Taking the Bite Out of Carnivore

Recently, the 2001 Computers, Freedom and Privacy Conference presented the 2001 U.S. Big Brother Awards to those agencies, companies and programs that had gone the farthest in their invasion of personal privacy. It will come as no surprise that the government’s program, ominously named Carnivore, received the award for Most Invasive Proposal.

What sort of government-sponsored program could bear such a name? Carnivore is a program run by the Federal Bureau of Investigation (FBI) that permits access to the electronic communications of every customer of an Internet Service Provider (ISP) in which a black box has been installed. More alarmingly, it also permits access to the e-mail of each person who communicates with them.

Chalk it up to my own cynicism, or perhaps to my general distrust of the sugar-coated drivel that emerges daily from the Beltway and its environs, but I would not like the government to have access to anymore knowledge about me than is absolutely necessary. When someone in Washington authoritatively announces that they need more personal information, I want a good explanation why. I do not want the government to know what books I buy, what kind of music I listen to, who my friends are or where I buy my clothes. I do not want them to know where I will be tomorrow at 8 p.m., for whom I voted in the last election or the state of my financial affairs. I am not planning a revolution, buying guns on the black market or consorting with terrorists.

My previous confidence in the Fourth Amendment that is supposed to protect me from unwarranted search and seizure was considerably shaken when I learned of these government surveillance programs, of which Carnivore is only one.

The FBI has assured the American public that they will use this technology in compliance with court orders. The purpose of Carnivore, therefore, is supposedly only to allow authorities to hone in on their targets. FBI officials insist that their engineers equipped Carnivore with the ability to differentiate between those under surveillance and the general public.

Perhaps it is only me, but I would like more than an assurance. The very fact that former Attorney General Janet Reno did not know about Carnivore’s implementation until she read about it in The New York Times indicates a gaping hole in the oversight that the FBI claims exists.

The Electronic Privacy Information Center (EPIC) sued the FBI last year in its quest for the source code for the Carnivore system through the Freedom of Information Act (FOIA), which would have enabled them to understand the degree to which Carnivore has the potential to impinge on privacy rights. But the FBI only released information on Carnivore version 1.3.4, which has reached a ripe old age and will soon be retired; there was no mention made in the report of the system capabilities of Carnivore version 2.0.

Also, the independent team set up to review Carnivore’s capabilities did not address the most fundamental issue, namely Carnivore’s potential constitutional infringements. The report states, “Illinois Institute of Technology Research Institute (IITRI) specifically excluded questions of constitutionality and of illegal activity by the FBI from this evaluation.” Another irksome issue left unresolved is that during Test Nine the IITRI review team worried that the default setting for Carnivore is to listen to all Internet traffic.

Certainly, the FBI did not portray Carnivore in this light. There is a real problem here, and Carnivore is only one of many examples of the need for legal regulation in the vast technological frontier. The Internet technology on which many of us have become so reliant, and which we assume is private, is now backfiring in ways that jeopardize our fundamental liberties. So until I start planning a revolution, purchasing arms on the black market or consorting with fundamentalist terrorists, the U.S. government should stay out of my life. And even then, it should approach me with a search warrant.