Carnivore: Just the facts or a whole lot more?

Carnivore: Draft Independent Technical Review of Carnivore System

The FBI's e-mail surveillance system known as Carnivore does just what the

FBI has claimed — and more, according to a research institute's review of

the system.

Not surprisingly, the FBI heralded the report, which the Justice Department

released through its Web site Nov. 21, while Carnivore critics said some

report findings validate their concerns about privacy issues. The report

by IIT Research Institute concluded that while Carnivore can perform "fine-tuned

searches" for just the specific data authorized by a court order, "it is

also capable of broad sweeps.

"Incorrectly configured, Carnivore can record any traffic it monitors,"

according to the report.

David Sobel, an attorney for a Washington, D.C., public interest research

organization, said that presents a problem.

"If it's that easy for the FBI to accidentally collect too much data,

imagine how simple it would be for agents to do so intentionally," said

Sobel, general counsel for the Electronic Privacy Information Center (EPIC).

One IITRI recommendation calls for the FBI to use different versions

of Carnivore — one strictly for intercepting and recording the "to" and

"from" data of e-mails and another for capturing the entire content of correspondence

when authorized by a court order.

But Wayne Madsen, a senior fellow at EPIC whose background includes

computer security at several federal agencies, said the institute's researchers

and his organization might be on the same page in some instances.

"I think they made some [positive] recommendations on the weak accountability

that the FBI has on Carnivore," Madsen said.

IITRI's recommendations to the FBI on the e-bugging system include:

* Tighten accountability for users of Carnivore.

* Enhance physical control of the system when deployed.

* Improve future versions of Carnivore so that the possibility of error

during use is reduced.

* Provide checks in the user interface to ensure settings are reasonable

and consistent.

The institute turned over its report to the Justice Department more

than a week ago for editing by the Justice Department. An IITRI official

familiar with the report said he had no problem with the editing.

"I did a page-by-page comparison of the two, side-by-side," said the

official, who spoke on condition of anonymity. "Except for a difference

in the size of the figures — the result of [Adobe Systems Inc.] Acrobat

versus [Microsoft Corp.] Word, which is what it was written in — and specific

redactions that they mention on the Web site, I can't see any changes."

The Justice Department awarded the research contract to IITRI after

a number of other institutions that were approached about running the tests

backed out, citing FBI restrictions that they believed would compromise

their integrity.