An independent review of Carnivore, the U.S. Federal Bureau of Investigation’s (FBI’s) Internet surveillance tool, has found that the system provides an investigator with no more information than is allowed when court orders are properly used.
The Illinois Institute of Technology in Chicago issued its report on Carnivore Tuesday. U.S. Attorney General Janet Reno ordered the review after concerns surfaced that Carnivore was capable of intercepting Internet communications outside of court-ordered parameters. The U.S. Department of Justice (DOJ) published the institute’s draft report on the DOJ Web site, although elements deemed technically sensitive were deleted.
The institute researchers who conducted the review concluded that “Carnivore reduces, but does not eliminate, risk of both intentional and unintentional unauthorized acquisition of electronic-communication information by FBI personnel, but introduces little additional risk of acquisition by persons other than FBI personnel.”
While traditional wiretaps are hooked into a single phone line, Carnivore requires the FBI to link directly into the Internet pipeline for an ISP (Internet service provider). Because Carnivore checks the IP (Internet Protocol) address of every incoming and outgoing information packet to determine which belong to a suspect under surveillance, ISPs voiced concern that the system could compromise subscriber privacy.
Unlike phone wiretaps, which allow law enforcement authorities to produce only a list of phone numbers, surveillance on the packet-switched Internet can reveal e-mail addresses, e-mail header information, IP addresses, dial-up numbers and e-mail logs. Critics raised concerns that Carnivore could be used to collect the IP addresses of all Web users who access a particular Web page, for example.
The draft report indicated that Carnivore’s filtering system was capable of protecting citizens from unauthorized surveillance, but noted: “while operational procedures or practices appear sound, Carnivore does not provide protections, especially audit functions, commensurate with the risks.”
The FBI’s “initial reaction overall is quite positive,” said Paul Bresson, a FBI spokesman. “I think the review overall will benefit everyone. It provides for feedback … it makes the way we do business better. There were constructive recommendations made, and in the development of Carnivore we will take many of these things into account. I think the report overall gave Carnivore a passing grade.”
Critics have assailed the review as biased in favor of the government. Harvard University and the Massachusetts Institute of Technology in Massachusetts, Purdue University in Indiana, Dartmouth University in New Hampshire and the Supercomputing Center at the University of California at San Diego all declined to review the system, citing restrictive requirements laid down by the FBI. Critics have also pointed to the relationship between Illinois Institute of Technology reviewers and government law enforcement agencies as a source of bias.
“What surprises me is not that the review team is telling reporters that they gave a thumbs-up to Carnivore, but that they expect anyone outside of the government to take this report seriously,” said Barry Steinhardt, associate director of the American Civil Liberties Union (ACLU), in a statement on the organization’s Web site.
“This report is, at best, a fuzzy snapshot of Carnivore, and it will be obsolete in two months when the FBI comes out with the next version of Carnivore,” Steinhardt said in the statement.
Bresson called the review “fair and independent.” The DOJ, as might be expected, agreed.
“We have full confidence in the (review) team,” said Chris Watney, a DOJ spokeswoman. “We are satisfied that the review team has put a lot of work into this, and made a lot of thoughtful comments,” she said, adding that the DOJ disagrees with criticisms of the review team’s independence.
The draft review can be found at http://www.usdoj.gov/jmd/publications/carnivore_draft_1.pdf/.