[Senate Hearing 106-1057]
[From the U.S. Government Publishing Office]
S. Hrg. 106-1057
THE ``CARNIVORE'' CONTROVERSY: ELECTRONIC SURVEILLANCE AND PRIVACY IN
THE DIGITAL AGE
=======================================================================
HEARING
before the
COMMITTEE ON THE JUDICIARY
UNITED STATES SENATE
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
__________
SEPTEMBER 6, 2000
__________
Serial No. J-106-105
__________
Printed for the use of the Committee on the Judiciary
U.S. GOVERNMENT PRINTING OFFICE
74-729 WASHINGTON : 2001
----------------------------------------------------------------------------
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpr.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001
COMMITTEE ON THE JUDICIARY
ORRIN G. HATCH, Utah, Chairman
STROM THURMOND, South Carolina PATRICK J. LEAHY, Vermont
CHARLES E. GRASSLEY, Iowa EDWARD M. KENNEDY, Massachusetts
ARLEN SPECTER, Pennsylvania JOSEPH R. BIDEN, Jr., Delaware
JON KYL, Arizona HERBERT KOHL, Wisconsin
MIKE DeWINE, Ohio DIANNE FEINSTEIN, California
JOHN ASHCROFT, Missouri RUSSELL D. FEINGOLD, Wisconsin
SPENCER ABRAHAM, Michigan ROBERT G. TORRICELLI, New Jersey
JEFF SESSIONS, Alabama CHARLES E. SCHUMER, New York
BOB SMITH, New Hampshire
Manus Cooney, Chief Counsel and Staff Director
Bruce A. Cohen, Minority Chief Counsel
C O N T E N T S
----------
STATEMENTS OF COMMITTEE MEMBERS
Page
Hatch, Hon. Orrin G., a U.S. Senator from the State of Utah...... 1
Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont. 3
WITNESSES
Cerf, Vinton G., Internet Trustee, Internet Society, Reston, VA.. 29
Dempsey, James X., Senior Staff Counsel, Center for Democracy and
Technology, Washington, DC..................................... 42
Di Gregory, Kevin V., Deputy Assistant Attorney General, Criminal
Division, U.S. Department of Justice, Washington, DC;
accompanied by Martha Stansell-Gamm, Chief, Computer Crimes and
Intellectual Property Section, U.S. Department of Justice,
Washington, DC................................................. 21
Kerr, Donald M., Assistant Director, Federal Bureau of
Investigation, Washington, DC; accompanied by Larry R.
Parkinson, General Counsel, Federal Bureau of Investigation,
Washington, DC................................................. 9
O'Neill, Michael, Assistant Professor of Law, George Mason
University Law School, Fairfax, VA............................. 36
Rosen, Jeffrey, Associate Professor of Law, George Washington
University Law School, Washington, DC.......................... 62
QUESTIONS AND ANSWERS
Responses of Donald M. Kerr to Questions from:
Senator Hatch................................................ 81
Senator Thurmond............................................. 83
Senator Leahy................................................ 87
THE ``CARNIVORE'' CONTROVERSY: ELECTRONIC SURVEILLANCE AND PRIVACY IN
THE DIGITAL AGE
----------
WEDNESDAY, SEPTEMBER 6, 2000
U.S. Senate,
Committee on the Judiciary,
Washington, DC.
The committee met, pursuant to notice, at 10:08 a.m., in
room SD-226, Dirksen Senate Office Building, Hon. Orrin G.
Hatch, (chairman of the committee) presiding.
Also present: Senators Specter and Leahy.
OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM
THE STATE OF UTAH
The Chairman. We are happy to welcome all of you out to
today's hearing. The purpose of our hearing today is to examine
the effect that new surveillance technologies, such as the
FBI's now too famous Carnivore, is having on the important
public policy balance between personal privacy rights and law
enforcement in the digital age.
That the context of this hearing is important goes without
saying. The Internet is rapidly becoming a dominant means by
which Americans transact business, receive news and
information, communicate with their families, and even have
fun. A recent report states that over 40 million Americans are
currently using the Internet, and that the rate of increase is
nearly 55,000 new users every day. Over three million Web pages
were created every day in 1999.
Clearly, the Internet is becoming a pervasive feature of
daily life, and the technology on the horizon promises to make
it even more so. Additionally, the Internet's ability to allow
anyone, regardless of wealth or status or political clout, to
share opinions with the world, makes it the ultimate first
amendment-enabling technology.
But as with many great technological developments and
achievements, the Internet's greatest strength is also its most
vulnerable weakness. The huge amounts of data speeding through
the Internet, including phone numbers, addresses, credit card
numbers and bank account information, have facilitated an
online crime wave. And the same ease of use that has motivated
so many people to rely on the Internet has also given rise to a
new breed of swindlers, vandals and terrorists who are short-
circuiting the Internet's benefits by waging denial of service
attacks, or who are turning the Internet into a weapon by
spreading computer viruses.
Only last week, a 24-year-old California man was charged
with securities fraud after a fake news release posted on a
Website claimed that the Emulex Company had lost its CEO and
would restate its last quarter's earnings to show a loss
instead of a profit. The hoax caused a $2 billion loss in the
value of this company.
Unfortunately, this is only one of the myriad types of
crime committed via the Internet. The use of e-mail has been a
boon to criminals engaged in spreading child pornography,
coordinating illegal drug rings, stealing intellectual
property, and much more. America's Internet users are
legitimately concerned that surfing the Internet is like
walking in a big city at night: the enjoyment is tempered by a
fear of what is lurking unnoticed in the dark alleys. Even
short of illegal activity, Americans are concerned about the
ability of businesses and other Web site hosts to collect and
share personal information, and to track individuals'
interests, purchases, and other data.
On the other side of the debate is an equally important
concern that the Government should not intrude unduly into
commerce and personal lives. Unlike many other governments in
the world, the United States does not permit its law
enforcement agencies easy access to phone lines, the mail, and
other sources of private information.
The computer geniuses who are innovating with new
technology and creating e-commerce companies are understandably
wary of opening up their hard drives and servers to government
data traffic control. And individuals who use the Internet for
personal communications, purchases and hobbies are justifiably
reluctant to allow an ``Orwellian Big Brother'' to monitor
which Web sites they visit or what messages they send through
cyberspace.
In short, America's Internet users want a balanced approach
to Internet integrity that guarantees protection of personal
privacy, but that allows limited and constitutionally-
sanctioned access to law enforcement when necessary for the
protection of law-abiding citizens.
Some believe these goals are in hopeless conflict. I
personally do not. I firmly believe that properly calibrated
laws can simultaneously protect the Internet from criminals and
terrorists, respect the privacy interests of all Americans, and
allow the Internet to flourish free from burdensome regulation.
In fact, I recently introduced a bill, the Internet Integrity
and Critical Infrastructure Protection Act of 2000, that
strives to do that in certain circumstances.
Although no law could prevent bad actors from misusing the
Internet, my bill will provide much needed resources and
investigative tools to law enforcement and will update our
computer abuse laws to help deter and prevent such activities.
So it is within the context of this debate that we are
holding today's hearing to examine the constitutional and
policy implications of new surveillance technologies, in
general, and the FBI's Carnivore system in particular. I hope
we get a better understanding of what Carnivore is and how it
operates today. As I understand it, it permits law enforcement
agencies to gather specific electronic-mail information,
presumably circumscribed by court order, relevant to the
commission of a crime.
There has been a lot of controversy surrounding this
system, perhaps justified, perhaps not. Much of the controversy
and confusion is due to differences in opinion on the degree of
protection against improper searches by the Government that the
fourth amendment of our Constitution provides each citizen, and
whether current laws--which were written before the Internet
became the revolutionary force in communications that it has
become--need updating in this new digital age. It is this
constitutional challenge created by technological advancement
that we are here to examine today.
Now, before we hear from today's witnesses, I want to note
that the technical questions about Carnivore are to be
addressed by a DOJ-commissioned independent technical review.
These technical questions include whether the Carnivore system
could interfere with the proper functioning of Internet service
providers, whether the system might provide investigators with
more information than is authorized by a court order, or
whether the system's capabilities could give rise to a risk of
misuse, leading to improper invasions of privacy. I think this
is a very important study which likely will affect some of our
policy decisions, and we will examine the report's findings
once it is conducted in a future hearing.
