Critics attack FBI e-mail snooping device

WASHINGTON - Civil liberties and privacy groups railed Tuesday against a new system designed to allow law enforcement agents to intercept and analyze huge amounts of e-mail in connection with an investigation.

The system, called ''Carnivore,'' was first hinted at on April 6 in testimony to a House subcommittee. Now the FBI has it in use.

When Carnivore is placed at an Internet Service Provider, it scans all incoming and outgoing e-mails for messages associated with the target of a criminal probe.

In a letter addressed to two members of the House subcommittee that deals with Fourth Amendment search-and-seizure issues, the American Civil Liberties Union argued that the system breaches the Internet provider's rights and the rights of all its customers by reading both sender and recipient addresses, as well as subject lines of e-mails, to decide whether to make a copy of the entire message.

Further, while the system is plugged into the Internet provider's systems, it is controlled solely by the law enforcement agency. In a traditional wiretap, the tap is physically placed and maintained by the telephone company.

''Carnivore is roughly equivalent to a wiretap capable of accessing the contents of the conversations of all of the phone company's customers, with the 'assurance' that the FBI will record only conversations of the specified target,'' read the letter. ''This 'trust us, we are the government' approach is the antithesis of the procedures required under our wiretapping laws.''

Barry Steinhardt, associate director of the ACLU, said citizens shouldn't trust that such a sweeping data-tap will only be used against criminal suspects. And even then, he said, the data mined by Carnivore, particularly subject lines, is already intrusive.

''Law enforcement should be prohibited from installing any device that allows them to intercept communications from persons other than the target,'' Steinhardt said in an interview. ''When conducting these kinds of investigations, the information should be restricted to only addressing information.''

A spokeswoman for Rep. Charles T. Canady, R-Fla., who heads the Constitution subcommittee, said that the congressman had no immediate comment on the letter.

In testimony to Canady's subcommittee, Robert Corn-Revere, a lawyer at the Hogan & Hartson law firm in Washington, said that he represented an Internet provider that refused to install the Carnivore system. The provider was placed in an ''awkward position,'' Corn-Revere said, because the company feared suits from customers unhappy with the government looking in to all the e-mail.

''It was acknowledged (by the government) that Carnivore would enable remote access to the ISP's network and would be under the exclusive control of government agents,'' Corn-Revere said.

Corn-Revere told the committee that current law is insufficient to deal with Carnivore's potential and that the Internet provider lost their court battle in part because of the Internet's connection to telephone lines, and that the law was stretched to cover the Internet as well.

Corn-Revere would not reveal the name of his client, and the client lost the case. He said that the FBI has been using Carnivore since early this year.

James X. Dempsey, senior staff counsel at the Center for Democracy and Technology, said that the main problem with Carnivore is it's mystery.

''The FBI is placing a black box inside the computer network of an ISP,'' Dempsey said. ''Not even the ISP knows exactly what that gizmo is doing.''

But Dempsey said that Internet providers contributed to the problem, by saying that current technology does not allow the Internet provider to sort out exactly what the government is entitled to get under a search warrant. The carriers complained that they had to give everything to the FBI.

''The service providers said they didn't know how to comply with court orders,'' Dempsey said. ''By taking that position, they have hurt themselves, putting themselves into a box.''

Marcus Thomas, who heads the FBI's Cyber Technology Section, told the Wall Street Journal that the bureau has about 20 Carnivore systems, which are PCs with proprietary software. He said Carnivore meets current wiretapping laws, but is designed to keep up with the Internet.

''This is just a specialized sniffer,'' Thomas told the Journal, which first reported details about Carnivore.

Encrypted e-mail, done with an e-mail encoding program like PGP, still stays in code on Carnivore, and it's up to agents to decode it.

Dempsey has a possible solution to the problem, though one that's probably unlikely - show everyone what it does and how it does it, allowing Internet providers to install the software themselves.

''The FBI should make this gizmo an open-source product,'' he said. ''Then the secret is gone.''

On the Net: Federal Bureau of Investigation: http://www.fbi.gov

American Civil Liberties Union: http://www.aclu.org

Center for Democracy and Technology: http://www.cdt.org

Pretty Good Privacy (PGP): www.pgp.com