FBI Defends "Carnivore" 156
lasertech writes "This story on CNN.com explains how the FBI will only use Carnivore to sift through e-mail only with a valid court order.
Can the FBI be trusted with this?" While I don't want to stir the fire too much, the statistics concerning unauthorized wiretaps, which have similar restrictions, led me to believe that policing agencies need to get a grip on what they already have before they start working through more.
Re:they need to catch the criminals (Score:1)
Don't get me wrong, a whole lot of the folks in law enforcement are good people driven by a desire to see justice done.
Then again, there's also hairbrained idiots that give people like Joe McCarthy all the ammo he wants, by using the constitution as toilet paper.
So we're clear, the right to privacy is _not_ in the Constitution, it's been implied by the Supreme Court. However, to allow the Feds unfettered email access, even "court order only" access to any email they want, is tantamount to saying that while we like the Fourth Fifth and Sixth amendments, they really don't apply on the net.
Which could technically be argued - no reasonable expectation of privacy because your email goes through proprietary systems and not pure common carrier systems, as the phone company has been designated. They may have a legal leg to stand on, unfortunately. I don't want to think about that.
But as far as your "child molestors and their like" go, I must say that I wonder if you were being sarcastic. Who else is like a child molestor? Depends on who is legislating, no? Perhaps an abortion foe? Or an abortion activist? Or a Jew? Or a Muslim?
I mean, we should REALLY be cracking down on those middle eastern peoples, anyone who came here from Iran or Iraq or Libya or whatnot, whenEVER should be able to have their email scanned at will, because they might be emailing Ossama Bin Laden. (note: sarcasm)
Those of you that give up your Freedoms for freedoms (your Bill of Rights Freedoms for the freedom to live without fear, or so you believe) are exactly those that De'Tocqueville warned would cause the inevitable destruction of the "Great Experiment." Those who would rather a bottle of vodka, a linux box and oral sex once a week, instead of the Freedom to be secure in our persons from an intrusive government.
Put me down on the side of "Freedom" thanks. I don't mind if I live in a little bit of fear of my neighbors, if I don't have to fear being rounded up by the government because they saw me chatting with a friend, via email, about DeCSS.
Re:Too much power regardless (Score:1)
Since there are alternatives (duplicate routing of only the court-ordered monitored traffic is the most reasonable) there is no reason to put a system so ripe for abuse in the hands of any agency.
As far as proving they can handle it, I don't think that should ever be put to that test.
The scariest thing about the CNN article and other pieces in which the FBI responds is that it seems that the only thing they've learned is to name these projects better. They consider it a public relations issue, not a privacy one.
Why not tap the physical layer ? (Score:4)
Of course people communicate from computers from places other than their home, but the FBI and other law enforcement authorities have delt with pay phones and people placing calls from cell phones and from their work place in the past. (Often an extension to the wiretap order is needed. Or they use traditional bugs (small hidden microphones) or long distance directional microphones, etc.)
Why doesn't the tap go straight to the physical wire which at once assures you the you get all the subjects communications, and none of anyone elses ?
It can't be a matter of the trouble of sending someone to place a clip on the wires, because I don't think that law enforcement does that at all now. The telephone central switches have a way for them to remotely connect to a phone call and tape it, don't they ?
It would seem that this system would also expose them to the problem of a smart target tricking them into ignoring his communications through some type of packet mal-formation, so that his traffic isn't matched to his ip address. Or worse, someone else forging stuff that you end up thinking is the subject's. But if you hit the physical wire he is using, it is the perfect filter; all of his stuff and none of anyone else's.
I think the choices are:
-- The FBI thinks they can do their mission for a lot less money if they install carnivore boxes, and they don't think they will loose anything (or much) coming from the subject or get other's traffic mixed in. In this case I think they are just operating on technically incorrect advice; they probably hired some government contractor to look into the possibilities of such surveilence, and got talked into believing it was needed or would work.
-- The FBI actually wants to be a able to illegally grep through everyone's email. (If I was a lawyer defending some young client for "hacking" and reading someone else's mail, I'd sure have those FBI agents on the stand describing exactly what they do with that box, and I'd claim my client could not be punished for anything the Agency routinely does without a court order.)
Unfortunately, I'm leaning toward the first case. Or maybe that is fortunate. I think the FBI is just blowing money, getting less performance out of the new system, and spending a lot their political chits (which they might really need later), all for nothing. It's a boondogle that will blow a lot of trust along with government money. If the FBI is going to try to setup illegal wiretaps, it's nice that they are incompetent, but I'd rather have an agency both legally and technically skilled.
What happened to mail-forwarding? (Score:1)
Carnivore should be eliminated and in its place all ISPs should be required to have the ability to forward a specific user's email to the FBI in presence of a warrant. Carnivore intentionally gives the FBI the ability to scan all internet messages for any content, but we are supposed to trust that the FBI will not use 99% of that functionality. If that is the case then do not give them the ability in the first place.
This is still the early stages of the internet and the government is trying to stake out as much ground as it can before laws come into effect that will limit their internet activity. This is a clearly a case of it and we must fight for every bit of freedom we have left, though it may not be much. The primary focus of the FBI and related agencies is to protect the citizens, not their rights. Until this changes we as aware individuals must limit the ability of the FBI to infringe on our rights, and that means that Carnivore must be replaced with a more focused system of tapping emails.
Re:There already *IS* a watch dog agency.... (Score:1)
In some cases where the government refused to disclose evidence because of secrecy concerns (the old "National Security" thing), some judges have been known to take the government attorneys and witnesses into their private chambers and have them show the evidence there, and demand to know why the evidence needs to remain secret.
<RAMBLE> This happened in one case involving Area 51 and the secret activities that happen there - the judge got tired of hearing "sorry, we can't tell you - National Security" and brought the feds into his chambers for an explanation. When they all came out, the judge ruled the evidence was to remain secret...</RAMBLE>
Re:You Might want to check your facts... (Score:1)
Define "close cooperation".
Open Source Carnivore & Congress (Score:3)
Re:Why not tap the physical layer ? (Score:1)
So what ? The FBI doesn't need to, and shouldn't want, to "monitor internet traffic." But they often need to, and should set up a system that will allow them to, intercept all traffic from a specific person. The FBI's mandate to support law and order and the constitution doesn't require them to ever look at the packets coming from a person not under warrant, and in fact doing so is not just a violation of someone's privacy, it's a waste of resources that should be spent on their mission. Why is the money that was spent on carnivore not being spent on making, for example, a single piece of expensive equipment that can be connected to any DSL line from any provider in the country ? And then they need the software to analyze that -- something that will look a the log of packets and dump out the web sites visited with http, emails, emails sent through web based interfaces like hotmail or yahoo (or posts on slashdot), etc. That shit can't be cheap and they are wasting their (our) money on this crap.
The FBI will not get a warrant to investigate the internet as a whole. But *people*, the subjects of particular criminal investigations, will sometimes be the target of as much information collecting as the FBI can bring to bear.
The FBI and other law enforcement agencies should be thinking about how to maintain a system to allow for the monitoring of people when needed and justified. And that system is not a purely technical box and computer program; it has to be an organizational system, consisting of laisons and communication channels with other organizations, established methods of obtaining warrants and wire tap orders, etc, as well as technical infrastructure.
Where does carnivore fit into such a system ?
