The intent of this new ruling by the Supreme Court is for anonymous networks but, when doing forensics on a wire in such a manner as to present to a judge, you can't tell what's inside those packets. Also, an encryption session from the peer to peer client WASTE has a 256 encryption key in the header and that is it. WASTE would certainly fall under the criteria under the new ruling BUT, as soon as you class WASTE into the mix, a regular credit card purchase fits like a glove too!

Tor ban article: http://themerkle.com/fbi-can-obtain-a-warrant-if-you-run-tor-come-december/

The ruling: http://www.supremecourt.gov/orders/courtorders/frcr16_mj80.pdf

The part that sucks:

A magistrate judge ... has authority to issue a warrant to use remote access to search electronic storage … if: (A) the district where the media or information is located has been concealed through technological means;

What's to prevent cops from busting down your door for making a credit card purchase?

UPDATE response: So, one dirty movie/copy write protection violation on Frostwire and a connection to Tor, and I'm gonna be looking down the barrel of a few M-16s?

In theory, the FBI could be after Bob but have the 'wrong address', like what happens so many times today. They perform a packet capture at the ISP and look for what they consider dirty traffic but could easily be some other form of encrypted service, and end up raiding Mary's house because she was running encrypted traffic (such as a credit card purchase) on a non-standard port to her servers. RPC servers do this all the time (send encrypted credit card purchase data on a nonstandard port).

  • the only party that can really answer this must be nifty with wireshark, as much as law. This seamed to more appropriate due to the nature of the legal issue. It very much effects the security community.
    – dooode
    May 8, 2016 at 16:44
  • If this question is the real case, then any customer you configure encryption for is at risk of being stormed. only the security commity understands how all of these things are really the same. Judges are endusers and sign stuff blindly when in comes to technology. This looks like a MAJOR oversite.
    – dooode
    May 8, 2016 at 16:47
  • Why do you think that using a credit card constitutes concealing the district in which some information about a crime exists? The rule does not override the basic probable cause requirement. So the cops will not have probable cause, and credit cards do not technologically conceal their whereabouts.
    – user6726
    May 8, 2016 at 18:43
  • This question isn't about wireshark or interpreting packets. This is pure intent and application of the law. Also, I'm not sure that "kicking down the door" would ever happen. Your own quote says "warrant to use remote access".
    – schroeder
    May 9, 2016 at 4:20
  • There is a good response to some of the criticism of this new procedural rule here: fed-soc.org/blog/detail/…
    – sjy
    Apr 13, 2017 at 9:53

2 Answers 2


This question, along with a number of articles on the Internet, misconstrues what the rule change is about.

The rule change does not say that you can get a search warrant, that is to enter premises with/without machineguns etc, solely on the basis that someone is running Tor on that premises. The rule changes actually has nothing to do with search warrants.

The rule change is about "remote access" warrants and, specifically, the question of which magistrate you need to get the warrant from.

The background is that statute grants the FBI the power to hack into a computer (that is, obtain "remote access") to search for and retrieve evidence in a criminal investigation. One of the preconditions for doing so is that they identify which district the computer is in, and apply to a magistrate in that district. (By way of further background, under the American way of distributing power, it is seen as a bad thing for (for example) a magistrate in California to be able to issue a warrant to an FBI agent to conduct a search in North Carolina.)

When the target computer is desired to be hacked because it is running a hidden Tor service, then how does anyone know what district it is in? Where does the poor FBI agent apply for his or her warrant?

This rule change resolves this practical problem by saying that, where the use of Tor or a similar system precludes any knowledge of the physical location of the target computer, then the FBI can apply for a warrant with any magistrate.

See further http://www.fed-soc.org/blog/detail/amendments-to-federal-criminal-rule-41-address-venue-not-hacking-powers


The language includes changes like inserting the underlined text in "A summons is served on an organization in a judicial district of the United States by delivering a copy to an office...", and there is a corresponding clause about a warrant "served on an organization not within a judicial district of the United States". This is relevant to the change that the article find offensive, pertaining to technologically obscuring the district. Rule 41(b) focuses on venue for warrant application, and the amendment adds "a magistrate judge with authority in any district where activities related to a crime may have occurred" and specifically authorizes remote access to computers (not previously included in the rules) under two circumstances. One is that the district where this computer is has been "technologically concealed", and the other is someone hacked into computers in at least 5 districts.

Using a credit card is not a crime, so there would be no probable cause. Using Tor is also not a crime, so using Tor would not be probable cause. The probable cause has to exist first. If you've downloaded child porn and they know that and are after you, with that probably cause they can get a warrant. And with the new rule and a warrant, they can access the computer remotely to obtain the evidence. Whether or not using identity-hiding software becomes per se probable cause in the future remains to be seen in the future: this rule change does not do that. There aren't any clear rules about what constitute "probable cause", which is what fundamentally protects individuals' privacy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .