Digg this story   Add to del.icio.us  
Forty-five days of the Carnivore
Kevin Poulsen, SecurityFocus 2000-08-16

The FBI has 3,000 pages on their Internet surveillance tool, and EPIC wants them. The countdown began Wednesday.

WASHINGTON -- Responding to a lawsuit filed under the Freedom of Information Act, the Justice Department on Wednesday said it would begin releasing documents about the FBI's Carnivore network surveillance tool in approximately 45 days.

According to a court filing by Assistant U.S. Attorney Lisa Barsoomian, the FBI has compiled some 3,000 pages of material in response to the suit, filed last month by the Electronic Privacy Information Center (EPIC). "The FBI anticipates that it will be in a position to begin making interim releases to plaintiff in approximately 45 days," reads Barsoomian's filing. "The FBI plans to make a release every 45 days until all responsive material is processed."

"The review of these documents will be more complex than most FBI FOIA requests because, among other things, a large amount of responsive material involves material supplied, under contract, by outside commercial entities," notes the filing. Those contactors will be permitted to "weigh in on the disclosure of their information."

That timetable satisfies a legal requirement for "expedited processing" of the FOIA request, the filing argues. "Plaintiff has received all the relief to which it is entitled at this early stage of litigation."

At an August 2nd hearing, EPIC attorney David Sobel accused the Justice Department of dragging its feet in responding to the FOIA request. Federal judge James Robertson ordered Justice Department attorneys to produce a timetable within 10 working days. Wednesday was the deadline.

University Audit
Carnivore has drawn harsh criticism from privacy advocates, computer security experts, some ISPs and members of Congress. The Carnivore boxes are personal computers loaded with custom software -- a modified packet sniffer -- capable of picking out traffic to or from a particular user once it's placed on a service provider's network. The FBI uses it when they have a court order allowing them to wiretap a suspect's Internet use, or, more commonly, when the bureau has certified that knowing whom a user sends email to, or receives email from, would be useful in a criminal investigation.

Critics contend that unless the source code for the system is made public, there's no way of knowing that it doesn't scoop up the communications of innocent people once it's plugged into an ISP.

At a congressional hearing last month, the FBI agreed to choose a group of independent experts who will examine the software and issue a report. Last week, Assistant Attorney General Stephen Colgate said the Justice Department was in the process of selecting a university to perform that audit.

Wednesday's filing does not mean that all of Carnivore's secrets will be released. The Freedom of Information Act has nine exemptions, including carve-outs for classified information, commercial trade secrets, and investigatory records compiled for law enforcement purposes.

    Digg this story   Add to del.icio.us  
Comments Mode:
Again?!?! 2000-08-17


Privacy Statement
Copyright 2010, SecurityFocus