Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Censorship

Emergency Hearing About Carnivore - Updated 248

Joe Moloughney was the first of several folks to point out that an emergency hearing is scheduled for 19:30GMT (3:30 Washington time) regarding disclosure of information about the FBI's Carnivore data surveillance system. The Electronic Privacy Information Center (EPIC) filed suit (pdf) and were granted the hearing because their request for details on how Carnivore works (under the Freedom of Information Act) have not yet been acted upon. [Updated 11:45GMT by t] voodoogumbo writes with an updated from Fox News that "[t]he courts declined to unwrap Carnivore."
This discussion has been archived. No new comments can be posted.

Emergency Hearing About Carnivore's Workings

Comments Filter:
  • I glad you laught as much as I did "bouncer guy" !!

    wiZd0m [wizd0m.net]

  • I beleive you may be misinterprating the request. The request for all records on Carnivore likely refers to asking for the technical details of how the system works and does what it is made to do, not the records stored in the Carnivore system itself.

    -={(Astynax)}=-
  • by mindstrm ( 20013 ) on Wednesday August 02, 2000 @10:00AM (#885042)
    What impressed me was that what mindspring did was extremely logical.
    They simply said 'Look, if a court orders (or a judge issues a warrant, etc) data to be obtained from our systems, then we will comply and help do this. If a court orders that Mr. Smiths email be sniffed, we will assist in doing this. '

    They simply refused to allow a box to be added to their network to allow the FBI to sniff whenever they wanted. And I wouldn't either... it's my network.. what reason do they have to dictate how I will build my network?



  • Rash generalizations like this:


    ..the kind of people that burn down ski lodges in order to protect "scenic mountain beauty" and the people that vandalize laboratories where mice are being used to do medical tests?

    are precisely the fear of privacy advocates like myself. Because I subscribe to a mailing list read by people who might burn down a ski lodge doesn't mean that I advocate that person's actions. I also would prefer that my participation in the mailing list would not cause the FBI to categorize me as a Timothy McVeigh and monitor my every communique.

    While we're at it, let's do a little profiling of the Timothy McVeigh demograph...

    Timothy McVeigh Profile:

    1. Ex-military.
    2. Lives in farmhouse with two other men.
    3. Does not own a computer.
    4. Drinks jack and coke.
    5. No bank account.
    6. Owns multiple unregistered firearms.
    7. ~ 100. Other inane character traits.

    So we've established the character-type that makes a bomber. Monitoring the 20 or 30 million people who fit this description is likely to rope in a bunch of people who are never going to blow up a building. On top of that, do we really want to spend tax money spying on 20 or 30 americans? Considering the scale of the undertaking, it's probable that such a system capable of monitoring this large a group would be equally effective at monitoring the entire populace. Oh. I guess I answered my own question. That's what carnivore is about in the first place.



    Seth
  • If you notice, the "Bill of Rights" message was moderated to 0. Probably exactly where it should be; of extremely marginal interest, but not a true -1 worthy troll.

    Moderators in aggragate are a lot smarter than you think.

  • by SheldonYoung ( 25077 ) on Wednesday August 02, 2000 @11:13AM (#885045)
    Carnivore is a crackers dream come true. Imagine a remotely accessible box designed specifically for sniffing and that is required by law.

    It's obvious that these boxes will be cracked one day, it's just a mater of time. Carnivore is still just a computer with software written by humans.

    Any ISP would be right to refuse a black box on their network. They even might be able to argue that it can unreasonably impact the safety of their business.
  • THe FBI's been known to put the law aside when it comes to catching criminals. The big problem is that the law is the only protection for the innocent bunch.
    By strong opinion is that they should stay out of it, and do their thing through different means. Everybody knows that they bug houses, scan phone conversations and sniff networks as it is. People kind of know that, but they assume that "it's never them," and that sort of thing doesn't happen where they live...
    Well, guess what, it does.
    What boggles my mind is that with Carnivore, they're bringing all their chicaneries upfront for everybody to see, hoping that they cann enstill a sense of trust by being 'honest.' I'm curious to see how this thing works, and I wonder who the "group of experts" that will examine the software are.

    Be cautious! This could be the beginning of a privacy-free era. With more an more people moving to computers and the Internet, the Carnivore and its followers will provide an unbeatable communism-inspired way to control the crowds into a system that which will be the handiest tool to turn the country communist.

    The carnivore must be filed away and forgotten about!
    --------------
  • "Prudence, indeed, will dictate that Governments long established should not be changed for light and transient causes; and accordingly all experience hath shewn, that mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the forms to which they are accustomed"
    -Thomas Jefferson, Declaration of Independence [nara.gov]

    I believe that this second quote can be attributed to Thomas Jefferson as well - "Those who would trade liberty for security shall have and deserve neither."

    You'd think that if they passed a law requiring background checks on people who wanted to buy a gun, keeping criminals from buying said firearms, you'd be able to keep guns out of the hands of people who really shouldn't have them, and gun fatalities would go down. But according to this abcnews article (which has strangely disappeared since I read it last night) about a study of states that had to change their gun laws to comply with the Brady Bill, that hasn't been the case. When someone says "it's for your own good," I say that I'd rather take my chances.

  • open source is too "open" for a government agency...if they did that anyone could go over the code and find an exploit.....maybe...
    But when it comes to matters of the FBI even I, who disagrees with carnivore's existence, think that "maybe" is too much of a risk...If someone figured out an exploit they could possibly hack the file containing the list of whose email is getting filtered, and then notify the person....not a good thing because the FBI is only going to set this system to catch criminals, and I wouldn't want criminals to know they are bieng monitored......would you?
    Maybe the snapshot of the source code that deals with the actual methods of filtering could be made public...that way we would have some assurance that they aren't just copying all packets to 2 files, one that contains suspect emails, and one that contains all the rest..... Then what would stop them from posting dummy code??
  • I don't post it AC, so if you dont like the joke, you'll know who to flame.

    Nothing wrong with the joke, but it's been floating around the Internet for years, and most of us have already seen it several times. Plus, it has absolutely nothing to do with the discussion about Carnivore and the FOIA. If you had posted it to a discussion to a thread relating to Microsoft, Windows, software licensing, etc. that might have been a little more appropriate. Use a little discression next time.

    --

  • "Puh-leeeeeeze. Unless the FBI all of a sudden raises its number of employees by a factor of ten thousand or so, surveillance on every American citizen is not possible."

    Sure it is, if you have black boxes attached to all the entry nodes (ie, ISPs) in the country. The vast majority of e-mail messages wouldn't interest the FBI at all. Those that match the keywords (or whatever exact system Carnivore uses) would be stored in a database for later retrieval. That way, when the FBI does want to investigate a particular person, they already have a log of anything he/she sent since the start of the system that might be "interesting."

    Just because most of the logged messages are never used again or are never seen by human eyes doesn't meen it isn't snooping on everyone.


    --
    "Better dead than smeg."

  • It's the law, you moron. The same reason your wireless phone provider needed to install a system to do this. The FBI was kind enough to provide a system that for you in the event that you haven't one.
  • While the person posting this is probably a troller, the Bill of Rights is at the very core of this issue. Trollers can be on-topic and insightful sometimes -- even if it's an accident.

    I'm glad to see the Bill of Rights in this thread. It's very relevant.
  • > An example is the former East German (DDR) government's Stasi secret police.

    See, they should have used Rambus instead of DDR, and they might still be in business.

    --
  • The FBI should have to justify to us why they feel it necessary to snoop on our communications...

    YEAH!! They should have to get a search warrant or something before they can use Carnivore. Oh. Ummm, never mind.

  • > Anyway, the FBI was saying that if they opened it up, ppl could learn how to get around it.

    Yeah, people will start disguising their mail as dope and getting FedEx to deliver it.

    --
  • Even if the above is true, it's not very constructive, is it? Between you and me, let's just pretend like the democratic system is not hopelessly fscked up, OK? It makes it easier for me to get out of be in the morning, and it also makes for more interesting conversation and troll-baiting.
    While I do appreciate your willingness to sink to my level and your generally uncombative tone, I cannot agree to pretend any longer that the system works. It was those sorts of pretensions which allowed the usurpers to gain power to begin with.

    My statement was intended to serve as the basis for constructive conversation concerning the removal of the current oppressive regime that has been controlling the US. If you don't choose to engage that concept, that does not make my statement 'unconstructive'. It simply means you a) don't believe it, or b) are not interested in pursuing it. Is that too serious for your taste?

    I will say that the kind of mutually agreed pretentions you suggest (pretend it didn't happen, pretend the government is 'okay', that we are not living in an illegally empowered police state) is to give ones tacit approval of the corruption that infests the former United States.