With that background, I will introduce our distinguished
witnesses as soon as the ranking member makes his comments.
STATEMENT OF HON. PATRICK J. LEAHY, A U.S. SENATOR FROM THE
STATE OF VERMONT
Senator Leahy. Thank you, Mr. Chairman. We talk about ISP's
and URL's and all this new language of the Internet age that
Mr. Cerf and others gave us. And I thank you most of the time,
Mr. Cerf. There are days when connections are slow when I
don't, but that is not your fault.
What we are doing here actually is carrying on a 200-year
conversation about how we assure the rights of the American
people, the rights of all of you, the rights of me and the
chairman and everybody else to be secure in their persons, in
their houses, in their papers, and their effects, secure
against unreasonable searches and seizures. That obviously goes
back to the Constitution's Fourth Amendment.
Back at the time of the Framers, you gained access to a
person's private effects by being there. You were going to find
out what was in somebody's desk drawer by walking in the house
and opening the desk. You were going to find out what papers
they had in their inside pocket by searching them and searching
their inside pocket. It is a lot different today. You can be a
mile away or 10,000 miles away and search information about
most families, certainly those who have computers and are on
the Net.
This is really the concern that I have. On the one hand, I
ask the question, are we dealing with a legitimate surveillance
tool in a cyber age when we know that criminals can move
billions of dollars electronically; when terrorists can plan
damage from a point on another continent to a residence or a
warehouse in the United States; when a kidnaper can deal with
somebody in a different State, or where a child abuser can seek
out a victim hundreds of miles away. But on the other hand, is
this surveillance something that goes way beyond what we the
American people want?
It is legitimate to ask the FBI, which has come up with
this unfortunately named device--and I suspect nobody has
claimed credit as the author of the name, but we should not
allow ourselves to be distracted simply by the name. Call it
anything you want. The question we have to ask, and
legitimately, is has the FBI given themselves a tool which
allows them to go way beyond what the American people would
allow, what the stated mandate of the FBI would allow, and
certainly what the Congress or anyone else would accept.
I think these are the kinds of questions that we have to
ask because new communications technologies both have benefits
and pose challenges to privacy and law enforcement. The
Congress has, I think, worked successfully, in a bipartisan
fashion, to mediate this tension with a combination of very
stringent procedures for law enforcement access to our
communications, but also legal protections to maintain privacy
and confidentiality, whether it is in person, over the
telephone, fax, computer, or elsewhere.
In fact, in 1968 the Congress passed comprehensive
legislation authorizing Government interception of voice
communications over telephones, and so on. We returned to this
in 1986, when we passed the Electronic Communications Privacy
Act, which I sponsored. That law established procedures for law
enforcement access to electronic mail systems, to remote data
processing systems, and had privacy safeguards for computer
uses. It talked about the way we get pen registers and traps,
and so on. These pen register and trap and trace orders,
though, were not to be used to identify or record the contents
of the communications.
Now, we have this new surveillance tool and we have to find
out where it fits in the mix. I understand Carnivore is a
surveillance tool, a software program developed by the FBI,
installed by the FBI at the physical premise of an Internet
service provider, to intercept Internet communications
following a court order.
The order may authorize capture of an entire communication
or it may be limited to addressing information, sort of like a
pen register. This program, though, is versatile enough that
the FBI can use the same program to accommodate variations in
court order authorizations. So I want to hear more about how it
works, the precise kind of information the program produces to
the FBI, and what controls the FBI has in place when Carnivore
is used to ensure the program is operated only as authorized by
the court order.
This is keeping in mind the fact that usually the court
orders are going to be designed exactly the way the Government
wants them to be. But notwithstanding that--and I am sorry some
of the courts may take offense at that, but that is a fact. And
notwithstanding that, I want to make sure it still doesn't go
beyond it.
Carnivore is not ``freeware'' available for download and
public scrutiny. So somewhere, somebody has got to be able to
scrutinize it. I commend the Attorney General for her efforts
to address this concern and hiring an independent contractor to
conduct a technical review of the surveillance program. It is a
constructive step that moves beyond the hypothetical
discussions of Carnivore.
Now, there is no dispute that the stringent legal
requirements governing wiretaps apply to Carnivore when it is
used to capture the content of e-mails or other computer
transmissions. I think all of us here on the Judiciary
Committee would agree with that.
There is also no dispute that both the text and the subject
line of an e-mail message are content which law enforcement may
intercept only under a wiretap order. But we still want to know
whether the legal standards for its use are adequate and
exactly what it does.
Telephone companies regularly comply with wiretap and other
legitimate surveillance orders, as do Internet service
providers. But if the Internet service provider doesn't have
the capability or willingness to do it, to execute court
orders, fine; I will accept the fact that law enforcement can
step in. I think Carnivore is for that. But, again, is it
limited, and will it limit itself to what a willing ISP would
give if they were willing to carry out the order themselves?
Second, Carnivore works by sifting through the Internet
traffic of a particular ISP to capture the particular
information or communication authorized by a court order. I
think privacy advocates are rightly concerned about whether
Carnivore accesses too much, not only too much information
about Internet users, but also too much information about the
communications that are the subject of the court order.
We know that the Internet breaks down communications into
separatepackets that are reassembled at the destination point.
The FBI will say that Carnivore is able to find the different packets
that make up a suspected Internet criminal's message only by sifting
through all the traffic. Technically, that is correct, but that might
not be a great comfort to all the other Internet users who are not
subject to the court-ordered surveillance but have their messages being
looked at.
It comes down to this: Carnivore is like a car. It can be
very useful or it can be abused. You can drive back and forth
to take your kids to school or you could have a drunk driver
come down the road and wipe out a family. What counts is the
rules of the road, but also what counts is what license we give
the driver, and I am interested in the license and hearing from
the witnesses today whether surveillance rules we developed for
the analog telephone environment and for the pre-Internet
computer environment are adequate to protect our current
expectations of privacy when we go online.
And I must say in that regard, Mr. Chairman, that we have
the CALEA Act, which we all worked on very closely and worked
closely with the FBI. And in many ways, the FBI has tried to
push the envelope way beyond what I as one of the authors of
that bill intended and what many of the others did. Because of
that, I take a little more careful view of what they might say
and whether the FBI now is going to push beyond the envelope of
what they are allowed.
In closing, I am a strong proponent of the Internet. I
don't know of anybody in the Senate who is a stronger
proponent. But I am a defender of our constitutional right to
speak freely, and also I have the typical Vermonter's view of
privacy that we should keep private our confidential affairs
from either private sector snoops or unreasonable government
searches. These principles can and must be respected when law
enforcement agencies use surveillance tools to uncover and hold
accountable criminal wrongdoers.
So, Mr. Chairman, I think you have an excellent hearing. I
think it is a wise one to have. I would put my whole statement
in the record so we can hear from the witnesses.
The Chairman. Well, thank you, Senator, and we will put all
statements in the record at this point.
[The prepared statement of Senator Leahy follows:]
Prepared Statement of Senator Patrick J. Leahy
We will talk today about ISPs and URLs and other new language of
the Internet age, but fundamentally we are continuing a 20-year-old
conversation about how we assure the right of American people to be
secure in their persons, houses, papers and effects, against
unreasonable searches and seizures. This is both the promise and the
mandate of our Constitution's Fourth Amendment.
The means by which law enforcement authorities may gain access to a
person's private ``effects'' is no longer limited by physical
proximity, as it was in the time of the Framers. New communications
methods and surveillance devices have dramatically expended the
opportunities for surreptitous law enforcement access to private
messages and records from remote locations.
In short, new communications technologies pose both benefits and
challenges to privacy and law enforcement. The Congress has worked
successfully in the past to mediate this tension with a combination of
stringent procedures for law enforcement access to our communications
and legal protections to maintain their privacy and confidentiality,
whether they occur in person or over the telephone, fax machine or
computer. In 1968, the Congress passed comprehensive legislation
authorizing government interception, under carefully defined
circumstances, of voice communications over telephones or in person in
Title III of the Omnibus Crime Control and Safe Streets Act.
