U.S. Lawmakers Probe FBI Net Spying

A U.S. House of Representatives subcommittee heard conflicting testimony Monday over whether the Internet surveillance system being operated by the Federal Bureau of Investigation (FBI) under the code name “Carnivore” threatens privacy in an age when government intrusion into personal communications is already considered by many to be out of control.

Law enforcement officials told the subcommittee that Carnivore is a necessary weapon in their arsenal to police the infinite range of cyberspace, which they say has fallen prey to many new forms of crime.

The Carnivore system is a combination of hardware and software that law enforcement agencies attach directly to the network of an Internet Service Provider (ISP) to intercept the contents of the electronic communications of a specific person or “target.” Carnivore can weed out the specific information it wants from large amounts of network traffic, finding the so-called “meat.”

The system analyzes millions of messages per second while it looks for the messages it wants.

New Weapon in Cyberspace

According to the government, the Internet is increasingly used for illegal activities, such as the anonymous distribution of child pornography and the theft of proprietary information through system hacks. Law enforcement officials also point to the use of the Internet’s efficiency and range to conduct massive fraud and terrorist attacks.

FBI Assistant Director Donald Kerr said that Carnivore “strike[s] a reasonable balance between competing interests — the privacy interests of telecommunications users, the business interest of service providers, and the duty of government investigators to protect public safety.”

Justice for All

The U.S. Department of Justice — which is charged with overseeing the FBI and protecting the rights of all Americans — agrees that the escalating incidence of computer crime makes developments like Carnivore essential.

“Our vulnerability to computer crime is astonishingly high and threatens not only our financial well-being and our privacy, but also this nation’s critical infrastructure,” said Deputy Assistant Attorney General Kevin DiGregory.

Government Out of Control?

Though law enforcement agencies are eager for the chance to get on even footing with cyber-criminals, privacy advocates argue that Carnivore tramples the Constitution’s Fourth Amendment protection against unlawful search and seizure.

According to American Civil Liberties Union (ACLU) Associate Director Barry Steinhardt, wiretapping and electronic surveillance are already at record levels, and more than 80 percent of law enforcement’s intercepted communications in the past few years did not produce useful evidence for government investigations.

Citing federal government-reported statistics, Steinhardt said that in 1999 about two million innocent conversations were intercepted in law enforcement electronic surveillance. While the number of opportunities to intercept communications is increasing, due to the growing variety of communications methods for both voice and text, the government’s ability to accurately select the incriminating exchanges is dropping, according to Steinhardt.

Steinhardt added, “Carnivore is a dramatic example of this new digital reality.”

Traffic Report

In some ways, Carnivore is more dangerous than the traditional phone wiretap, because it gives the FBI access to all of the traffic over an ISP’s network, not just the communications to or from a particular target, according to Tom Perrine, a computer security expert with the San Diego Supercomputer Center.

“It would be trivial for the FBI to monitor ten or a hundred or a thousand or more people with a single Carnivore system, using a wiretap order which only authorized monitoring of a single subject,” Perrine told the subcommittee.

There is no way for an outside entity to know the how the Carnivore system has been configured in each installation without examining the source code of the system during installation and while the suspect communications are being monitored, Perrine explained.

“This ‘trust us, we are the Government’ approach is the antithesis of the procedures required under our wiretapping laws,” the ACLU’s Steinhardt said. “The very premise of the Fourth Amendment is that searches should be narrow and targeted so as to avoid intrusion into the privacy of persons who are not suspected of engaging in crime.”

However, the Justice Department argues that the combination of detailed court orders, the federal wiretap statute’s current monitoring system and Carnivore’s built-in privacy protection mechanisms create a system of privacy checks.

Justice Department attorney DiGregory said, “One of the most powerful privacy-protecting features of Carnivore is its ability to ignore information that is outside the scope of the court-ordered authority.”

A Less Intrusive Solution

Carnivore opponents say that law enforcement agencies could obtain much of the same data they are seeking with Carnivore by working in cooperation with the ISPs. If the FBI and other agencies could obtain court orders to gain access to the targeted communications data ISPs control, the ISPs would be better able to reassure a consumer base that has grown increasingly wary of threats to their privacy, consumer advocates argue.

However, the FBI’s Kerr said that while ISP cooperation is essential and can be ensured with a separate court order, in many cases the ISPs do not have the technical capability to obtain the information the law enforcement agencies need in a secure manner.

Short of allowing ISPs to provide the data law enforcement agencies need, staff counsel for the Center for Democracy and Technology Alan Davidson called for the requirement that Carnivore use an open-source technology model to allow the public to get a close look at how it works.

New Laws Needed?

Privacy activists are calling for an update of the wiretap statute and other federal laws regulating the government’s interception of communications to account for technology advances such as e-mail and the Internet.

“This current debate over the FBI’s new digital wiretap tool,” Perrine told the committee, “is really about the risks in naively attempting to simply translate the policies, law and practices of telephone wiretaps into the digital realm of the Internet.”

President Clinton supports improved standards for intercepting electronic communications in the digital age, and plans to submit a broad proposal for updating privacy laws covering cyberspace to Congress this summer. In addition, the administration supports guidelines requiring federal judges to confirm that stricter requirements are met before they issue certain types of surveillance orders.

Call to Action

The Republicans also chimed in on the Carnivore debate, calling it a “dangerous invasion of privacy.”

House Republican Conference Chairman J.C. Watts of Oklahoma issued a statement Monday calling on the Clinton administration to suspend the new surveillance program until its developers can ensure better privacy protections.

“Before we impose privacy restrictions on the commercial industry, it seems the federal government has a duty and an obligation to honor the privacy of the people it has sworn to protect,” Watts said.