    Truth should not be so lightly dismissed. That amounts to self-censorship in direct opposition to your own self-interest, probably based on fear. No doubt the fear that others will compliment you on the fit of your tinfoil hat....

    Huh. I seem to recall the Colonial Tricorner was widely sneered at, too.

  • The point is that you are not trying to "keep little old ladies and children from being blown to bits"; you are trying to get the government to monitor e-mail.

    The plausible lie that you are using is that this "will improve everyone's security", but that is unlikely. E-mail tapping wouldn't have stopped the Unibomber, it wouldn't have stopped Tim McVeigh, it wouldn't have stopped the World Trade Center bombing; in fact, it wouldn't have stopped ANY act of terrorism that has occurred in this country.

    What you actually want is to silence the views of people like me; that is why you said something about monitoring anyone who complains about monitoring. You pretend to espouse lofty views - but your motivation is as common as dirt.

    Evil has hidden agendas like you do, good does not. Evil pretends to do one thing while actually doing something else, good has no need to hide what it is doing. Yes, YOU ARE THE BAD GUY, and you always will be.

    By the way, part of the reason I chose the name Veteran is that I am one; no flags burned, but now and then I do enjoy exposing the occasional street fascist for what he is.


  • -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    I harass people to get PGP by annoying
    them with signatures...
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.2 (GNU/Linux)
    Comment: For info see http://www.gnupg.org

    iD8DBQE5iJvi+2VvpwIZdF0RAqIhAJ0bqKAp/bkRS456pvOy 8bZLKLX9WgCfaU9A
    2vp7ttzIQxCiBRdZ1Qar7Ao=
    =Kk1j
    -----END PGP SIGNATURE-----
  • I seriously doubt FOIA really works. Ok, by the law the agencies have to give out information, but there is no way of ascertaining how reliable the information is.

    What's stopping FBI just writing a source code for a simple, bogus search engine and releasing that as Carnivore?

  • Frankly, I find it hard to believe your sincerity in such sentiments since you posted them as an Anonymous Coward. Are you afraid of something? Perhaps by posting anonymously you're expressing that you probably are doing something, if not illegal or extralegal, at least that would reflect negatively upon you if your identity were known.

    The folks expressing concern about Carnivore reading their mail are no more paranoid than you are being by posting anonymously.
  • In point of fact, you are not there to protect me, or my family, you are there to arrest people who are breaking the law. If you get them in the act, that raises the chance of getting a conviction.

    Am I grateful for the work you do? Yes, you do dangerous work. I do understand the limitations of your job, and I don't expect more than you can do.

    In the final analysis, protecting myself and my family IS my job. I understand that fact, and I have taken the steps necessary to give me as good a chance of doing that job as I can.

  • The FBI should have at least released an outline of how the system works. In doing so they would have staved off this lawsuit, or at least the emergency hearing without giving away enough information to compromise their supposed need for secrecy.
    Yes, the content of e-mails caught do need to remain secret, and would not have fallen under the Freedom of Information Act.
    However, the basics of how the system work did not. The training manuals for stakeouts, search and seizure, arrests, due force, etc have been release under Freedom of Information requests. The outline of how the system worked, should have been. For that matter even releasing the source code should have been possible, but probably too much to ask of the Justice Department.
  • You are right, the government would have no reason to monitor most of "us". I think I speak rightly when I say that most /. readers are pretty innocent and not a threat. However, this system has no checks and balances. Lets assume for argument sake that you are not a prime suspect for monitoring. You are an average, law abiding guy, who pays his taxes. What if 30 years from now the laws change enough that you are considedred a threat, the government could continue to try to exert more control and then finally be at a point where YOU are out of control. YOU are now a prime suspect for monitoring.

    However, that is an admittedly unlikely scenario. But consider this. Lets assume again (for argument sake) that you are Pro-Choice. Now lets assume that the government passes a law that makes abortion illegal (a much more likely scenario). Your daughter is pregnant, and you take her to get an abortion and it is discusses in an e-mail. BAM! Your thrown in jail because you were under monitoring because of your pro-choice tendencies.

    Still too unfeasable? Ok. Lets say there is no anti-abortion law. Lets say that the new director of the FBI is a very strong pro-lifer, and he institutes secret policy to have all pro-choice people monitored. You are found talking about pro-choice in an e-mail. (And why wouldn't you talk about it in e-mail. It's legal, and your not the type of person who would be monitored anyway). But when the FBI director finds out, he has your FBI Record fabricated to include other violations such as felonies or murders.

    I'm not saying that it is likely that these things will happen, but the existence of an (unchecked and unbalanced) system like Carnivore would allow such things to happen.

    I apologize if I offended/confused anyone with the abortion scenario, it was simply the first that came to mind.

    Shaun
    ICQ:1634382
  • There was this Timothy McVeigh guy who had some "non-mainstream" political views. Good thing he had his privacy, we wouldn't want the government infringing on that!

    Well, maybe you should read up on the
    other [wired.com]
    Timothy Mc Veigh
    and maybe get a clue about what privacy means.

  • Why not just use a service outside of the USA if you plan on doing illegal things via email?
    --
  • we're worried that people with mr. mcveigh's morals might get in a position of power and use these tools in ways that would get less press then okc (and other evil acts) because they's get covered up and yet would be much more complete in their destruction.

    six million jews were killed back in the late 30's, early 40's in no small part by using a variety of surveillence methods to capture them and by stopping the press from reporting them.

    okc was terrible, but that was probably just a slow day in "the final solution." power should always be attached to a leash - a damn short one.
  • Yep. The law stipulates a maximum response time, and the article says the FBI's 10 days expired Friday.

    They weren't obligated to fully *comply* with the request, but if they weren't going to comply they at least need to respond why as specified by the bill (most probably citing the exemptions intended at protecting law enforcement methods and investigations). Apparently, they haven't done even that.
  • I'd say that posting the entire bill of rights to a story that relates to only specific parts of it, is troll. I have absolutely nothing against the BoR, or the rights that are delineated therein. But posting the entire thing to a discussion like this is a cheesy knee-jerk reaction that does nothing to move the dialogue at all.
  • IT IS THE DUTY OF THE GOVERNMENT TO PROTECT ME AND MY FAMILY.

    Where did you ever get that lunatic idea?

    Sure, it is one of the (few legitimate) duties of government to provide for the common defense, but that means protection of the governed as a whole, not the individual or family. (Not that they're necessarily doing a wonderful job of the former, either.) The only person or entity whose duty it is to protect you and your family is YOU.

    See Ruby Ridge as an example of how well the government protected Randy Weaver (who was doing nothing illegal) and his family.

    Or for that matter, any number of crime victims who suffered while waiting for the cops to show up and "protect" them rather than taking responsiblity for their own protection.
  • Being a public employee, I am a daily witness to the theory that, "Don't blame on malice what could be explained by incompetence."

    Too often people assume the government is trying to hide something, when in fact, a FOIA reqest is just sitting on somebody's desk who's been on vacation for two weeks.

  • Well, that isn't' quite true. For one thing, someone would have to realize that the evidence was obtained as a result of an illegal search. Usually there is closer relationship temporally between the illegal search and evidence that later results from that search, e.g., an officer makes an illegal search of a trunk and finds evidence, such as drugs, that give rise to probable cause to search the guys house and then find a drug lab in the basement. Here, the illegal search may be a long ways from the next event, and no one realize that the reason the FBI were interested in someone was an email six months ago. The government can also argue some of the exceptions to the "fruit of the poisoned tree" doctrine, such as inevitability, i.e., we would have found the evidence even without the tainted search.
  • by baka_boy ( 171146 ) <<lennon> <at> <day-reynolds.com>> on Wednesday August 02, 2000 @10:03AM (#885096) Homepage
    This could set a very interesting precedent of making government technology public. While I support the idea of accountability and public review of government tools and processes used in intelligence and surveillence, I worry about a potential backlash from this and similar cases.

    Basically, from what I can gather, the Carnivore system looks like a glorified packet sniffer. It's not something I'm happy about, but I haven't exactly been losing any sleep over it. However, the response I've already seen, including this suit, make me wonder how hard the government is going to try to keep the rest of its intelligence technologies secret. If the public panics over a sniffer, what would the think of more sophisticated tools used for tracing, wiretapping, en/decryption, etc.?

    I know that a lot of the excitement has been generated by sensationalist media hype, (the extrapolation of Carnivore into some sort of global on/off switch for the Internet is solid gold BS, if you ask me) but I really think that choosing our battles might be wise here. We don't want to send the government into a paranoid spin, and make it that much harder to find out what they're up to later on.
  • by Anonymous Coward
    How many of us do you really believe were born yesterday?

    The FBI has an uninterrupted history of abuse when it comes to civil liberties, beginning with J. Edgar Hoover and continuing to this day.

