Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy Your Rights Online

Dartmouth Student Invents A Carnivore Leash 188

Posted by timothy from the now-heel-and-fetch dept.
timdorr writes: "Looks like a student at Dartmouth wants to turn Carnivore into a much more resonable tool according to this Wired article. I'd personally feel a lot less invaded if I knew the system was in place and in this form. Hopefully the government takes notice becuase Carnivore still seems like quite a loophole for our government to exploit."
This discussion has been archived. No new comments can be posted.

Dartmouth Student Invents A Carnivore Leash More

Dartmouth Student Invents A Carnivore Leash

Comments Filter:

  • hmmm (Score:2, Insightful)

    by Mac Nazgul ( 196332 )
    No offense to the ASPCA, but how about a quick and dirty neutering?

    • Re:hmmm (Score:5, Insightful)

      by digitalunity ( 19107 ) <digitalunity@yah o o . com> on Friday April 19, 2002 @06:16AM (#3372211) Homepage
      These Orwellian news stories are becoming more frequent. They are beginning to scare me. Average American citizens believe that because they've done nothing wrong that this invasion of privacy does not affect them. That's what eastern europeans thought before WWII. Think about this: So, you have some unfounded trust in your current government. You think that the invasion of privacy will only lead to greater safety. This is laid on the premise that the current government is the only one to ever lay hands on the sensitive information. Can you say now that you trust any future governments to use the information for the greater good?

      Can you trust all new administrations to do only good? McCarthy is a prime example of what happens when you let paranoia feed on patriotism. What if in the future a fascist(in the true sense) governemnt controls america. What will you do then? By this time, you've already been catalogued and filed and triplicated in every possible way; you gave up your right to privacy years ago.

      Round two: A computer cracker or a corporate spy thieves the database for their own personal gain. You, and all 249 million of your neighbors are now in the hands of the highest bidding corporation or marketing firm. What are you gonna do? Nothing. You don't have any rights. You gave them away already.

      Although the right to electronic privacy is not in the constitution for obvious reasons, the true intent of the bill of rights is obvious. The Bush Legislation Regime is feeding on our own fear of the enemy(whoever that is) to take away our rights. Everything from Carnivore to the SSSCA(or whatever new derivative is in the works) to the USA Patriot Act, our rights are being eroded away one law at a time. Americans are like frogs, they'll sit in their apathetic zombie worlds letting their rights vaporize while calmly waiting for the water to boil.

      I may be a elitist prick; but the apathy, disillusionment, and ignorance surrounding me makes me want to vomit.

      • Re:hmmm (Score:3, Insightful)

        by iamplasma ( 189832 )
        Slashdot moderation at work! All you need to do is make a totally content-free paranoid libertarian post, and it's an instant +5.

        Do you have the slightest thing to say on topic, or are you just taking any chance to rant? Seriously, I think you need to take off the tin-foil hat for once. Do we oppose phone taps on the grounds that if they really really wanted to, the FBI could tap everyone's phone? No! "Carnivore" is just phone tap for email with a catchy name, nothing more, which for no particular reason has turned into a lightning rod for every paranoid conspiracy out there.

        (and just watch me get moderated "-2, Dissenting Opinion" for saying it too)

        • Not the same. (Score:3, Insightful)

          by Grendel Drago ( 41496 )
          The FBI needs a court order or the permission of one of the two parties involved to get a wiretap. It's not trivial.

          Carnivore, on the other hand, listens without permission from the judicial system, without any oversight. There is no balance to this power.

          Sure, Carnivore is equivalent to a phone tap for email---a phone tap that the feds can apply to anyone, for any reason, on the merest whim.

          I think the tin-foil hats are justified here.

          --grendel drago
          • On what basis do you say that they can apply to anyone, for any reason, on the merest whim? I'm not talking about "it could be if they went off on a personal vendetta and abused it", but what actually legally seperates it from another such listening device? I haven't heard of any such provision until now, so I'm open to any further information.
            • A phone tap requires a court order. Carnivore does not. That's the important difference.

              No personal vendetta is required; law enforcement officials may have the purest of intentions while stepping on my rights, but that doesn't justify them.

              If we trust law enforcement to make these decisions, we give up on the whole idea of judicial oversight---the cops become accountable to no one.

              --grendel drago
          • Okay, so what is needed?

            First of all, every judge authorised to make wiretap decisions needs to have an encryption key signed by the secretary of state. Without this, the whole system falls apart, but nobody seems yet to have implemented it.

            Secondly, a list needs to be electronically published and signed, containing the names and keys of all judges so authorised. Again, how else do they expect people to know who's got authorisation to get this data.

            Thirdly, a standards body needs an XML template that the judges can fill in to authorise an electronic wiretap. Information required, the intended target, the name of the investigating officer, etc. Once these are in a standard form, they can be electronically processed.

            This is all just what the story's proposing (albeit in a narrower sense) but did it ever occur to -anyone- before, to have something as basic as a way of finding out if an electronic warrant is valid?

            If, as the article says, companies are spending hundreds of man-hours per week on this, they definitely need somewhere they can feed all the electronically-signed warrants, a computer which will determine their validity, log the information asked for, get the information, encrypt it both to the investigating officer's key, and to the judge's, then email it back to them.

            Try explaining that to a policeman. "But I just want this information... and this, and this, and this... And I want it for free. And I want you to check this warrant for free also. And you can be sued if you accept an invalid warrant. And you can be sued if I take data not permitted by law. And you can be sued if your servers fuck-up while I'm poking around in them..."

            Try explaining that to the sysadmins...

        • Re:hmmm (Score:1)

          by mgv ( 198488 )
          (and just watch me get moderated "-2, Dissenting Opinion" for saying it too)

          Well, you got that bit wrong at least. You are sitting at +5, Insightful.

          Probably doesn't reflect on the quality of the rest of your post I guess.

          Michael

      • Average American citizens believe that because they've done nothing wrong that this invasion of privacy does not affect them. That's what eastern europeans thought before WWII. Think about this: So, you have some unfounded trust in your current government. You think that the invasion of privacy will only lead to greater safety.

        This just reminds me of a really good quote by Benjamin Franklin that I'd really like to share...

        "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - Benjamin Franklin
  • How soon before this student will be detained for 'Un-American' behavior?
    • Un-American? He's being down right UNPATRIOTIC. How dare all you fuckers; privacy? You don't get no stinking privacy! If you are innocent, you have nothing to hide, right?
      [/sarcasm]

      I'm 1/4 Australian. When can I move?
      • Well, as an Australian I think you'd hate it over here. We allow knife searches based on suspicion, and various limitations on our freedoms which Americans would never dream of. It's not that we are oppressed, it's just the way we like to live, even if you disagree.

