . in all cases in which a subpoena to a member of the news media is contemplated;” and, typically, obtain sign-off by the Attorney General.
The impact of the Rule 41 changes seems to contradict the Justice Department guidelines, which demonstrate the Justice Department’s own commitment to identify, before a request for information, whether the information sought belongs to a member of the news media, and to deliver notice to the news media organization. Given that Rule 41 is used in circumstances where law enforcement may not know the identity of the person they are searching before the search has begun, the Rule could better comport with the spirit of the guidelines by at least ensuring notice is given after the fact. Unfortunately, Rule 41’s requirement merely requires a “reasonably calculated” effort be made to reach the affected person.
Conclusion: What Now?
To be clear, the vulnerability of journalists’ work under Rule 41 is hypothetical. But the mere possibility is troubling in light of the fact that Congress did not even debate the changes, and instead the amendments were shuttled in as procedural adjustments under the Federal Rules of Criminal Procedure. Moving forward, law enforcement officials should ensure that (1) searches pursuant to the Rule 41 changes continue to adhere to special protections for journalists using tools for newsgathering; (2) there is proper oversight by senior officials as required by the Justice Department’s own guidelines; and (3) journalists and media organizations receive notice of remote searches. In the meantime, journalists should continue to use tools like Tor, because the risks from inadequate data security still outweigh the risks of being targeted by a search warrant, but journalists should continue these practices knowing they now come with an additional cost.
