Critics Attack FBI E-Mail Snooping Device
AP News
July 12, 2000
WASHINGTON (AP) -- Civil liberties and privacy groups are
railing against a new system designed to allow law
enforcement agents to intercept and analyze huge amounts of
e-mail in connection with an investigation.
The system, called "Carnivore," was first hinted at on April
6 in testimony to a House subcommittee. Now the FBI has it
in use.
When Carnivore is placed at an Internet service provider, it
scans all incoming and outgoing e-mails for messages
associated with the target of a criminal probe.
In a letter addressed to two members of the House
subcommittee that deals with Fourth Amendment
search-and-seizure issues, the American Civil Liberties
Union argued that the system breaches the Internet
provider's rights and the rights of all its customers by
reading both sender and recipient addresses, as well as
subject lines of e-mails, to decide whether to make a copy
of the entire message.
Further, while the system is plugged into the Internet
provider's systems, it is controlled solely by the law
enforcement agency. In a traditional wiretap, the tap is
physically placed and maintained by the telephone company.
"Carnivore is roughly equivalent to a wiretap capable of
accessing the contents of the conversations of all of the
phone company's customers, with the 'assurance' that the FBI
will record only conversations of the specified target,"
read the letter. "This 'trust us, we are the government'
approach is the antithesis of the procedures required under
our wiretapping laws."
Barry Steinhardt, associate director of the ACLU, said
citizens shouldn't trust that such a sweeping data-tap will
only be used against criminal suspects. And even then, he
said, the data mined by Carnivore, particularly subject
lines, are already intrusive.
"Law enforcement should be prohibited from installing any
device that allows them to intercept communications from
persons other than the target," Steinhardt said in an
interview. "When conducting these kinds of investigations,
the information should be restricted to only addressing
information."
A spokeswoman for Rep. Charles T. Canady, R-Florida, who
heads the House Judiciary subcommittee on the Constitution,
said the congressman had no comment on the letter.
In testimony to Canady's subcommittee, Robert Corn-Revere, a
lawyer at the Hogan & Hartson law firm in Washington, said
he represented an Internet provider that refused to install
the Carnivore system. The provider was placed in an "awkward
position," Corn-Revere said, because the company feared
suits from customers unhappy with the government looking
into all the e-mail.
"It was acknowledged (by the government) that Carnivore
would enable remote access to the ISP's network and would be
under the exclusive control of government agents,"
Corn-Revere said.
Corn-Revere told the committee that current law is
insufficient to deal with Carnivore's potential and that the
Internet provider lost its court battle in part because of
the Internet's connection to telephone lines, and that the
law was stretched to cover the Internet as well.
Corn-Revere would not reveal the name of his client, and the
client lost the case. He said the FBI has been using
Carnivore since early this year.
James X. Dempsey, senior staff counsel at the Center for
Democracy and Technology, said the main problem with
Carnivore is its mystery.
"The FBI is placing a black box inside the computer network
of an ISP," Dempsey said. "Not even the ISP knows exactly
what that gizmo is doing."
But Dempsey said Internet providers contributed to the
problem, by saying that current technology does not allow
the Internet provider to sort out exactly what the
government is entitled to get under a search warrant. The
carriers complained that they had to give everything to the
FBI.
"The service providers said they didn't know how to comply
with court orders," Dempsey said. "By taking that position,
they have hurt themselves, putting themselves into a box."
Marcus Thomas, who heads the FBI's cybertechnology section,
told the Wall Street Journal that the bureau has about 20
Carnivore systems, which are PCs with proprietary software.
He said Carnivore meets current wiretapping laws, but is
designed to keep up with the Internet.
"This is just a specialized sniffer," Thomas told the
Journal, which first reported details about Carnivore.
Encrypted e-mail, done with an e-mail encoding program like
PGP, still stays in code on Carnivore, and it's up to agents
to decode it.
Dempsey has a possible solution to the problem, though one
that's probably unlikely -- show everyone what it does and
how it does it, allowing Internet providers to install the
software themselves.
"The FBI should make this gizmo an open-source product," he
said. "Then the secret is gone."