        Though have you considered that you may be acting a bit paranoid? I mean, really, you seem to be (along with most of Carnivore's opponents) assuming the very worst, without any firm evidence to do so. How about giving things a chance before passing judgement?
        • Though have you considered that you may be acting a bit paranoid? I mean, really, you seem to be (along with most of Carnivore's opponents) assuming the very worst, without any firm evidence to do so. How about giving things a chance before passing judgement?

          The point is that there is no judicial review, which is required by the Fourth Amendment. To at least a few Americans, violations agains the Constitution - even if done with the best of intentions - are problematic.

          Without judicial review the police can do whatever they like. And police are only human, no better or worse than the rest of us, and just as prone to mistakes and the presence of 'bad apples'.

          Max
        • The USA PATRIOT Act denies us the opportunity for judicial review. In cases of abuse, we may never hear about it. Neither will the courts. Law enforcement have overreaching authority now. They can get a wiretap or e-mail tap on someone merely by saying it is 'in connection' with an ongoing investigation, without providing evidence. There is also no performance review. They are under no obligation to tell the courts how fruitful the search was or what, if anything they found. These 'checks and balances' have been in place for over 25 years and had really changed a lot.

          Maybe I'm being paranoid. But, maybe I'd just like there to be no opportunity for abuse. I have to assume that the fact there are 100's of thousands of requests by the justice department for new information on online users that in some way, they are too broadly searching the net.

          This is all based on the premise that the terrorists aren't using any type of concealment such as PGP(which we know they are). The invasion of privacy is unwarranted. There was no real review process for the PATRIOT act. It has some really good provisions. And a bunch that are blatantly 'over the line'. I want a safe homeland just as much as the next guy. I'm just hoping that fear similar to that felt during the cold war doesn't well up again. Our own fear is our worst enemy.

  • And remember (Score:3, Funny)

    by Kierthos ( 225954 ) on Friday April 19, 2002 @05:24AM (#3372052) Homepage
    Don't just leash your Carnivore, spay or neuter it unless you want to be responsible for little baby Carnivores.

    Kierthos
    • Hey!, aren't most people that 'frequent' slashdot their own 'sysadmins?', personally I own my own RAQ and domain, sure it's co-located, but it's still mine for $75.00/month - no-one has ever (or will) install such a gadget on this machine or any domain I host/donate.

      I think people are freaking out about nothing...there is no way any 'men in black suits and thin ties' can monitor all the email that comes out of a major co-lo. they just can't....sorry, but that's a hard pill to swallow.

      If you think carnivore is running on your server, well, I'll give you a free email address and web based email - that'll quite down all the whinning.

      John

    • Re:And remember (Score:1, Offtopic)

      by alexburke ( 119254 )
      Ash nazg durbatulûk,

      One ring to rule them all,

      ash nazg gimbatul,

      one ring to find them,

      ash nazg thrakatulûk agh burzum-ishi krimpatul.

      one ring to bring them all and in the darkness bind them.

  • Re: (Score:2, Interesting)

    by account_deleted ( 4530225 )
    Comment removed based on user account deletion
    • This guys idea would essentially ruin the Carnivore project.
      This guy's idea is a load of crap. It won't work. Why? First, let's see how this works: He proposes the ISP put a "vault" on the network to store all the traffic, and the "vault" would be designed to only allow the FBI to see the data a judge permitted them to see with a court order.

      OK, assuming for a moment the judge wouldn't simply grant the FBI permission to open the entire vault, this idea totally misses the point of Carnivore. Carnivore is a box that sits on the ISP's network and snoops the traffic, looking for whatever the FBI wants. It would sit on the network right next to the "vault" and see the exact same traffic the "vault" sees; nothing the "vault" does would hid anything from the Carnivore box. Get it?

      THIS IDEA WILL NOT WORK.

      Ah, Dartmouth, home of Usenet's greatest genius [killfile.org]. Must be the water.

  • >>> The U.S. Department of Justice and IBM partially funded this research. I am surprised that the justice dept would pay for this. If they actually use it, my impression of them will actually improve for once.

  • unfortunately, it will provide no protection at al (Score:5, Insightful)

    by Syre ( 234917 ) on Friday April 19, 2002 @05:26AM (#3372063)
    This is an excellent approach! I am really thrilled to see someone coming up with a solution that allows the government all legitimate use while providing the tools to prevent overstepping. And partially funded by the justice department too!

    The big problem with this is that even if it's implemented, since under the Patriot Act judges need not sign off on subpoenas, the FBI et al would still be able to get all they keys they want and still access all the data.

    For this device to be useful, unfortunately, the law must be changed to require judicial oversight... and the judges must be trustworthy!
    • True, they would be able to get all the keys they want - but they would still be limited in the data each key can retrieve. It's highly unlikely that the system would allow the FBI to request key allowing them to access ALL emails, or enough restricted-data keys, without there being some oversight by a third body (the judge)

      This is an important developement because it looks like striking the right balance between the individuals' right to privacy and the requirements of the government in their quest to protect us. Whether the system will be used to protect us or not is not something programming can change, sadly, that's a matter for the judges et al signing off on the subpoenas/search warrants/what not
      • "designed to destroy itself if it detects an intrusion attempt. " - sounds like something out of Mission Impossible - but seriously won't the FBI just cite something like "national security" or some other phrase to get what they want when they haven't got a valid case?
    • For this device to be useful, unfortunately, the law must be changed to require judicial oversight... and the judges must be trustworthy!

      [ I said this before, but I like to repeat myself :) ]
      Current public-key encryption (gnupg, pgp) is strong enough to keep you safe from "casual" prying eyes - like your spouse, children, parents, syadmin, boss, street cops, even the fbi. Maybe they *can* crack it (i mean the feds), but they won't go to that without strong reasons and probably more thinking.

      What really pisses me off if this "casual" attitude to authorities snooping my personal communication; I'm sure that if the cia, nsa, kgb, mafia, big corporations or who knows else - want to read my email, they will. But I'm also sure that by using gpg, none of the small big-brothers will get their kicks.

  • Get some perspective (Score:4, Funny)

    by Anonymous Coward on Friday April 19, 2002 @05:35AM (#3372082)
    Anyone who thinks Carnivore is a ferocious animal right now, please step into the hallway for your I.Q. test.
    Everyone else knows that after 9/11 so many people made calls, emails, HAM traffic to the tune of 'terrorist' this, 'Cell' that, that Carnivore must have sustained a complete mental(server) breakdown. Put your thoughts to things of more importance (Israel/Palistineans, Coke vs Pepsi). The chance that something the FBI/CIA built outside of a national coding symposium would be so utterly, absolutely crashed from the traffic of keywords that it doesn't bear looking at. I'm not trying to point you in the direction of unilateral oversight and say it's OK, I'm just saying that 'right now' there are more important things to look at than a system more crashed and confused, that it probably thinks its an Atari 2600 with a buggy version of Combat loaded up
    • ...

