united-states police hacking
Under what circumstances could law enforcement hack a server?
<p>I recently read a <a href="http://www.wired.com/2015/05/silk-road-2/" rel="nofollow">wired article</a> about Silk Road and the arrest of Ross Ulbricht. The article describes how an FBI agent attempted to discover the true IP address of the Silk Road Server:</p>

<blockquote>
  <p>Tarbell [New York FBI] threw data at Silk Road, hoping to see the leak. He entered
  usernames with bad passwords (and vice versa) and pasted data into
  input fields—all the while using regular old freeware to analyze
  network traffic and collect the IPs communicating with his machine.</p>
</blockquote>

<p>For the sake of discussion, lets assume that the actions above are violations of the <a href="http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow">CFAA</a>. Under what circumstances is Law Enforcement allowed to attempt unauthorized access or exceed authorized access of a system as prohibited by the CFAA or laws. Does Law Enforcement need a warrant, probable cause, etc?</p>

<p>Ok, there is an essential flaw in your question. What you stated the FBI did was not attempting an unauthorized access on the network. What they did was collect IP addresses.</p>

<p>This would be the same thing as a pen register, which law enforcement does not need a warrant for. <a href="http://caselaw.lp.findlaw.com/scripts/getcase.pl?court=US&amp;vol=442&amp;invol=735" rel="nofollow">Smith v. Maryland</a></p>

<p><a href="http://privacylaw.proskauer.com/2007/07/articles/fourth-amendment/ninth-circuit-applies-pen-register-and-mail-principles-to-warrantless-monitoring-of-internet-traffic/" rel="nofollow">The ninth circuit stated the same</a> in the 2007 case US v. Forrester.</p>

<p>However, if you mean actual intrusion into the network, then yes, law enforcement would need a warrant. <a href="http://caselaw.lp.findlaw.com/scripts/getcase.pl?court=US&amp;vol=389&amp;invol=347" rel="nofollow">Katz</a></p>

<p>Disregarding the example of logging IP addresses (as Andrew said, this is not the same as "hacking a server"):</p>

<p>The conduct in question ("hacking" a server and exfiltrating information without the permission of the owner) would definitely constitute a "search" for purposes of the fourth amendment and other constitutional law; therefore, a warrant is required.</p>

<p>As for CFAA violations, the act in question states:</p>

<blockquote>
  <p>This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.</p>
</blockquote>

<p>(18 U.S.C. § 1030 (f) retrieved from <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow noreferrer">https://www.law.cornell.edu/uscode/text/18/1030</a>)
<br>
<br>
It would thus seem that CFAA violations are out of the question, at least so long as a warrant was obtained. </p>

<p>If no warrant was obtained, criminal or civil liability may arise depending on circumstances under several different laws.<br>
<br>
As for other conduct that would not necessitate a warrant but would ordinarily be prohibited under the CFAA, there is no criminal liability. 
<hr>
I am not a lawyer; I am especially not your lawyer; this is not legal advice.</p>