We returned to this important area in 1986, when we passed the
Electronic Communications Privacy Act (ECPA), which I was proud to
sponsor, that outlined procedures for law enforcement access to
electronic mail systems and remote data processing systems, and that
provided important privacy safeguards for computer users. ECPA also set
forth the procedures for use, application and issuance of orders for
pen registers and trap and trace devices that were to be used to
identify the numbers dialed from a particular telephone line or the
originating number of an incoming telephone call, respectively. As the
Committee's report on ECPA makes clear, these pen register and trap and
trace orders were not to be used ``to identify or record the contents
of the communication.'' [Senate Comm. On the Judiciary, ``Electronic
Communications Privacy Act of 1986'', S. Rep. No. 99-541, 99th Cong.,
2d Sess. at p. 46 (1986).]
This hearing will explore where the FBI's use of the new
surveillance tool called ``Carnivore'' fits into that mix.
As I understand this surveillance tool, Carnivore is a software
program developed by the FBI and installed by the FBI at the physical
premise of an Internet Service Provider to intercept Internet
communications, in accordance with a court order. This court order may
authorize capture of an entire communication, or it can be limited only
to addressing information, akin to a pen register order for a telephone
line. Carnivore is sufficiently versatile that the FBI can use the same
program to accommodate variations in court order authorizations. I want
to hear more about how the Carnivore program works, the precise kind of
information the program produces to the FBI, and what controls the FBI
has in place when Carnivore is used to insure the program is operated
only as authorized by the applicable court order.
Certainly, some of the concern over the FBI's use of Carnivore
stems from the fact that the Carnivore program is not ``freeware''
available for download and public scrutiny. I commend the Attorney
General for her efforts to address this concern and for moving forward
to hire an independent contractor to conduct a technical review of the
surveillance program. This is constructive step to move beyond
hypothetical discussions of Carnivore's theoretical capabilities to
focus on the facts.
At the outset, let us be clear where there is no dispute. There is
no dispute that the stringent legal requirements governing wiretaps
apply to Carnivore when it is used to capture the content of e-mails or
other computer transmissions. There is also no dispute that both the
text and the subject line of an e-mail message are ``content'' which
law enforcement may intercept only under a wiretap order. But
fundamental questions remain about when the FBI chooses to use
Carnivore, how the program works, and whether the legal standards that
apply to its use are adequate. First, telephone companies regularly
comply with wiretap and other legitimate surveillance orders, as do
Internet Service Providers. But if the trail of a criminal
investigation leads to evidence in the custody of an Internet Service
Provider that lacks the capability or willingness to conduct the
interception as required in a court order, most of us agree that law
enforcement authorities should not be stymied but should have the
authority to pursue the trail. Indeed, it has been a long-standing
tenet codified in the wiretap and pen register laws that providers of
telephone services must furnish law enforcement officials with ``all
information, facilities and technical assistance necessary to
accomplish'' the interception or installation of the pen register
device unobtrusively and with a minimum of interference with the
service being provided to the person whose communications are to be
intercepted.'' [18 U.S.C. Sec. 2518(4) and3124(a).] Carnivore was
apparently created for use in just this circumstantce--where the ISP is
unable to assist directly in execution of the court-ordered
surveillance.
We want to hear today about whether use of Carnivore is limited to
only that circumstance and what effect, if any, this use has on the
integrity and function of the ISP.
As the principal Senate sponsor of the Communications Assistance
for Law Enforcement Act (CALEA), I should note that we passed this law
in 1994 to require telephone companies to be able to execute court
orders for surveillance. That law was passed with the concurrence of
the telecommunications industry, which wanted all participants to share
the responsibilities and expenses of complying with such court orders.
This law exempts ``information services'', however, including most
ISPs. Consequently, the FBI has developed its own program to fill the
gap if a particular ISP is unable or unwilling to assist in execution
of a court order for surveillance. This is preferable, in my view, to
legislation requiring ISPs to ramp up to execute court orders.
Second, Carnivore apparently works by sifting through the Internet
traffic of a particular ISP to capture the particular information or
communication authorized by a court order. Privacy advocates are
rightly concerned about whether Carnivore accesses too much--not only
too much information about Internet users whose communications are not
the subject of the court order, but also too much information about the
communications that are the subject of the court order.
The Internet works by breaking communications down into separate
packets that are reassembled at the destination point. The FBI says
that, as a technical matter, Carnivore is able to find the different
packets that make up a suspected criminal's Internet message only by
sifting through all the traffic. This is cold comfort to all the other
Internet users, who are not the subject of any court ordered
surveillance but nonetheless are having their Internet messages
automatically screened by the FBI's Carnivore program.
The FBI says that Carnivore can be used as the functional
equivalent for the Internet of a pen register or trap and trace devices
that provide information about the source or destination of a telephone
call. Yet the addressing, or header, information on an Internet message
may provide far more detail about the interests of the person sending
the message than a dialed telephone number does. This prompts the
question whether the same legal standard and procedure should apply to
capturing Internet addressing information that applies to capturing
telephone numbers.
Finally, Carnivore is a like a car. It can be useful, or it can be
abused. What counts are the rules of the road and the license we give
the driver. I am interested in hearing from the witnesses today whether
the surveillance rules we developed for the analogue telephone
environment and for the pre-Internet computer environment are adequate
to protect our current expectations of privacy when we go online.
I, for one, do not believe our current laws are adequate. That is
why over a year ago I introduced the E-RIGHTS Act, S. 854, to update
our laws and provide additional privacy protections for our online
communications and records, including law enforcement access procedures
and standards that are more in keeping with our current privacy
expectations.
For example, a critical privacy issue confronting us today is the
procedure by which law enforcement authorities obtain pen register and
trap and trace orders. The controversy over Carnivore puts the
shortcomings of that procedure in stark relief. Under current law,
federal judges are no more than rubber stamps who are required to issue
pen register or trap and trace orders whenever a prosecutor asks for
them. Federal judges have no authority to ask ``why'' and to make sure
that requested surveillance is necessary and justified. The E-RIGHTS
Act proposes a procedure that would permit judges to ask for and get
reasons for the surveillance. The Administration has recently
transmitted proposed legislation that would modify this procedure in a
fashion similar to the one I originally proposed.
I am a strong proponent of the Internet and a defender of our
constitutional rights to speak freely and to keep private our
confidential affairs from either private sector snoops or unreasonable
government searches. These principles can and must be respected when
law enforcement agencies use surveillance tools to uncover and hold
accountable criminal wrongdoers. I look forward to hearing from the
witnesses today about whether Carnivore oversteps these bounds.
The Chairman. We have a distinguished group of witnesses
here today. First, we will hear from Dr. Donald M. Kerr, who is
the Assistant Director of the Federal Bureau of Investigation.
Mr. Kerr heads the FBI lab that developed Carnivore and will be
able to provide us with valuable insight from the Bureau.
Our next witness is Kevin V. Di Gregory, Deputy Assistant
Attorney General of the Criminal Division, which includes the
Computer Crimes and Intellectual Property Section at the
Department of Justice.
After first hearing from these two witnesses, we will then
hear from distinguished experts who will help guide us through
the complex legal and technical issues involved in balancing
the needs of law enforcement with the privacy rights of
individuals.
So we will hear, after the first two, from Mr. Vinton G.
Cerf of the Internet Society, a non-profit educational and
research institution devoted to the continual evolution of the
Internet. Mr. Cerf is also a senior vice president at WorldCom,
where he is responsible for Internet architecture and
technology. In 1997, Mr. Cerf was awarded the National Medal of
Technology for his role in the invention and implementation of
the Internet.
We are very fortunate to have you here today and we look
forward to taking your testimony.
Our next witness, Michael O'Neill, is an assistant
professor of law at the George Mason University School of Law
in Fairfax, VA. Professor O'Neill, who is a former Supreme
Court clerk and current Commissioner on the U.S. Sentencing
Commission, specializes in criminal law, criminal procedure,
and constitutional law.
Mr. O'Neill, we are very happy to have you back before the
committee.
Next, we welcome James X. Dempsey, Senior Staff Counsel
with the Center for Democracy and Technology, located here in
Washington, DC. Mr. Dempsey is a respected leader in the
privacy community. He has been a friend of the committee and
has testified here before, so we are really happy to have you
back and we look forward to hearing your testimony.
