Justice Dept Seeks Carnivore Review

By MICHAEL J. SNIFFEN Associated Press Writer

August 24, 2000

WASHINGTON (AP) _ WASHINGTON (AP) _ The Justice Department formally asked
outside technical experts Thursday to review whether the
FBI's "Carnivore" e-mail surveillance system has adequate
protections against abuse.

The department posted a 63-page description of the technical
review on its website for bids by outside contractors. It
hopes a major university will undertake and complete the
task this fall.

The technical review, to be followed by public comment and
an internal Justice Department review, is designed to
present Attorney General Janet Reno with recommendations by
Dec. 8 on how to respond to criticism of the system from
Congress and privacy advocates.

David Sobel, counsel for the Electronic Privacy Information
Center, a civil liberties group, said that, while the review
would be "a good exercise to add to the knowledge about
Carnivore, this review will not be able to resolve all the
questions, either technical or legal."

The Carnivore system, installed by the FBI on the network of
Internet service providers, has software that scans Internet
traffic as it moves through that provider's network. The FBI
says it configures the software to capture e-mail to or from
someone under investigation and that court orders limit
which e-mails agents can see.

But privacy advocates say only the FBI knows what Carnivore
can do, and Internet providers are not allowed access to the
system. They ask why the FBI retains remote control of
Carnivore equipment and doesn't just give it to Internet
providers so they can comply with court orders.

The government's review description said it wants to know:

_ If the operators obey the law, will Carnivore provide
agents with all the information they ought to see, but only
that information?

_ Will Carnivore risk harming an internet service provider's

_ Does Carnivore introduce new risks that FBI agents or
others will gain intentional or unintentional access to
electronic communications they have no right to see?

_ Are Carnivore's operational procedures and built-in
protections adequate to prevent such unauthorized access?

Sobel said those questions "underscore the other question:
Why is the government refusing to suspend use pending review
when there are all these serious about its use? It seems
irresponsible to keep using a system that raises this many

Assistant Attorney General Steve Colgate, head of the
internal review team, said the system remains in operation,
under court orders and general oversight by Justice
Department lawyers.

Last month, FBI officials told Congress that Carnivore has
been used 25 times, including in 10 national security and
six domestic criminal cases this year. None of the cases has
gone to trial, so the FBI has not disclosed details.

Prospective contractors were asked to submit proposals by
Sept. 6. Reno will pick one by Sept. 15. The contract is to
be awarded Sept. 25. A report is due by Nov. 17. And a final
version of the report, incorporating public comment, is due
Dec. 8.

Sobel noted, however, that the entire technical review will
not be made public for comment. "There's a real question
how much the public will see," he said.

The department said that as much of the report would be
released as possible, but not trade secrets of the
contractors who developed it or anything that would
undermine "the effectiveness of Carnivore as a tool" for
law enforcement.