    Illegal taps and surveillance of political figures (including Martin Luthar King, Jr.) and human rights activists, illegal enforcement actions, even framing innocent people for crimes they did not commit.

    All of this was possible because the FBI had the tools to be privy to private information they were not constitutionally permitted to have access to.

    It is absurd to expect such an organization to behave more responsibly now that they have a tool orders of magnitude more powerful than any they had in the past to violate our privacy.

    The only reasonable possibility is that they are deliberately dragging their feet, and the judicial process is an excellent one to give them the requisite kick in the rear and obtain the information the ACLU is entitled to under the Freedom of Information Act.

    [ posted anonymously for reasons left as an exersize for the class ]
  • Actually there is. I can't remember how long it is, but they have to either refuse (and state why) or comply within a set period. (I know it's less than six months.)
    ---
  • Carnivore is a product of necessity. It's workings have to do icky things like scan all emails; how else could you differentiate different emails passing through the system?

    Incorrect. It is a trivial task for the ISPs themselves to put up some kind of simple packet filter for this type of e-mail traffic, and does not necessitate the addition of some black box to do the filtering for them.

    Prediction: It won't matter. The FBI will get their way.
  • by ndpatel ( 185409 ) on Wednesday August 02, 2000 @10:05AM (#885109) Homepage
    every time i read about these sorts of systems, i have these weird mixed feelings about them. on the one hand, i don't want anyone looking through my stuff without my permission. on the other hand, i want to feel secure knowing that the government to which i pay taxes is doing what it can to protect me from harm. how can i as a citizen demand that the government have the utmost respect for my privacy when demanding that respect cripples its ability to protect me?

    if timothy mcveigh had sent an email about 1 federal plaza, would that picture of the fireman and the bloody little girl ever been taken?

    if he had and there had been no such thing as carnivore in place, would we have kicked ourselves about it?

    sometimes this reminds me of when my friends would come over in middle school and forget their cigarettes at my house. i tried to hide them in my room from my mother, and i'd throw a fit about how it was my room and she should stay out if she went in there to put away my laundry or whatever, but i was really worried that she would find the smokes and yell at me for something i didn't do (which i didn't). her response was always, "what are you so worried about if you've got nothing to hide?"

    what are we so worried about?
  • by Magic5Ball ( 188725 ) on Wednesday August 02, 2000 @02:01PM (#885111)
    Here's a thought:

    1) It is difficult and processor intensive to turn pictures into something that can be represented digitally. My computer knows that cat.jpg is a file, and can show me a bunch of dots that looks like a cat, but the fact that it is a cat is unknown to the computer.

    2) It is even more difficult to attempt to pattern-match such things when the computer only has one image to work from. (Ever notice how OCR does not work on scans of handwriting (not things like Palm[whatever]?)

    3) A picture of a page of text occupies significantly more memory than a text file of text (on the order of >5 to 1). Consequently, a picture consumes more bandwidth and takes longer to pass through any particular point in the network.

    So why don't we just send around images of hand-written notes (or images of text using uncommon fonts), possibly deformed using PS5/GIMP/MS Paint or whatever? And XOR/ROT13/encrypt the file for good measure. Surely, carnivoire, echelon, and all the other things peeking into our transmissions would be overwhelmed by having to process >5x more data. (Yes, this doesn't work too well over cell phones and such, but this would work decently now and even better so in the future as high speed access becomes more readily available). Unless they get humans to look at the images (practically defeated by using masks similar to what the Japaneese electronic porn industry currently does) or invest in more hardware, I think this method might work.

    I'm also thinking that 0.3mm pencil on textured newsprint at 16.7 million grays with a trapazoid deform would be nearly impossible to electronically sniff but would easily get the message across unprocessed :-) Of course, since the recipient could easily tell that a trapazoid deform was used and ignore the noise, 'decryption' wouldn't really be a problem.

    Just a thought...

    M5B
  • The FBI claimed (during the Carnivore Congressional hearing last week) that the ISP which was being sued (presumably Earthlink/Mindspring), and the ISPs in every case where Carnivore had been used so far, were not able to provide the FBI with the data they needed. Given the almost trivial effort needed to track e-mail, and other internet activity (e.g. web browsing), this shows that either Carnivore is after much more than it is currently assumed, or the FBI wants a broad surveilance device, not limitted by the traditional court-order wire tapping.

    As a matter of fact, one of the points made during the Judiciary committee hearing was that currently the FBI has to go the phone companies with the court order to get information about a particular phone number. The phone companies will then give them the information, thus making sure that the FBI only gets the information specified in the court order. In contrast, Carnivore (as far as the public knows) has access to much more information, and we have to trust the FBI to only pay attention to what is authorised. This is one of the main issues as far as the fourth amendment is concerned, because the regulations under which the FBI requires the instalation of Carnivore are meant only for the above scenario of the phone companies providing the info themselves.

    Learn all about it at the C-SPAN web site [cspan.org] (the hearing from Monday, July 24).
  • Having the government be able to read the mail of people who are known or suspected terrorists is most certainly not unreasonable and not unconstitutional.

    We are not discussing a program that allows the government to "read the mail of people who are known or suspected terrorists". We are discussing Carnivore, which is a black box containing Ghu knows what capabilities. The FBI simply wants us to trust their assurances that the two are equivalent. Sorry; I base trust on past performance, and by that criterion I would no more allow the FBI to install Carnivore boxes than I would allow my teenage daughter to work in Bill Clinton's office.
    /.

  • by Samrobb ( 12731 ) on Wednesday August 02, 2000 @10:57AM (#885127) Journal
    Like I said, ENOUGH with the Ben Franklin. Franklin didn't live in the kind of world that we live in today.

    You're absolutely right. If idiots like you get their way, though, we'll soon live in a world where our government will have free reign to do whatever they want to us, whenever they want. In Ben's time, they did it - well, because they were the government. They had the power to tell you to silence you, sieze your property at the slightest excuse, throw you in jail for no particular reason, or otherwise do whatever they wanted because they had the power to do so.

    Since that time, we're progressively limited government's powers; until sometime around the early 20th century in America, when the federal government started grabbing for more an more powers - the power to tax; to limit discourse; to sieze property and silence critics without a need to pay attention to all those annoying civil liberties.

  • The law specifies deadlines for agencies to respond to requests, but as this example illustrates, you may have to file a lawsuit in federal court to get any action. Some of it is due to insufficient funding and some of it is deliberate delay or refusal to release information.
  • how else could you differentiate different emails passing through the system?

    How bout using software installed on ISP systems instead of some ominous black box clearly put their by watchers to avoid being watched. And once again I have to wonder if Cringley has his finger on a better pulse than EPIC or EFF with his article [pbs.org] suggesting the FBI wants to start the process of creating an off switch for this newfangled 'internet'.

    The main point here is not that the FBI is tapping e-mails. The general trend in National Intelligence (*muffled laughter*) is obviously going to yeild things like Carnivore, but what groups like the ACLU want is what we all want, KNOWLEDGE! We simply want to know what the hell is going on in this little black box, because we as citizens have a responsibility to watch the watchers.

    Red tape or not, there should have been more information available on this little gizmo before the sudden accross the board implementation came about. Steady encroachments on rights are bad enough, but sudden sweeping moves deserve intense and widely publisized scrutiny in my opinion. Sets a good example...
  • by Anonymous Coward on Wednesday August 02, 2000 @10:09AM (#885133)
    And if England had the equivalent of Carnivore, would the Boston Tea Party ever have happened?

    Sometimes good, upstanding citizens need to be secure in their communications. The government is not always a benevolent protector.

  • by snubber1 ( 56537 ) on Wednesday August 02, 2000 @10:57AM (#885140)
    I rember when a couple people filed under the freedom of information act to get the forumla the IRS uses to select people for an audit. Naturally the IRS objected, and even after a court victory, they still refused to give out that information. What did they do? They ran to congres and asked them to make and exemption, which they did. Bastards. I can only guess what is going to happen here... again.

    ----------------------------------------------
  • Carnivore is broad in scope; everyone's e-mail is monitored.

    Not without a court order.

    Well, the Carnivore boxes would be in place in a way that they could conceivably monitor all email traffic. The FBI claims this is pre-emptive and would/could only be used with a court order. I don't think anyone thinks for a second that the FBI would only use Carnivore boxes with a court order.

    Furthermore, the Carnivore boxes will cause substantial difficulties. How are you going to intercept all of AOL's email ?? You would need a daemon on the mail server, or a box that intercepts all traffic going to all of the email servers (which are typically set up in a load balancing manner). The likely incompetence of the FBI alone should stop this from happening. Who really thinks their Carnivore boxes will be able to intercept email without interfering with normal email usage.