      So, what three-letter agency do you work for?
    • Yes, if Carnivore is doing a simple word scan on email messages, but somehow I doubt that. I would imagine that it knows the difference in context from a message like "Say a prayer for those who died by the hands of terrorists" and a message that contains the launch directives for the next message.

      If I was going to do something similar to a terrorist activity, I wouldn't just be pushing raw ASCII email messages with that kind of information in them. I would encrypt the message in a image and say, "Look at some pictures from my trip to NYC." Carnivore is looking for those kinds of patterns.

      • Re:Get some perspective (Score:3, Insightful)

        by mpe ( 36238 )
        Yes, if Carnivore is doing a simple word scan on email messages, but somehow I doubt that. I would imagine that it knows the difference in context from a message like "Say a prayer for those who died by the hands of terrorists" and a message that contains the launch directives for the next message.

        Except that a terrorist "go code" probably wouldn't contain any information about what they were doing at all. Since they already know what the mission is.

        If I was going to do something similar to a terrorist activity, I wouldn't just be pushing raw ASCII email messages with that kind of information in them. I would encrypt the message in a image and say, "Look at some pictures from my trip to NYC." Carnivore is looking for those kinds of patterns.

        No you want to avoid encrypting anything and denfinitly not hiding inside a graphics file. Since this is likely to create obvious patterns. Far better to use a code a good code will appear to be a competly innocent message.
    • I'm afraid there's a lot more to monitoring communications than just keyword searches, which are not necessarily even the first thing an email monitoring system would examine.

      When examining a communications network -- which is what we would be doing if we were trying to track illegal activity through email -- the first thing we look at is not the content of the messages, but the pattern of communications between nodes. We would only have to start with keywords if we had no suspects, and that would be the sort of fishing expedition that is prohibited by law. But odds are we do have a suspect, so we look at who he's talking to, who those people are talking to, and so on, until we are eight or nine steps away from the suspect. (Much further than that is not only impractical but generally pointless.)

      Having established a clique, we can examine the volume of mail between nodes, and see who is the best-connected (and therefore likely to be exerting some kind of administrative control). If, in the course of this, we see some people who are suspects in a previously unrelated investigation, we can explore the possibility of hitherto unknown connections.

      Without once having looked at the content of a single message, we have developed a pretty clear picture of the relationships between our suspect, people not yet suspected of anything, and if we are lucky, other suspects.

      Then we can start using keyword searches on a reasonable volume of mail to serve as a starting point for manual examination of message contents.

      In any event, the word 'terrorist' is not going to be a problem for law enforcement, because terrorists don't call themselves terrorists -- that's a label that our propagandists apply to them. Judging from what has been released to the public, they refer to themselves as 'freedom fighters', 'fighter brethren', 'mujahideen', and several other labels -- which points out another thing we can exploit: people who belong to cliques, especially tight-knit underground ideological factions, develop their own characteristic jargon. Simple word-frequency analysis as well as more complicated techniques such as n-gram analysis and Markov chains, can be used to pick these out of the crowd once you have a 'model text' to study. (These techniques can be applied with significant but lesser accuracy to less-cohesive cliques, such as professions, religious affiliations, and ordinary political factions.)

      In short, it is wise to bear in mind that however misguided federal law enforcement agencies may be, they are not stupid or naive, and neither are the computer scientists who work for them. Even if they were, the kind of programming involved is not especially challenging -- ninety percent of what you'd need to know can be found in Knuth.

  • great... (Score:3, Interesting)

    by CmdrTaco (editor) ( 564483 ) on Friday April 19, 2002 @05:39AM (#3372096)
    Great, just what we need- something comes along to make the public think it's perfectly okay for the government to monitor email. I don't care how secure it is, I would still rather have no government monitoring at all than even a system that would guaranteed not to be prone to abuse.

    • Re:great... (Score:2, Interesting)

      by Kierthos ( 225954 )
      Considering how many corporations monitor their employees' e-mail, how many ISPs just roll over for the cops/feds/armed forces when it comes to online information, and how amazingly dense most judges are when it comes to the internet, e-mail, file-sharing, etc., I'd rather that there was some kind of system that can guarentee some sort of privacy. Other then, of course, just not being online.

      I'm far too addicted to various online forums, games, and the easy access of e-mail to give it up. But in a like manner, I'm far too addicted to the idea of "Innocent until proven guilty.", "Life, Liberty, and the Pursuit of Happiness", Freedom of Speech, the 5th Amendment, and so on.

      Kierthos
      • But in a like manner, I'm far too addicted to the idea of "Innocent until proven guilty.", "Life, Liberty, and the Pursuit of Happiness", Freedom of Speech, the 5th Amendment, and so on.

        What about "give me liberty or give me death"?

        Max

    • Re:great... (Score:5, Insightful)

      by NoNeeeed ( 157503 ) <slash&paulleader,co,uk> on Friday April 19, 2002 @06:40AM (#3372325)
      Why do people have so much of a problem with the authorities monitoring e-mail, yet don't get up in arms about straight phone tapping? The right of the police to tap your phone is no different from their right to search your home, search you or indeed put you in prison. The same goes for reading your e-mail.

      Each of these powers is granted so that they can fight crime. I don't have a problem with the police having any of these powers, as long as they are restricted, i.e. you need a warrent to search someones house, or tap their phone, so you should need one to read their e-mail. I have a problem with echelon and 'fishing-trips', and the police abusing their power of search and arrest. But then thats why we have rules. Its up to us/our representatives/the judges to make sure that the police obay those rules. This is why so many cases get thrown out of court on 'technicalities', because someone broke the rules.

      On the whole this is pretty well inforced in britain, for example ALL interviews with the police, MUST be taped, and there has to be a witness, (unlike in the US where recording is only reccommended. That said we do have the rather dubious RIP bill but that still requires a warrent.

      So basically, if you are against (restricted, needs a warrent etc) tapping of your e-mails, you should be against the (warrented) search of properties and the (warrrented) tapping of phones.

      The internet is no different from any other communications medium. If you really think that it is, or has ever been some utopian paradise of free speech somehow seperate from the real world and real world laws, where anything is allowed, then you need to get out and about a bit more.

