Carnivore - Bill Addresses E-mail Surveillance

Bill Addresses E-mail Surveillance

By D. IAN HOPPER Associated Press Writer

July 27, 2000

WASHINGTON (AP) _ Attorney General Janet Reno said Thursday
she will not suspend the FBI's court-approved monitoring of
some people's e-mail messages while the law enforcement
program is under review at the Justice Department.

"I think that" FBI "agents can still use it" during the
review of the FBI's new "Carnivore" surveillance system,
Reno said at her weekly news briefing.

Reno said it is important "that we be able to explain the
process and address the issues raised by the industry,
privacy experts and others." She said her hope is that "we
will be able to address these issues in a thoughtful way and
resolve them."

Reno's comments came amid a move in Congress to increase the
burden on federal law enforcement agencies to justify
monitoring people's e-mail messages and other
communications.

Rep. Bob Barr confirmed that he and his staff are at work on
a bill that would rein in "Carnivore" and place additional
restrictions on telephone wiretaps as well.

Barr, R-Ga., said he was concerned about computer
eavesdropping capability before attending a hearing on
Capitol Hill earlier this week, and he said he "came out of
it scared."

Privacy advocates and computer experts called Carnivore a
"black box" in testimony Monday, and said only the FBI
knows what it truly does. They also contended that
information the FBI gets from the device, installed at a
suspect's Internet service provider, is far more than what
could be gleaned from a telephone wiretap and statutes
governing telephone surveillance are being misused.

In a telephone "trap-and-trace" or "pen register"
wiretap, authorities can get a list of phone calls made to
and from a certain telephone number. The usable information
is limited to the 10-digit telephone numbers and the time of
calls; the phone company, when given a court order, provides
the information.

Current laws and judicial precedent say that the numbers a
person dials are not private communications, and therefore
authorities do not need to show that a crime has been
committed.

With Carnivore, that statute is being extended to the
Internet world.

The details of Barr's bill aren't clear yet, but he said it
would address the issue of translating telephone wiretap law
to the Internet by designing strict constraints for
monitoring the medium. It would also make sure that evidence
gained from an e-mail tap would not yield more information
than a similar court order for a telephone tap.

The FBI's new surveillance mechanism sits at the subject's
ISP and scans the addressing information coming from or
going to the suspect's computer. This can reveal far more
information than a simple e-mail address, such as a subject
line describing the contents of the message.

"Capturing Internet origin and destination address instead
of 'numbers dialed' could create a much more intrusive form
of surveillance that is not clearly supported by law," said
Alan B. Davidson, staff counsel at the Center for Democracy
and Technology.

For authorities to be able to request e-mail contents they
must show probable cause and obtain a search warrant. The
same is true for listening in on a telephone call.

Regarding the inner workings of Carnivore, the FBI is
resisting a Freedom of Information Act request by the
American Civil Liberties Union for Carnivore's computer
code, but said it will submit to an external review.

Since the Carnivore computer, devoid of keyboard and mouse,
sits at the suspect's ISP and is locked down from any
manipulation from non-FBI personnel, Internet providers have
bristled at the idea of letting it sit on their networks.

Donald M. Kerr, assistant director of the bureau's
laboratory division, said in an interview that the FBI would
love to have the ISP provide the information authorities
need, but the cost and technical knowledge can be
prohibitive for small Internet companies.

Peter William Sachs, a lawyer and president of ICONN, a
small Internet provider in Connecticut, said the job could
be done with two lines of computer code, and called it a
"trivial" task.