Our final witness is Professor Jeffrey Rosen, associate
professor at the George Washington University Law School,
located here in Washington. Professor Rosen teaches
constitutional law, criminal procedure, and the law of privacy.
He is also the legal affairs editor of the New Republic and has
authored a book analyzing privacy issues.
I wouldn't mind having one of the books if you could send
it, OK?
Mr. Rosen. I will provide it for you Senator.
The Chairman. Good. I hope you autograph it.
Mr. Rosen. Absolutely.
The Chairman. We are fortunate to have each of you here
today and we want to welcome you to our hearing on ``The
Carnivore Controversy: Electronic Surveillance and Privacy in
the Digital Age.'' This is a very, very important hearing and
we look forward to hearing from each and every one of you.
So we will turn to you, Mr. Kerr, and go from there.
PANEL CONSISTING OF DONALD M. KERR, ASSISTANT DIRECTOR, FEDERAL
BUREAU OF INVESTIGATION, WASHINGTON, DC, ACCOMPANIED BY LARRY
R. PARKINSON, GENERAL COUNSEL, FEDERAL BUREAU OF INVESTIGATION,
WASHINGTON, DC; KEVIN V. DI GREGORY, DEPUTY ASSISTANT ATTORNEY
GENERAL, CRIMINAL DIVISION, U.S. DEPARTMENT OF JUSTICE,
WASHINGTON, DC, ACCOMPANIED BY MARTHA STANSELL-GAMM, CHIEF,
COMPUTER CRIMES AND INTELLECTUAL PROPERTY SECTION, U.S.
DEPARTMENT OF JUSTICE, WASHINGTON, DC; VINTON G. CERF, INTERNET
TRUSTEE, INTERNET SOCIETY, RESTON, VA; MICHAEL O'NEILL,
ASSISTANT PROFESSOR OF LAW, GEORGE MASON UNIVERSITY LAW SCHOOL,
FAIRFAX, VA; JAMES X. DEMPSEY, SENIOR STAFF COUNSEL, CENTER FOR
DEMOCRACY AND TECHNOLOGY, WASHINGTON, DC; AND JEFFREY ROSEN,
ASSOCIATE PROFESSOR OF LAW, GEORGE WASHINGTON UNIVERSITY LAW
SCHOOL, WASHINGTON, DC
STATEMENT OF DONALD M. KERR
Mr. Kerr. Good morning, Mr. Chairman, members of the
committee. I am grateful for the opportunity to discuss the
Internet and data interception capabilities developed by the
FBI in response to the increased exploitation of computers,
networks, and databases by terrorists, spies, and dangerous
criminals to commit crimes and to harm the safety, security and
privacy of others.
I have provided a rather long statement for the record
which I will spare you.
The Chairman. We will put all statements in the record as
though they were fully delivered. We hope you can summarize.
Mr. Kerr. Thank you, Mr. Chairman, and I will simply
briefly try to address some of the major issues covered in that
statement.
The context for our development and use of the Carnivore e-
mail intercept system and other similar tools is the
significant increase in terrorist and criminal acts. For
example, terrorist groups are increasingly using new
information technology and the Internet to formulate plans,
raise funds, spread propaganda, and to communicate relatively
securely.
An early instance of the use of secured information was the
convicted terrorist Ramzi Yousef, who was the mastermind of the
World Trade Center bombing, who, in fact, had encrypted files
on his laptop for blowing up U.S. airplanes in various parts of
the world.
Serious fraud, such as the one mentioned earlier in your
opening statement, recently dramatized by a case in New York,
in March, where 19 people were charged in an insider trading
scheme--the commission of that fraud rested on theability to
enter chat rooms, in effect recruit people to provide information on
two major brokerage firms' customers and, of course, share in the
profits from the use of that illicitly obtained information.
You are well aware of our Innocent Images program dealing
with child pornography and sexual exploitation of children
where, since 1995, the FBI has investigated nearly 800 cases
involving adults traveling interstate to meet minors for the
purpose of illegal sexual relationships, and more than 1,800
cases involving persons trading child pornography over the
Internet.
As mentioned, the FBI only conducts electronic surveillance
pursuant to Federal law, and in particular acts pursuant to
court order. The Federal electronics surveillance law has
carefully balanced the constitutional and privacy rights of
individuals, legitimate search and seizure needs of law
enforcement, and the obligations placed upon communications and
information service providers to cooperate.
In enacting the Federal electronic surveillance laws,
including title III and the ECPA-based transactional record and
pen register trap and trace regimes, Congress specified
appropriately strict procedures for law enforcement's
interception of communications content, and also its access to
communications transactional, addressing, and dialing
information.
Also, by law, the investigators must specify the steps that
will be taken to minimize the acquisition of any non-criminal
communications. A title III application must be approved by a
Federal district court judge who, after authorizing the order,
carefully monitors the progress of the surveillance by
reviewing reports brought to the court usually every 7 to 10
days by the U.S. Attorney's Office. The U.S. Attorney's Office
oversees the surveillance on a daily basis, and at the end of
the surveillance the judge directs notice be given to those
whose communications were intercepted.
Under titles II and III of ECPA, law enforcement acquires
transactional addressing and dialing type information pursuant
to court orders based upon relevancy to an ongoing criminal
investigation. These acquisitions, which include no
communications content, can be obtained through approval by a
Federal magistrate pursuant to applications from the U.S.
Attorney's Office.
Acquisitions under the pen register trap and trace regime
last for 60 days, since they only pertain to the transactional
addressing and dialing information. While the law requires no
notice be given to the criminals or others concerning whom
service provider communications transactional records are
obtained, many service providers advise their subscribers after
the investigation is concluded.
Those who have raised concerns regarding Carnivore have
principally asserted that through the use of Carnivore, the FBI
is collecting more information than a given pen register or
trap and trace court order permits. I want to speak to the
safeguards we have in place, the techniques by which we deploy
Carnivore, and in particular I think the great protections we
offer for both personal privacy and the business interests of
the Interest service providers.
First of all, as you have correctly mentioned, Carnivore is
both software and hardware. And because it is software in part,
it can be configured to specifically comply with each court
order. In doing that, we provide an audit trail. And, of
course, you are well aware of the sanctions for misuse, both
criminal and civil.
It is a PC-based system. We maximize the use of commercial
software to reduce risk and cost. It is installed by a team
comprising a senior supervisory FBI special agent, typically an
electronics technician, and one or more members of the Internet
service provider's staff to be sure that we don't do something
that would interfere with their system. But I would point out
the case agent is not the one installing the system. People who
are specifically trained in its use and the legal constraints
on its use are the ones who do that.
It is important to understand that it filters the Internet
traffic. It is looking for the addressing information, and at
the first stage it is looking for the Internet addresses that
are covered in the court order and it picks off the packets
that meet that test. It then goes through the subsequent
filtering stage. If full content is allowed, it, of course,
captures all of the packets relating to that message and
records them in their digital form. If only the addressing
information, the ``to'' and ``from'' lines, subject again to
the court order, are captured, those are recorded.
Once the recordings are made, there is no other information
available to the FBI. We capture and record no other
information, and those pieces of data are not available to us
at any subsequent time. There is no real-time review of text
because, in fact, we are dealing with systems where the
information is transiting at rates, for instance, of 40
megabits a second. We have no one who can read 0s and 1s at 40
megabits a second and translate that into content. In fact, we
only restore the message when content is authorized after
recovering the recorded bits and bringing it back to our
laboratory to recover the actual content of the message.
We produce a record of all settings, and that becomes part
of the evidentiary chain that we create. The system, in fact,
is secured within the Internet service provider's spaces to
provide physical chain of custody as well. In fact, in the
newest version that we are intending to bring into use, we will
provide the same authentication of the message information that
we capture, as well as the settings, so that we will be able to
testify later in court as to what the settings were, who set
them up, and were any subsequent changes or alterations made.
