|
|
 |
|
 |
 |
| CYBER SNOOPING | |
 July 24, 2000  |
|
|
The FBI is under fire for its use of a wiretapping system called Carnivore that allows officers to find and read e-mails of criminal suspects. In a hearing today, Congressional lawmakers argued the system infringes on privacy rights. Ray Suarez leads a discussion.
|
|
RAY SUAREZ: Millions of people use their computers every day to send electronic messages or e-mail. Computer hackers, terrorists, and other criminals also take advantage of this technology. The FBI says it has an indispensable tool for fighting new crimes spawned in cyberspace. It's a surveillance program called Carnivore. The FBI says the system was created 18 months ago and has been used fewer than 25 times. The high-tech system taps data flowing from an Internet service provider, or ISP, to a client. It then sends the filtered information from an e-mail or a visit to a web site into the carnivore system to be analyzed by FBI Investigators. But privacy groups and some lawmakers have raised objections that Carnivore infringes on the privacy of innocent people who are not under investigation. SPOKESMAN: The subcommittee will be in order. RAY SUAREZ: Today, Congress took a closer look at cyber-snooping as a House panel held a hastily called hearing on Carnivore. Constitution subcommittee chairman Charles Canady provided an outline of what's at stake.
|
 |
||||||||||||||||||
| Fourth amendment and privacy | ||||||||||||||||||||
|
RAY SUAREZ: And to explore that question, we're joined by Larry Parkinson, general counsel for the FBI, and Marc Rotenberg, executive director of the Electronic Privacy Information Center, a research organization on privacy issues and the Internet. Larry Parkinson, the FBI gets word of an ongoing criminal enterprise. It decides to launch an investigation. How would Carnivore be used, and how would it work?
RAY SUAREZ: Marc Rotenberg, isn't this just a higher technology version of a police officer showing up at the apartment door with a warrant or a court authorizing a wiretap on the telephone?
RAY SUAREZ: So when Mr. Parkinson says surgical, limited, court supervised, what's your response? MARC ROTENBERG: This depends completely on the techniques and algorithms contained within the system, what type of key word searching, for example, what type of searches are being used to extract the information that's being sought. And we think that's a process where there has to be greater public accountability. The structure of the federal wiretap laws are such that it's recognized at the outset that when law enforcement conducts an investigation it's critical to have an outside assessment, whether it's the court or the magistrate and, in some circumstances defense counsel, to determine if procedures were properly followed, because if there isn't that mechanism in place, then we're basically left with the government saying to us, "trust us. What we're doing is in your interest." And that's frankly an answer that's not satisfactory in the U.S. wiretap law. RAY SUAREZ: With this kind of search, Larry Parkinson, don't you inevitably, as critics like Mr. Rotenberg point out, look at or aggregate the e-mails of a lot of people who have nothing to do with what you're looking for? |
 |
|||||||||||||||||||
| Carnivore - just a filtering system? | ||||||||||||||||||||
|
MARC ROTENBERG: Well, with due respect, Mr. Parkinson, this system simply could not pick messages out unless it had some algorithm that could distinguish the message content that you're looking for from the message content that's not relevant to the information. You're describing a system which magically extracts data without excluding the data that's not being sought. And that's nonsensical.
MARC ROTENBERG: But the filtering technique that you're describing requires identifying search terms, Larry Parkinson may be one e-mail address. Maybe you have pseudonyms. I imagine a good investigator would include the likely pseudonyms for the target. Those require some human determination, what terms you're going to use as you filtering message traffic. I find it very difficult to believe that you've been able to construct a filtering technique that extracts only the court-authorized information. That's a very difficult problem, even for experts in artificial intelligence. LARRY PARKINSON: Well, I guess my response to that is we've done it. And there is some question and there was some discussion today in the hearing about verification, outside verification. And we've agreed and have started the process in motion to have outside experts verify that not only does Carnivore do what we say it does in a very limited, tailored, structured fashion, but it also doesn't do what some of us -- some others are accusing us of, and that is sucking in all of this information and reading it. We're simply incapable of doing that, technologically and legally.
LARRY PARKINSON: When I say search parameters, I'm simply talking about the sender and the recipient of the e-mail. We do not put in words like bomb or explosive device and go through the e-mail stream and pick it out those terms. What we do is we identify, based on evidence that we've gathered, that we have reason to think a particular person is engaged in criminal conduct. We then go to the court and say we want that person's e-mail traffic. And we capture in some cases the to and from, in some cases the to or just the from. And sometimes content. But it's not a word search capability. RAY SUAREZ: Well, this would seem to answer a lot of the misgivings of some of the people that testified on the Hill today, Mr. Rotenberg. |
|
|||||||||||||||||||
| Carnivore - eating into new territory | ||||||||||||||||||||
|
LARRY PARKINSON: Let me say something about the ISP's. We've had very good cooperation with the ISP's. RAY SUAREZ: And that's Internet service providers.
LARRY PARKINSON: Yes, if there's a court order that says you the Internet service provider will capture this following information and they do not have the technical capability to capture that, and we have the ability to offer Carnivore as the manner in which this is captured, we can go back to the court. RAY SUAREZ: I'm going to have to stop it there. Larry Parkinson, Marc Rotenberg, thank you both.
|
||||||||||||||||||||
| |||||
 | |||||
| |||||
|
|
| |||
| |||||
| |||||
| Support the kind of journalism done by the NewsHour...Become a member of your local PBS station. | |||||
ELECTRONIC
VOICE: You've got mail. 
