New US law could put your UK data at risk

The US Department of Justice (DoJ) is seeking a change in the law that would give American law enforcement access to all internet connected devices, no matter where they are in the world.

The Federal Rules of Criminal Procedure is a little-known piece of legislation that governs how US district and general trial courts conduct criminal prosecutions, including the issuing of warrants.

The DoJ has specifically proposed a change to Rule 41: Search and Seizure, section b6, which covers the authority to issue a warrant. Whereas now judges can only issue a warrant for search and seizure – including remote search – within their district, the proposed change to section b6 would allow them to “issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information within or outside that district”.

In simple terms, this means a US judge can issue American law enforcement agencies or government representatives with a warrant to access any machine connected to the internet, irrespective of where that machine is located.

Due to the loose wording of the amendment, it could mean not just a judge in New York issuing a warrant to be executed in Taho, but the same judge could issue a search warrant for a device overseas – including here in the UK.

Google has submitted a formal objection to the amendments to the Judicial Conference Advisory Committee on Criminal Rules, which is considering the proposed changes.

In the document, Google’s director of law enforcement and information security, Richard Selgado, said: “The proposed amendment substantively expands the government’s current authority … and raises a number of monumental and highly complex constitutional, legal, and geopolitical concerns.”

Selgado also argued it’s inevitable warrants will be issued for the seizure of data overseas, even if the change isn’t initially intended to be used in this way, as claimed by the DoJ.

“The nature of today’s technology is such that warrants issued under the proposed amendment will in many cases end up authorizing the government to conduct searches outside the United States,” he said.

The move follows a long-running court case between the FBI and Microsoft regarding information on an Office 365 subscriber stored in its Irish data centre. Microsoft has repeatedly refused to hand over the data, which the FBI wants as evidence in a narcotics case, arguing the orders it has received don’t apply to data stored overseas.

The FBI, however, has argued that, as Microsoft is an American company it can be compelled to hand it over, even if it isn’t located in the US. The case is still ongoing, with a new appeal expected to be heard soon.