Carnivore does not adversely affect the business interests
of the Internet service provider. I mentioned we safeguard
their interests in part by collaborating with their technical
staff. We always use the smallest segment of traffic through
their system because, in fact, what we are after is just the
message traffic of the subject of the court order. So if that
can be delivered and the ISP can do it with their equipment, we
accept that from them and, in fact, we reimburse them for
providing that service.
When the ISP does not have the equipment or the capability
to meet the terms of the court order, we, in fact, use
Carnivore, installed under the conditions that I mentioned. But
recall there may be 15,000 ISP's in this country. Some of them
are well capitalized and well equipped. Others are very small
operations and would not have the capital to have in place an
infrequently usedcapability or perhaps a never used capability.
The Chairman. How many ISP's did you say are in the
country?
Mr. Kerr. I think approximately 15,000, but I think there
are others at the table who know better.
Mr. Cerf. Mr. Chairman, I can respond to that. I think
probably that is a global number, as opposed to the number in
the United States. So presumably your focus of attention is the
number in the United States, but that still could be on the
order of 8,000. So you are in the same order of magnitude.
The Chairman. OK; sorry to interrupt you.
Mr. Kerr. Not a problem. It is very helpful.
Carnivore is a passive system and, in fact, it is isolated
from the Internet service provider's network by a commercial
device that allows for information to flow to Carnivore, but
for no signals to flow from Carnivore into the system. And, of
course, like all communications intercept equipment, it is
removed as soon as the court order has expired.
Overall, we think that the public should have trust and
confidence in the FBI conduct of electronic surveillance under
the legal guidance that we have. We first exhaust other means
to get timely information. We always try to minimize the
intrusiveness of our intercept, whether it be for e-mail or for
telephones.
We attempt to avoid undesirable consequences for
telecommunications providers or Internet service providers. We
cannot activate our capabilities without an appropriate order.
There are sanctions in place that deter misuse. Broad search
and surveillance is prohibited, and we seek specific evidence
of criminal behavior, not broad information content.
With that, Mr. Chairman, I will conclude my remarks and
look forward to your questions.
[The prepared statement of Mr. Kerr follows:]
Prepared Statement of Donald M. Kerr
Good morning, Mr. Chairman and Members of the Committee. I am
grateful for this opportunity to discuss with you the FBI's Carnivore
system--a system specially designed for effectively enforcing the law
while at the same time fully complying with the law. Carnivore is a
system which we are counting on to help us in critical ways in
combating acts of terrorism, espionage, information warfare, hacking,
and other serious and violent crimes occurring over the Internet, acts
which threaten the security of our Nation and the safety of our people.
In my statement, I will touch upon five points; why we need a system
like Carnivore; why the public should have confidence that the FBI is
lawfully Carnivore; how Carnivore, as a special purpose electronic
surveillance tool, works; why computer network service providers, with
whom the FBI always work closely, should not be fearful about
Carnivore's use with their networks; and, as an overarching matter, why
the public should have trust in the FBI's conduct of electronic
surveillance and in its use of the Carnivore system. In addressing
these important points, we hope to set the record straight and allay
any legal, privacy, network security, and trustworthiness concerns.
Why does the FBI need a system like Carnivore?
By now, it has become common knowledge that terrorists, spies,
hackers, and dangerous criminals are increasingly using computers and
computer networks, including the Internet, to carry our their heinous
acts. In response to their serious threats to our Nation, to the safety
of the American people, to the security of our communications
infrastructure, and to the important commercial and private
potentialities of a safe, secure, and vibrant Internet, the FBI has
responded by concentrating its effort, including its technological
efforts, and resources, to fight a broad array of Cyber-crimes.
While the FBI has always, as a first instinct, sought to work
cooperatively and closely with computer network service providers,
software and equipment manufactures, and many others to fight these
crimes, it also become obvious that the FBI needed its own tools to
fight this battle, especially where legal, evidentiary, and
investigative imperatives required special purpose tools. One such tool
is Carnivore, which I will discuss at length today. However, before
discussing Carnivore, it is important to identify and briefly discuss
some of the types of Cyber-crime threats which we in law enforcement
have been encountering, and will encounter in the future, and
concerning which Carnivore, and tools such as Carnivore, are of
critical importance to the FBI.
Terrorism
Terrorist groups are increasingly using new information technology
(IT) and the Internet to formulate plans, raise funds, spread
propaganda, and communicate securely. In his statement on the worldwide
threat in the year 2000, Director of Central Intelligence George Tenet
testified that terrorist groups, ``including Hezbollah, HAMAS, the Abu
Nidal organization, and Bin Laden's al Qa'ida organization are using
computerized files, E-mail, and encryption to support their
operations.'' As one example, convicted terrorist Ramzi Yousef, the
mastermind of the World Trade Center bombing, stored detailed plans to
destroy United States airliners on encrypted files on his laptop
computer.
Other terrorist groups, such as the Internet Black Tigers (who are
reportedly affiliated with the Tamil Tigers), engaged in attacks on
foreign government websites and E-mail servers. ``Cyber terrorism''--
the use of Cyber tools to shut down critical national infrastructures
(such as energy,telecommunications, transportation, or government
operations) for the purpose of coercing or intimidating a government or
civilian population--is emerging as a very real threat.
Recently, the FBI uncovered a plot to break into National Guard
armories and to steal the armaments and explosives necessary to
simultaneously destroy multiple power transmission facilities in the
Southern United States. After introducing a cooperating witness into
the inner circle of this domestic terrorist group, it became clear that
many of the communications of the group were occurring via E-mail. As
the investigation closed, computer evidence disclosed that the group
was downloading information about Ricin, the third most deadly toxin in
the world. Without the fortunate ability to place a person in this
group, the need and technological capability to intercept their E-mail
communications' content and addressing information would have been
imperative, if the FBI were to be able to detect and prevent these acts
and successfully prosecute.
Espionage
Not surprisingly, foreign intelligence services have adapted to
using Cyber tools as part of their espionage trade craft. Even as far
back as 1986, before the worldwide surge in Internet use, the KGB
employed German hackers to access Department of Defense systems in the
well-known ``Cuckoo's Egg'' case. It should not surprise anyone to hear
that foreign intelligence services increasingly view the Internet and
computer intrusions as useful tools for acquiring sensitive U.S.
government and private sector information.
Information Warfare
The prospect of ``information warfare'' by foreign militaries
against our Nation's critical infrastructures is perhaps the greatest
potential Cyber threat to our national security. We know that several
foreign nations are developing information warfare doctrine, programs,
and capabilities for use against the United States or other nations.
Knowing that they cannot match our military might with conventional
weapons, nations see Cyber attacks on our critical infrastructures or
military operations as a way to hit what they perceive as America's
Achilles heel--our growing dependence on information technology in
government and commercial operations. Two Chinese military officers
recently published a book that called for the use of unconventional
measures, including the propagation of computer viruses, to
counterbalance the military power of the United States. And a Russian
official has also commented that an attack on a national infrastructure
could, ``by virtue of its catastrophic consequences, completely overlap
with the use of [weapons] of mass destruction.''
Child Pornography and Sexual Exploitation of Children
Through the FBI's ``Innocent Images'' case, and others, it has
become abundantly clear that certain adults are using computers and the
Internet widely to disseminate child pornography and to entice young
children into illegal and often violent sexual activity. Such sexual
predators find the Internet to be a well-suited medium to trap unwary
children. Since 1995, the FBI has investigated nearly 800 cases
involving adults traveling interstate to meet minors for the purpose of
illegal sexual relationships, and more than 1850 cases involving
persons trading child pornography--almost all of these involve the
exchange of child pornography over the Internet.
Serious Fraud
One of the most serious criminal threats facing the Nation is the
use of the Internet for fraudulent purposes. For example, securities
offered over the Internet have added an entirely new dimension to
securities fraud investigations. The North American Securities
Administrators Association has estimated that Internet-related stock
fraud results in a loss to investors of approximately $10 billion per
year (or nearly $1 million per hour). In one case, on March 5, 2000,
nineteen people were charged in a multimillion-dollar insider trading
scheme. At the core of the scheme, the central ``insider'' figure went
online and found others in ISP chat rooms. He soon was passing inside
information on clients of several brokerage firms to two other
individuals in exchange for a percentage of any profits they earned by
acting on it. For 2\1/2\ years, this person passed inside information,
communicating almost solely through online chats and instant messages,
with the insider receiving $170,000 in kickbacks while his partners
made $500,000.