    Further, a failure on the Carnivore boxes (intentional or not) could shut down the vast majority of US internet traffic.

    It is a stupid plan, plain and simple. It should never be allowable under the 4th Amendment to the US Constitution. It is unreasonable to assume that since you might need to intercept anyone's email at any time - you have a right to place an infrastructure that can intercept EVERYONE's email.
  • When law enforcement obtains a court order to monitor your mail, they can either look only on the outside of the envelope or have the authority to open and read your mail. Likewise, the difference between a wiretap and a "pen register" order is that the former allows law enforcement to listen to the conversations, while a pen register order (or trap-and-trace order) is limited to capturing the digits of the party you are calling.

    In the mail case, there is a definite barrier between the address information and the content, so limiting law enforcement to the proper level of monitoring is fairly easy. In the telephone-tapping case, though, the growing use of voice-response systems that accept DTMF digits makes it harder for law enforcement to avoid capturing content -- and that content can be my bank account number and the PIN associated with it so that someone tapping my line with a pen-register order could access the account without due process.

    On the Internet, the intrusion goes beyond that of the pen-register tap. With the telephone company, the telephone switch can isolate one line from the rest of the lines in the central office. There is no such isolation in the Internet for e-mail. Software would have to monitor EVERYTHING.

    It's the requirement about looking at everything, even if you only want address information, that make Carnivore such a problem.

    The solution would be for the Congress to pass a law that would require all electronic mail programs to encrypt all messages so that a pen-register order is guaranteed to capture only address information.

    Can you imagine the howls?

  • I think the point of the poster you so quickly flamed was that if the carnivore system was in place, then mr. McVeigh's email may have been flagged, causing the FBI to take notice of him.

    And how on earth does the carnivore system have anything to do with your weight-loss attempt graphs?

    I think this is the point where you are supposed to have an Open Mind(tm), and consider the other side of the argument. We all know why the FBI is the super devil incarnate, stealing the privacy of the american citizen for evil ends. But, instead of getting hung up on the Popular View(tm), why not pause and consider the other side, which is how this system would benifit the american public? How else can you come to a critcal analysis on the situation?

    Personally, when i hear of people like Timothy McVeigh getting arrested, it makes me sleep easier at night. Some people on Slashdot seems to be as inflexable as those on the Christian Chat Network [cchat.net], which is quite frightening.
    -legolas

    (ps go Canada [www.gc.ca]! Ra ra ra, etc.)

    i've looked at love from both sides now. from win and lose, and still somehow...

  • The question in my mind is whether Carnivore will ultimately be used only for scanning for 'illegal' things.

    We all know the government spied on leaders of the Vietnam war protest and civil rights movements. Their activities weren't illegal, just unpopular with the establishment.

    I don't have any problem with the Carnivore-like technologies if it is only used a) with a search warrant and b) to aid investigations of illegal, not just unpopular, activities. Unfortunately, I don't trust the FBI to police themselves on this.

    I would rather the FBI present a warrant to the ISP, who then sets up the monitoring. How hard could it be to set up a sendmail rule to forward all message headers for a given user to the FBI?

    --
  • by Eric Green ( 627 ) on Wednesday August 02, 2000 @02:54PM (#885149) Homepage
    The FBI is a huge law breaking organization. Remember, they are legally required to respond to FOIA requests with a "yea" or "nay" within a certain time frame. They can say "nay", at which point a lawsuit can be filed, or they can actually provide the documents requested, but either way they're required, *BY LAW*, to respond.

    Yet they did not.

    And this is typical behavior for the FBI. They believe that the law does not apply to them, and behave accordingly.

    A rogue law enforcement agency that believes that it is above the law and above the Constitution does not serve us, no matter how well they protect us from terrorist threats. Not that such rogue law enforcement agencies would ever care what we think about them. After all, when you have a badge and a gun, who is going to stop you? "Who shall watch the watchers?".

    -E

  • Maybe Joe Schmoe belongs to an environmental or animal rights organization, a non-mainstream political or religious group, corresponds with people in "terrorist" countries. There are many things that can put you on a watch list.
  • by Tairan ( 167707 ) on Wednesday August 02, 2000 @10:13AM (#885153) Homepage
    Yeah, sure. How many mail administrators have never opened someone elses mailbox without them knowing? Did you get that raise you asked for? How did your annual review go? It's a fact. Every mail admin I know has opened someones mail at least once. I am sure it happens more than that.

    Now imagine the same thing, except infinately worse. Board FBI person is sitting in his office late at night. Well, he has access to the carnivore system, so he drops in a few new rules. Save any mail with the words 'Natelie Portman.' There, now he has some porn to look at. Okay, but that wasn't enough. Now he wants to know what email his wife/girlfriend/lover sends around, since he does not have her password. Set up a rule to save her mail, and boom, there ya go. Now he is having lots of fun. He just starts scanning any mail with his name on it. Looks for anything with "last night was so good," "i want to fu" or "my password is." Now everything is getting really cool! You should see all the emails he is collecting! There are some really cool things people are sending around the web. Next he starts reading the mails of one of his cute coworkers, and then that girl he dated in high school and never got over (something about how he was a geek and had a really small penis, so now he will teach her and maybe even forge a few emails i her name)

    Where does it stop? He can continue going. No one else would ever know he was doing it. The mails get through. Not 'everyone's' privacy has been invaded.. just those who happened to send a few emails that matched a few rules set up by some guy late at night.

    What do you think?

  • Remember, we are all members of the Open Source cult here. It is conceivable that, in the future, we could all be put on a "watch list" as evil communistic subversives intent upon destroying Free Enterprise As We Know It.

    What? You say it could never happen?

    It happened to those who wished to free the black man, an effort that threatened the economic well-being of many well-heeled industrialists and Southern planters. Why do you think it could not happen to those who wish to free the code? You honestly believe that this does not present as big a threat to entrenched powers?

    -E

  • If you've been involved in the computer industry for some time, you've probably encountered Management By Airline Magazine. A pointy-haired boss comes to you and says "Our product needs feature X!", where feature X will basically render the product insecure and useless. So you drag your heels and procrastinate in hopes that he'll forget that he requested feature X. Big corporations have invented paperwork and bureaucracy to institutionalize this process of procrastination. And 99% of the time he does forget about feature X -- he takes another airplane trip, reads another airline magazine, and falls in love with feature Y :-).

    Point: Sometimes administrative heel-dragging, while blamed on "administrative red tape", can be purposeful behavior. If there is "red tape" involved, it is because the FBI heirarchy wants it to be. I'm sure they did not invent this red tape just for the Carnivore case -- after all, it's institutionalized -- but it's there for a reason, and that reason is to be as an excuse for non-responsiveness to the public.

    -E

  • The problem is that this is the chief law enforcement agency of the United States of America that we're having to force (via a court) to obey the law.

    When a federal law enforcement agency does not obey the law, we must raise the question, "who's watching the watchers?".

    -E

  • So does the Canadian government assert Crown copyright over government documents? This is used in, amongst other nations, England and Australia, in order to limit the effect of disclosure of government documents -- it is illegal to, for example, post a copy of the document to a web page or include it as part of a book, for example (because this violates the Crown copyright).

    Granted, you can always summarize documents, but sometimes the sheer black and white effrontery of a government bureaucrat's abuse of power, in his own handwriting, is the most effective way of communicating.

    Note that here in the United States, government documents are explicitly in the public domain. You can copy them in any way you wish, and use them in any way you wish, at least those that you know about and can get your hands upon. There is no concept here similar to "Crown copyright".

    -E

  • by Veteran ( 203989 ) on Wednesday August 02, 2000 @10:31AM (#885163)
    We are entering a very dangerous era, and Carnivore is only the tip of the Iceberg.

    Computers are intellectual amplifiers, in the same sense that a fork lift is a physical amplifier; they both allow you to handle loads you could not handle unassisted.

    The most dangerous aspect of "Computer Crime" is that it is really "Thought Crime" in the sense that Orwell meant in "1984". The problem with "Thought Crimes" is that there is no way to prove you didn't commit them. Example: FBI seizes your computer, they 'find' child pornography on the machine. Go ahead, prove that they planted the evidence. Everything on a hard drive is ones and zero's and as such it can ALWAYS be faked.

    I have a personal friend who has been doing police work for 20 years. When I asked him why he quit doing narcotics work he explained that he got tired of framing people. "Look" he said, "drug dealers aren't stupid, they don't keep drugs in their own homes. Every time you read about a bust where the narcotics agents break down a dealers door and find drugs you can just about bet that they brought the evidence along with them."

    Law enforcement does not need Carnivore for the same reason that they really don't need to decrypt messages; traffic analysis alone is enough for them to learn almost everything about you. All they need to know is who you are talking to and when you talk to them. This is one of the main reasons that the US has lifted the export restrictions on data.

