Law Enforcement

DOJ gets new legal tool to go after botnets

Shutterstock image 

The Justice Department is eliminating a key legal gap that has stymied or killed past federal botnet investigations, Leslie Caldwell, assistant attorney general announced.

Under new rules, federal law enforcement won't be required to file in almost 100 individual federal districts for search warrants to track down and kill sprawling national botnet attacks.

The rules of criminal procedure dating back to 1917 had posed a substantial obstacle to botnet investigations, Caldwell said in a Nov. 22 blog post.

To get information on a specific botnet or piece of malware from one computer requires a search warrant from a judge in the jurisdiction where the computer is located. Since botnets can leverage millions or even hundreds of millions of computers, that procedural hurdle can pose a logistical nightmare for investigators.

"The result is that while we are struggling to keep up with criminals who, as you read this, are committing mass, harmful hacking of our computers, our own archaic procedural rules may prevent investigators from taking timely, smart, lawful and court-supervised enforcement action," she wrote. "In short, under our current procedures, botnets may be 'too big to investigate.'"

Three years ago, the Justice Department proposed a fix to the rules, proposing new rules requiring agents to meet the same exact constitutional requirements as before, but with botnet cases, if computers in five or more jurisdictions were attacked, agents would only have to bring warrant applications to a single federal court, rather than in each jurisdiction.

The rule, she said, doesn't change probable cause rules, but only identifies that a single court is authorized to consider questions in the context of an application for a search warrant.

The Supreme Court signed off on the new rules, which are due to take effect on Dec. 1.

Sens. Ron Wyden, D-Ore. and Chris Coons, D-Del., issued a statement on Nov. 22 criticizing Justice Department officials for failing to "substantively answer" the legislators' questions about the new rule's potential for abuse. The senators had asked what would prevent government investigators from "forum shopping" to find the most agreeable court to issue a search warrant, and whether citizens would be further harmed by investigators hacking into their compromised devices.

Wyden called the department's Nov. 18 response "a big blinking warning sign about whether the government can be trusted to carry out these hacks without harming the security and privacy of innocent Americans’ phones, computers and other devices." He and Coons both said Congress should pass legislation blocking implementation of the new rule.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at or follow him on Twitter at @MRockwell4.


  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.