FC: DoJ study says Carnivore OK; FOIA documents say no way

[Declan McCullagh <declan () well com>]

http://www.wired.com/news/politics/0,1283,40304,00.html

   Report: Carnivore Works Just Fine
   Associated Press
   3:30 p.m. Nov. 20, 2000 PST

   WASHINGTON -- The Chicago law school dean who reviewed the FBI's
   controversial e-mail surveillance tool said Monday his report
   concludes it works the way the bureau described and generally doesn't
   "overcollect" evidence as feared by privacy advocates.

   On the eve of the Justice Department's release of his review findings,
   Henry H. Perritt Jr., dean of the Illinois Institute of Technology's
   Chicago-Kent College of Law, said the report contains recommended
   improvements to the Carnivore system both for efficiency and privacy
   that likely won't be made public Tuesday.

   [...]

*********

http://www.msnbc.com/news/492929.asp

   Draft's findings represent victory for the FBI
   By Ted Bridis
   THE WALL STREET JOURNAL
   WASHINGTON, Nov. 21 -- A draft review of the Federal Bureau of
   Investigation's "Carnivore" Internet surveillance system expresses
   confidence overall in the government's continued use of the
   eavesdropping software.

          BUT IT ALSO URGES changes in the way agents adjust the
   program's intricate settings for fear that simple errors could allow
   the FBI to mistakenly capture e-mail, Web browsing or other data from
   innocent citizens.
          The draft study, being released Tuesday by the Justice
   Department, also will urge FBI engineers to build better mechanisms
   into Carnivore to detect tampering with digital evidence. But the
   draft's findings generally represent a victory for the bureau, which
   had faced a firestorm of criticism over its software's capabilities.

   [...]


*********

FOR IMMEDIATE RELEASE             CONTACT:
November 16, 2000                 David Sobel or Wayne Madsen
                                  202-483-1140

       NEWLY-RELEASED FBI DOCUMENTS SHOW CARNIVORE CAN
       SWALLOW MUCH MORE INFORMATION THAN BUREAU CLAIMS

WASHINGTON, DC - Newly-released documents concerning the FBI's
"Carnivore" Internet monitoring program suggest that the system
might capture far more information than the Bureau has claimed
publicly.  The documents were disclosed to the Electronic Privacy
Information Center (EPIC) as part of a Freedom of Information Act
lawsuit filed by the privacy rights organization.

One of the documents, dated June 5, 2000, reports the results of
tests performed on Carnivore version 1.3.4, which is currently in
use.  The report indicates that Carnivore, contrary to FBI
assertions, is capable of capturing and archiving "unfiltered"
Internet traffic.  It states:

     Carnivore was tested on a real world deployment [deletion]
     having recently come back from a deployment.  The machine
     had a single 300MHz PII processor running Win NT4 SP6
     Workstation.  There were 384MB of RAM but the hard disk was
     relatively small at 1.19GB.  This [deletion] has both Zip and
     Jaz drives.

     This PC could reliably capture and archive all unfiltered
     traffic to the internal hard drive (HD) at [deleted].

The FBI's public defense of Carnivore has centered on the claim that
the system only captures traffic that has been isolated by a
software filter that "minimizes" collection and limits it to the
particular information authorized for seizure in a court order.
Thus, in testimony before the Senate Judiciary Committee on
September 9, 2000, FBI Assistant Director Donald M. Kerr stated:

     If the subject's identifying information is detected [by
     the filter], the packets of the subject's communication
     associated with the identifying information that was detected,
     and those alone, are segregated for additional filtering or
     storage.  However, it s critically important to understand
     that all . . . other communications are instantaneously
     vaporized after that one second.  They are totally destroyed;
     they are not collected, saved, or stored.

The new disclosure comes on the eve of an important milestone in the
debate over Carnivore.  An independent review team from the Illinois
Institute of Technology Research Institute (IITRI) is due to file a
draft "technical report" on the Carnivore system with the Justice
Department tomorrow (November 17).  That report will not be made
public until it has been reviewed, and possibly edited, for release
by Department officials.

According to David Sobel, General Counsel for EPIC, the
newly-released information underscores the need for full public
disclosure of Carnivore's capabilities.  "The little information
that has become public raises serious questions about the privacy
implications of this technology," he said.  "The American public
cannot be expected to accept an Internet snooping system that is
veiled in secrecy."

EPIC filed the FOIA lawsuit after the FBI revealed that it had
developed an Internet monitoring system that would be installed at
the facilities of an Internet Service Provider (ISP) and would
monitor all traffic moving through that ISP. EPIC's lawsuit seeks
the public release of all FBI records concerning Carnivore,
including the source code, other technical details, and legal
analyses addressing the potential privacy implications of the
technology.

EPIC is a public interest research organization in Washington, DC.
More information about the case, including a scanned image of the
document quoted above, is available at the EPIC Carnivore Litigation
Page:

     http://www.epic.org/privacy/carnivore/foia_documents.html

                      - 30 -




-------------------------------------------------------------------------
POLITECH -- the moderated mailing list of politics and technology
You may redistribute this message freely if it remains intact.
To subscribe, visit http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------