Carnivore Independent Review RFP

Anonymous Coward writes "The RFP for a contractor to do an independent review of the FBI's Carnivore system has been posted here." Only ten days to submit your proposal!

I got a rejection letter already!

[Rupert]

Thank you for your proposal to review Carnivore for us. We feel that Rupert's Independent Software Reviews Inc., while possessing all the technical requirements of the RFP, is insufficiently independent to perform the review. We base this conclusion on the fact that you have been known to use email (we can prove this!) and thus have a vested interest in the outcome.

Yours faithfully,

Janet Reno.

P.S. You did, however, get First Post. Congratulations.

--

Universities...

[phUnBalanced]

So universities are the only ones who can review...

That seems odd.

Besides, this is what I want to know. Who's to say that the Carnivore the Feds hand over for testing etc... is the same model / version / sames software / that they use. We all know how easy it is to change a couple pieces of code. The code that's reviewed is certainly not set in stone.

Oh!

[griffjon]

Y'know, first thing I thought reading that was that rfp/rainforestpuppy was going to do the review, and boggled over apparent sanity for a second before I realized it was not the case.

Alas.

If we play nice, is it okay?

[human bean]

I was amazed at the laxness of this RFP critter. Under definitions you have:

(2) For purposes of Objectives 1 and 2 in Section C.3, the term "assuming proper usage" includes assuming the existence of proper legal authority; the assistance and cooperation of the relevant ISP or system administrator, including the timely and accurate provision of any necessary system information; and observance, by those using the Carnivore system, of any relevant statutes, policies, procedures, methods, and practices.

However, skipping down a bit, to the actual request:

C.3 Contract Objective
(a) The Contractor's technical review of the Carnivore system should address the following four questions:
(1) Assuming proper usage, will the Carnivore system provide investigators with all the information, and only the information, that it is designed and set to provide in accordance with a given court order?
(2) Assuming proper usage, will use of the Carnivore system introduce new, material risks of operational or security impairment of an ISP's network?
(3) Does use of the Carnivore system introduce new, material risks of the unauthorized acquisition, whether intentional or unintentional, of electronic communication information by (i) FBI personnel or (ii) persons other than FBI personnel?
(4) Are the protections built into the Carnivore system, including both audit functions and operational procedures or practices, commensurate with the level of the risks, if any, identified in response to (3) above?
(b) Additional, relevant questions may be added to the above list.

So what is the point? If we play by the rules, then will rules be broken? Seems like this is a rather limited view of the situation. The problems with Carnivore is that it is like the butt-set in the trunk of the police detective's car. "Only to be used in case of court order" Uh, right. "Don't worry that the information we obtain by listening to his phone is not admissible, just as long as we can dig up evidence some other way..."

Toxic Chemicals?

[benenglish]

Some of the bureaucrat-speak in the 60-page RFP is lots of fun. I wonder how many potential "offerors" will be tripped up by that requirement for a "Certificate of Toxic Chemical Release Reporting?"

My Page on Why You Should Use Encryption

[goingware]

I hasten to suggest you read my page on my you should use encryption. [goingware.com]

Read the page, pass on the URL, and link to it from your own pages.

And yes I know there's a broken link on the page, I've got the correct one but haven't had a chance to update it yet.

Theo and the rest of OpenBSD

[bluGill]

Face it, their is only one name that comes to mind when someone thinks of comptuer review: openBSD.

Therefore lets get theo and the rest of his team to review Carnivore. That they are Canada based only helps to assure they will be independant.