I think at least some people at the FBI veiw the problem in those terms. I suspect that they see a threat to their established surveilence system in the growing amount of internet communications, and they just aren't technically informed enough to make the right decision. There probably exist numerous people in the agency who would agree with the tone of the posts on this thread, but the current culture of the agency might be smothering any valid technical criticism. The manager types at the top might be hiring inept "consultants" to do research and make recommendations, and those recommendations might gain huge momentum and plow through all objections, just based on the fact that they cost a lot.
Carnivore as a necessary law enforcement tool? (Score:2)
Folks, Carnivore is a fishing tool, designed to circumvent such inconvenient limits as the 4th or 5th amendments to the constitution [cornell.edu]. If Carnivore is installed at YOUR isp then you can presume your email is being scanned along with everybody elses (why else would it's operation be so secret?). They do say it can scan thousands of emails. Oh, so those are only for the individual named in the search warrant? Yea, RIGHT!
What about this idea? - ISP's institute a new contractual policy: If the FBI (or other "Justice" Department goons) show up with carnivore to monitor email at the ISP's office, the ISP is bound, by contract, to cancel or suspend all the affected accounts (or alternatively, increase the monthly fee) immediately. This could be justified on the basis that obviously the customer's behavior has caused the isp additional time and money (to deal with the FBI and the additional hardware.) Since she's in business to make money and the added cost is not budgeted, it must be dealt with. If the cost of a T1 went up by 100% overnight, you would expect the ISP to forward that cost on to the consumer. Court order may prevent her from telling the customer(s) why the account was suspended or the fee raised by 100% but ultimately her customer's privacy is protected from a fishing expedition. I, for one, would be glad if my ISP suspended, canceled, or doubled the fee on my account when my privacy is undermined by Carnivore (or other carnivore-like snoop tools).
Another technology breakthrough to help monitor the serfs.
not exactly (Score:1)
No, it takes a cort order for them to "officaly" read your email. But this box basicaly lets them do whatever they want...
Re:If the FBI wants my email... (Score:1)
Cheers,
WFE
===========
Re:Historicly Americans Will Give up Rights (Score:1)
During the American Civil War, Ol' Honest Abe, suspended the writ of habeus corpus and imprisoned supreme court justices based only on executive power. Since that time, the rights of the citizen has dwindled.
Whether anyone is willing to realize it or not, we live in a dangerous time that unless something is done to change it, we will all wind up in an Orwellian future. As a percentage of the most intelligent portion of the population, geeks need to take a much more active political role and be much more diligent while selecting representatives. Then, and only then, will bullshit such as this stop.
What statistics on unauthorized wire taps? (Score:1)
Cheers,
WFE
===========
You Might want to check your facts... (Score:2)
People forget the FBI doesnt install these systems. You do.
-Brook Harty
Can they be trusted with it? Do we have a choice? (Score:2)
m4ki|\|G 4|\| 31337 |30|3m (Score:1)
What about the Fourth (Score:1)
No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law.
Soldier? Quartered in any house? There is no hidden meaning to this amendment with regard to wiretapping or intercepting e-mail. This amendment was put in because the British used to quarter their soldiers in private homes. This sort of pissed ppl off. Instead read the Fourth Amendment.
The right of the people to be secure in their persons, houses, paper, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularily describing the place to be searched, and the person or things to be seized.
The key words and phrases are: 1) unreasonable, 2) probable cause, 3) supportedby Oath or affirmation, and 4) describing the place... This is the basis and rules for court issued search warrants, and in this case, for court issued interception of e-mail. What the courts have continuously debated is the meaning of unreasonable and probable cause. The accidental discovery of incriminating evidence is something that the Supreme Court has recently ruled on.
Re:X Developers and the future (Score:1)
Re:What about web-based mail? IRC? (Score:2)
Do you really think any serious narcotics trafficker or terrorist will use their own e-mail account? Esp. when they know it can be easily traced back to them?
Or will they use a combination of things like free and anonymous web-based email. Coded messages in public forums. (The *real* reason for all of the "hot grits" traffic on Slashdot - it's code for heroin!) Coded messages on IRC. Coded reviews on Amazon.
There is simply no way I can believe that the FBI is so mindnumblingly incompetent that they will only scan SMTP traffic, no matter what they tell credulous reporters asking softball questions lest they find their reporters arrested at the next police acti^H^H^H riot. (Think that's extreme? Ask the Colorado Daily reporter facing federal charges because of his attempts to cover a nighttime raid on eco-protesters.) Even if carnivore doesn't scan SMTP, I'm sure it's an "oversight" which will be remedied immediately after the FBI becomes aware of it, say after the current uproar over carnivore dies down because it only monitors SMTP.
Have no doubt - this system, or its immediate successor - will track *all* traffic associated with a suspect.
Re:Come on, the FBI is a law enforcement agency (Score:1)
Since an e-mail is just another form of sending a letter. By this line of reasoning, why doesn't the government perform routine inspections of letters passing through the U.S. postal service? Could it be this would be too invasive because people would know? The only reason that people won't be as fired up about this, is because they don't think it will happen to them...and if it did, they wouldn't know.
Better yet, I think we should put up listening devices that record all sounds in public gathering places...maybe cameras too. Then people wouldn't be able to hide in public places and commit crimes any more.
Come on, we have the lessons of history to look back on. Do not allow our freedoms to be taken like this. We WILL regret it.
Re:they need to catch the criminals (Score:1)
Re:Come on, the FBI is a law enforcement agency (Score:1)
As has been repeatedly pointed out, the FBI can already obtain information about suspects by serving their ISPs with court orders. Carnivore is equivalent to installing cameras in everyone's homes, but promising they'll only look at the bad people. Given their history, you'll excuse me if I have my doubts.
Open Source it (Score:1)
Re:Come on, the FBI is a law enforcement agency (Score:5)
I suppose you believe the 4th, 5th, and 6th Amendments [loc.gov] are also criminal-coddling. I mean, if we want to catch criminals, why require search warrants? They just slow down the process and allow the "guilty" to go free...
A free and dignified people must always evaluate any expansion of governmental power, to judge it as to its merits and appropriatness. What are we gaining here? And what are we being asked to yield? From everything -- I mean everything -- that has come out about Carnivore, my opinion is that we are being asked to yield important and vital rights, and that in return we are being offered nothing that is not already available.
For a people to remain free and strong, the government must never be treated like a black box. We own the government, and it's our right and our duty to look under the hood and see how the engine's running.
Yes, but we must hand over the absolute least that we can. No one here has called for the disarmament of the FBI. But by your logic, they should institute phone surveillance of everyone, just in case. And we should welcome this, apparently?If the FBI's motives are so pure, why is the operation -- and for some time, the mere existence -- of Carnivore such a closely-held secret. Why can't the FBI obtain email logs from the ISPs, who collect them for legitmate reason? What else does Carnivore do -- and if the answer is "nothing", why is the FBI afraid to let anyone see the box?
I wonder if the American people are worth saving, if we're so ready to abandon fundamental Consitutional rights ("The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated") in return for hypothetical payoff.
Re:How can you try and defend this? (Score:1)
Re:they need to catch the criminals (Score:1)
Spread the love.
Re:they need to catch the criminals (Score:1)
Oh, and just because you arn't a "major pirate" does not mean that it is ok.. just that it is not worth going after you..
SMPT AUTH & encryption (Score:1)
encryption have relaxed, other MUAs will probably start moving more towards encryption. So
unless the FBI would like to start plugging carnivore directly into the ISP's mail server to
sift through messages after they have been received (yeah right, although I wouldn't put it past them to try) they just wasted a lot of taxpayers money..
