Government, Academics Fret Over Carnivore

W A S H I N G T O N, Sept. 11, 2000 -- While the Justice Department decides which group will perform an independent review of the much-criticized “Carnivore” e-mail surveillance system, Attorney General Janet Reno says she wants to change the name of the tool to something a little less threatening.

The review, offered by the department as a way to calm privacy concerns from the public and Congress, which has had several hearings on the tool, will be performed by a group chosen by the government, based on applications. The deadline for applications expired Thursday.

Rubber Stamping vs. Review

But several prominent universities have denounced the review as a rubber stamping, not an independent verification.

Tom Perrine, manager of security technologies at the University of California at San Diego’s Supercomputer Center, said the government reserves veto power over who is on the review team, controls when and where the review will be issued and has the ability to direct the contractor to make changes in the report.

“To be honest, we were pretty surprised by the restrictions,” he said Friday.

Perrine and his center has been joined by the University of Michigan, Purdue University and the Massachusetts Institute of Technology in shunning the review process.

Justice Department officials refused to specify what organizations submitted an application, citing federal law that prohibits revealing that information before a decision is made. Spokeswoman Chris Watney would say only that there were multiple submissions.

Perrine also considered reviewing Carnivore under the “Open Carnivore” project, a group of security professionals and academics. He said his group was willing to review Carnivore for free.

But after looking at all the restrictions, he and his colleagues decided against it. He said no one in the group — which includes representatives from AT&T, the University of California at Berkeley, and Tsutomu Shimomura, who tracked down hacker Kevin Mitnick — showed any interest.

Considering the application process, Perrine said he expects the final choice, which does not have to be a university, to be a Defense Department contractor. Then, he said, the review would be highly suspect.

Despite his feelings, Perrine said he and his group don’t think the FBI is misusing Carnivore at all. He primarily wants to make sure that the tool isn’t vulnerable to outside manipulation.

“None of us really saw any ulterior motive in Carnivore. Every single person in our group has dealt with law enforcement in the past,” he said. “Law enforcement does have some legitimate access to digital wiretaps.”

What’s Inside the Black Box?

Carnivore looks like a desktop computer, but contains tracking software. In cases where authorities believe a suspect is using e-mail, it is installed at the suspect’s Internet service provider where it scans through all incoming and outgoing messages. It captures only e-mails going to or from the subject. It can also scan other means of Internet communications, like Web browsing or chat.

Critics call Carnivore a “black box” whose technology is a mystery to the public and to Internet service providers. The Justice Department and the FBI, which says it has used the tool about 25 times, say it has many safeguards to protect the privacy of the provider’s other customers.

The government has resisted efforts by civil liberties groups to make Carnivore’s inner workings public, saying that would allow criminals to circumvent the tool.

Reno, who has repeatedly showed her annoyance with the ominous name, said during her weekly news conference Thursday that Carnivore’s name will be different after the review is finished.

“I think the feeling is that we want to get the report, and see what, if anything, needs to be done, and go to a second stage with a new name,” she said.

Naseem Javed of ABC Namebank in New York, who helps corporations come up with names and has published two books on the subject, suggests a name with more empathy.

His pick: “Big Sister.”