      The Internet is just another communications network, no different from any other. It is not special, just more advanced. Using the internet is no different from using a phone, or fax. You are not special, it is not special. Grow up and stop seeing the world from such a narrow viewpoint (I can't beleive I just said that on /.)

      Paul
      • It is known throughout the Internet that previous versions of the system now known as Echelon has been used for industrial espionage. Off course, the government sees it different but facts are that information about bussiness orders have been handed over to (American) rivals. So alot of companies want to be sure that Carnivore isn't misused for the same kind of "information gathering"

      • I don't really agree with your comparison. The problem is, if an officer gets a warrant to search my home then I know about it. I won't arrive home one day to find my place in a disarray and think it normal. There are ways (supposedly) to detect wiretaps. With monitoring email and internet traffic, it's completely transparent--there is nothing to tip you off to the fact that it's happening. This makes it even more alarming, because an officer can overstep his/her bounds (personal vendetta perhaps? zealous?) and there is a chance that *noone* would be the wiser.
        • Oh my god! A criminal can't find out he's under surveillance? It's an atrocity!

          Seriously, the whole idea of this sort of thing is to find out what's happening without the guy knowing, is that so unreasonable, as long as it's with just cause? I mean, sure, someone COULD misuse it, but I doubt there's a thing in the world which can't be misused anyway, so it is hardly a conclusive rebuttal.

          • But ... (Score:2, Insightful)

            by royalblue_tom ( 557302 )
            Let's look at it this way. If I have to go to a judge to request a tap, spelling out why I need it, then it's a serious thing. If I don't have to, then it's a casual thing - so the possibilities of misuse become that much greater.

            Let's say someone is misusing it. If they have to knowingly decieve a judge in order to get their tap, then if they are caught it's obvious to all. If they don't have to get prior approval, it can be blown off with "oh that's the wrong address, sorry" without any easy way of proving that it is not the case. And as it's a casual thing, generate a load of taps - the "oh that shouldn't have been there" excuse becomes all the more plausable ...

            Everyone accepts that misuse is always likely to occur (human nature). That's why you should have a set of checks and balances to disuade people from casual misuse.

            But it's all smoke. The constitution (4th amnd.) says that your right of "privacy" should only be disturbed if authorised by a judge. If the government/authorities want to change that, then they need a new amendment (nothing less will do). Anything less is "not the american way". What's the point in having a constitution (contyract between people and government) if it's not followed by the government?

            I've always understood that you are innocent until proven "a criminal". It's not that criminal's can't find out if they are under surveilance, it's *anyone*, criminal or otherwise can't find out. Who decides if it's a just cause -oit used to be a judge ...

      • Aside from possible uses for industrial espionage, which somebody else already pointed out... evidence integrity.

        When law enforcement records the phonecalls or your activity, they use a media that can be examined for integrity. Audio and video tapes can be examined for signs of manipulation. Digital, text-form messages have no such property. After all, it is not unheard of police tampering with the evidence or even implanting some.

        And for what? When they seriously need a scapegoat for a major and much publicized incident, or when they are certain in their collective mind that a certain person has committed the crime but not enough evidence exists. Now, fast forward to a situation, where these same law enforcement officials are in charge of the storage of digital evidence.

        In such a situation, forging email content and removing other parts is both easy and plausible. Add that to the fact that you will have hard time to prove that you didn't send such emails. You and the counterparts would all naturally destroy any and all such messages immediately afterwards. Even having something in store that resembles the alleged evidence is not enough. You would have stored that as an alibi and destroyed the others.

        So, in the end it's not about intercepting my digital correspondence. It's the possibility of easily tampering with that data, without leaving any evidence that such activity has ever taken place.

      • Re:great... (Score:3, Insightful)

        by extra88 ( 1003 )
        You haven't been paying attention to this subject. That's okay, it's not your country.

        One problem is that it's an information vacuum, it sucks up *everything* from the ISP, not just the packets sent or received by the suspect. They supposed to toss the packets belonging to everyone but the suspect but we only have their word on that. It's like they tapped every phone at a CO and are supposed to throw out all the tapes except the ones for the one house.

        Another is that the implementation of Carnivore does *not* have the same oversight wiretaps or property searches do.

        Have you ever seen Goodfellas or The Sopranos? When they do a wiretap, they're only allowed to record or listen if they hear in the first two minutes the target of the wiretap (not his wife, not his cousin) or if it's is material to the case. If its not, they have to turn it off for a period of time (something like 5 minutes) after which they can turn it back on to check again. With Carnivore they keep it all and don't even have a way of knowing who in the household was using the computer. Carnivore is like a secret search warrant of every home or business the suspect or anyone in his family visited.

        Someone else mentioned a suspect has no way of knowing if they're being "bugged" by Carnivore but I don't think we have a fundemental right to know if a warrant has been issued with our name on it.

        Of course wiretaps have gotten broader. I believe the FBI finally got their "roaming wiretap" law allowing them to listen to any phone the suspect *may* use. I'm sure there are rules of admissability if they record someone else by "mistake" but it's to late, the damage to innocent people's privacy has been done, they can't un-listen to their conversation.

        The Internet is different from other communications networks, not in terms of our rights but in technical terms. This has important ramifications for how laws are written and implemented. You should be squirming at the sight of my my similes comparing Carnivore to wiretaps and house searches, most metaphors relating the Internet to the physical world break down with a little scrutiny, but I'm just trying to relate my perspective.

        Carnivore is part of a larger trend we've been seeing in this country where what we believe is our right to privacy is being trampled by our government, not to mention corporations and other individuals. We see the lack of oversight for something like Carnivore and we feel the "chilling effect" it has on our speech and acts. It comes down to Quis cusotdiet ipsos custodes, "Who Watches the Watchers?" The recording of interviews by the police in the UK is smart for evdentiary reasons but it's really there to prevent abuses by the police. How do we get that for the use of Carnivore?
      • So basically, if you are against (restricted, needs a warrent etc) tapping of your e-mails, you should be against the (warrented) search of properties and the (warrrented) tapping of phones.

        You are sadly mistaken there, or actually you're stating the obvious in a wrong context. Carnivore is _NOT_ analogous to phone tapping. An analogy would be such phone tapping where _all_ calls (and without warrants) would be recorded somewhere "safe" or atleast triggering on unwarranted recording by merely saying "my brother is such a terrorist" over the phone.

        So, you see, the problem here which gets people so anxious is that Carnivore et al is about unwarranted monitoring. Little like having a surveillance camera in your living room and hoping that only feds would access the tapes and with proper warrants.

