Reno Plans Study of FBI's "Carnivore"

WASHINGTON, D.C. — The Justice Department plans to hire a major university to analyze the FBI’s “Carnivore” e-mail surveillance system, but civil libertarians said such a review can’t answer all the questions about the system, the Associated Press reported.

“The university review team will have total access to any information they need to conduct their review,” Attorney General Janet Reno told her weekly news conference Thursday, according to the AP.

Assistant Attorney General Steve Colgate is a career official who will chair the department’s review committee. The report will be made public, and a team of department officials will ask privacy and law enforcement experts to comment before making final recommendations to Reno about the system that has caused an uproar among civil libertarians and in Congress.

Despite these assurances, the ACLU and other privacy rights groups remained wary.

“`This is not a truly independent review,” said Barry Steinhardt, associate director of the American Civil Liberties Union. “The fox doesn’t get to choose who guards the henhouse.”

David L. Sobel, general counsel of the Electronic Privacy Information Center, said he doubted such a review could satisfy concerns that the system might be abused. “The technical community believes widespread testing is the only way to fully understand the capabilities and vulnerabilities of a system,” he said.

Sobel and Steinhardt said outsiders, like judges and Congress, should decide whether Carnivore complies with the Constitution’s Fourth Amendment ban on unreasonable searches.

Their groups have filed Freedom of Information lawsuits to obtain records of the system, including its computer source code. A judge gave the FBI until Wednesday to provide a timetable for turning over documents.

The Carnivore system has software that scans and captures “packets,” the standard unit of Internet traffic, as they travel through an Internet service provider’s network. The FBI installs a Carnivore unit at a provider’s network station and configures it to capture only e-mail to or from someone under investigation.

FBI officials say court orders limit which e-mails they can see.

But privacy advocates say only the FBI knows what Carnivore can do, and Internet providers are not allowed access to the system. They ask why the FBI retains remote control of Carnivore equipment and doesn’t just give it to Internet providers so they can comply with court orders.

Last month, FBI officials told Congress that Carnivore has been used 25 times, including 10 national security and six domestic criminal cases this year. None of the cases has gone to trial, so the FBI has not disclosed details. Colgate said the system is still in operation and criminal division attorneys monitor its use.

“It seems backward to still be using it, while arranging to answer the questions about it,” Sobel said.

Reno and Colgate said the FBI, state and local law enforcers and privacy and civil liberties groups will be consulted on the choice of a university, the scope of its review and for reactions to any recommendations.

The university team will have complete access to all hardware and software involved, including the computer source code for Carnivore, Colgate said.

The source code, however, is likely to be withheld from the public because it is a trade secret of the company that produced the software, which has been modified by the FBI, Colgate said.

Steinhardt and Sobel said the source code should be released to enable widespread examination of its capabilities.