Privacy v. Security (Score:1)
- Benjamin Franklin
The history of the FBI demonstrates that they will break any laws that restrict them in their surveillance of political dissidents. From the McCarthyite witch hunts to Martin Luther King to CISPES (opposed US government foreign policy in Central America) in the '80s to Waco.
They are no doubt doing so right now. The Seattle coalition against corporate globalization are probably being investigated using illegal wiretaps etc. on the grounds that they are Communi. . . I mean terrorists.
I recommend that anyone interested in a (depressingly) detailed history of FBI violations of citizens' rights and US law read Ward Churchill's the COINTELPRO Papers < http://www.lbbs.org/sep/backl.htm#thecointelpro>
Re:they need to catch the criminals (Score:1)
Re:not exactly (Score:2)
But their job is not to prevent crime. There is exactly one person whose job it is to prevent crime: yourself, and you do that job by committing crime. Law enforcement is there to apprehend those who are delinquent in that duty. It is not to catch people who have yet to do anything wrong.
But they've forgotten this. We always hear about how they want to wiretap without warrants; the only reason they could possibly want such a power is if they were going to exercise it.
How is this so certain? To answer that, let's use another issue: mandatory Internet filtering, as seen in China, Australia, and a few other places. I don't like Internet porn, and I don't peruse it. But I'm a vehement opponent of mandated filtering, because I believe that those who want to view such things, while I might not agree with them, ought to be able to view it. I don't want to block filtering because I want to see porn; I want to block it because I think that anyone who wants to see it should.
But this isn't how the FBI does this. Are they defenging the people's sacred right to wiretap when they ask for such authority? No; they don't want the people wiretapping. They want that power only for themselves. That means, logically, that they must want to use it (assuming they aren't already). If no one has the power to do something, you don't think anyone else should have that power, but you don't want to use that power eigher, then to spend who knows how much money fighting to get it is absolutely pointless.
There are a lot of bad people out there. Most deserve prison; they don't deserve freedom. If law enforcement is restricted to fair and reasonable means of apprehending them, more of them will keep the freedom they forefieted by breaking the law. But I am not going to sacrifice my freedom just to deprive a felon of his. I don't think anyone who's really thought about this would truly be willing to do so.
Formal Proposal to Janet Reno... (Score:1)
Bad things already exist. Oh no. (Score:2)
According to the FBI, Carnivore works much like a "sniffer," a program that has been around for some time and is designed to monitor and analyze network traffic so as to help network administrators eliminate such problems as bottlenecks.
FBI officials believe critics will be less fearful once they know more about Carnivore, which has been used in about 25 investigations in the last year, including criminal cases and "national security" cases involving counter-intelligence or counter-terrorism
Okay, my interpretation of this is that they already carnivore on enough ISP's to use it as evidence in 25 investigations last year, which means that for all you know your ISP already has it, was not required to notify you and has been spying on all your SMTP mail for the past year. That fucking pisses me off.
1) Anyone who spies on me without telling me and forces my ISP to comply is invading my privacy, and turning my ISP into a means for them to spy on me. Jackasses.
2) My ISP has been taking my money and not telling me that they are allowing people to spy on me. I have done nothing to make the FBI suspicious of me. That means that since I am paying for internet service my ISP is a thief and a sleaze.
3) Since this has been going on for at least 1 year (possibly longer) it means the FBI could be spying on all of us right now. Very bad.
4) Saying that such "sniffers" have been around for a long time is wrong. Sniffers to monitor network traffic (like hitbox and the like) have been around to monitor hits, not spy on people. Wrong wrong wrong cnn.
5) Network admin is a lot different than big brother.
Think of your rights. And how you will miss them.
Kris
botboy60@hotmail.com
Nerdnetwork.net [nerdnetwork.net]
relevant nytimes story (Score:1)
It would be nice if the NY Times or other big newspapers had really technically sophisticated people on their staffs. If this article had been written by someone who had used a packet sniffer before, it would be more interesting. For example, the article says:
"In making their case, supporters of cybersurveillance say that the only way to track e-mail is by combing through all of the messages on a particular network, because e-mail consists of a series of digital packets that are broken apart at the sending end and transmitted along multiple electronic paths before being reconstituted by the recipient's computer. "
What are they talking about ? If they tap the wire going to either the sending or the receiving computers, they are guaranteed to get all the packets used in the communication and no other ones, while listening to the whole network just gives you the whole network, and then you have to do a bunch of processing. If they had a person who had actually tried to intercept other people's communication write this article (how many people do you know who went through a phase of net-stalking some girl in high school or college?) then it would be much clearer.
This is the no-registration link [nytimes.com] .
Re:they need to catch the criminals (Score:2)
In the UK they are introducing a less restricted version of carnivore soon that will allow blanket searching for illegal activity.
I dont want a criminal state, but i dont want a police state and believe that people should be free to say what they want without detection.
My main greivance is that the carnivore system wont stop organised crime or anything 'hi-level' like that. Lets face it the mafia i'm 99% sure are already using strong encryption. Carnivore wont help!! It wont help in any complex computer case since any cyber terrorists know fine well the value of encryption.
And if it doesn't trap terrorists, organised crime, drug traffickers, paedophiles etc... then why have it at all?! They are surely just going to spend more time pursuing the people who are 'only just breaking the law' because these people are easy to catch and prosecute.
Trust it?! (Score:2)
PGP (Score:1)
Ryan
they need to catch the criminals (Score:1)
Re:LOL nt (Score:1)
--
How can you try and defend this? (Score:1)
----
Re:Why not tap the physical layer ? (Score:2)
I think it is as easy to pull that mail message out of the stream of data as it is to sift through everything else. Sniffers usually do some organization of the raw information, so you can pull out the mail messages.
Consider the following: suppose the suspect signs up for a yahoo or hotmail account. With carnivore you might never know it, as all of the mail will pass through the ISP formatted as html pages and html submissions. But if you are directly tapping the line, you will see his connections to any web site, and pick out the information.
So why do a carnivore thing ? I think they just don't know what they hell they are doing. If they get a wiretap order and don't figure out what hotmail account the guy uses when he dials in, that's just inept. I would expect more from them. Prehaps carnivore also pulls out a lot of packet level information, and knows about other protocols such us http and irc and ftp and telnet ?
Re:Open Source Carnivore & Congress (Score:1)
Doesn't look good: reverse burden of proof? (Score:3)
That's an ... interesting standard to apply by somebody who is responsible for the review. Surely the standard should be for FBI to prove that what they are doing is appropriate?
I guess nothing much will come out of the hearing...
---
"Where do you come from?"
Re:At the risk of beating a dead horse (Score:1)
Then why do they need it? The system has been set up to allow these searches if necessary. There are numerous alternatives to a "mysterious black box" that they can use that are already in place.
I'm just guessing here, but Carnivore might store information for a little while back. Thus, if the FBI gets a court order, the can look at some of the activity before they got the order, in addition to the activity after they got.
Suppose you were an idiot. And suppose that you were a member of Congress. But I repeat myself.
Re: (Score:1)
Think yourselves lucky... (Score:2)
And if you encrypt your data, you will have to supply the decryption keys on demand, or face up to two years in jail. If you even tell some-one their internet usage is being (or has been) intercepted, you can face jail too.
One of the best sources of info for those interested is here. [fipr.org]
How the FBI can gain some trust (Score:1)
The first thing would be to give the source code for Carnivore to someone like the ACLU or the EFF (perhaps under a NDA). Or give it to two or more different groups, and have them all poke through the code.