Why should the public have confidence in the FBI's lawful use of
Carnivore?
There are a number of reasons why the public should have confidence
in the FBI's lawful use of Carnivore. First of all, since 1986, with
the enactment of the Electronic Communications Privacy Act of 1986
(ECPA), which amended Title III of the Omnibus Crime Control and Safe
Streets Act of 1968 (Title III), Congress created statutory legal
protection for all types of wire and electronic communications'
content, including computer and Internet-based communications' content,
consistent with the Constitution. The ECPA also created statutory
privacy protection for ``transactional records'' pertaining to an
electronic communications provider's provision of services to a
customer or subscriber consistent with the Constitution. The term
``transactional records,'' as used here, includes addressing (e.g., in
the context of E-mail communications, the ``to'' and ``from'' lines--
but not the ``subject'' or ``re'' lines) routing, billing, or other
information maintained or generated by the service provider.
``Transactional records'' do not include the content (substance,
purport or meaning) of E-mails or other communications.
Correspondingly, in the ECPA, Congress regulated all governmental
electronic surveillance interceptions of communications' content and
all acquisitions of communications addressing and transactional record
information consistent with the Constitution. Under the ECPA, all such
electronic surveillance efforts require some form of court order,
either a full Title III (probable cause-based) court order for
obtaining communications' content or an ECPA-created court order based
upon relevancy for communications' addressing and transactional record
information. Of course, there are ``emergency'' provisions whereby
surveillance is permitted to proceed immediately, when high-level
Department of Justice authorization is obtained, so long as a court
order is filed within 48 hours.
Under Title III, applications for electronic surveillance must
demonstrate probable cause and state with particularly and specificity:
the offenses being committed, the communications facility regarding
which the subject's communications are to be intercepted, a description
of the types of conversations to be intercepted, and the identities of
the persons committing the offenses and anticipated to be intercepted.
Clearly, the criminal electronic surveillance laws focus on gathering
hard evidence--not intelligence. Under this law, the FBI cannot, and
does not, ``snoop.''
In obedience of the law, the FBI obtains judicial authorization, in
terms of always obtaining the appropriate court order required when
intercepting wire and electronic communications' content or when
acquiring addressing information and transactional record information,
or lawful consent, regardless of whether they are occurring over a
computer or telecommunications network. The FBI's use of the Carnivore
system--approximately 25 times in the last two years--has in every case
and at all times been pursuant to such a judicially-granted court order
or lawful consent. In every case, we only deploy Carnivore after
serving a court order on an ISP (or after obtaining lawful consent of a
party to the communication) and then only after working closely with
the ISP technicians or engineers in installing it. Parenthetically,
were the ISP is equipped to fully and properly implement the court
order or consensual authorization, the FBI leaves the interception to
the ISP and does not rely upon Carnivore. Moreover, if an FBI employee
were to attempt to acquire such content or information using Carnivore
without obtaining a court order or appropriate consent, it would be a
serious violation of the law--a federal felony, thereby subjecting
theemployee to criminal prosecution, civil liability, and termination.
Finally, FBI employees fully understand that the unlawful interception
of the content of private communications will lead to the suppression
of any and all tainted evidence and any evidence of fruits derived
therefrom. In short, the penalties for violating the electronic
surveillance laws are so severe as to dissuade any such unlawful
behavior, even if someone were so inclined.
Those who have raised legal concerns regarding Carnivore have
principally asserted that (1) through its use of Carnivore, the FBI is
collecting more information than a given pen register or trap and trace
court order permits, or (2) while using Carnivore, the FBI is acquiring
more information under such order than that order should lawfully
permit.
As to the first assertion (as will be explained in detail below),
in many investigative situations (principally those involving pen
register or trap and tract court orders), Carnivore--far better than
any commercially-available sniffer--is configurable so as to filter
with precision certain electronic computer traffic (i.e., the binary
computer code, the fast-flowing streams of O's and 1's) such that, in
each case, FBI personnel only receive and see the specified
communications addressing information associated with a particular
criminal subject's service, concerning which a particular ECPA court
order has been authorized. Further, to our knowledge, there are few, if
any, electronic surveillance tools that perform like Carnivore, in
terms of its being able to be tailored to comply with different court
orders, owing to its ability to filter with precision computer code
traffic.
In fact, the genesis for some of the technological functionality of
Carnivore was the result of the FBI's decision, made in light of
privacy and investigative concerns, that prudent practice, with regard
to computer network-based electronic surveillance, dictated that the
communications' addressing information gleaned through technical
equipment the FBI would be using should, to the fullest extent
possible, correspond to that information authorized for acquisition and
use under law. In this regard, prior to our development of Carnivore,
the FBI, consistent with the Constitution and the legal mandate found
in 18 U.S.C. 3121, was using ``technology reasonably available to it''
which permitted the acquisition of communications' addressing
information, but which necessitated minimization. However, while the
technology then available (principally commercial sniffers) worked as
well as could be expected, as discussed in greater detail below, such
equipment had never been designed as a law enforcement electronic
surveillance tool, and hence had shortcomings. Not knowing if, or when,
market forces would lead to the development of a law enforcement
electronic surveillance too, the FBI took the initiative.
In this context, we want to make sure that both the Congress and
the public understand that, in using Carnivore, there is no broad-brush
acquisition by either Carnivore or by FBI personnel of the ``contents
of the wire or electronic communications'' of all ISP users--such as to
constitute an unauthorized Title III ``intercept.'' Carnivore only
intercepts the communications of that particular criminal subject for
which a Title III order has been obtained. Similarly, we want everyone
to understand that, in using Carnivore, there is no broad brush
collection, storage, or review, by either Carnivore or by FBI
personnel, of the addressing or transactional information regarding any
ISP user beyond that pertaining to the criminal subject's service for
which an ECPA court order under 18 U.S.C. 3123 and 18 U.S.C. 2703(c)(d)
has been obtained.
As to the second assertion, some have stated that, in their
opinion, the FBI is acquiring more information when it uses Carnivore
to acquire communications addressing and transactional record
information than it should be entitled to under the Constitution or
under the ECPA statutory regimes found in Chapters 206 and 121 of Title
18 of the United States Code, and, in particular, under the court order
authorities within 18 U.S.C. 3123 and 18 U.S.C. 2703(c)(d). By way of
response, and more to the point, it appears that much, if not most, of
this contention regarding governmental access to communications
addressing and transactional information emanates from concerns about
the use of electronic surveillance generally, as opposed to the FBI's
use of Carnivore in particular. However, there is little or nothing in
law or Federal jurisprudence to support the contention that has been
asserted in this regard.
In 1979, the U.S. Supreme Court ruled that, because there was no
justifiable or reasonable expectation of privacy in the electronic
impulses dialed and transmitted over the telephone lines of a service
provider to initiate a telephone call, no Fourth Amendment search or
seizure was implicated, and, accordingly, that no legal right or
protection regarding governmental acquisition of such information was
cognizable or afforded under the Constitution (see, Smith v. Maryland,
442 U.S. 735 (1979). Similarly, the U.S. Supreme Court had earlier
found no Constitutional right or protection against the Government's
warrantless acquisition of banking information that had been disclosed
by a customer to a third party financial institution (see, United
States v. Miller, 425 U.S. 435, 442-444 (1976)). Hence, then, at least
as a matter of Constitutional law, the Supreme Court has found no
Constitutional requirement for a probable cause-based warrant in order
to acquire transactional records or information that a customer conveys
or transmits to third parties such as banks and telephone service
providers.
In 1986, in enacting the ECPA's Title II and Title III provisions,
the Congress was aware of the foregoing Supreme Court rulings and
sought to ``create'' new privacy protection in statute to protect a
subscriber's communications addressing and transactional record
information. Also, just as it intended to afford statutory privacy
protection for such information, Congress also created appropriate and
commensurate court order authorities for lawful governmental use in
acquiring such information. In doing so, Congress made very reasonable,
considered, and balanced determinations as to the level of privacy
protection that was appropriate for each type of information at issue.