        Naturally the feds should have warrants and such _when_ they actually start digging through and/or using the material, but many, like myself, are reluctant to believe that such information would not find it's way to the wrong hands...
      • Ok, I'm going to reply to myself in order to address one or two things that people have said.

        a) I was replying to Taco's post. He expressed the view that he didn't want anyone being able to read his e-mail, no matter how good the system was. That was the angle I was working from.

        b) I am against carnivor and similar systems as they stand. Someone made a comment that Carnivor sniffs everything at the moment. That is not a reason to be against sniffing of e-mail, it is a reason to abhore Carnivor and Echelon in their present state. It is also a reason to develope alternatives as this guy from Dartmouth has done.

        c) I know that the USA PATRIOT act allows tapping without warrents, but this is not just confined to e-mails, it includes normal wire taps as well. This is not a reason to be against WARRENT RESTRICTED tapping, as I said several times in my post. It is however a reason to be against the USA PATRIOT act (and in the UK the R.I.P act (although that still requires warrents.

        d) Abuse of evidence. Again I agree that there is a problem with abuse of evidence. Someone mentioned that when the FBI taps a phone they are restricted in what they can listen to. What stops them? Rules, and oversight. The same thing that will stop abuse of any power. Also I doubt that any conviction would stand purly on the basis of an e-mail, most convictions in this country that are based on a single piece of very limsy evidence generally get overturned pretty quick. Agian, systems like that being developed help in the oversight. Presumably there is a combination of technical systems, and human organisation that prevents the FBI from listening to the wrong thing on a wire tap, why can't the same be done for e-mail? Hmm?

        All or most of this was in the original post, but then am I expecting too much of /.ers to read a post before they reply? Mabey I should just move permenantly to K5, people tend to read things more.

        It's funny that /.ers tend to be the first to go "technology is not evil, people are!" when it is file-swapping etc, but when it is the feds then the tech itself becomes evil, not the rules and laws that are inacted by YOUR representatives, on YOUR behalf.

        Paul
    • Even if it was guaranteed? That's retarded.

      Sheesh. Someone comes up with something GOOD, and CmdrTaco can't do anything but find some negative angle on it. How did this post get bumped up to a score of 3? Or do the editor's posts start off at 3?

      And why is Slashdot a congregation point for libertarian communists?
    • Hey, if you dont want your email to be read please download and use GPG. and dont try to say that it's too hard... it's simple for anyone who want to use the effort to keep their communications private.

      Basically, I have always believed that if you send a plain-text email EXPECT it to be read by someone that it is not intended for.. consider it a public posting.

  • Encrypt your mail... (Score:5, Insightful)

    by u01000101 ( 574295 ) <u01000101@yahoo.com> on Friday April 19, 2002 @05:41AM (#3372100) Homepage
    I'd personally feel a lot less invaded if I knew the system was in place and in this form.

    I'll personally continue to encrypt my emails - as many as possible of course.
    Routine use of encryption (like for the one-liners) defeats to some extent traffic analysys.

    The recent improvements in factoring (look here [cr.yp.to] and here [counterpane.com]) don't affect 1536- or 2048-bit keys (or larger). For the time being, public-key encryption is the best means of protecting your e-mail privacy. Don't rely on some guys' kindness - with a little effort you can be sure your nosy admin/ parent/ spouse/ street cop won't "accidentally" read your stuff.

    http://www.gnupg.org [gnupg.org]
  • ... convert Carnivore into Herbivore (e.g. something that's not going on a legal 'fishing expidition')

    Otherwise, only criminals are entitled to [or get any] privacy...

  • Impractical? (Score:3, Interesting)

    by hazyshadeofwinter ( 529262 ) <arto&telusplanet,net> on Friday April 19, 2002 @06:14AM (#3372202) Homepage
    The Wired article didn't go into too much detail, but I can see a couple of potential problems here..

    - how exactly does the FBI (or whatever) specify *what* they're looking for? Searching for "all traffic containing the keywords TERROR, BOMB, COCAINE and OSAMA" sounds like Carnivore as is, and would be pretty easy to defeat anyway. Anyone remember "The Longest Day", in which the Allies sent messages re: the date of the D-Day invasion over clear channel radio, using a code based on a Rimbaud (I think) poem?

    - the data vault might hold the FBI/NSA/whoever to their warrant, it does nothing about intentionally vague/overreaching warrants or the laws that enable them.

    - re: using this system to keep medical/financial/etc. info private: Hardly a catch all solution, the data vault can't stop companies from spreading/selling your info after you've given it to them in confidence.

    - If these do become commonplace, how long before a bungled police investigation results in evidence being lost because of one of these things self destructing? And once that happens, how long until they become outlawed?
    • FWIW, the Overlord messages of which you speak- "Les sanglots longs des violons de l'automne Blessent mon coeur d'une langueur monotone." (which roughly translates to "The long sob of the violins of autumn wound my heart with a monotonous langour") -are from Verlaine's poem "Chanson d'Automne" ("Song fo Autumn").
    • [your blabla]
      "There are only two things that have come out of Berkeley; LSD and Unix. And that's NOT a coincidence!"
      [/your blabla]

      [myblabla]
      LSD was discovered in Basel/Switzerland. [hawaii.edu]
      What about Steve Vai?
      Which Unix do you refer to?
      [/myblabla]

      I ack your points on the subject though.

    • LSD was discovered in the 1930's in Switzerland. Unless the Berkeley you are referring to is NOT the University of California.

      For further reference:
      The History of LSD Therapy" [psychedelic-library.org]
  • if it becomes a legal requirement for sysadmins to log certain traffic then it sounds like this is a better soloution than somthing written by the goverment. Still i live in the uk so it effects me slightly less.
  • Looking at the turn of events latley I'm glad to see that someone is taking such an active role in keeping the Govt agencies in check.

    If they have the right to enact the holy "DMCA" then what do we have to ensure they are not using computers to break the law for their own benifit?

    We can't even have code distributed that might possibly break someones rights, but they can copy every data transmittion across a network that they don't own? I don't think so. There needs to be some sort of fair play here, or else we're not much better than a dictatorship in which they get to tell us what we can't do and we get to shut up and take it or be arrested under laws we didn't vote on (read DMCA).

  • Since the entire Carnivore system - new or old can be thwarted just by encrypting your emails or using secure tunnelling it seems pointless to even waste money developing it. Ok, so most people don't bother and don't even need to, but one day a popular OS or internet package will come with features to do this automatically with out the user having to worry about it (maybe its here already but i haven't seen it.. Peek-a-booty? maybe?). Then, all emails/etc. will be encrypted and the governments won't be able to do anything about it. Then most people will start installing similar things on their phones, and buying hard-drives that are rigged to self destruct etc.. and no warrant or wire-tap will be able to get anything.

