W A S H I N G T O N, Sept. 11, 2000 -- While the Justice Department decides whichgroup will perform an independent review of the much-criticized“Carnivore” e-mail surveillance system, Attorney General JanetReno says she wants to change the name of the tool to something alittle less threatening.
The review, offered by the department as a way to calm privacyconcerns from the public and Congress, which has had severalhearings on the tool, will be performed by a group chosen by thegovernment, based on applications. The deadline for applicationsexpired Thursday.
Rubber Stamping vs. Review
But several prominent universities have denounced the review asa rubber stamping, not an independent verification.
Tom Perrine, manager of security technologies at the Universityof California at San Diego’s Supercomputer Center, said thegovernment reserves veto power over who is on the review team,controls when and where the review will be issued and has theability to direct the contractor to make changes in the report.
“To be honest, we were pretty surprised by the restrictions,”he said Friday.
Perrine and his center has been joined by the University ofMichigan, Purdue University and the Massachusetts Institute ofTechnology in shunning the review process.
Justice Department officials refused to specify whatorganizations submitted an application, citing federal law thatprohibits revealing that information before a decision is made.Spokeswoman Chris Watney would say only that there were multiplesubmissions.
Perrine also considered reviewing Carnivore under the “OpenCarnivore” project, a group of security professionals andacademics. He said his group was willing to review Carnivore forfree.
But after looking at all the restrictions, he and his colleaguesdecided against it. He said no one in the group — which includesrepresentatives from AT&T, the University of California atBerkeley, and Tsutomu Shimomura, who tracked down hacker KevinMitnick — showed any interest.
Considering the application process, Perrine said he expects thefinal choice, which does not have to be a university, to be aDefense Department contractor. Then, he said, the review would behighly suspect.
Despite his feelings, Perrine said he and his group don’t thinkthe FBI is misusing Carnivore at all. He primarily wants to makesure that the tool isn’t vulnerable to outside manipulation.
“None of us really saw any ulterior motive in Carnivore. Everysingle person in our group has dealt with law enforcement in thepast,” he said. “Law enforcement does have some legitimate accessto digital wiretaps.”
What’s Inside the Black Box?
Carnivore looks like a desktop computer, but contains trackingsoftware. In cases where authorities believe a suspect is usinge-mail, it is installed at the suspect’s Internet service providerwhere it scans through all incoming and outgoing messages. Itcaptures only e-mails going to or from the subject. It can alsoscan other means of Internet communications, like Web browsing orchat.
Critics call Carnivore a “black box” whose technology is amystery to the public and to Internet service providers. TheJustice Department and the FBI, which says it has used the toolabout 25 times, say it has many safeguards to protect the privacyof the provider’s other customers.
The government has resisted efforts by civil liberties groups tomake Carnivore’s inner workings public, saying that would allowcriminals to circumvent the tool.
Reno, who has repeatedly showed her annoyance with the ominousname, said during her weekly news conference Thursday thatCarnivore’s name will be different after the review is finished.
“I think the feeling is that we want to get the report, and seewhat, if anything, needs to be done, and go to a second stage witha new name,” she said.
Naseem Javed of ABC Namebank in New York, who helps corporationscome up with names and has published two books on the subject,suggests a name with more empathy.
His pick: “Big Sister.”