    Carnivore is just snoopy people who want to spy on everybody. Given the chance, they would read everybody's snail mail - not because they would get useful information but just because they could; that is how stupid, petty people behave.

    Everybody who believes that with Carnivore the government will only read the mail they are authorized to read is entitled to their belief. I - on the other hand - quit believing in the Tooth Fairy a number of years ago.

  • by Rand Race ( 110288 ) on Wednesday August 02, 2000 @10:17AM (#885164) Homepage
    "Presumably they will need a warrant to use any information they gather anyway."

    That statement should be amended right after 'gather' with "...in a court of law...". Just because evidence gathered by carnivore cannot be used in court does not mean that FBI analysts can't use it. Hell, just because the email is legal doesn't mean the FBI can't use it.

    For instance, suppose I'm sending out emails supporting drug reform. The FBI, gunning for a pedophile on my ISP, scoops up my messages. Even though what I am doing is legal, even though the feds don't have a warrant, I could easily be added to a database of possible drug users at the FBI or, even more nefariously, those messages could be reported to my local police (or my boss) who would then keep an eye on me for something they could use in a court of law.

    Such an ability would be stunningly simple to incorporate into Carnivore with keyword searches, nobody has to read it unless it gets flaged by the search.

    By the tone of this post you might be led to believe I don't trust the FBI... you would be abso-fucking-lootly correct.

  • by kinglear ( 140064 ) on Wednesday August 02, 2000 @10:32AM (#885168)
    There are millions upon millions of people in this country. And yet some little schmoe from Asshole, Indiana thinks that he is so important that the "gummint" has got dozens of agents watching his every move and reading every little piece of mail that he gets.

    Actually it is possible for a government to do this kind of thing, and some governments have found it desirable. An example is the former East German (DDR) government's Stasi secret police. After Communism fell, the unified German regime opened up the Stasi records and people were shocked at how many of their neighbors had been snitching on them.

    It worked kind of like Amway: Joe recruits Mary, Mary recruits five of her friends, they each recruit five, etc. There's a threat of blackmail for those who resist being recruited. These people didn't have to be on the Stasi payroll; they were public-spirited citizens. Of course, half the people being snitched upon were also working for the Stasi, but the Stasi liked this feature. It kept everyone on their toes.

    The other interesting thing that came out was the level of detail that the Stasi agents was recording. Incredibly trivial stuff. Not that the Stasi used most of this trivia. That wasn't the point. In techie terms, they were interested in Granularity. Hi-rez surveillance.

  • but it's not "idiots like me" that invented suitcase nuke bombs, biological weapons, and Ryder trucks

    No indeed, the first two were invented by government munitions developers. The last is not really all that relevant to the discussion as stolen vehicles are even more anonymous than rented ones.

    Just as a point of reference though, somewhere between 5,000 and 10,000 Americans die in traffic accidents each year (sorry, I don't recall the accurate figures and am too lazy to look them up). How many US citizens were killed by terrorists in the entire last decade? Probably not even 1,000. Should we therefore ban cars?

    IT IS THE DUTY OF THE GOVERNMENT TO PROTECT ME AND MY FAMILY

    And what, pray tell, constrains a government to perform its "duty"? There is no such thing as absolute safety, any more than there is absolute freedom. It's all relative and there is a balance to be struck. Where that balance lies depends on many things such as socially accepted values and technological capabilities. Simply pompously proclaiming the "the government has a duty" will acheive nothing, the work of building the institutions that ensure the good behaviour of the government is far harder than that.

    What kind of a personal tragedy will it take for you to understand that there are certain realities that make your Franklinesque fantasy world a logistical impossibility?

    More to the point, what kind of national obscenity will it take to open your eyes to the danger of government misbehaviour?

    What killed more people last century (and every century before), terrorism or unrestrained government? (If you answer terrorism, you have obviously forgotten the "big three" murderers of the 20th century, Hitler, Stalin and Mao).

    I agree that those who refuse to live by the rules of a civilized society and commit willful murder and mayhem should lose the protection of the said society's rules, but that doesn't justify abandoning those rules for everyone. The issue here is not whether law enforcement agancies should be allowed to spy on known or suspected (provided there is good, solid reason for suspicion) killers, the issue is whether an untrustworthy agency should be allowed to spy on everyone in the country. If you say "yes", consider that you are putting in place the tools for a Despot who may kill you with no more compunction than the terrorist you fear.

    Just because the US democracy has never fallen to totalitarian rule does not mean it can - after all it happened in Russia and Germany both in the 20th century.
  • From 6A1 of the FOIA...
    (6)(A) Each agency, upon any request for records made under paragraph (1), (2), or (3) of this subsection, shall - (i) determine within ten days (excepting Saturdays, Sundays, and legal public holidays) after the receipt of any such request whether to comply with such request and shall immediately notify the person making such request of such determination and the reasons therefor, and of the right of such person to appeal to the head of the agency any adverse determination;
  • To continue on with that theory, it would be easier to catch criminals of cops were allowed to enter anyone's house, at any time, without giving a reason. Hell, think of how many drug dealers they could dump in prison if they were allowed to start searching houses at random.

    It is not so much that the FBI is considered "the devil incarnate". It is that the FBI is considered human, and therefore both fallible, and open to potential abuses of power. Yeah, if you can guarantee that the FBI will never make a mistake, and will never do anything but what it is supposed to do, then yeah, it would be no problem for them to basically have open access to everything. But in the real world, we have an FBI that mistakenly accused the wrong person in the Atlanta bombing, and was known for being a tool for political vendettas in the sixties. Now, this isn't so much meant as an attack on the FBI as to point out that it, along with every other human organization, is not perfect. And as long as it is not perfect, we need checks to ensure that it does not get out of control.

    "And how on earth does the carnivore system have anything to do with your weight-loss attempt graphs?"

    Simple. The poster said that "if you are not guilty, you have nothing to hide". I'm not guilty, yet I definitely want to hide those!

  • by 11223 ( 201561 ) on Wednesday August 02, 2000 @12:10PM (#885178)
    I'm getting sick of the rampant confusion, speculation, and pure FUD in these comments. This is what it's about:

    Carnivore is the email equivalent of a phone-tapping system. Under federal law, your wireless phone service provider is required to be able to give you a tap; this was quite a major change for some systems. The FBI needs wireless phone tapping capability for all systems to perform its duties. The same goes for email - it needs to be able to tap your email. You have the option of an in-house system or an FBI-provided system. Earthlink chose one of their own writing. If you can't/don't want to/don't know how to institute one of your choice, then you get the FBI's solution by default.

    I hereby propose that we make GNU Herbivore - a system that provides the requirements of the FBI (email monitoring with a court order) so that those who wish to view the source, etc. can feel safe. This would eliminate the problem. That means you, Open Source community!

    (And please don't call this post a troll. It's not.)

  • by Agelmar ( 205181 ) on Wednesday August 02, 2000 @10:18AM (#885185)
    Call your ISP and ask them about their policy! Ask them if they have ever been asked to install it, what their policy is on devices like it, and if they would install it if asked. You might be suprised (or not). My ISP transferred me to five different people, after which I was told to mail the abuse department. (I was told a bunch of BS first, like that Carnivore is not installed on their network, but rather somewhere else and therefore they can do nothing about it etc...). Interesting ain't it? CALL THEM AND FIND OUT! And encrypt everything! It will make scanning impractical. And to those people without a PGP key, get one! There's no reason not to! Absolutely no cost at all...
  • This is really a non-item, since we all have a pretty good idea of how Carnivore works. It is probably very simple, just scanning for certain headers that will trigger it and then turn on the collection mechnism to collect that email and file it away.

    What makes you think this is how Carnivore works? I've seen no evidence that would support this supposition. Its certainly one theory, but we don't know what exactly it is supposed to do, and what data it works on. You might be completely wrong. That';s why getting some details released under the FOIA is a good idea.

    If it does anything more than that, I really doubt they would admit it. Do you really think they are going to say,

    "Yeah, we set it up to scan for words like Bomb and President, and then we take names, put them in a secret database, and monitor everything that person does." ?

    Well on NPR radio news this morning, it was reported that Carnivore does indeed monitor all email going to and coming from individuals. Maybe that was FBI FUD, maybe its closer to how Carnivore actually works. Sounds like it would be worth actually finding out. If it really only targets individuals rather than sniffing every email sent then its a very different system from the one you've supposed.

  • by VP ( 32928 ) on Wednesday August 02, 2000 @10:33AM (#885191)
    For those who didn't see the Congressional hearing on Carnivore on C-SPAN last week (you can watch all 3 hrs and 15 minutes of it from here [cspan.org]), it showed one thing - it is currently not known what exactly Carnivore does.