Then, have one of these groups do the actual compilation of the program, and digitally sign it; this would be done with the FBI, to be sure that the non-govt group didn't diddle with the program. This digitally signed copy would be given to the ISPs, so that they'd know that no one had slipped anything funny into the program after EFF or whoever reviewed the code.
Finally, make it so that the program, rather than giving info directly to the FBI, sends the information to someone within the ISP, who'll check to make sure there actually is a court order before forwarding it the the FBI; this would make it much harder for the FBI to abuse the system. Carnivore could encrypt all the email but the headers, so that the ISP won't be able to look at the body of what's being transmitted, in case the FBI is worried about details of the case being leaked.
Suppose you were an idiot. And suppose that you were a member of Congress. But I repeat myself.
Re:Think yourselves lucky... (Score:1)
Not like an envelope (Score:1)
Wrong. E-mail communications are nothing whatsoever like sealed letters. The "to" and "from" is essentially part of the content. If you are parsing these fields, you probably have the entire e-mail. It's more like reading the address from a postcard -- the content is just a few bytes over.
Re:Profiling (Score:1)
Re:Open Source Carnivore & Congress (Score:1)
Re:Doesn't look good: reverse burden of proof? (Score:1)
where can we get carnivore? (Score:1)
Re:Why not tap the physical layer ? (Score:1)
I see two basic types of network surveillence here, and maybe the FBI's rediculous looking system comes from confusing them:
1) the subject uses the same computer or device for communication on a regular basis. This would be the dialup computer from home, or a computer at work or school. This is the wiretap model. You go and listen to everything that goes into or out of that computer. For a phone line or DSL line this is clear cut: through a passive modem device on the line. For cable modem or for the lan at work, you have to put a sniffer (see note below).
2) The subject of the investigation uses various different devices, also used by other people, to communicate. This would be the case of the drug dealer who always used different pay phones, someone who worked from various public computers in a library or school, using a different one each time, etc. This just doesn't fit the wiretap model, and there is no reason to try to warp a wiretap to fit the situation, which may be what the FBI is attempting to do. For such a case you would get a court order for a different type of surveillence. Just as one doesn't tap all the payphones in anticipation that a subject of an investigation might choose to use them, you wouldn't place carnivore type equipment on that school or library network.
(note -- why would putting a sniffer on the ethernet that a subject's machine was attached to not be a violation of the same nature as carnivore ? It is because everything the sniffer would record is something the subject could potentially be using to communicate. The subject *might* be using an ethernet sniffer himself, and watching traffic not directed at his machine as a way of getting information on a covert channel. Think of ethernet as a crowded room with a lot of conversations overlapping; of course most people are filtering out everyone else's, but when the FBI surveils the subject they record everything that is hitting his ears, so that if he is getting cues from a third party's conversation, it will be discovered.)
Yet Annother "Bash Microsoft" artical (Score:2)
Run through Slashdot you'll see half a dosen reasons why Windows isn't a good system for this sort of thing.
On the other hand a quote after Leet Radios Thirty Seconds With Eschelon "That eppisode suck.. perl script have no problem with that".
(LR used Unix systems... Solarus laptops, Linux door stops, etc)
It should be a minnor effort to set up the kind of filter the FBI wants using perl on (insert your favoret Unix fork or clone here).
Anyway... it's easy for a Windows box (famous for it's defects) to "accadentally" record information it shouldn't...
(Notice the quotes)...
It dosn't have to be a REAL defect... Just write a trigger into the code and pretend it's a defect...
Re:Why not tap the physical layer ? (Score:1)
As for IP telehones, I don't think they necessitate any change. How are they different from using a voice-over-ip solution on a regular PC ? If a subject regularly uses a particular computer, you can tap that computer and pull out all traffic going in or out of it. If he uses a different computer every time, you have to look at non-wiretap types of surveillence; the wiretap model pressumes that their is a specific communications channel you can regularly listen to.
Re:Guilty By Omission (Score:1)
Re:Why not tap the physical layer ? (Score:2)
For DSL, I think you can just tap the line, it is not shared with anyone else.
In the case of an ethernet card on a network, just sniff the whole network. After all, the subject might be sniffing too, and picking up information in packets not addressed to his card. If the subject can see it, the wiretap should cover it.
For a cable modem, it is slightly complicated. The subjects computer can't see everyone elses pacekts, except for broadcast packets, because the ethernet card plugs into the cable modem box which is acting like an ethernet bridge; this is why you can't sniff the packets of that cute girl down the block, even though you are both on the same cable modem service. So for that case I would presume that their would be a cable modem between the FBI's computer at the cable network, filtering out exactly what your cable modem filters out.
None of these cases will record my traffic if I am not potentially in communication with the subject. That's good. Carnivore uselessly and ineeficiently reads my email to see if it is labeled as communication with the subject, when in fact the subject might not see it even though carnivore did see it, and vice versa.
DefCon 8 upcoming (Score:1)
Hope is out there! (Score:1)
The truth is, you can't modify the FBI's behavior because our checks and balances aren't
Re:There already *IS* a watch dog agency.... (Score:3)
Odd query: The Sixth Amendment [loc.gov] includes the right of the accused "to be confronted with the witnesses against him". How advanced do these things have to get, before they qualify as "witnesses" (instead of simple tools)? And can a defendant subpenoa an FBI geek and demand that he/she explain the workings of Carnivore to the jury?
I respect the FBI. I even trust them ... a little. But my respect rests upon the fact they are constrained by the laws, traditions, and people of the United States. It doesn't take long to slide from law enforcement to police state. And because I respect the FBI, I don't want them to ever be faced with that temptation.
Re:Why not tap the physical layer ? (Score:2)
Carnivore seems to be a system that seriously degrades the privacy of all users so that the FBI can catch those criminals as computationally inept as itself.
GOOD FAITH? (Score:1)
Any presumption of good faith on the part of the FBI is erased by the assertion that they've been using it without taking the trouble to inform the Attorney General.
Re:Trust it?! (Score:1)
Monitoring the Monitors (Score:1)
monitoring communications is okay (Score:2)
Governments monitoring my electronic communications isn't what bothers me. It's not as if it's hard to do, and it's not as if there aren't lots of other people who are also equipped to monitor anyone's communication if they wanted to.
What irritates me are government restrictions on people's efforts (such as encryption) to avoid being monitored. They're effectively saying that I can't speak in a language until they know what I'm saying.
===
Freedom (Score:1)
Being a citizen (first born) and hearing stories on how a country's goverment can do horrible things to the citizens. I would be concern about this system if the people use it. Let us be honset about it will be used be the wrong people.
Anyway Janet Reno deosn't like the either so we they should not use it period
There already *IS* a watch dog agency.... (Score:3)
There already is a watch dog agency out there....and it is called the JUDICIAL BRANCH of government. The judicial branch works within our system of checks and balances against the Legislative (Congress) and Executive (President).
IANAL or a law enforcement officer, but I do understand that if some agency wants to monitor your communications, they have to get a judge to sign off on it. Plus, if you ever ARE charged, any lawyer with a half brain would question how the evidence was collected against you (you know, that little right you have that protects you from unreasonable search and seizure).
Re:Guilty By Omission (Score:1)
I'd bet $1M that's not the reason.
I think you're generallyspecific hypothesis you state, namely a supposed link between Echelon and Carnivore, is wholly bogus.
I can't believe anyone in the intelligence community would never entrust FBI with the nitty-gritty of something as advanced as what Echelon is rumored to be. I can't think of a single situation in which FBI personnel would have a "need to know".
