Groups clash on results of Carnivore report
- By Bryant Jordan
- Nov 27, 2000
Carnivore: Draft Indpendent Technical Review of the Carnivore System
A research institution's evaluation of the FBI's Carnivore system concluded
that laws ensure that the system only intercepts approved information. But
a privacy group says much of that information is below the law's radar.
The Justice Department ordered the study to determine if Carnivore performed
as FBI officials claimed — that is, capturing e-mail messages specified
by a court order without intercepting additional information.
IIT Research Institute concluded that Carnivore is "more effective in protecting
privacy and enabling lawful surveillance than...alternatives." The report
said laws exist to guard against FBI misuse of Carnivore.
But according to James Dempsey, the bureau is free to collect the "to" and
"from" lines of e-mail messages and the Internet addresses that a computer
user visits and downloads files from — all without judicial oversight. Dempsey
is a senior staff attorney for the Center for Democracy and Technology,
a Washington, D.C., public policy group.
Justice Department officials could not be reached for comment. However,
FBI officials testifying before Congress have emphasized that Carnivore
is used largely to intercept only e-mail addresses.
Barry Watson, a spokesman for IITRI, said reviewers may not have considered
that so-called pen register surveillance carries a lower level of judicial
scrutiny and protection than a full content intercept. Pen register surveillance
is similar to a trap-and-trace order on a telephone when investigators only
record the phone numbers of a suspect's incoming and outgoing calls.
IITRI could address that issue in its final report, due Dec. 8, Watson said.
Dempsey said the current laws are good at safeguarding full e-mail messages
because a judge must confirm that any e-mail information intercepted was
legally authorized. There are criminal penalties for agents violating the
But when Carnivore is used to capture only addresses, those protections
do not exist. A judge must sign an intercept order but is not required to
do a follow-up review, Dempsey said.