    Almost everyone assumes that Carnivore tracks e-mail - this may not be all. During the hearing suggestions and speculations covered a lot of TCP/IP protocols - from the near admission of the FBI that they have tracked ftp transfers, through the constant mentioning by the FBI pannelists that they look at packets, to the tracking of http requests, streaming media server connections, etc.

    One of the panelists, the CEO of a small ISP in the DC area, testified that it took one of his sysadmins about 3 lines of configuration code and half an hour to implement tracking of e-mail (incoming and outgoing) on the CEO's account, which would have satisfied the needs of the FBI if this is were the only thing Carnivore does. The fact that the ongoing Earthlink lawsuit was brought up allegedly because Earthlink was unable to provide the requested information to the FBI (with a valid court order and all), seems to indicate that Carnivore is after much more than simple e-mail.

    Among other interesting things that came out at that hearing was the security aspect of Carnivore - no sysadmin in their right mind would welcome a "black box" to become part of their LAN, and at the same time be accessible remotely.

  • How bout using software installed on ISP systems instead of some ominous black box clearly put their by watchers to avoid being watched.

    I saw an interview with an FBI representative who said that ISPs that were able to provide the data required by the warrant using their in-house resources would not have to install Carnivore.
  • by Steve B ( 42864 ) on Wednesday August 02, 2000 @10:34AM (#885193)
    Personally, I think that the only people that need to be monitored are those who are worried about the government monitoring them. By expressing worries, they've expressed that they are probably doing something illegal or extralegal.

    Meanwhile, back in the real world, the FBI's pattern of behavior [time.com] indicates that it is indeed a threat to law-abiding citizens. For an FBI official to propose to install some black box into the Internet takes as much cheek as a repeatedly-convicted embezzler applying for the position of chief accountant.
    /.

  • Personally, I think that the only people that need to be monitored are those who are worried about the government monitoring them. By expressing worries, they've expressed that they are probably doing something illegal or extralegal. This is why I am (more or less) in favor of Carnivore. It's not the end of privacy in America by a longshot. People who believe that it is are probably conspiracy theorists who should go back to figuring out who shot JFK (hint: his initials were LHO.)

    "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin, 1759.

    This is really ludicrous, and makes me quite happy I set up my own email server at home. The argument being fostered by the FBI is that they have a right to have a device in place that can be used to intercept email. This is like allowing the FBI to wiretap every phone line in the country, and trusting them to only turn on one of their phone taps when they have an appropriately obtained court order.

    This is not about allowing criminals to hide. We in the US have a right to be secure in our persons and things against unreasonable search and seizure. The FBI would like us to think that they have a right to invade our privacy at their leisure.

    Love your country, but never trust its government.
    --Robert A. Heinlein.

    Government is not reason, it is not eloquence, it is force; like fire, a troublesome servant and a fearful master. Never for a moment should it be left to irresponsible action.
    --G. Washington January 7, 1790

  • From the article:
    The Justice Department did not immediately respond to requests for comment on the move to compel release of "all records" on Carnivore. The American Civil Liberties has also filed a FOIA request for details on Carnivore, including the software code.
    Interesting -- the key question is whether DOJ will be able to snow the committee with security-through-obscurity FUD.
    /.
  • I'm not a member of a cult, I'm the evil lord of the universe.

    Watch your step or I will drop you into a volcano like the BT infested scum that you are.

    mwa-ha-ha!!

  • Yes, by law the public has a right to this information, but how would one know if all of the info is brought to the table?
  • How very ironic that you would dismiss concerns about thought crime while posting as an A.C.

    And yet some little schmoe from Asshole, Indiana thinks that he is so important...

    200+ years ago, a government was founded on the basis of the idea that rights were retained by the people - "We The People" - making those Indiana schmoes the center of government power. Simply acknowledging that the government is not representative of the people should be a red flag to you. Why is it not?

    By expressing worries, they've expressed that they are probably doing something illegal or extralegal. This is why I am (more or less) in favor of Carnivore.

    How interesting -- that is precisely why I am dead-set against Carnivore. How many in law enforcement or in the courts take this sort of prejudicial approach?

    And again, by posting anonymously, you have expressed a concern that you, too, could be a target. Perhaps not a government-OKd target -- well not THIS time, anyway. But who knows? In a decade or so, perhaps YOUR opinions will become politically unpopular. Good luck -- with the government you've asked for, you'll certainly need it. Or maybe then you'll thank me, and those like me, for what we sometimes call "eternal vigilance".
    --

  • Carnivore is a product of necessity. It's workings have to do icky things like scan all emails; how else could you differentiate different emails passing through the system?

    Prediction: It'll turn out that the failure to act on the FOIA request was just administrative red tape and such, and that there's nothing wrong/sinister going on here. Give them some time. The FBI is a beuracracy, and things move slowly. Besides, they probably gave their request to a summer intern :-P.

  • My problem is that /. readers don't say enough good things about the Freedom of Information Act. Or, hold on, other cool and useful legislation. We're always in slam mode. We look for the negative, we look to bitch, we look to complain. Above all, we look to push our individual agendas. It would be nice if there was a bit more positive mojo spread around.

    John S. Rhodes
    WebWord.com [webword.com] -- Usability Vortal
  • Even if the people directing the FBI are all perfectly honest and law-abiding, what about the thousands of people who work for the FBI?

    Imagine an ISP (with a Carnivore box) that has the ex-spouse of an FBI agent as a customer. What prevents the agent from gathering information about the ex-spouse?

    Imagine an FBI agent who has access to a Carnivore box bucking for a promotion. What prevents the agent from making fishing expeditions, and then presenting the information gained as tips from an anonymous source?

    Imagine a loan shark who has loaned tens of thousands of dollars to an FBI agent with access to a Carnivore box. What prevents the agent from getting information (credit card numbers, blackmail-worthy details, information on the loan shark's enemies, etc.) through the box that will make the loan shark willing to forgive the debt?

    Imagine an FBI agent whose spouse manages a business. What prevents the agent from using the Carnivore box to spy on the spouse's competitors or customers?

    We don't know ... that's part of the problem.
    --

  • it only eats meat.

    no, seriously. their first box was called omnivore, and it listened to everything. the new one is called carnivore, and it selectively listens. i think it's quite probable that the reason they are keeping it a secret is that it sucks so bad, and they don't want people to know how far behind they are. i bet omnivore was esniff.c, and that carnivore is a flat packet sniffer with keyword filters:

    while (1)
    if packet_contains_keyword(packet,"bomb") savepacket();

  • by Peter Dyck ( 201979 ) on Wednesday August 02, 2000 @10:25AM (#885226)
    And yet some little schmoe from Asshole, Indiana thinks that he is so important

    This point needs to be re-iterated from time to time: it doesn't matter how important you are; what matters is how easy it is to conduct surveillance on people. If you need special equipment and lots of people to monitor a single person, the resources will obviously be concentrated on only the most important targets. However, if you can do it practically automatically with minimal hardware and manpower, then even your "little schmoe from Asshole, Indiana" becomes a potential target.

    First of all, he's important to people currently in the government. That's because he's a member of the electorate and the government wants desperately to get re-elected. Knowing Joe Schmoes' party affiliations, special interests and voting histories helps targeting the campaign.

    A more sinister use of the e-mail snooping would be gathering dirt on your political or business competitors. History knows several examples (Nixon and allegedly Clinton admins, for instance) of this kind of abuse. This application would probably not affect your average Joe Schmoe, though, because he doesn't wield direct power or pose a direct threat.

    Knowing Joe Schmoe's habits is also important to businesses. Why do you think they'd like you to tell them your name, e-mail address and sometimes even income and hobbies before they let you use their web services? Profiling people is a serious business today.

    So, don't take comfort in thinking that you're not important enough...

  • Is an absolute necessity. This is a perfect example of where something as simple as a bug in an email collection routine could frame the wrong guy.... The "innocent don't have anything to hide" defense for an invasion of privacy is invalid - the Government is accountable to the people, not the other way around. The FBI should have to justify to us why they feel it necessary to snoop on our communications, rather than us having to justify why we don't want them in our ISPs
  • e-mail and mail delivered by the US Postal Service are two very different things. There are no federal laws protecting e-mail in the same way that snail mail is protected. All of the complaints people lodge against Carnivore are based on the assumption that we have a "right to privacy," which stems from an interpretation of the 4th amendment's protection against unlawful search and seizure. (at least I think it's the 4th amendment.)

    In any case, you can't compare e-mail to USPS mail. they are two completely different things, you shouldn't even think of them the same way.

    Moller
  • Well yes you have to go to court to enforce a law, that is what the court is for. If you want to put someone in jail for murder you have to go to court for that to.

    The Cure of the ills of Democracy is more Democracy.