    All this technology is available now, but no-one can be bothered to use it (except the criminals). All it would take is one popular browser/email/OS developer to implement encryption like they implement spy-ware and half the internet would become unavailable to the governments over-night.
    • This wasn't developed to defeat Carnivore, it was developed as a research project, funded by IBM to make use of their 4758 cryptographic coprocessor.

  • Private Citizens vs. FBI (Score:3, Interesting)

    by blankmange ( 571591 ) on Friday April 19, 2002 @07:19AM (#3372444)
    I guess, for me anyway, the irony here is that a single student did this. Not the FBI or any other agency/department of the government, but a private citizen had to come up with a way to harness and focus the power of Carnivore. I know the FBI probably could have done so themselves, or any other company/corporation, but they didn't. Never underestimate the power of the individual.
    • or any other company/corporation, but they didn't

      Thet's really odd... because if you think how much storage this whole "vault" idea will take, you'd imagine maxtor, wd, seagate, ibm... oops - forget ibm, hitachi grinning and rubbing their hands.

  • Hold on (Score:3, Interesting)

    by njord ( 548740 ) on Friday April 19, 2002 @07:38AM (#3372486)

    The problem is the people have huge misconceptions about Carnivore. Being concerned about personal privacy, I chose to research Carnivore for an Ethics class at school. I found that Carnivore is pretty much just misunderstood; it is really incapable of doing any large-scale surveillance. There's an independant review that was conducted by IITRI last year that points out that Carnivore is the safest of any online monitoring tool and that it is incapable of wantonly collecting data. Incidentally, the report suggests that Carnivore be open-sourced. Fat chance.

    The real issue is whether or not it's right to perform surviellance. I think that it can be necessary at times (with the required warrants) but I also think that it needs to be taken more seriously and greater restrictions need to be in place to ensure that it is only used in extreme situations. If you think that Carnivore could invade your privacy, read up on how many wiretaps are used every year. Carnivore is used much less and is safer to boot. The real problem here is whether the government should be allowed to monitor communications at all, not that Carnivore gives the government some awesome new powers of data capture.

    njord

    By the way, I really have no association with the government. I'm just a left-winger college student that did a little research and was surprised by what I found.

    • Re:Hold on (Score:3, Insightful)

      by vidarh ( 309115 )
      Carnivore in itself may not be a problem. The problem is if the FBI is given the ability to place tools in an ISPs environment without any control over what is placed there. How will the ISP know that FBI is using the version of Carnivore that has been through an independent review?

      If the ISP was allowed to review the code, compile it themselves, and install it one of their own boxes, the chance of abuse would be much smaller.

  • Even if the FBI physically seized the vault, legally or otherwise, it's supposed to be just about impossible for the cops to crack. Iliev's program runs on an IBM 4758 cryptographic coprocessor, designed to destroy itself if it detects an intrusion attempt. (emphasis added)

    I'm curious about this passage from the article. Would the ISP have a backup copy or does it completely eradicate the information? Would it destroy all the Carnivore data at an ISP or just the files that a "hacker" was trying to access?

    And finally, if the FBI got a warrant(?) to request the e-mails from a certain person, couldn't that person engineer a "hack" attempt on his own files, thus triggering their destruction before the FBI could access them?

    • First of all the processor destroys itself, not the data. If a second copy of the private key exists, then you could still access the data by installing a new processor with the same key. However of course, then a possible attack against the system would be to get hold of the second copy of the key.

      You could keep a set of processors encoded with the same key available as backups in case the processor in use is destroyed, though.

      Also, presumably in real life use noone would have network access to the interface you'd request data from, so unless someone gained physical access to the box at the ISPs offices, they wouldn't be able to trigger any destruction.

    • It's a little misleading to say the 4758 is "designed to destroy itself" when it detects a tamper attempt. What it does is immediately destroy all sensitive data stored inside the secure module. Thus, any data inside the card (like keys) cannot be obtained by anyone attacking the card. There are a number of sensors and barriers to detect many different hi-tech attempts to break in or extract data, and all of them trigger hardware-based tamper response mechanisms that destroy data before the attacker could get inside. Note that with the 4758, it is entirely possible to have the card generate its own RSA key pair, then keep the private key inside, so that it can never be compromised by getting at a backup, or at another card with the same key. The standard 4758 CCA software provides functions to do that, as it is a requirement by some applications. (Yes, they realize that the keys are lost if the hardware fails, is stolen, etc.)

  • How to predict government actions... (Score:3, Interesting)

    by PHAEDRU5 ( 213667 ) <instascreed.gmail@com> on Friday April 19, 2002 @07:47AM (#3372513) Homepage
    Simply take them to their logical end.

    The fact that Carnivore exists, in any form, indicates that the government wants access to all your communications, to know exactly what it is you're saying and hearing.

    This modified Carnivore is an attempt to claw a way back up the slippery slope when you've already hit bottom.

    You're only real options are either not to say or do or listen to anything the government might find objectionable, or encrypt all your communications.

  • Backdoor? (Score:3, Insightful)

    by Diabolical ( 2110 ) on Friday April 19, 2002 @07:47AM (#3372515) Homepage
    The article mentions the use of an cryptographic coprocessor that will self destruct if it notices any breach of security, rendering the stored data useless. It also states that this "vault" could be used to store medical information etc..

    I for one would like to know for sure that my medical information could be retrieved even after the destruction of the coprocessor.. would be nice when i'm caught in accident and i'm not able to sum up my medical history myself...

    Off course it's possible to use a less secure version of this "vault" for this kind of applications

    This is one nice solution though to harden the carnivore system against unwanted, illegal, snooping around for nice bits of information that could be used by a cop or fbi agent on the take...
  • Someone says "You didn't get my email? Carnivore ate my homework prefessor. That is the only explanation."

  • Iliev's Abstract (Score:2, Informative)

    by echucker ( 570962 )
    Taken from the PDF of his proposal "Prototyping an Armored Data Vault Rights Management on Big Brother's Computer" Alex Iliev and Sean Smith Department of Computer Science/Institute for Security Technology Studies Dartmouth College PDF can be found at http://www.cs.dartmouth.edu/~pkilab/papers/bb.pdf "This paper reports our experimental work in using commercial secure coprocessors to control access to private data. In our initial project, we look at archived network traffc. We seek to protect the privacy rights of a large population of data producers by restricting computation on a central authority's machine. The coprocessor approach provides more exibility and assurance in specifying and enforcing access policy than purely cryptographic schemes. This work extends to other application domains, such as distributing and sharing academic research data.This paper reports our experimental work in using commercial secure coprocessors to control access to private data. In our initial project, we look at archived network traffc. We seek to protect the privacy rights of a large population of data producers by restricting computation on a central authority's machine. The coprocessor approach provides more exibility and assurance in specifying and enforcing access policy than purely cryptographic schemes. This work extends to other application domains, such as distributing and sharing academic research data."
  • They certainly seemed to have invented a nice tech gadet. However (I don't know about you) but I don't see how it should help much with carnivore, at least from the article. Doesn't give much tech detail. It seems better suited to control access to data on smart cards or something like that (e.g. "chip that destroys itself during unauthorized access attempt").