FBI may have a want to know, sure. But need to know, at the levels required by the SIGINT guys, not bloody likely :-)
Re:Guilty By Omission (Score:1)
Re:What about the THIRD Amendment? (Score:2)
Re:Think yourselves lucky... (Score:2)
Re:If the FBI wants my email... (Score:1)
Kris
botboy60@hotmail.com
Nerdnetwork.net [nerdnetwork.net]
Re:Why not tap the physical layer ? (Score:1)
The feds have devised a system to better monitor the internet. If you think otherwise then good, don't worry as they will be inept.
Carnivore should be able to pull out tcp msgs b/c of the e-mail system in place. UDP, I don't know. But it wouldn't be hard to place a UDP packet sniffer in place.
Re:But this is a fallacy, a red herring... (Score:1)
When they took the sixth amendment, I was quiet because I was innocent.
When they took the second amendment, I was quiet because I didn't own a gun.
Now they've taken the first amendment, and I can say nothing about it.
The people saying this is alright for the FBI to do clearly do not care about the removal of their privacy. When a right that such people care about is removed, they should expect similar reactions from other people.
Kris
botboy60@hotmail.com
Nerdnetwork.net [nerdnetwork.net]
Re: (Score:1)
Re:There already *IS* a watch dog agency.... (Score:2)
I could be wrong about the illegal evidence thing, but I don't think so.
SO, for the FBI to be snooping on us, you know, even though they have to do massive amounts of paperwork to appease paranoid people like us and have far more cases than can be investigated, they are in cohorts with ISP's, who don't require proper warrants. Or judges, who unproperly sign warrants.
And then they go to court, where the FBI, the ISP's, the prosecutors, the judges, and the public defenders (also in league, because they don't bring up the fact that the FBI used illegal evidence, or the warrants were improper) conspire to convict the poor helpless email-using defendant.
Of course, this, with the cooperation of the media (including slashdot), because I don't remember hearing of people being convicted with dubious evidence in cases involving electronic correspondance.
And, of course, with the cooperation of the most nefarious of them all, the geek community. Because, with their willingness to come to the defense of any highly-skilled web vandal, they politely ignore the plot of that poor person, convicted because of their emails.
And, convicted of course, of no real crime, because the FBI will abuse their powers not to snoop on the communications of criminals, but of honest people like me and you. And then they make sure that every email is read by an actual person, so that the privacy of every internet-using american (which is mostly the poor -- if you hear otherwise, that's a lie too) will be violated.
Hee hee
Re:Why not tap the physical layer ? (Score:2)
Ethernet "bridges" and "hubs" dont do what most people thing they do...
What you're talking about is where only lan segments get packets that are actually destined to them... thats called "LAN Switching" and a Catalyst 1924 will set you back almost 2k... hubs... even expensive hp procurve 10/100s dont do switching (they are like $800)... and do you think a cable modem which is basically so cheap its free will have switching in it?
of course not.... who cares about security anyways! HA!
Re:Why not tap the physical layer ? (Score:2)
That's more or less what the United Kingdom is suggesting [fipr.org]. The FBI approach seems to be much less invasive.
The problem is that except for my pathetic dial-up line, most internet traffic goes on dedicated data lines, not over the public standard telephone network (PSTN). Sure, they can tap the telephone switches and have equipment in place to do this, but they do not have similar equipment in all the data networks.
Telephone networks are increasingly becoming obsolete by IP telephones [cisco.com] and IP switching equipment [cisco.com]. This is likely to worry FBI, and I guess that in all fairness it should (America did approve of telephony tapping). I don't know what the right answers are...
---
"Where do you come from?"
But this is a fallacy, a red herring... (Score:5)
Setting aside the issue of whether we should trust the FBI and their motives and integrity for the moment, let's examine the specific issue you mentioned: child molestors. In nearly every paper the FBI puts out about the Internet you can see the terms "child molester" "child pornography" and "pedophiles" sprinkled about liberally, suggesting that without the FBI looking over our shoulders our children would never be safe. But is it true? Just like the comic cries of "Won't somebody PLEASE think of the CHILDREN!" uttered on The Simpsons, the FBI's pronouncements ring out with few facts and statistics behind them. The few statistics the FBI ever uses are usually aggregate statistics which don't distinguish between pervs who used the Net to meet up with 12 year olds, and 15 year old kids who got nabbed for posting underage porn in chatrooms when they really didn't know it was illegal (yes, it has happened--more than once).
How great a problem is child pornography on the Net? Reality: Not very. But the FBI makes it sound in all their reports as if you can't surf for an hour without stumbling across kiddy porn. The FBI makes much in their reports and testimony of online "rings" of child pornographers who sell access to their collections by credit card, when the reality is that most of these sites are legal in their countries of origin and contain images of nude 16 or 17 year olds, which are legal in most Western countries; yet the FBI doesn't distinguish between these and "real" child porn of young people being molested or exploited. If pictures of nude 16 year olds are legal in The Netherlands and Japan, then it is unfair to count those sites based in those countries and operating legally as being child pornography sites. Most of the FBI's figures are skewed by this. Only a few people are busted each year for operating sites which are truly composed of kiddyporn. Plus, overzealous activists usually turn in sites for kiddie porn which are, in reality, hosting perfectly legal images of 18 year olds from publications such as Hustler's *Barely Legal*.
The reality is that most child porn online is well-hidden from the average user, yet easy enough for the FBI to find. It isn't on the Web, irt's on Usenet. Don't ever download binaries from there unless you want to go to jail, but if you want to know where all the child porn is then read the text messages in newsgroups like alt.binaries.pictures.erotica.pre-teen and alt.binaries.adolescents. As I said, no binary downloads unless you want jail time, but reading the text messages is both legal and educational--you'll learn that the FBI isn't really doing much to stop child pornography when they use systems like Carnivore to intercept e-mail, because most pedos online communicate not by e-mail but by posting PGP'd private messages to these groups or to alt.anonymous.messages. Since so many binaries are posted there, the content of which can be gleaned from accompanying text posted as follow-up commentary by its viewers, we can ascertain that the FBI isn't doing much to actually get these people. Headers can be forged, but that can only get you so far. Most of these people could probably be found if the FBI really tried--but evidently they don't. The FBI is all talk, using the threat of child porn and molesters online to gain control over areas which those people typically don't use to communicate with one another, like e-mail. They also like to entice morons who are stupid enough to think the FBI agent they're chatting with is an underage child, sometimes catching people who are clearly pedos who need to be locked up and sometimes raising the spectre of entrapment--more than one such case has been dismissed because judges believed it was clearly entrapment (law enforcement coaxing someone to do something illegal which they'd never have done without all the encouragement).
Research the issue yourself if you don't believe me. Go to all the major online news sites, and search for terms like "child pornography" and see how few cases there actually are where the FBI has busted someone, and then see how many of them mention entrapment, e-mail, chat, usenet, to get anh idea of what the FBI is actually doing with all that money they're being given for cybercrime. Then get the headers for the usenet groups I mentioned above, and maybe read some text postings that are too small to be encoded binaries. Are all the people who post to USENET so smart as to elude all FBI pursuit and cover their tracks so perfectly, or is the FBI that technically incompetent or unable to hire good computer personnel despite all the tax dollars they embezzle supposedly for that purpose, or do they just not care that much about the problem and use it as a means to play on emotions and get all those tax dollars which they then use to intercept our e-mails and build a KGB or Stasi like surveillance network, instead of using it to REALLY fight child predators online? The latter seems most likely.