  • >The number of people murdered by out-of-control
    >governments this century is in eight digits.

    ... I think that estimate is somewhat conservative. I would guess nine digits.

    For a quikie rundown...

    stalin's purges to socialise the USSR are estimated at 20 mil or so, that's NOT including all of the soviet citizens murdered by rulers other than stalin.

    The nazis (hmm, does this invoke Godwin's law?) got 6 million European Jews.

    pol pot took out several hundred thousand Cambodians.

    Who even knows how many Chinese died in mao's "great leap forward". I've never heard of an accurate number being agreed upon. Most guesstimates I've run across place the number in the tens of millions.

    Now, that's ONLY the major players in the genocide game. That does NOT count the numerous wannabes in the "murder your own citizens" competition.

    Oh... speaking of which, the examples I've mentioned thus far are only examples of governments murdering their *OWN* citizens. I've not even guessed at the deaths caused when governments have decided that they's just LOVE to annex that land next to their own; trouble being, that it usually belongs to someone else who's willing to fight to keep it.

    Add in Germany (damn... did I just do ANOTHER Godwin???) and Japan's little plan to take over the world about sixty years ago, and I think you'll EASILY get into nine digits. To say nothing of the REST of the wars of the 20th century.

    So, I'm with the anonymous coward here (damn is THAT a strange occurance). Governments gone rogue are a LOT more of a concern than J. Random Lunatics such as mcveigh, koresh, arafat, et. al.

    john
    Resistance is NOT futile!!!

    Haiku:
    I am not a drone.
    Remove the collective if

  • by Madwand ( 79821 ) on Wednesday August 02, 2000 @11:40AM (#885239) Homepage

    One other thing that came out in the Congressional Hearing that I haven't seen in any postings moderated up to level 3 or above is that Carnivore is an exact equivalent to a practice in the telephony world called "trunk tapping" which Congress specifically debated, deliberated, and outlawed 30 years ago.

    When any LEA taps your phone, they've got to go to the particular wire pair that leads to the telephone being tapped. They are not allowed to tap the inter-switch trunk lines, because they could concievably record more than they're legally entitled to under the court-order that authorizes the wiretap. Carnivore's function as a packet sniffer for Ethernet or equivalent allows them to tap the trunks of ISPs - the LAN links between routers, rather than just the xDSL pair leading to your house. This is likely to be ruled illegal.

    Longer term, IP Security (encrypting everything in an IP packet except the IP header) is going to reduce LEA's ability to do anything other than traffic analysis (who is talking to whom, but not what they're saying). The quicker we deploy IPsec and use it in daily practice, the sooner we render Carnivore relatively harmless.

  • by Richy_T ( 111409 ) on Wednesday August 02, 2000 @09:56AM (#885240) Homepage
    Glad I'm a vegitarian :)

    Rich

  • by jesterzog ( 189797 ) on Thursday August 03, 2000 @03:26AM (#885243) Journal

    Almost everyone assumes that Carnivore tracks e-mail - this may not be all. During the hearing suggestions and speculations covered a lot of TCP/IP protocols - from the near admission of the FBI that they have tracked ftp transfers, through the constant mentioning by the FBI pannelists that they look at packets, to the tracking of http requests, streaming media server connections, etc.

    I can't deny that the whole thing bothers me in the short term, but every time I think about it I can't help but come to the conclusion that it shouldn't matter what carnivore does.

    Fundamentally, people in all parts of the world should be able to do whatever they want with your traffic, and it shouldn't compromise the sender and receiver being able to get what they want. When it comes down to it, something like carnivore shouldn't be any more than an issue between the government and any given ISP that is being coerced into using it.

    One of the most amazing things about the net is that it's a completely open system, and at the same time it's reliable. You can send a packet out into the wild and through clever development of end-to-end protocols, have a completely reliable conversation with someone on the other end. The storm in the middle might be dropping half the packets, but the protocols on each end can be designed to detect all this and compensate for it. That's one of the coolest things about the net, IMHO: surviving so well in an archaic system.

    If people have to rely on something in the open system (beyond their control) to conform to imposed rules - such as not reading their transmissions - then the people aren't using the net properly. Where one person argues for the right to their privacy, another person can argue for the right to monitor traffic that passes through their system. As soon as rules are imposed on either of these people, it blocks possible directions that the whole thing can expand to in the future.

    By trying to block carnivore we're grasping at straws. It's on the same level as security by obscurity: you can make a rule but you can't guarantee that anybody's going to listen to it. No-one foresaw in time that this might happen, and the infrastructure wasn't put in place to ensure we have as much end-to-end privacy as we have end-to-end reliability.

    If privacy protocols and encryption don't get standardised and easy to use soon, the net community is going to be more or less crippled, relying on others to turn their back to get privacy. It's security by politeness, and to me that's even dumber than security by obscurity.


    ===
  • by evanbd ( 210358 ) on Wednesday August 02, 2000 @09:57AM (#885244)
    I heard a piece about this on NPR this morning. I don't remember where to get text, is it available online? Anyway, the FBI was saying that if they opened it up, ppl could learn how to get around it. But can't we do that already? Encryption, etc. Yet another case where obscurity doesn't work -- those who want to can, and those who don't know how are stuck having their privacy invaded, with the result that the ones who they want to snoop on are stopping them...

    ---
  • By the way, there were many people during Franklin's era who had ideas and opinions similar to yours. There was even a name for such people: they were called 'Tories'.

    Your side lost the war. Perhaps we would all have been better off with a paternalistic Royal government looking after us - but I don't think so.

    Those of us who disagree with your approach to things are the intellectual descendants of the people who founded this country. That is why we are fond of quoting people you find obsolete.

    These were great men - you Sir are not, and there in lies the difference; your views are common as dirt, their views are profound.

    Given the choice of the words of Ben Franklin or those of an Anonymous Coward I choose Franklin.

  • Even if we were to get Carnivore's source under the FOIA (yeah, right), main would probably look something like this:

    #include (blacked out text)

    int (blacked out)
    {
    while((blacked out)==(blacked out))
    {
    int (blacked out) = (blacked out);
    (blacked out)();
    (blacked out)();
    }

    and so on...
  • by rjh ( 40933 ) <rjh@sixdemonbag.org> on Wednesday August 02, 2000 @11:42AM (#885253)
    I've posted this before, in a different form. But since people keep on making the same boneheaded statement again and again, I have to keep on presenting myself as an Average Joe exception to the rule.

    First, I'm not Joe Schmoe from Asshole, Indiana. I'm from a small town in Iowa, which is probably even more podunk than Asshole, Indiana is. And I'm fairly certain I've been under surveillance at least once in my life, and maybe far more often than that.

    Back in 1993 I was just getting interested in crypto, and I had an email exchange with a notorious arms dealer who was under investigation by the U.S. Government for arms smuggling. His name was Phil Zimmerman, the guy who wrote PGP. It was an innocuous email conversation talking about large number theory. But realistically, Phil was under investigation for arms smuggling (specifically, violation of ITAR/EAR), so it seems pretty reasonable for me to believe that he was under some kind of surveillance.

    Guess what? Since I was talking to him, that meant I was under surveillance, too.

    How many of us here have friends who are active in the phreak community? Go on, raise your hands. How many of you believe that your friends are so 1337 that they'll never be caught, never be fingered to the cops by their friends? Wow. So you have 1337 phreak acquaintances or friends, and you think that they might come under police investigation someday?

    Well, guess what, buddy. If they come under investigation... so do you.

    Loyd Blankenship, from Steve Jackson Games, found this out the hard way. Remember the Secret Service raid on SJG? That was predicated, in large part, on Blankenship's association with people the government declared to be naughty. It was a pretty tenuous freakin' association, too--and the Secret Service still decided to swoop down and raid the place.

    In my last job, I was doing InfoSec for a San Francisco start-up which was going to be expanding into Europe. This concerned me, because a lot of European businesses are partially owned by the government, and the European intelligence agencies (particularly France's DGSE) have been known to eavesdrop on communications for purposes of economic espionage. The NSA does the same thing for American firms--but the NSA claims that it only does so to counteract foreign governmental abuses of their intelligence apparata.

    Was I concerned about the DGSE? Hell yes. Little ol' me, the hayseed who grew up on an Iowa farm, was working in an industry where governments commit economic espionage.

    A few months ago I became tangentially involved in a criminal investigation. Although I wasn't the target of the criminal investigation, I worked closely with the individual who was under the FBI's spotlight. Guess what? That spotlight got pointed against me, too. Not for long, just long enough for the FBI to realize that I had nothing to do with it. But I didn't like it one bit.