    So what is this story all about? Media whoring and fundraising?
    Problem: we have invetented this cool technology, which noone is going to understand because it's a little complex and "people" (replace with "reporters" or "managers" as you see fit) are stupid. So how are we going to get some attention (and as a result, more funding)?
    Solution: we apply our gadget to some area where it doesn't really fit in (just sort of will do), but which will result in loads of attention because we'll get connected with the latest buzzwords and issues.

    Problem solved.

    • They certainly seemed to have invented a nice tech gadet. However (I don't know about you) but I don't see how it should help much with carnivore, at least from the article.

      I hope this works out better than the ill fated "Clipper" chip, well described in Steven Levy's "Crypto".

      http://mosaic.echonyc.com/~steven/crypto.html

      The last time the government promoted its wonder privacy gizmo, it didn't work out so well. Not only did Clipper start a political firestorm, but it turned out later not to be secure.

  • I know... Let's turn the net into the wild west, where the person with the fastest ping flooder wins. "Ugh! Ya got me sheriff!" While I would like to be so naive as to think that the net could survive without regulation, the sad facts are that the very thing that makes it so useful to us is the same thing that makes it useful to foriegn (and domestic) entities looking to do us harm. Yes, I know they can find other ways to do it, but not quite as quick and efficiently as on the net. Our entire society is rapidly going digital and that real estate is going to need some kind of defense and monitoring, just like the boarders of our nation.

    The big debatable question is how you do it. I think it was an interview with Neal Stephonson posted to Slash that correctly noted that it's not nessisarily the monitoring of our lives, but whether that monitoring has a watchdog in place to keep the power from being abused. Personally, I think Alex has the right idea. You need a search warrent to enter an search a house and likewise you'd need something similar to access somebodies digital "life", both requiring just cause. I'm not saying that they're not prone to abuse, but it'd sure go a long ways in the right direction.

    Unfortunately, the problem I see with Alex's system is not it's security, but in what Carny was originally designed to do. It is an evidence collector, designed to proactively track names and keywords, not wait for the e-police to have just cause to raid a database. Putting a search warrent lock on Carny defeats the entire purpose of having a system that illuminates potential problems before they happen. I think there acually needs to be a group that monitors everything the CIA/FBI/FIAA pulls from Carny and asks if it's A) relevant to the defense of our nation and B) Even ethical. That's the counter balance systems like Carnivore need, not simply a padlock.
    • But then, the govenment doesn't monitor every piece of mail, every conversation or every package you send IRL, now does it? While I do think the net needs regulation of some sort, vacuuming up every piece of information out there is the easy way out.
  • I just finished reading Crypto, and this sounds an awful lot like the escrow system the government was proposing and security advocates fought so hard against in the early 90's. Has anything changed to make this system more palatable?

  • Why all the pro-"Clipper Chip" type arguments??? (Score:5, Insightful)

    by BitMan ( 15055 ) on Friday April 19, 2002 @08:33AM (#3372630)

    I think people need a history lesson on all the arguments surrounding the Clipper chip. Remember, the problem isn't always government (although that's definitely part of it), but the inability of government to effectively protect the information from third parties that will abuse it. Key escrow is something that can and will be compromised. And because it is a technology that can and will infiltrated everything, it will allow complete access to your privacy by anyone who wants it. Again, it's the Clipper chip all over again!

    Need I revisit the the classic boofernery of the Social Security Number? Outlawed by the government for use outside of its specific creation, it is now used by everyone. And it is extremely easy to obtain, let alone steal! Now the government wants to introduce a national ID, something that is "more controlled" than the SSN. But it too will be easy to obtain and steal in no time as well. Only now, with a national ID, more people will put more of that so-called "faith" it in, so good Americans will have a tougher time proving someone has stolen their identity when it does happen (and it will). And if Microsoft gets Passport behind an "eID," God help us!

    Combine this with the CBDTPA/SSSCA, and there's plenty to worry about. The CBDTPA/SSSCA is exactly a pro-Clipper chip mentality! Only it isn't the FBI asking for it, but "Big Media." Heck, I'm surprised no one in "Big Media" is selling the CBDTPA/SSSCA to the government as an "unified solution" for "guaranting copyrights, privacy and law-enforcement" all in one shabang!

    Now this researcher has got "all the answers." His solution? Implement an encrypted recording and storage system with key escrow for access. How original! How many times are we going to go in the same damn circle on this???

    • "What? need Joe's complete digital history? Let me hack into Carny and get it for you..."
    • Key escrow is something that can and will be compromised. And because it is a technology that can and will infiltrated everything, it will allow complete access to your privacy by anyone who wants it.

      Who said anything about key escrow?

      I'd imagine this sort of system would use public key technology. The Carnivore boxes would not be able to decrypt the stuff it encrypts. There's nothing to compromise.

      The private key needed to decode it would be kept in a secure location. As long as RSA doesn't have some fatal flaw, i'm confident the key won't be compromised.

      The problem with the Clipper Chip was that it would allow the government a way to read messages that we had encrypted. Carnivote doesn't do that. It's purpose is to allow the government to read message that we were too stupid or lazy to encrypt.
    • The difference between this and the Clipper chip was that the clipper chip was going to be backed by a law that required ALL encryption in the US (personal, corperate, government, whatever...) be done under key escrow. It made it illegal to use any encryption that did not support key escrow and you had to get your keys from a federal agency (so they could insure that they had a key in escrow). The Clipper proposal took encryption out of the hands of the common man (no PGP or anything else, only government sanctioned encryption)

      The Dartmouth proposal is key escrow, but not as wide ranged as the Clipper proposal. This proposal does not state that you can't use PGP( or ROT-13 or some other encryption technology) for personal reasons, or that you can't create a private encrypted (VPN) digital voice channel between you and your friend (or partner in crime).

      The proposal is that if ISPs are forced to provide a standard mechanism for government agencies to snoop transmissions (ala CALEA for telco) then make the mechanism encrypt the data in a way that forces a process to be followed (even if a portion of that process is illegal, such as stealing escrowed keys)

      Currently the data is available with no auditing at all. Anyone who has the capability (agencies) can force there way into an ISP and take the info, even threaten the ISP to remain silent that the event even occured. With technology of this nature, the event could be logged and audited later (even reporting which key was used so it could be invalidated)

      This proposal needs lots of peer review; however it's not the Clipper Chip revisited.