Now, although it is true that there have been great changes in computer
technology since 1986, the core statutory privacy principles and fault
lines applicable to protecting computer-based communications content,
on the one hand, and communications addressing information, on the
other, as well as to their lawful interception or acquisition, have
remained quite stable.
Since 1986, and long before the advent and use of Carnivore, the
FBI and many other Federal, State, and local governmental authorities
having been lawfully acquiring computer network-based addressing and
transactional information from both telecommunications carriers and
Internet Service Providers (ISPs) under court order as anticipated by
Congress within the ECPA., i.e., the court order authorities set forth
within 18 U.S.C. 3123 and 18 U.S.C. 2703(c)(d). Governmental
surveillance in this area has proceeded based upon the rightful premise
that, with the appropriate ECPA court order(s), each and every type of
communications addressing and transactional record information found
within telecommunications and computer networks could be lawfully
acquired. Since the ECPA was enacted, federal courts throughout the
country have consistently authorized ECPA-based court orders applied
for by the Department of Justice and the United States Attorneys'
Offices, under the authorities set forth within 18 U.S.C. 3123 and 18
U.S.C. 2703(c)(d), with regard to the types of governmental access to
and acquisition of computer network addressing information currently
being complained of, without finding Constitutional or statutory
impediment.
Finally, with specific reference to Carnivore, in the approximately
25 instances wherein its use has occurred, the courts have approved the
applications, in terms of what was lawfully obtainable through the
federal statutory regimes(s) and/or court orders cited above, and in
terms ofthe information which Carnivore, through its filtering, enables
FBI personnel to lawfully receive or see under these regimes. In the
only case challenging Carnivore's intended use (in a case involving the
acquisition of E-mail addressing information under the court order
authorities set forth within 18 U.S.C. 2703(c)(d) and 18 U.S.C. 3123),
the court sided with the Government, finding that the addressing
information to be acquired through the Government's use of Carnivore
was no more intrusive than the information acquired through a
conventional pen register under 18 U.S.C. 3123.
How does Carnivore work, and why the FBI believes Carnivore is superior
from a legal, privacy, investigative, evidentiary and
technological perspective to commercial sniffers
Carnivore is very effective and discriminating special purpose
electronic surveillance system. Carnivore is a filtering tool which the
FBI has developed to carefully, precisely, and lawfully conduct
electronic surveillance of electronic communications occurring over
computer networks. In particular, it enables the FBI, in compliance
with the Constitution and the Federal electronic surveillance laws, to
properly conduct both full communications' content interceptions and
pen register and trap and trace investigations to acquire addressing
information.
For many electronic surveillance purposes, Carnivore is superior to
any commercially available ``sniffer'' tool which ISP network
administrators typically might use for network oversight, management,
and trouble-shooting. In the ISP world such sniffers are the closest
thing to what would be considered an electronic surveillance
interception device. Such sniffers, however, were never designed or
intended to be a special purpose electronic surveillance tool, and
therefore they are not best suited to protect the privacy rights
afforded by the Constitution or by statute.
It's important to describe the context of when and how Carnivore is
used and the way Carnivore works. It's most critical to clearly
understand what Carnivore discloses and, more importantly, what it does
not disclose to the FBI personnel who use it.
First of all, as emphasized above, Carnivore is only employed when
the FBI has a court order (or lawful consent) authorizing a particular
type of interception or acquisition regarding a particular criminal
subject user, user address, or account number. Second, when an ISP can
completely, properly, and securely comply with the court order on its
own, the FBI does not need to deploy Carnivore.\1\ Third, if a decision
is made to use Carnivore, the FBI never deploys it without the
cooperation and technical assistance of the ISP technicians and/or
engineers. Fourth, through working with the ISP, Carnivore is
positioned and isolated in the network so as to focus exclusively upon
just that small segment of the network traffic where the subject's
communications can be funneled. This is roughly analogous to using an
electronic surveillance device only within in a single trunk or cable
within a telephone network. Stated differently, and contrary to the
statements of some critics, Carnivore is not positioned to filter or
access ``in a Big Brother mode, all subscriber traffic throughout an
ISP network.''
---------------------------------------------------------------------------
\1\ In many instances, ISPs, particularly the larger ones, maintain
certain technical capabilities which allow them to comply, or partially
comply, with court orders. For example, certain ISPs have the
capability to intercept or ``clone'' the E-mail transmitted to and from
a particular criminal subject's account. In many instances, such
capabilities are satisfactory and allow full compliance with a court
order. However, as noted in the main text, in most cases, ISPs do not
have such capabilities or cannot employ them in a secure manner. Also,
most ``off the shelf'' sniffers or internal systems designed ad hoc to
effect an electronic surveillance effort frequently lack the ability to
properly discriminate between messages in a fashion that satisfies the
court order. Further, many court orders go beyond E-mail, authorizing
the acquisition of other messages or protocols, such as instant
messaging. In these cases, obviously, a cloned mailbox would not be
sufficient to comply with the order of the court.
---------------------------------------------------------------------------
In illustrating its functionality, it is important to understand
that Carnivore's filtering operates in stages. Carnivore's first action
is to filter a portion of an ISP's high speed network traffic.
Specifically, it filters binary code--streams of 0's and 1's that flow
through an ISP network, for example, at 40 mega-bits per second, and
often at much higher speeds. Carnivore operates real time with these
speeds. To visualize this, imagine a huge screen containing 40 million
0's and 1's flashing by on this screen for one second, and for one
second only. Carnivore's first effort--entirely within the Carnivore
box--is to identify within those 40 million 0's and 1's whether the
particular identifying information of the criminal subject (for which a
court order has been authorized) is there.
If the subject's identifying information is detected, the packets
of the subject's communication associated with the identifying
information that was detected, and those alone, are segregated for
additional filtering or storage. However, it's critically important to
understand that all of those 40 million 0's and 1's associated with
other communications are instantaneously vaporized after that one
second. They are totally destroyed; they are not collected, saved, or
stored. Hence, FBI personnel never see any of these 40 million 0's and
1's, not even for that one second. Continuing the illustration, if the
subject's identifying information is not in that screen, then the next
screen of 40 million 0's and 1's flashes by at the same rate, and the
process described above is repeated in identical fashion until the
subject's identifying information is detected.\2\
---------------------------------------------------------------------------
\2\ Parenthetically, some might argue that although the FBI does
not collect, save, or store all of those 40 million bits per second,
that it could if it chose to. In fact, that is simply not the case. The
reason is that, even with substantial gigabit level storage, the hard
drive storage would fill up in a matters of a few minutes, requiring
constant replacement of the hard drives or alternatively the front end
acquisition of large amounts of equipment space within an ISP's access
space. Neither one of these scenarios is in any way realistic.
But, for the sake of argument, even if such massive collection and
storage could be marshaled, an equally gigantic effort would be
required to process all of the O's and 1's to produce intelligible
English text. Then finally, there would have to be a huge dedication of
FBI human resources to sift through the information--and for no
discernable reason. The fact of the matter is that the FBI, focused
upon the identified criminals/accounts under investigation, is normally
``swamped'' with evidence. The FBI simply has no interest in rummaging
(``snooping'') through the immense number of communications of those
ISP users that through mere happenstance traverse the same part of the
network as the traffic of the criminal subject. As noted above, any
such unauthorized rummaging would be a violation of law, subjecting FBI
personnel to criminal prosecution, civil liability, and immediate
termination of employment.
---------------------------------------------------------------------------
After exclusively segregating the subject's information for further
machine processing, then a second stage of filtering is employed. At
this point, and again all within the Carnivore box, Carnivore checks
its programming to see what it should filter and collect for
processing. In other words, it determines, as required by the specific
wording of the court order, if it's supposed to comprehensively collect
communications content--in a full title III or FISA mode--or,
alternatively, whether it's only to collect pen register or trap and
trace transactional and addressing information. Only information
specified in the court order is being collected by Carnivore.
Importantly, this is where some of Carnivore's key legal,
evidentiary, and privacy-enhancing features really kick in. To address
the particular concerns that have been raised regarding what is
filtered and processed, and what FBI personnel see and don't see, its
useful to illustrate how Carnivore operates, for example, in a pen
register or trap and trace transactional and addressing information
mode, pursuant to authorities set forth within 18 U.S.C. 3123 and 18
U.S.C. 2703(c)(d). Under these circumstances, Carnivore only collects
transactional and addressing information. It is programmed to filter
out all content, including subject line and ``re'' information.
