Janie Slaven: LEFT TO MY OWN DEVICES: The courts sealeth, and the hackers taketh away

Aug. 8—There's a cynical sentiment about the judicial system that degenerates the spirit of justice as it proceeds. It goes something like...

If your client's factual case won't likely win in court, go after the laws implicated in the matter;

If the laws aren't on your side, attack the facts of the case;

If neither the facts nor the laws lean in your favor, go after opposing counsel and witnesses.

Actually, the great poet and journalist Carl Sandburg summed it up more directly, and it may be that this trope is based on his quote despite my recalling it from courtroom lore. He advised that when the law and the facts are both stacked up against you, "pound the table and yell." Maybe you'll simply wear down the court until you win. At least that's what I gather he's advising, or has possibly even experienced, himself.

Seems like in the digital age everything changes, accordingly. In 2020, some federal cases apparently involving our most ardent nation-state antagonists—think Russia, North Korea, China, and Iran—suffered under their next strategic move after getting nowhere pounding tables. When that, too, failed they hacked the system.

Much of the meat of the matter is unknown, at least publicly. It is unclear what federal cases were affected. It is undisclosed about which of these, or other, nation-states conducted the criminal trespass of our Constitution's Article III realm, the courts. There is enough information available from the Administrative Office of the U.S. Courts in its public statement about the 2020 cybersecurity breaches to conclude that they were marshaled by three hostile foreign actors. I'm sticking with that premise until more information is released that contravenes it, or that fills in its many, many holes of the incidents.

Suffice it to say that having the federal court system compromised through cyber-attacks is not good. Take the notion of HSDs. Federal courts classify some of its filings, submitted by the Department of Justice's U.S. Attorney's Office, as Highly Sensitive Documents. These HSDs are described as sealed documents filed by USAs in cases of national security, terrorism, criminal cybersecurity cases, or public official investigations. Talk about sensitivity!

It wouldn't take a le Carré-esque spy novel to concoct all the potential scenarios that fit into a breached HSD storyline, and it wouldn't need his iconic plotting to determine the risks, either, should HSDs become vulnerable to foreign actors.

Last week the House Committee on the Judiciary convened hearings to understand about the threats and risks we face when foreign hackers breach the courts' security systems. It's looking beyond the most apparent effects, which have already become integral to all sorts of pending litigation surrounding foreign intelligence and national security cases.

You may be inclined to nonchalantly watch this play out from afar. National security, while an important topic to everyone in America, rarely seems to find a nexus with our day-to-days. See, however, the federal government's authority under Section 702 of the Foreign Intelligence Surveillance Act. Now, if you're in the know about Section 702, you might cry "Foul!" here. "C'mon Ed, you and I both know that 702 governs collecting data on foreign intelligence from non-Americans located outside the United States." Mm-hmm.

Let's spin through the transcript of the Committee's hearings where one member explains what 702's naysayers have contended since FISA came into effect in 2008. Section 702, just between December 2020 and November 2021, allowed 3.4 million searches of American's correspondence. The rationale? It's the phrase in 702 reading "incidental collection," which appears to point to some incident such that, for example, a foreign surveillance target Cc:'d a bunch of Americans, so now they're on the target list.

In other words, the bitter irony is that some of our most adversarial foreign state actors stood up hacking teams. They were charged with infiltrating the federal court system to directly influence ongoing national security litigation by gaining access to HSDs, and who-knows-what else? Plus, bonus points for them because Section 702 devolved so quickly during the past 13 years that millions of Americans' emails are being caught up in its FISA authority. Our own government is facilitating those same foreign entities' look-see into your and my private correspondence, potentially. It's layer upon layer of Keystone Coppery, in terms of cybersecurity.

The United States Government Accountability Office published a report last week about AO's cybersecurity, especially since 2020, and concluded that it's certainly not turning out to have inspired a more secured administration of justice, technologically speaking at minimum. The GAO advised the AO to simply implement 18 new initiatives and follow just 23 best practices not currently adhered to. This is not the result that coming cigar-close warrants. Two initiatives, seemingly basic in terms of organizational efficacy, are found first in the report's title: "Action Needed to Improve IT Management and Establish a Chief Information Officer." How novel! Improve management and hire a CIO.

The AO already answered that they will evaluate the report and determine what to incorporate from it. Sweet. Problems solved. It's quite easy to critique the AO and all these shortcomings from the comfort of an armchair expert's seat. I embrace that the federal judiciary is obviously immense, complicated, widespread, and an administrative behemoth, like most three-letter agencies. Even excluding the extremely sensitive and authoritative Supreme Court operations, these reviews and all the likely change will affect the Court of International Trade; the Court of Federal Claims; 94 district courts; 90 bankruptcy courts; and 13 appellate courts. Each body having levels of administration within it, as well.

Clearly the AO and its governing body, the Judicial Conference of the United States, have a ton of work to handle. It must be done yesterday. It must be done perfectly. And, it must lead to results that secure your and my information, and HSDs.

Ed Zuger is a professor of cybersecurity, an attorney, and a trained ethicist. Reach him at edzugeresq@gmail.com.