1

Other than air-gapping, does anyone know enough about rule 41 to provide advice and guidance on how to protect a linux system from this type of remote hacking? I've read that perhaps linux + disk encryption + firejail with Tor could possibly be a good defense. I've also read that booting and running from a liveCD would be the only way to prevent such access to your system.

http://fossforce.com/2016/05/rule-41-getting-around-constitution/ http://fortune.com/2016/11/30/rule-41/

2

This answer covers only the recent changes to Rule 41, which I assume from your links is what you are asking about. It also assumes you and/or your equipment is in the US; if you're a non-citizen and you and your equipment are outside the US, the 4th Amendment rights that are clarified by Rule 41 wouldn't apply to you anyway

The changes primarily affect the (geographic) scope of what law enforcement is legally allowed to search with a warrant. So it's worth pointing out that you're asking for information on how to prevent agents of the government from legally obtaining information from your system that they have been explicitly (via a warrant) been given permission to have.

From a technical perspective, there's no difference between

  • a) what law enforcement from within your jurisdiction is allowed to do (and has been allowed to do) regardless of Rule 41 changes,
  • b) what law enforcement from a different jurisdiction is now allowed to do under Rule 41, and
  • c) what criminals can do outside the law to hack your computer.

So from a technical perspective, this question is just, "how do I secure my computer from access by people who were not personally authorized by me to access it," and the Rule 41 part of your question is irrelevant.

Finally, it's probably worth noting that the changes to Rule 41 include allowing a judge from outside your jurisdiction to issue a warrant if "the district where the media or information is located has been concealed through technological means," so using Tor would actually bring you into the scope of the Rule 41 changes; if you don't hack (damage) someone else's computer and don't try to hide your location then you are not affected by the changes to Rule 41.

  • You make some valid points. But one of my main concerns is a pc that's inadvertently infected and now part of a botnet without my knowledge. I personally do not feel the government has a right, warrant or not, to hack into my system and snoop around if it feels the need to, without my consent first. And we all know there will be no "ask first, hack later" policy. – user53029 Dec 1 '16 at 20:06
  • 1
    Well if the warrant is to investigate the botnet then, at least legally, anything they find while "snooping" around is "unreasonable search" and not admissible in court (not to mention that you should probably be more worried about the actual criminals who have access to your system than about the cops who are legally pursuing them). And no, we don't all know that, in part because Rule 41 explicitly covers the scope of searches pursuant to a warrant so any "hack first, ask later" expedition wouldn't be bound by Rule 41 anyway. – drewbenn Dec 1 '16 at 20:20
  • I get what your saying. So if technically speaking, its no different than what a criminal hacker can do in an attempt to remotely access your system then there is no guarantee that LE, even with a warrant, would succeed in remotely accessing your system. I suppose it depends on the tools being used against you and how hardened your OS is. Would you agree? My thoughts on all this were leading me down the road where applications and OS'es were going to somehow have a new "rule 41" backdoor. Which would allow the govt to get right on in w/out having to exploit a vulnerability of some sort. – user53029 Dec 1 '16 at 20:54
  • 1
    Right, just as there's no guarantee the cops will be able to physically break down your steel-reinforced front door after they were given a warrant to search your home (ability to access being a separate issue from the legal right to access) There's no mention of a backdoor (or master front door key) in Rule 41, that's a completely separate issue: Rule 41 is only about what the government can legally search and (this is the part the recent changes apply to:) who can approve those searches. – drewbenn Dec 1 '16 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.