Carnivore is not a meat-eating animal
By Jim Bumgarner
"Carnivore" is Internet-surveillance software, a politically correct term for the FBI's electronic eavesdropping system. According to what the FBI has told a congressional oversight panel, the system is used only when approved by a judge. In a further effort to convince the committee of the software importance to the nation, the FBI mentioned that they need to use it for detection of terrorists in addition to capture of criminals.
In order to defend its position, it says it will let federal judges and others observe during each investigation in order that they may see how the covert monitoring operates. Further, the FBI says it intends to show the programming of the surveillance system to some unnamed organization. That unnamed organization would, in turn, assure the public that the software works only as described. This procedure is unlikely to satisfy the general public that the government does not have access to information from such persons under surveillance, and that it does not have the ability to gather irrelevant information from them.
According the head of the FBI laboratory where Carnivore was developed, its use is subject to vigorous internal reviews, and it misuse would be a felony. Of course, those who use the Internet and e-mail have reason to be suspicious of such assurances, if they have no way to verify them. Moreover, the secrecy surrounding the programming of the software is closely guarded by the FBI and the Justice Department. Admittedly, it may be a felony to misuse the product, but any number of felonies are committed daily without ever being detected. To counter this argument, the FBI asserts that disclosure of the programming would permit hackers to defeat the system rendering it useless.
How it works: although it is not clear just how it does so, a computer containing Carnivore software connects to a Internet-service provider's network and monitors every byte that passes thought it. While doing this, it detects information meant for the suspect and makes copies of it. Neither is it clear whether the government's computers intercept all of the traffic moving to and from the Internet provider's computers, or that they just intercept messages addressed to the person under surveillance. According to releases, the FBI installs a Carnivore unit at the providers network station and configures it to capture only e-mail to or from someone under investigation. Considering the billions of digital bits that enter, leave, become stored, and get deleted from even a peripheral Internet server, this is a formidable system.
According to the government's assertions, its use is not yet pervasive. As of July of this year, the software was being used for six criminal cases and ten national security investigations. If it is as good as one suspects, that number should increase geometrically in a short period of time.
Meanwhile, perhaps the congressional committees hearings will be overtaken by the courts. A civil liberties organization, Electronic Privacy Information Center, has asked, under the federal Freedom of Information Act, for all the documents about the development of Carnivore and how it is used. The U.S. District Court in Washington, D.C. has given the Justice Department until August 16 to explain either when it will be able to produce the documents or begin production of them. According to the Justice Department, the FBI has 3,000 pages of documents about its Carnivore e-mail surveillance system and expect to begin releasing them to the public in about 45 days from August 16, 2000. They say additional pages will be released every 45 days as they evaluate additional pages for releaseability. They are not specific about the contents of the first release, nor of the releases to come.
None of these disclosures indicate what the surveillance authorities will do if the transmission is encrypted. Apparently, they are satisfied that they can decrypt the information, as no point is raised as to the earlier demand that all encryption algorithms contain a key giving access to the government. And the prohibition against providing encryption for overseas use has been lessened.
Obviously, what the privacy organization wants is the source code so that it can replicate the software. Such an extremely broad court order is unlikely. Undoubtedly, some compromise will be reached, such as disclosure to a federal judicial panel or a congressional committee. Both judges and congressional committees often deal with highly secret matters of national interests. At the same time, the users of the Internet are adamant about preserving free and unfettered use of this medium. Nothing short of some assurance that the system not be used in any way whatsoever except by one-at-a-time judicial approval similar to search warrants, will be begrudgingly accepted. That would seem to call for some method of escrowing the source code.
%20Initial.GIF)