Then, judge their intentions from their past behavior. Lok at the statistics for the unauthorized number of wiretaps law enforcement uses in this country--in the thousands each year. Look at what the ATF and FBI did at Waco--whether they set the fires (accidentally, of course) or not isn't the important issue; first they lied about it being a drug operation in order to get military assistance/training/a tank, then they made 2/3 of the warrant affidavit about unsupported allegations of child abuse (which they have *no* jurisdiction over--the state social services dept. was investigating those allegations, and found that the underage girls were above the legal age for marriage in Texas and thus it was a gray area; but, ATF and FBI have no jurisdiction over that, only Texas did, so it had no place in the warrant *except to play on emotions*), then they lied about firing pyrotechnic rounds (grenades or mortars) into the compound--for years they lied about it, but now the official report says they did; then they claimed that the tape from their listening device had them spreading gasoline around and setting the compound on fire, when in reality the Davidians were talking about pouring Molotov cocktails to use against the tank that was tearing their house down; finally, let's not forget that they completely demolished the remains like a conquering army salting the earth, so that no evidence was left, and the evidence they had (like the doors the Davidians claim the FBI fired through first) has all disappeared, together with the pictures taken by the Texas Rangers. Then there's Ruby Ridge, wwhere the FBI murdered innocent people and the Court agreed and held them responsible--they even killed a woman who was standing there, unarmed, with a baby in her arms, because their orders were "shoot to kill" once they killed that teenager who was walking around with a hunting rifle. The FBI is not to be trusted, at all. They lie and play on emotions, then do whatever they feel is best even if it's illegal and unconstitutional. Child molesters, kiddy pr0n, cybercrime--they'll say anything to get our sympathy and trust. It's just a red herring, and NOT a good excuse to give up our Constitutional rights--without those, we're no longer Americans. Don't be fooled.
What about the THIRD Amendment? (Score:3)
Before everyone goes off in search of a copy of the Constitution, the Third Amendment forbids the government from quartering troops in private residences. Most people today seem to assume it's because of the extra expense put onto the homeowner, but I think it's also a pretty damn clear example of implicit guarantees of privacy in the BoR. After all, few things are more intrusive than having an agent of the government living in your own house!!!
ISPs aren't private residences, of course, but the idea that the government can insist on putting a black box in ISPs "just in case" a search warrant is issued worries me. I can understand why the agents are relunctant to have ISP employees install and configure sniffers, but at the same time even the most gung-ho defender of the police has to admit that the police are not always on the side of the angels. In fact, earlier today A&E re-aired an hour-long report on the murderous corruption of the New Orleans police, and every American should remember the McCarthy era witch hunts and Nixon's "enemies list."
So call me silly, but it bothers me to think that a government agent won't be stationed inside of my residence... but *will* be stationed on my front porch where he can casually examine the contents of my mailbox, the books I'm carrying to and from the public library (which traditionally zealously protects patrons' reading material), etc.
Hmm; this is a minor, almost trivial, point... but I wonder if the FBI pays the standard co-lo fees, or if they just waved a magic wand and require the ISPs to provide free co-lo rackspace and bandwidth.
Guilty By Omission (Score:5)
There's a lot of scary shit that's being danced around, because nobody in the media or government has enough technical clue to ask the right questions.
The more I read from the CNN article, the more convinced I am that this is something Very Wrong.
A simple laptop. Good to see it wasn't a complicated laptop, that might've sounded like they had real power. Just a simple one, nothing to be scared of, totally harmless. Nice spin, CNN. I hope they gave your news teams "ideal camera positioning to catch the flames and explosions^W^W^Wnews footage" from the next massacre in exchange for the favor.
In geek, that sounds like, at best, it listens to *all* SMTP traffic and stores *ALL* From: and To: headers.
Whaddyawannabet that, court order or no, since "it's just like looking at the envelope", all those headers get kept, just in case some day they decide they want to do traffic analysis on everyone in the future, and/or use the data they've gathered on you when they do decide they feel you've been using one too many anonymizing relays?
Fedspeak for "Next time, we'll call it 'Guardian' or 'Defender' and maybe our PR lackeys will begin buying us beer and pussy at the local strip club again."
Hey, Fed. If you're worried about the name of your technology because it's too goddamn accurate for your PR lackeys' tastes, isn't that a hint that you might be Doing The Wrong Thing?
If they want a name for your next universal surveillance product that sounds friendlier to the public, might I suggest "Night Watch"? People too stupid to get the B5 reference will see right through it. And anyone who did watch B5 would have seen through your naming choice even if you'd called it "FluffyBunnyProtector". But at least we'll appreciate the combination of honesty and irony.
I trust NSA and CIA. I don't trust FBI. The first two are intelligence agencies; it's their job to weed out the irrelevant crap their dragnets snag. The more of us NSA and CIA can ignore, the better they can do their jobs, conserving their resources for the real threats.
FBI, on the other hand, isn't an intelligence agency, it's an enforcement agency. The more of us it can keep tabs on - whether for pr0n, oral sex in certain states, MP3z, DeCSS, expressing non-Demipublican political leanings, or anything else that might someday become criminalized - the happier it is, because every citizen is guilty of something, even if it's just spitting on the sidewalk. Every sidewalk-spitter they can find is another source of funding, because every crime, however minor, serves as an indication that More Enforcemnt Needs To Be Done.
CIA and NSA are Big Brother, but would prefer not to be so they can just get their jobs done effectively. FBI isn't Big Brother yet, but it's trying very hard to catch up. Sadly, there's nothing more dangerous than a wannabe-Big-Brother trying to prove its worth to itself.
Re:Freedom vs. Law Enforcement - a tenuous balance (Score:2)
There are some checks on the system. For one thing, the FBI is only allowed to use Carnivore with a court order. That means that its use is reviewed by a judge, who while still a part of the government is at least a part of a different branch of the government.
I also think that there are some advantages to having the system set up with a big black box. While the idea that we don't know exactly how it works, or if it's actually grabbing more information than it's supposed to, is scary the box aspect has some advantages. It means that the FBI actually has to go to the ISP with the box and the court order authorizing it to set up the tap. That inherently lessens the chances of an unauthorized tap because it involves somebody who's not from the FBI in the process. It also means that agents who want to tap somebody's internet access have to apply within the FBI to get the equipment, and you can bet that there will be internal safeguards as well. I think that it's important to point out that the existing safeguards on phone taps have done a pretty good job of ensuring that the major risk of unauthorized taps is from individual agents deciding to do things on their own hook, rather than from the agency as a whole deciding to ignore the legal restrictions on searches.
I would certainly be happier to know that some independent third party has gone over Carnivore to ensure that it doesn't record anything that it shouldn't. But until that happens I take a certain amount of comfort in that the FBI has already done some things to make it hard for anyone to initiate taps without needed controls.
government is an ever growing industry (Score:2)
It's easy to dismiss issues like this, because you aren't up to any terrorism or kiddie porn trading. However, how much of this type of government Big Brotherism can you take? How much are you willing to let the government expand the scope of this into un-American activites other than kiddie porn and terrorism? The internet has the potential to give our government many new powers, and we need to decide whether or not we want to grant them the authority to use such powers, how they will be used, and who gets to use them. Just because you are not a criminal, doesn't mean that showing apathy to issues like this is not dangerous. This type of general public apathy provides politicians and law enforcement officials with a sufficiant excuse to expand their power in small increments at the expense of our personal liberties. As usual, they are parading this as an attack against a specific kind of scary vilian. Look at the freedoms we have already lost in the war on drugs for an example of how far this kind of paranoia can go.