    We don't have to be important or criminals to come under the spotlight of government scrutiny. We don't have to be doing anything wrong. We can be community leaders, outstanding citizens and decent human beings--and still, if you associate, knowingly or unknowingly, with people which the government is taking an interest in... well, you can expect to get hit.

    Period.
  • by Chris Parrinello ( 1505 ) on Wednesday August 02, 2000 @11:45AM (#885258)
    I'm currently involved in implementing software to allow cellular carriers to comply with CALEA.

    What the FBI is doing with Carnivore is completely contrary to how surveillance has been done in the past, if the stories about Carnivore are true. From what I understood, the Carnivore system is locked up in some cage, hooked up to the ISP's network and left alone. Only the FBI personnel are allowed to touch it.

    The way surveillance has been done in the past is the FBI or any law enforcement agency goes to a carrier with a paper warrant written by a judge that says they can conduct surveillance on a person in a particular geographical area for a certain length of time. The carrier then provisions the wiretap equipment (owned by the carrier) to allow the LEA's Law Enforcement Monitor (LEM) to login and receive surveillance data. The surveillance should stop when the warrant expires if it is not renewed by a judge. The judge does regular reviews of the surveillance to make sure it is all compliant with the law.

    With Carnivore, all of the accountability above is missing. The FBI owns and maintains the equipment and can be doing whatever they want with it regardless of whether or not there is a warrant. Who knows if they have implemented the automatic expiration of warrants (we had to in order to be compliant with FCC regulations). At least with the current scheme of things, the carrier has to be presented with a warrant and knows what is being done on its network.

    With what I have seen the FBI try to get out of the CALEA law, they are really trying to expand their wiretap capabilities. An example: The FCC's latest CALEA standard allows LEA to continue surveill conference calls that the subject under surveillance has already hung up on or may or may not be a particpant of (in dispatch systems).

    I think Carnivore is just another example of the FBI trying to expand its capabilities. I think this is also a case of asking for forgiveness rather than permission. Permissions would have taken too long in their eyes.
  • by John Jorsett ( 171560 ) on Wednesday August 02, 2000 @10:44AM (#885265)
    Prediction: It'll turn out that the failure to act on the FOIA request was just administrative red tape and such, and that there's nothing wrong/sinister going on here.

    My guess is that you're probably correct that Carnivore isn't some nefarious conspiracy on the part of the FBI. However, having worked in large bureaucracies, I think you're wrong that the dealy is just red tape. The first instinct of a bureaucrat is to stonewall any request for information. Disclosure never is to their advantage. At best, there's no harmful stuff there, but the organization/bureaucrat isn't going to get any brownie points for doing the right thing by releasing it. At worst, there's going to be something horrible that will embarrass the organization. get them a hearing on capitol hill, and possibly ruin the bureaucrat's career. The the first question that runs thru a bureaucrat's mind when getting a request like this is: "What's in this stuff they're requesting? Do they know something? I'd better have our staff review it before releasing so maybe we can bury it or at least get our story straight about it."
  • by rellort ( 146793 ) on Wednesday August 02, 2000 @10:44AM (#885266)
    The mere ability of the FBI to snoop POP3/SMTP traffic should not be a suprise. Any punk with a packet sniffer can pull this off.

    What should concern us is the scope of Carnivore. Present indications are that it works like a fishing net and we simply trust the FBI to throw out the stuff they're not interested in. In order to be "interested in" traffic, the FBI must have a warrant. Right?

    Wrong.

    Having a warrant only permits the FBI to introduce the evidence in court. They can still listen in order to determine whether or not to continue an investigation on a suspect. This is a VERY common law enforcement technique. It saves a lot of resources and produces leads that can be followed up later without stepping all over the Fourth Amendment.

    Warrantless wiretaps DO happen. Covert audio recordings ARE made. The results are just never introduced in court.

    The old rule still applies -- don't say anything in email you wouldn't want your mother, your boss, or the police to hear.

    (And yes, black helicopters do exist. My uncle used to paint them.)
  • I wonder what the FBI is concerned a review would find?

    Anyone using PGP or some other encryption is going to require some horsepower to decrypt. So this means they are looking for the dumber crooks.

    So what is it we would find? I can only think of a few reasons:
    Paranoia - if they tell us, we will
    hack it. (security through
    obscurity)
    Bad Code - the embarrassment factor when
    someone describes a flaw in the
    first 10 minutes of its release.
    Deception - we find it sniffs for more or
    keeps more than we are told

    I am not of the group who thinks the FBI is defined by WACO. The issue is that sometimes in the face of a situation that is difficult to understand and even harder to control, you want to look like you can. In the end you jeopardize the very reason for being. To protect our freedoms, even at the risk of some security.
  • The funny thing about mass searches is that they have an amazingn umber of false positives. We have lots of people who have falsely been convicted based on DNA evidence dispite the fact that the chances for bad DNA evidence are very very high (much higher then the chances for a bad keyword search). The false positives become likely since so many people are searched so frequently.

    We really need to pass laws with prohibit any evidence *type* collected from more then 100 suspects from use in a court of law, i.e. If you use any DNA evidence to find the suspects then you may not use any DNA evidence to convict. Simillarly, if you use any email to narow down the search (i.e. reduce the nuber of suspect at a time when the number of suspects exceaded 100) then you may not use any email evidence to convict. I think this would curtail the use and implementation ofthese type of systems.
  • by Anonymous Coward on Wednesday August 02, 2000 @09:59AM (#885275)
    Look, while I understand that people don't like the idea of having the government read their e-mail, I think that a lot of people frankly overestimate their importance in the grand scheme of things. There are millions upon millions of people in this country. And yet some little schmoe from Asshole, Indiana thinks that he is so important that the "gummint" has got dozens of agents watching his every move and reading every little piece of mail that he gets.

    Puh-leeeeeeze. Unless the FBI all of a sudden raises its number of employees by a factor of ten thousand or so, surveillance on every American citizen is not possible. Even if it were, why would the government bother? They've got better things to do than watch you defile yourself in front of electronic porn. Somebody here on Slashdot has got a sig that says "Big Brother doesn't care about you." That's right. Don't be so deluded and self-important as to believe that people actually care about what you're doing.

    Personally, I think that the only people that need to be monitored are those who are worried about the government monitoring them. By expressing worries, they've expressed that they are probably doing something illegal or extralegal. This is why I am (more or less) in favor of Carnivore. It's not the end of privacy in America by a long shot. People who believe that it is are probably conspiracy theorists who should go back to figuring out who shot JFK (hint: his initials were LHO.)
  • by LNO ( 180595 ) on Wednesday August 02, 2000 @09:59AM (#885277)
    "We have nothing to hide," a FBI spokesperson said. "The ACLU's request was sent by email, so, er, it came as a complete surprise to us, so, um, we couldn't have hidden anything."

    "Please use email for all of your future correspondence with our Congressional overseers- it makes, er, participating in politics that much easier for you. Yeah."

  • Sorry to tell you this, but it is NOT the government's job to protect you and your family.

    This may come as a shock to you, but THAT IS YOUR JOB. If anything bad ever happens to you or your family, you will discover that to be true.

    The government's job is to enforce the law - this may, or may not, result in increased security for you and your family. That is why the Government agencies are called POLICE departments, not SECURITY FORCES; they are not set up to provide security.

  • What good would Carnivore do in catching any but the stupidest of criminals anyway? That is to say, if a criminal enterprise were to use strong encryption on their e-mail, wouldn't that secure the e-mail from being read by Carnivore? Given the fact that e-mail can persist for years on every mail server between the sender and receiver, only an idiot would send anything confidential and/or possibly incriminating over unsecured e-mail. It would seem to me that catching anyone this stupid would be easily enough done without Carnivore.
  • Maybe we should have the FBI come in and compile all the software we need and then install it on various ISPs on a case-by-case basis. In the meantime, the e-mail ordering the obliteration of your daughter's elementary school or your grandmother's nursing home has already been sent and has gone out to the co-conspirators undetected.

    No, for the system to be effective, it has to be available at a moment's notice. The paranoid rantings of those who feel that the government is "coming after them" are not impressive in the least.


    Well, the FBI does not feel it necessary to place a black box on every phone line in the US because they might have a need to wire tap them. Instead, they go to the phone companies, and the phone companies facilitate the action. There is no reason that they could not require ISPs to provide them with email from specific court order named accounts - and that such accounts be "tappable" on a moment's notice by the ISP.

    The precedent the FBI would set here is unmistakable. They claim they have a right, in the name of national security, to become an integral part of email traffic. The government NEVER has a right to become an integral part of its citizen's private communications without reasonable cause!!!
    That is a blatant violation of the 4th Amendment.

    Not to mention it is just a stupid idea. Carnivore is conceptualized as a mail server intercept -
    not a mail server sniffer. Its failure will shut down ISPs.

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Working...