      =Shreak

  • "The source code for the vault, which runs under the Linux operating system, is available on Dartmouth's website."

    So this system will itself be illegal when Senator Hollings and his ilk finally get non-security-compliant systems banned.

    • My guess is that the FBI will probably hate the idea, but the RIAA will love this thing. This is what they've been pushing for in the SSSCA or CBTBKJWhatever. Encrypted data that can only be accessed through special hardware? Any attempt to tamper with it destroys the data. Anyone worried yet? Oh, but Patrick Leahy headed that off at the pass, right? Wait till after the elections boys.

  • graduate students are funded to produce THIS? (Score:1, Insightful)

    by Anonymous Coward
    I'm sorry, I had to laugh. This whole thing is based on:
    1. The judiciary being incorruptible;
    2. All ISPs being incorruptible;
    3. The laws being such that the judiciary doesn't OK any and every excuse to look at data;
    4. The idea that some kid supplying a nice geek-friendly method automatically makes it OK for a government to enforce mandatory logging.
    Once again, an attempt to apply a technological solution to a social problem. This is to privacy as CSS encryption is to piracy.
    • "Hey Judge Judy, I'm calling in a favor. I need a key to search the entire life history of my ex-Girlfriend..."

      Or

      "Here's a $50,000... Look the other way while I search for ______"

      The government can't look through your mail, packages or monitor your every conversation in real life, why should they over the net?

  • You know what the big deal is about Carnivore? (Score:3, Insightful)

    by Leven Valera ( 127099 ) on Friday April 19, 2002 @09:46AM (#3373075) Homepage Journal
    The Internet has become a personal communications medium, with people blissfully chatting away on email, instant messagers, message boards, et cetera. The question is simple: If it was your phone, would you let a machine be installed to listen to all of your conversations without judicial oversight?

    No? Well, how about we read all of your mail as a matter of routine.

    No again? Why not have someone follow me around and tape all of my meatspace conversations?

    Still no? So why are you giving in so easily when it's just the Internet?

    Anybody who thinks that this capability won't be abused just has their head in the sand. It's only a matter of time.

    LV

  • I'd pay for an offshore secure mail service... (Score:1, Interesting)

    by Anonymous Coward
    ...or even one in the USA which is run by widely-known well-trusted members of the community, and which makes a promise to avoid all attempts at installation of government monitoring equipment/software.

    Hello EFF, gonna set such a service up or just gonna whine about the record industry all the time? ACLU, what about you?

    (I know they could still track some traffic to/from the network, but surely not all of it, and much less efficiently than being able to actually browse through a stored history of mails.)

  • ..a more interesting headline to see would've been:

    "Innsmouth student invents a Cthulhu leash"

    (Sorry, perhaps I should've got more sleep last night?)
  • Privacy? It's overrated. Terrorist? People with too much time on their hands anyway. But whether it works or not, Carnivore would make for a really mean Quake/UT server... Sorry, I just had to say it ^__^

    On a side note, it seems incredibly easy for an organization to spoof carnivore by simply lighting off an email/ftp campaign with a bunch of bots; all the files containing the key words bomb,terrorism,nuclear,WTC,biological,anthrax,atta ck,target or whatever else trips Carni to dance.

  • Why is this better? (Score:2, Insightful)

    by mencik ( 516959 )
    I fail to understand why this system is all that much better? This box records everything! Yes, each "conversation" is stored encrypted, and supposedly the FBI needs a court order to get the keys. Carnivore on the other hand looks at everything, but only records those things relevant to the court order, as determined by the settings entered into Carnivore. Yes, there is a chance it could be set up wrong, and that was the subject of the many recommendations IITRI made to improve the product. However the stuff that is not recorded by Carnivore can never be recovered, by definition of not being recorded in the first place. There is no opportunity to go back to court to ask for more keys. It has either been recorded or not.

    While I am not a big fan of Carnivore, I fail to see how this system protects us any better.
  • PCI Cryptographic Coprocessor now available for all IBM servers... [ibm.com]
    The leadership product for high-security cryptography and secure computing is now available for all IBM server platforms and many personal computers. The tamper-responding design has been certified under the USA FIPS 140-1 standard at levels 3 and 4, and has received German ZKA approval for critical financial transaction system processing.
    One would think that the Germans are very careful with encription, nowadays, having been badly burned by Colossus decrypting their Enigma output during the war... :) :)

  • Paranoia (Score:1, Flamebait)

    by Pedrito ( 94783 )
    Why is everyone so paranoid about Carnivore? I don't get it. They need a warrant to use it, and they can't use anything that's not in the warrant against you. Same rules as phone tapping. Why not have a big uproar about phone tapping? Granted, phone taps don't collect everything and sniff through it, but the end-result is the same.

    Being a, more or less, law abiding citizen, I have no issues with it at all. I might be a little concerned if I were dealing drugs over the internet, or performing some similar crime, but really, come on. You think the FBI is really concerned with how your day has been? That you just got an 'A' on your exam? Or that you hate your boss?

    Sorry, but I think everyone blows this stuff way out of proportion. When I see carnivore being abused, then I'll be concerned, but until then, I'm willing to give them the benefit of the doubt.
  • Why aren't be putting our collective weight behind FreeS/WAN [freeswan.org]?
  • This doesn't leash Carnivore. The creator doesn't understand Carnivore.

    First of all, the FBI gets a warrant for the DATA. If the ISP is unable to get the DATA themselves, the FBI can then insist that they install the Carnivore box. On the other hand, courts have ruled that if the ISP can indeed get the data, then Carnivore isn't needed.

    Second of all, the reason the FBI created Carnivore was because existing tools could not get the data. This encryption device is based upon existing tools, and therefore does not help get the data at all. For example, if the warrant requires the ISP to deliver copies of the suspect's e-mail, this device cannot do it.

    Third, people persist in believing that Carnivore is a keyword search engine like the rumored Echelon. This is false: no judge would grant a court order allowing the FBI the ability to search for keywords. (This encryption device is based upon a keyword search engine). A typical court order would be one that allows the FBI to get all e-mail to/from a named e-mail account. Another example would be a lesser court order allowing the FBI to record the e-mail addresses to/from the specified account, but not the contents.

    I have written a Carnivore engine that has previously been written up in /. It, and a Carnivore FAQ, is at: http://www.robertgraham.com/altivore/ [robertgraham.com].

Slashdot Top Deals

UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things. -- Doug Gwyn

Close