The issue at the moment is whether or not we are comfortable with the idea of letting the FBI install mystery machines at our ISPs with the intent of monitoring internet communications. If Carnivore only reads the "To:" and "From:" fields and can only be used with a court order, why does the FBI need to supply the hardware when they could conceivably get the same type of court order to retrieve communications involving any individual from their ISP? Even if Carnivore is exactly what they say it is and nothing more, I still don't like the precedent it is setting.
Re:But this is a fallacy, a red herring... (Score:2)
Re:But this is a fallacy, a red herring... (Score:2)
Before America Online introduced an "early teen" Parental Control setting in Nov. 1997, there had been a nearly two-year window in which increasingly adult content was accessible to early teens whose parents weren't willing to keep them set at "kids only," and parents weren't told.
AOL volunteers were noting that teens were popping up in fora where they might be targetted, and yet AOL management refused to warn parents that certain areas accessible to their early teens might not be appropriate to them. I was then a volunteer, mostly answering questions about mailing lists, and tried to get some action on this point - at least alerting parents - from inside, with no luck.
Finally I reported AOL to the NYS Attorney General's office, Bureau of Consumer Affairs, claiming that AOL allowed parents to think their kids were safe when it was extremely easy for any of them to wander into areas that were explicitly adult. AOL responded to the complaint by explaining their Parental Controls settings, acting as if I were a clueless parent that only need to know which buttons to push. At the same time they took steps to curtail the "overhead" access I had on their system at that time and which I used for volunteering, except the AOL employee who I worked with at that time agreed with my stance and refused to pull it.
Finally AOL introduced their "early teens" setting, and the issue became moot. The introduction coincided with a reallocation of volunteers to police the Kids Only area, and "children" became the big mantra of the "Community Leaders Organization."
The interesting thing is that AOL has never admitted its hole in Parental Controls, nor will they ever.
I did learn some interesting things during this period. For instance, there was a swelling of sting operations on AOL, run by different investigative agencies, out to catch predators targetting kids. In my opinion, if that's the scope of their operation, more power to them. But at least one of these teams who contacted me about my letter to the NYS AG were not interested in the open barn door at AOL, they were less interested in the mundane aspects of giving parents of perhaps half-a-million or a million kids the ability to decide effectively on their kids' access than to bust another lone sleazoid predator, which gets big headlines.
Basically, the large corporations have a lot to answer for if we're really concerned about protecting children in this society. Big services like AOL lie, simply, and someone should keep looking over their shoulder - not as big brother, but simply to ensure that they deliver what they promise. Consumer protection would help a lot. There are deeper issues in the society which have led to an epidemic of teen depression, and which may leave kids more vulnerable than before to predators - and yet our schools focus on busting kids dressing in black. Parents and schools need epidemiological information - a LOT of teens are depressed, and this is not just the way it is in each generation. Finally, the role the media, advertising and the fashion industry play in all of this needs to be examined.
In all of this, I think packet sniffing is a rather inefficient way to protect children in our society. I suspect the sting operations run by state, local and feds are already doing a lot to bust up the more blatant abuses. In my opinion, the rest of the problem can be addressed by looking at what's hiding in plain sight.
-Dave
Comment removed (Score:3)
At the risk of beating a dead horse (Score:2)
FBI will only use Carnivore to sift through e-mail only with a valid court order
Then why do they need it? The system has been set up to allow these searches if necessary. There are numerous alternatives to a "mysterious black box" that they can use that are already in place.
If they want to defend it, let the public know how it works [slashdot.org]. If there is nothing wrong with it, what's the harm?
--
Re:they need to catch the criminals (Score:3)
Perhaps trading copyrighted mp3s is wrong but it is largely taken for granted that unless you are a major pirate then it's ok. But what if as soon as a byte of copyrighted information hits your computer without proper authorisation the FBI log it, and send out the court summons. Or maybe they should just shoot you on the spot... no too far
Realistically if criminals are doing their job properly then they will be using strong crypto and I really dont see why putting snooping systems in every ISP will actually stop them.
Sure it might catch America's Dumbest Criminals (maybe you guys dont get that show but it makes a mockery of your country
Freedom vs. Law Enforcement - a tenuous balance (Score:3)
My fear is the potential for abuse and misuse by misguided or simply power hungry individuals is simply too great.
Some type of watch dog agency with the power to evaluate the protections and privacy afforded to citizens, and evaluate certain random cases to ensure that where these tools were used, they were used properly.
Personally I really like the moderation / meta moderation system used at Slashdot. It gives us the ability to police ourselves, yet it provides a certain check / balance against misuse of that same power.
FBI up to no good as usual (Score:2)
Firstly, if the FBI is acting in good faith here, why is it that they have hidden their actions from everyone including their superiors? Reno admitted she had gotten all her data from the press.
Ever since Louis Freeh was put in charge of the FBI, they have been increasingly hostile toward the constitution (not that they were great fans of it before). Freeh constantly argues for an erosion of basic rights and an increase in police power (and funding!) in order to fight the dangerous terrorists, cyber-criminals, and child pornographers. They have succeeded in getting snooping technology added to the phone systems, and no longer need a warrant for many surveilance activities (just a court order, which IIRC is easier to obtain).
If they really only needed the email from a user, they could get that through normal means. The FBI has gotten email before, under court order or warrant.
They have admitted that Carnivore employs a packet sniffer and sophisticated filtering. It is a complete black box at this point. If the software was only looking for to: and from: headers, someone could have whipped up a perl script to do that in five minutes. That much is obvious and has been pointed out in many instances.
I think this is a good reason for us to start pushing, as many other countries have, for total open-source solutions MANDATED in government implementations. If the FBI wants sophisticated software, it should be open-source. We as taxpayers paying for all of this should be allowed to see it, and the government would benefit from people contributing to it. Then they would not be able to hide.
Of course the FBI will never release information about what they do, because they don't want to be like a regular police agency, they want to be like the CIA (or more appropriately, the KGB). If they had to admit what they were really up to, they would be in more trouble than the criminals they claim to be after.
If the FBI wants my email... (Score:2)
Until then, I'll just hope that they can't factor 4096 bit numbers.
Re:There already *IS* a watch dog agency.... (Score:3)
If you think the FBI always wears the white hats, talk to civil rights demonstrators from the 1950s and 1960s, who were spied upon, blacklisted, and harassed -- because the government and the people gave the FBI the right to snoop on anyone simply due to their beliefs, because we the people in a fit of idiocy and blindness said, "Yes, wiretapping for political purposes is OK. Yes, paid informants are OK. Yes, the abandonment of an open justice system is OK. After all, people of different beliefs are dangerous."
Now we have a case where the FBI is asking for expanded powers coupled to reduced accountability. It is vital that we not yield fundamental rights and principles, especially "on margin". Abuses have occured, and they will recur unless we are vigilant.
Re:Why not tap the physical layer ? (Score:3)
For dialup users, I think you're bang-on. Even if the tap were to somehow degrade line quality, there's no way a dialup user could tell that the drop from 49,333 to 48,000 was due to a tap or to the phase of the moon. Computers and DSPs are fast enough that I'd imagine such a device could be built very cheaply.
And there's no privacy concern. You're guaranteed that you've got the subject's entire communication. If he's smart enough to leave his home to use a fortress fone or Internet Cafe, just put a tail on his ass and monitor him with a Mk. 1 eyeball from there. The few criminals smart enough to go that far to evade electronic surveillance are probably doing stuff that's sufficiently naughty to warrant physical surveillance anyways.
