On Friday, the American Civil Liberties Union (ACLU), Privacy International and Civil Liberties and Transparency Clinic at the University of Buffalo filed a Freedom of Information Act lawsuit against seven federal criminal and immigration enforcement agencies, including the FBI and the Drug Enforcement Administration (DEA).
According to a press release by the ACLU, the lawsuit demands that the agencies reveal “which hacking tools and methods they [these agencies] use, how often they use them, the legal basis for employing these methods and any internal rules that govern them.” It also calls for internal audits or investigations of the agencies.
In the press release, the ACLU references several instances of government hacking. In one case, the US government allegedly set up a “watering hole” attack that might have spread malware to innocent people who visited fake websites that mimic popular web pages, according to the nonprofit organization. The specifics of the case were not revealed.
According to a March 2017 report titled “Challenging Government Hacking in Criminal Cases,” “the FBI has remotely searched thousands of computers located in districts around the country pursuant to a single search warrant — including, in the most recent known operation, searching more than 8,000 computers in 120 different countries.”
The ACLU also references another 2017 case in which an FBI agent investigating fake bomb threats in 2007 impersonated an Associated Press reporter to get a suspect to click on a fake news story link, which revealed his computer’s location.
“The agent, posing as a reporter, created a fake story and sent a link to the story to a high school student. When the student visited the website, it implanted malware on his computer in order to report back identifying information to the FBI,” the ACLU claims.
According to a Motherboard article published last month, two 2017 search warrant applications revealed that the FBI had set up fake FedEx websites and rigged Microsoft Word documents to identify the IP addresses of cyber criminals attempting to lure companies into sending large amounts of money to them, suggesting that the FBI is using hacking techniques to investigate “increasingly ordinary crimes.”
In addition, the ACLU claims that the DEA has spent almost $1 million on remote hacking technology sold by Hacking Team, an Italian information company that sells intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.
“Our lawsuit is meant to shine a light on these activities and to hold government accountable, allowing meaningful public deliberations about activities that profoundly affect people’s rights and liberties,” the ACLU concludes.