Hearing raises privacy questions over FBI's Carnivore
JULY 25—Members of the House Judiciary Subcommittee on the Constitution grilled FBI and Justice Department officials Monday afternoon over the FBI's use of its Carnivore e-mail filtering system. The hearing addressed concerns over whether the tool violates Fourth Amendment privacy protections.
By Shruti Dat'
GCN Staff
JULY 25Members of the House Judiciary Subcommittee on the Constitution grilled FBI and Justice Department officials Monday afternoon over the FBI's use of its Carnivore e-mail filtering system. The hearing addressed concerns over whether the tool violates Fourth Amendment privacy protections.
'We need innovative, new law enforcement strategies to combat the real and growing threat of cybercrime. U.S. law enforcement needs to focus resources on the training and expertise necessary to protect our cybersecurity,' said Rep. J.C. Watts (R-Okla.).
But Watts added: 'The FBI's record on protecting privacy is problematic. From unwarranted wiretaps to its mishandling of hundreds of files on political appointees just a few years ago, there is ample cause for concern.'
Developed as the Internet equivalent of the telephone wiretap, FBI officials said the bureau uses Carnivore under strict court orders as a tool to gather communications as evidence in criminal cases. The application can be configured to capture e-mail messages sent to and from a suspect's address (see story at www.gcn.com/vol1_no1/daily-updates/2489-1.html).
Under the Title III amendment to the Omnibus Crime Control and Safe Streets Act and the Electronic Communications Privacy Act, the FBI also can request to collect e-mail containing keywords. Carnivore can be configured to intercept specific e-mail messages when installed on an Internet service provider's network.
Donald M. Kerr, director of the FBI lab division, said Carnivore captures the minimum amount of information necessary. E-mails not covered by the court order are discarded, he said.
This year, the FBI has used Carnivore in six criminal cases and 10 national security investigations. Since deployment, the bureau has used it 25 times, according to the FBI.
'We don't capture information we don't need,' Kerr said. The FBI removes the equipment at the end of the court-ordered period, which is usually about 30 days.
'The proper balance is key. Carnivore is a tool that helps us achieve that balance,' said Kevin V. DiGregory, deputy associate attorney general.
Technology and privacy experts, however, said the scope of the application is broader and more invasive than the FBI admits.
'Carnivore is not a minimization tool, but a maximization tool,' said Barry Steinhardt, associate director of the American Civil Liberties Union. 'Congress never authorized the FBI to access unlimited communications.'
FBI officials have said they developed Carnivore because Internet service providers could not isolate specific communications requested by the bureau.
Peter William Sachs, president of Iconn L.L.C., a New Haven, Conn., Internet service provider, said his technical staff easily could set up a system to conduct e-mail interceptions with two lines of code. Sachs said if Carnivore were installed on Iconn's network, it would provide hackers a new door to enter and would slow down performance.
'I believe Carnivore violates the privacy rights of every person using the services of an ISP to which it is attached,' Sachs said.
NEXT STORY: The ASP Question