ACLU files lawsuit against 11 federal criminal and immigration enforcement agencies for disclosure of information on government hacking

On Friday, The American Civil Liberties Union (ACLU), Privacy International, and the University at Buffalo Law School’s Civil Liberties & Transparency Clinic filed a Freedom of Information Act lawsuit against 11 federal criminal and immigration enforcement agencies, including the FBI, Immigration and Customs Enforcement, and the Drug Enforcement Administration.

This lawsuit demands disclosure of basic information about government hacking. They have demanded that the agencies disclose which hacking tools and methods they use, how often these tools are used, the legal basis for employing these methods, and any internal rules that govern them. They also seek any internal audits or investigations related to their use.

The ACLU, in their blog post, state that the hacking by the government raises “grave privacy concerns”, creating “surveillance possibilities” that could pose a security risk because even “lawful hacking” can take advantage of unpatched vulnerabilities in a users devices and software.

They believe that by hacking into a phone, laptop, or another device, federal agents can obtain any sensitive/confidential information. They can perform activities like activating a device’s camera and microphone, log keystrokes, or hijack a device’s functions. Most of the time users are completely unaware that they are being surveilled and there is not much information on what comprises a ‘lawful hacking’. ACLU argues that "Law enforcement use of hacking presents a unique threat to individual privacy."

They have supported this claim by giving examples of a case in which the government commandeered an internet hosting service in order to set up a “watering hole” attack that is suspected to have spread malware to many innocent people that visited websites on the server. In another case, an FBI agent, posing as a reporter, investigating fake bomb threats impersonated an Associated Press reporter to deploy malware on a suspect’s computer. The agent created a fake story and sent a link to the story to a high school student. When the student visited the website, it implanted malware on his computer in order to report back identifying information to the FBI.

To get a better understanding of what the government is doing, along with what rules it follows; the lawsuit will clarify whether and when the government should engage in hacking. It will also help users understand whether the government is collecting excessive information about the people it surveils, and how investigators handle innocent bystanders’ information.

You can head over to ACLU’s official blog to know more about this news.