REP.
CHARLES CANADY: Carnivore raises a question as to whether existing statutes
protecting citizens from unreasonable searches and seizures under the
Fourth Amendment appropriately balance the concern of law enforcement
and privacy. Law enforcement is concerned that the information needed
to keep the public safe remains available. Individual citizens are concerned
that a sufficient degree of privacy and the integrity of personal information
be maintained in an age of modern communications and information storage,
where information that may have traditionally been kept in a file cabinet
at home is now electronically stored by a third party in cyberspace.
LARRY
PARKINSON: Well, let's take the example of a terrorist incident, for
instance. If we had evidence that some terrorist group was communicating,
let's say two terrorist members were communicating with each other,
we would go to... and we wanted to see who was communicating with each
other, we might go to the ISP, the Internet service provider, and ask
them to do a number of things. One thing might be simply to identify
the to and from, who are the messages being sent to and from. Or if
we could restrict it to who the message is simply going out or coming
in. Or we could seek content if we wanted to see content. We wouldn't
do that without going to court and getting a court order. And in order
to get a court order, we have to make certain threshold showings. And
we never would deploy Carnivore or any other electronic surveillance
device without going to the court, getting a court order, and being
supervised by the court. Now, Carnivore is rarely used, it's a surgical
tool that is used occasionally, as the introduction indicated approximately
25 times since the life of Carnivore in the last two years. We have
used... we have gone in -- and with the cooperation of the Internet
service provider, we have attached this device, which is very surgical
and picks out the information that is provided and authorized in the
court order. 
MARC
ROTENBERG: No. Actually it isn't. It's a technique that sweeps more
broadly than the current type of electronic surveillance that law enforcement
might do. The Carnivore system doesn't simply go to a particular message
or look at the e-mail of a particular target in an investigation. It
has the capability capture all of the incoming information that the
ISP receives. The system then apparently goes through that incoming
information and tries to pull out those e-mail messages that may be
useful for the investigation. But in sweeping so broadly across the
e-mail traffic, it will necessarily capture e-mail unrelated to the
investigation of innocent persons who have nothing to do with the investigation.
LARRY
PARKINSON: Actually, we do not. I think that's what's critical. I think
there's a misunderstanding about how this system works. This system
is very tailored precisely to the court order. We neither capture nor
read streams of information from anybody other than the subjects. This
is a technique... it doesn't change the law or the structure under which
we operate and have operated for over 30 years. Under the wiretap statutes
this is simply a technique that we've adapted to ensure more privacy.
What this does is it filters. It's a filtering system where the system
is incapable of capturing or reading any stream of traffic that is not
part of the court order. 
LARRY
PARKINSON: If I might respond. Let's take an example. We have a court
order to capture the e-mail traffic of Larry Parkinson. I'm corresponding
with somebody, and there's evidence that I'm engaged in criminal conduct.
The system is set up, the Carnivore system is set up to capture only
the two or from Larry Parkinson traffic. And if it doesn't meet that
parameter, the parameters are set forth when the system is hooked up,
if it doesn't meet those parameters, it's not captured. It's not filtered.
In other words, there's a filter here. There's a stream of traffic,
and if it doesn't meet that designation, Larry Parkinson, it doesn't
come through the filter. 
RAY
SUAREZ: Well, I think some of the critics haven't necessarily said you've
been reading it, but by using search parameters, let's say you were
looking for, as in your first example, a terrorist, maybe terms like
gelignite, or cordite, or something, explosives terms, every e-mail
that has that in it might pop up whether it's from the target of your
investigation or not. And if it has no maligned purpose, it would just
be allowed to swim on like a fish that doesn't meet the weight requirement,
but still, I mean, is that a fair depiction, if you use certain search
parameters, of what would come into the hopper? 
MARC
ROTENBERG: I don't think so. I think as we get deeper into this system,
we're beginning to understand a new type of technological capability
for online surveillance something, for example, that the FBI is able
to attach, literally attach to an ISP's computer system and extract
data. Telephone companies, which have been for 30 years complying with
federal wiretap law, probably would not allow a similar system attached
to a telephone switch. So you're seeing objections coming not only from
privacy and civil liberties organizations, but also from the ISP's,
who have a genuine concern about what type of information is being collected
and how it will be used. 
LARRY
PARKINSON: Internet service providers. As I said, we've done this approximately
25 times -- 16 times in this current fiscal year. In those 16 cases,
we've done it six times in criminal cases, ten times in national security
cases. Our default position, what we prefer is to use the capabilities
and technology that's available at the Internet service provider. And
lots of the larger Internet service providers certainly have the capability.
They have as good a capability and sometimes better than we have. And
we would never try to impose Carnivore on an Internet service provider
who could meet the specific directions of the court order. Where it
does come in useful and where we've used it is those Internet service
providers-- there's thousands of Internet service providers out there,
and a lot of them do not have the capability of the larger ones.
RAY
SUAREZ: But what if those Internet service providers says, "I don't
want the FBI coming in here with Carnivore" -- if the use of this
search technique is approved, will you be able to impose it upon them?
