Groups clash on results of Carnivore report

Carnivore: Draft Indpendent Technical Review of the Carnivore System

A research institution's evaluation of the FBI's Carnivore system concluded

that laws ensure that the system only intercepts approved information. But

a privacy group says much of that information is below the law's radar.

The Justice Department ordered the study to determine if Carnivore performed

as FBI officials claimed — that is, capturing e-mail messages specified

by a court order without intercepting additional information.

IIT Research Institute concluded that Carnivore is "more effective in protecting

privacy and enabling lawful surveillance than...alternatives." The report

said laws exist to guard against FBI misuse of Carnivore.

But according to James Dempsey, the bureau is free to collect the "to" and

"from" lines of e-mail messages and the Internet addresses that a computer

user visits and downloads files from — all without judicial oversight. Dempsey

is a senior staff attorney for the Center for Democracy and Technology,

a Washington, D.C., public policy group.

Justice Department officials could not be reached for comment. However,

FBI officials testifying before Congress have emphasized that Carnivore

is used largely to intercept only e-mail addresses.

Barry Watson, a spokesman for IITRI, said reviewers may not have considered

that so-called pen register surveillance carries a lower level of judicial

scrutiny and protection than a full content intercept. Pen register surveillance

is similar to a trap-and-trace order on a telephone when investigators only

record the phone numbers of a suspect's incoming and outgoing calls.

IITRI could address that issue in its final report, due Dec. 8, Watson said.

Dempsey said the current laws are good at safeguarding full e-mail messages

because a judge must confirm that any e-mail information intercepted was

legally authorized. There are criminal penalties for agents violating the


But when Carnivore is used to capture only addresses, those protections

do not exist. A judge must sign an intercept order but is not required to

do a follow-up review, Dempsey said.


  • Cybersecurity
    Boy looks under voting booth at Ventura Polling Station for California primary Ventura County, California. Joseph Sohm /

    FBI breach notice rules lauded by states, but some want more

    A recent policy change by the FBI would notify states when their local election systems are hacked, but some state officials and lawmakers want the feds to inform a broader range of stakeholders in the election ecosystem.

  • paths (cybrain/

    Does strategic planning help organizations?

    Steve Kelman notes growing support for strategic planning efforts -- and the steps agencies take to keep those plans relevant.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.