Carnivore: Will It Devour Your Privacy?

Duke Law Review Technology Section

Originally Published in Duke Law Review
– http://scholarship.law.duke.edu/dltr/vol1/iss1/28/

Read more – Carnivore Will it Devour Your Privacy

Abstract

Perhaps you have written an e-mail that looks something like this:

“Dear David, Have you heard the horrible news? Robert has been picked up again for cocaine. That’s another parole violation for him, and I think we’ll be losing him at work….

Perhaps you have written an e-mail that looks something like this:

“Dear David, Have you heard the horrible news? Robert has been picked up again for cocaine. That’s another parole violation for him, and I think we’ll be losing him at work. I will get back to you on that important project we talked about; I am going to New York this weekend with Ben. Call me on my cell if you need me… (310) 555-2559. Calista “Can you think of any reason justifying the FBI’s access to this email? Assuming that Calista is not under investigation and there is no warrant allowing the FBI to intercept her communications, there simply is no compelling reason. Yet that is exactly what might happen if the FBI’s newest cybercrime battling machine, Carnivore, is “tapped” into Calista’s ISP.

Introduction

The Wall Street Journal broke the story of Carnivore a little more than a year ago and since then there has been a swarm of controversy surrounding the program. One of the major reasons for the controversy is that the general public has no firm understanding of the capabilities of Carnivore. There is prodigious misinformation surrounding Carnivore, and the FBI refuses (for proprietary reasons) to release the source code.

What is Carnivore?

From securities fraud to cyberterrorism, child pornography to espionage, electronic communication has become a major avenue for criminal activity. In response, the FBI developed Carnivore, a surveillance system that monitors electronic communication. With a court order or lawful consent from the Internet Service Provider (ISP), the FBI can tap Carnivore into an ISP’s high-speed network. Aptly named Carnivore because of its ability to find the “meat,” or criminal activity, in Internet traffic, it can track a user’s incoming and outgoing e-mails. Information travels through the Internet in packets of binary code. In the case of e-mail, a single message is broken down into several packets. Every packet contains duplicate information such as, among other things, the address from which the e-mail was sent, the address to which it was sent, and the subject line. Each packet also contains unique information – a section of the e-mail’s content.

Filtering the ISP’s network traffic, Carnivore “sniffs” binary code – streams of 0s and 1s – looking for specific information. Detecting this information, Carnivore saves the packets of communication associated with the subject. The rest of the network traffic continues its path, unscathed by Carnivore. From the stored packets, Carnivore collects email content and transactional information, such as the user address, source, destination, date, time, and duration of the message. Carnivore makes the saved, filtered information available to FBI agents. When the FBI attaches Carnivore to an ISP, it swims through a lake full of data searching for a very particular fish. Depending on whom you ask, Carnivore is either a sharpened spear aimed directly for the target, or a giant net cast wide across the whole lake. The FBI champions Carnivore as a surgical tool, superior to any commercially available “sniffer.”Most commercial sniffers are sufficient for network administration but lack the flexibility and precision to meet legal and evidentiary requirements.

The FBI can tailor Carnivore’s filtering system to collect only information authorized by court order. Carnivore appends each collection by noting the filter configuration during that search, for later reference by federal officials, a court, or defense counsel. Because the FBI can tailor the filtering process to meet the specific parameters of a court order, Carnivore is more flexible and effective than commercial sniffers. For example, if a pen register or trap and trace order authorizes collection of only transactional and addressing information, Carnivore can filter out any content of the message, including the subject line. Commercial sniffers are not sophisticated enough to do that automatically and require human screening of collected content. The FBI argues that this feature minimizes the involvement of FBI personnel in the filtering process and protects the privacy of email users.

Critics of Carnivore see it in a different light. The technology of e-mail messages, they point out, creates two major privacy concerns. First, does Carnivore give the FBI access to more information than it legally and constitutionally ought to see? ….

Read more from the Duke Law Review. – Carnivore Will it Devour Your Privacy