Where tapping gets tricky is cable, xDSL, and other access methods.
- Cable, because there are privacy issues in the law to deal with, and because you're effectively gonna end up installing a sniffer on a LAN segment anyways. (Though in the latter case, at least only the privacy of the people on the same LAN segment as the suspect would be affected, as opposed to everyone with Carnivore slurping down whatever it slurps at the ISP level.)
- xDSL, I don't know about. Can someone with clue (and, umm, assuming there's no security implications of divulging it) tell us how feasible it is for a device to be attached to a DSL line (or a T1) and snarf down all data going through that line without the subject being aware of it?
To be more precise on my xDSL question, of course it's possible, if your target is dangerous enough and you've got the budget. From what's been made public about the intelligence community and its transoceanic cable eavesdropping hacks, DSL-tapping is trivial.What I mean is "can a tap for xDSL be built cheaply enough to be of use to the general law enforcement community, as opposed to solely the intelligence community?"
(But the original poster's point still stands - I think FBI's doing this because it's expedient, not because it's right. These kinds of abuses are exactly what the Constitution tries to prevent. Not that I have any faith that our representatives will even try to, let alone be able to, defend it.)
Historicly Americans Will Give up Rights (Score:2)
Social Security Numbers:
These were not always around, and in fact when they were first propsed they were fought against by numerous religious groups and conservatives. Their reasons for being against were valid privacy and social impact issues... but they were a small minority. And the majority of people thought that assigning a number to each person so that the elderly would be taken care of in their old age was a valid sacrifice
Search & Seizure vs Probable Cause:
Even Elliot Ness and the untouchable required a warrant to search a vehicle that they suspected was carrying contraband. But because of the proliferation of ilicit drugs we saw a movement in many stattes to loosen the restrictions on a police officer for impromptu searchs for contraband. Infact in the home of the Slashdot Compound having more than two dead head stickers on your car is probable cause during a traffic stop for the officer to search the vehicle for illicit drugs... a lot of people have serious problems with this but they are in the minority.
Government Regulation:
Before the late 1800s there probably would have been another revolutionary war if the government had tried to force a business to conform to its will. But the oil barrons of the turn of the century and the horrid factory conditions that were to be found in every city coupled with the run away poverty of the average worker made it more palatable for the government to create Regulatory Commissions. Around that time is when OSHA, the FTCm and other such agencies to regulate corporations were created... There were people then who fought against their creation, but of course they were in the minority.
Well this is something to stop Child pornographers, and to protect the children... of course we see where this might really go, but then we are a minority.
Re:Come on, the FBI is a law enforcement agency (Score:2)
I don't know if you are an amerikan, but I would point out that there are a whole shitload of people who are now dead because they believed very strongly that the type of thing you are calling 'necesary' is in fact dehumanizing, not the proper province of govt, and should be prevented, even if it meant they die fighting to stop it.
The unfortunate fact is that the constitutional right of the citizen to be secure from unreasonable search (and siezure) no longer holds. You dismiss this as unreasonable paranoia, while amerikans (and some others, actually) who believe in the US constitution (as written) decry the fact that the country has fallen without a shot being fired. Are you sure you won the cold war? Carnivore is the software implementation of what Russia recently tried to implement in hardware...
You seem to misunderstand the role of law enforcement in a 'free' society. It is not the role of law enforcement to 'keep society in order'; the role of law enforcement is to enforce the law. Period. That's it. That is their only proper function.- The FBI already has tools sufficient to their job.
- There are reasons not to add tools that by definition expand the scope of the job.
- Carnivore is an example of the tool defining the job, which is always ineffective compared to choosing a tool based on the job.
This obviously a flamebait, patently false, and I challenge you to show otherwise. I personally have questions about whether the FBI is legal under the body of US law that fits the constitution, but that is another argument, and do not advocate unilateral removal of the agency. I just think it is something that should be looked at closely. So you advocating the disempowerment of the FBI? Does the FBI know you feel that way? Well, I guess they do now... Why not? By the same logic you use to defend Carnivore, if the FBI decypts everyone's email, they might catch a few more lawbreakers, which justifies their violation of your right to privacy.Or are you saying that individuals have the right to privacy only insofar as they can enforce it themselves? Can you say 'vigilante'? I knew you could...
Your premise for this statement has not been proven. That's what this discussion is about. First of all, if the FBI does have such a mandate, from where did they recieve it? Where is said mandate codified? What exactly are the parameters and the scope of this alleged mandate?They fact is, US law enforcement's mandate is to protect the rights of the citizens. Despite your apparent attempt to disenfrachise the 'Slashdoterati', the fact is that the amerikan users of slashdot are among the citizens from whom any 'mandate' the FBI may receive must originate, and the only mandate the FBI legally has is to protect them, their persons, propery, and privacy. Furthermore, that mandate puts severe constraints on any actions the FBI may take outside the law i.e. the FBI does not get a blanket mandate to violate privacy (the law, remember) in order to fulfill its obligations to the citizens.
You seem to forget that, unless the system is sadly broken, law enforcement works for the citizens who elect the representatives who pass the laws that mandate the desires of the citizens, protect the rights of the individual, etc, etc.
Come on, the FBI is a law enforcement agency (Score:2)
The Slashdoterati seem to favor stripping the FBI (and, presumably, other law enforcement agencies) of all its power. Sounds great, until you realize that this would be a field day for criminals. Everyone could h4x0r a box without fearing repercussion, companies would launch DDoS attacks against competitors, and terrorists would exchange bomb-making plans through the Internet.
Imagine if you removed that kind of power from real-world law enforcement agencies. Cops wouldn't be able to pull over speeders, unarmed SWAT teams would be gunned down by serial killers, and detectives would sit around picking their noses because it would be illegal to gather evidence. We have to hand over some kind of power to law enforcement agencies, or anyone can do anything that want. And then you have criminals running all over your street, dealing in drugs and shooting children.
Obviously, no wants their privacy trampled upon, and I'm not suggesting that the FBI be able to decrypt everyone's e-mail (you do use PGP, right?). But to suggest that the FBI not be allowed to take action when they have the mandate to is nothing short of anarchism.
That's a relief (Score:4)
Re:they need to catch the criminals (Score:2)
Re:they need to catch the criminals (Score:5)
As Benjamin Franklin put it, those who would give up essential freedoms in exchange for security neither have nor deserve either. Yes, limiting law enforcement to catching criminals by fair, honest, lawful means will mean that fewer criminals will be caught. Big deal; I would much rather a million criminals have undeserved freedom than for two hundred million to lose the freedom they do deserve.
Think of the bad people they can stop, not the fact that someone might accidentally read about your dinner plans.
But they can't stop all bad people. Anyone who thinks they can is outright deluded; there is no wayy to stop all suffering, because the only surefire way to stop the suffering of the few will cause the suffering of billions more. Crime is a horrible thing, but it is far, far preferable to a police state.
For that matter, I doubt you honestly believe what you are saying. Or if you are, why don't you carry a Webcam around everywhere you go? Let everyone in the world see every single thing you do, hear every single thing you say, and so forth for the rest of your life. My guess is, you'd think I was insane for suggesting that. But when law enforcement suggests it, you jump for joy. That's hypocrisy at its finest.
I'm all for catching criminals. But I will not sacrifice my own freedom simply to deprive a criminal of his, no matter how much he may deserve it. That's a price no sane person who's really sat down and thought about these issues is willing to pay, and for a good reason.