Capital Gazette wins special Pulitzer Prize citation for coverage of newsroom shooting that killed five

FBI taps of e-mail provoke concerns


WASHINGTON -- To civil libertarians and Internet service providers, a device created by the FBI to snoop through e-mail messages is as ominous as its name: "Carnivore."

Attached to an ISP's server, the contraption sifts through countless e-mail messages and copies specific information for federal agents seeking suspected criminals, including terrorists and child pornographers.

But critics say that, in the process of sifting out communications from its targets, Carnivore is also capable of retrieving the private messages of innocent people.

"This is a very dangerous device," said Barry Steinhardt, associate director of the American Civil Liberties Union. "It's unprecedented. It's the first time law enforcement has carte blanche access to the entire service provider's network."

The controversy surrounding the device with the foreboding name has caught the attention of Republican lawmakers, and a House Judiciary subcommittee is scheduled to hold a hearing on the matter today. Opponents and authorities who support the use of Carnivore are scheduled to testify.

After the system was disclosed in recent news accounts, sparking criticism from privacy advocates, FBI officials met with lawmakers and reporters to try to show that Carnivore is not nearly as intrusive as some fear.

For one thing, FBI officials said, they need the device to combat crime and threats to national security. They describe Carnivore as a "surgical" tool that would protect ordinary people from unintended searches.

"There are filtering mechanisms built in that limit the amount of information viewable to the human eye," said Paul Bresson, a spokesman for the bureau. "It ensures that only the exact communications authorized by a court are what we intercept."

For decades, federal agents and local police have been wiretapping suspects' phones after obtaining permission from judges. But those wiretaps are limited to a specific suspect and do not comb through phone calls at random.

Carnivore works much differently, though authorities still must obtain permission from a judge to scour e-mail messages or discover which Web pages a suspect visits.

Once they have court approval, agents attach the Carnivore device -- an ordinary-looking desktop computer -- to the ISP's main computer, and Carnivore "passively" sniffs through streams of data, FBI officials said.

Carnivore does not read e-mail messages or their subject lines, officials said. Instead, it searches for computer codes that direct the message to and from the suspect. Nor can it scan e-mail messages for key words, like "drugs or bomb," an FBI official said.

In other words, authorities say, Carnivore acts like an FBI agent authorized to scan envelopes sent by mail. The agent seeks a particular suspect's addressing information and pulls aside any qualified envelope and opens it.

Last week, after an outcry from critics, the White House said it would propose legislation to, among other things, require agents to seek Justice Department clearance before asking judges to authorize the use of Carnivore in a specific case. Such rules already cover voice wiretaps.

But the proposal was dismissed by civil liberties groups, who said it did not go far enough in protecting electronic communication.

For their part, FBI officials say, the White House proposal is not necessary: They say they abide by the rules governing voice wiretaps to use Carnivore.

Despite the assurances of FBI officials, civil liberties groups and congressional Republicans say they are wary of the system.

"It has the capability of grabbing it all," said Richard Diamond, a spokesman for Rep. Dick Armey, the Texas Republican who is the House majority leader and a sharp critic of Carnivore. "It all depends on who pushes the button. Someone could push the wrong button and have access to all sorts of information."

FBI officials dispute that assertion, though they concede that Carnivore has sometimes captured e-mail messages and data that were not targeted in their searches. They say they sealed such information and did not read it.

Earlier this year, an ISP tried unsuccessfully to prevent FBI agents from installing Carnivore on its network. After a brief court fight, the company, Earthlink, yielded to FBI demands and helped install the device.

FBI officials say they don't mind simply asking ISPs to provide them with e-mail sent by criminal suspects if that is possible. But, in most cases, agents would rather use Carnivore because it helps maintain security for criminal evidence. And many smaller ISPs are not capable of creating programs to obtain the necessary data, FBI officials said.

Though most ISPs have complied with court orders to install Carnivore, one major provider said it would refuse.

"We're not going to stand for this," said William L. Schrader, chairman and chief executive officer of PSINet Inc. "It's insidious. If they were to ask us with a court order to violate the privacy of all our customers, we would take this to the Supreme Court."

Authorities say that more criminals, especially those involved in child pornography and fraud, are increasingly using the Internet and e-mail to commit crimes.

About three years ago, agents and federal prosecutors began asking for real-time access to e-mail and Web-site visits, FBI officials said. The agents said they were worried about not having reliable and up-to-date intelligence.

FBI technicians began developing Carnivore, which was used for the first time about 18 months ago, authorities said. FBI officials declined to disclose any information about Carnivore-related cases but said the system has been used fewer than 25 times.

FBI officials said the "unfortunate" choice of a name emerged during internal discussions of the program. At first, technicians called it "Omnivore" because it ate everything in sight. But as the system became more refined, technicians felt it needed a better name and changed it to Carnivore: a meat-eater.

"We're looking at how we name a lot of projects right now," an FBI official said. "This has been sobering."

FBI agents noted that they don't need Carnivore to read most old e-mail messages stored on ISP servers; they can already do so with court approval.

They described the Carnivore system as a last-resort measure to capture real-time communications.

Authorities on technology and society say they are hardly surprised that the system has generated anxiety, because many people now send more personal information over e-mail than over the phone.

Corporate snooping of employee e-mail and the unauthorized sale of client information by e-retailers have unnerved many computer users.

Copyright © 2019, The Baltimore Sun, a Baltimore Sun Media Group publication | Place an Ad