For example, certain pen register or trap and trace orders will
authorize collection of simply ``source,'' ``destination,'' date, time,
and duration of the message. Others will authorize collection of
``source,'' ``destination,'' ``user account address,'' date, time, and
duration. Again, each collection, and the filters being employed, are
tailored to a particular court order's authorization.
At this point, an explanation on a more technological and
functional level is warranted as to why, with regard to pen register
and trap and trace transactional and addressing information usage,
Carnivore's use was necessitated by certain privacy, evidentiary, and
investigative concerns. Commercially-available sniffers do a very good
job in many circumstances of filtering and segregating ISP information,
especially in title III interceptions. However, in other cases, where
more stringent legal, evidentiary, and law enforcement investigative
requirements exist, manysniffers would collect either too much
information, such as collecting all of the information regarding a
given criminal subject's account, or , alternatively fail to collect
the authorized information at all.
For example, because of differences and vagaries in network
protocols and header addressing information and their implementations
by ISPs, collections with these commercial sniffers often do not cut
off the header addressing information at the precise point. This can
lead to a small amount of a communications' content being included
(such as the ``subject line'') which then must be minimized by human
review. Hence, resort to commercial sniffers alone under certain
circumstances raises privacy concerns and interferes with the FBI's
investigative resources. While such sniffer capabilities might suffice
for non-law enforcement administration purposes, it is less than
perfect for a law enforcement point of view. Carnivore's development
was driven by a need to address such issues.
In another area with significant legal, evidentiary, and
investigative ramifications, Carnivore is superior to commercial
sniffer. Commercial sniffers are typically designed to work only with
fixed IP addresses. Unfortunately, dynamic addressing within ISPs
occurs probably in 98-99% of the cases. Hence, the use of commercial
sniffers, without more, would be ineffective in 98-99% of court
authorized collections. Carnivore was specifically designed to
interface with ISP networks so that when dynamic addressing occurs it
can immediately respond to it. Finally, while it is true that other
efforts with ISPs can address this problem, this problem is effectively
and efficiently resolved technically by Carnivore.
In still another area with significant legal, evidentiary, and
investigative ramifications, Carnivore has the ability to filter and
collect Simple Mail Transport Protocol (SMTP) traffic sent to or from a
specific user. Most, if not all, commercial sniffers would collect all
E-mails and then require a human visual search to find the targeted E-
mail. This obviously is wanting from a privacy and operational
perspective. Carnivore, on the other hand, has the ability to conduct
very surgical acquisitions of only a targeted criminal subject's E-
mail.
To repeat, during all the filtering/processing noted above, no FBI
personnel are seeing information--all of the information filtering/
processing, and purely in a machine-readable format, is occurring
exclusively ``within the box.''
Now, at the end of all the filtering and processing, there, of
course, is information that ultimately is collected and stored for
human review. Hence, what finally reaches the hands of FBI personnel in
every case is simply and only that particular lawfully authorized by
the court order--and no more.
Finally, Carnivore includes another piece of important
functionality. For evidentiary purposes, and as an audit history,
Carnivore was also designed to append to an event file for each
collection the filter configuration that was used in that collection.
This information tells the FBI personnel--and indeed it tells the
world, including a court, defense counsel, and a jury--what mode the
device was operating in (what it was programmed to collect), so as to
allay any suspicion that more information was being passed along to FBI
personnel.
As you know, Rule 901 of the Federal Rules of Evidence requires the
authentication of evidence as a precondition for its admissibility. The
use of the Carnivore system by the FBI to intercept and store
communications establishes, with much less human interaction and
without the potential for human error, a trustworthy machine-based
memorialization of the evidence. It also establishes a reliable first
link in an undisturbed chain of custody, and it facilitates the ease
and accuracy of a witness' testimony by permitting the witness to
testify as to the retrieval of the evidence and as to the purely
technological method by which the evidence was acquired and recorded.
Finally, Carnivore is being upgraded by adding an integrity feature
which will further demonstrate the authenticity of the information, by
imprinting on the evidence the collection mode being used. It thus
helps prove authenticity, by demonstrating that no alteration has been
made to the filter settings employed or to the information obtained. As
an evidentiary matter, such features strengthen showings of ``chain of
custody,'' authenticity, and non-alteration.
Why computer network service providers should not be fearful about
Carnivore's use with their networks
Notwithstanding assertions to the contrary, the Carnivore system is
safe to operate with IP networks. As noted above, Carnivore is only
installed in that small segment of the computer network through which
the criminal subject's communications traffic will pass. The Carnivore
system is connected with the network by a bridging device that
physically prevents Carnivore from transmitting into the network. Thus,
as a technological certainty, there is absolutely no way it could
possibly have any ability to transmit any information or thing into the
network.
Importantly, Carnivore is only attached to the network after
consultation with, and after obtaining the agreement and assistance of,
technical personnel form the ISP. It is worth noting that, to date, the
FBI has never installed Carnivore with an ISP's network without first
obtaining the assistance of the ISP's technical personnel. The Internet
is highly complex and heterogeneous environment in which to conduct
electronic surveillance, and I can assure you that without the
technical knowledge of the ISP's personnel, it would be very difficult,
and in some instances impossible for law enforcement agencies to act
unilaterally and successfully in implementing such a technical effort.
Moreover, the FBI particularly depends upon the ISP personnel to
understand the protocols and architecture of their particular networks.
Some critics have also asserted that the use of the Carnivore
system introduces significant new vulnerabilities for hacking access.
But such assertions miss the mark. With regard to hacking, and
considering the hacking methodologies most commonly employed, there
would be absolutely no greater qualitative value in trying to use the
Carnivore system as an access point than any other access point or node
in the Internet, concerning which there are literally millions. Indeed,
recognizing that Carnivore is a law enforcement surveillance tool, a
hacker's attempted use of it as an access path would be particularly
foolish inasmuch as access to Carnivore, as noted above, would never
create an actual transmission path into the network.
Lastly, there has been the suggestion, in prior Congressional
testimony, that the Carnivore system had caused a network crash or
other problems in the network of a particular ISP. Let me emphasize
that such a suggestion is simply factually incorrect. In the instance
cited, the cause of the network problem (there was no crash)--it was in
the nature of a network slowdown--was programming steps undertaken
exclusively by the ISP's technicians, and entirely on their own.
Why should the public have trust in the FBI's conduct of electronic
surveillance, and, in particular, in its use of the Carnivore
system
We believe that the American public should have trust in the FBI's
conduct of electronic surveillance, principally because it has an
outstanding record of lawfully complying with the Federal electronic
surveillance laws which the Congress first enacted over thirty years
ago, in 1968. Although the assertion of widespread 'illegal FBI
wiretapping' is frequently made, and is an article of faith for some,
the facts in no way support it. Any careful review of the dockets of
the Federal courts offers no support to the assertion of FBI electronic
surveillance abuse during these years. Indeed, all FBI electronic
surveillance is authorized and carefully supervised by many different
``outside'' entities.
To begin with, in every FBI investigation involving electronic
surveillance, all surveillance efforts are approved, monitored, and
overseen at each step of the way by both the local United States
Attorneys Office and the appropriate U.S. District Court Judge (for
Title IIIs) or Magistrate (for ECPA court orders). In surveillance
conducted under the Foreign Intelligence Surveillance Act (FISA), FBI
surveillance efforts are approved, monitored, and overseen by the
Department of Justice's Office of Intelligence Policy and Review, and
by the Foreign Intelligence Surveillance Court, respectively. Moreover,
before any full-blown Title III or FISA electronic surveillance
involving the interception of communications' content is approved,
lengthy, multi-layered, and thorough reviews occur both within the FBI
and within the Department of Justice, and, as a statutory mandate,
high-level Department of Justice approval is required for all such
surveillance.
For more than three decades now, FBI electronic surveillance has
been closely supervised and monitored by the Department of Justice.
There has been no indication of FBI abuse. Indeed, the Department of
Justice typically points to the FBI as an agency model with regard to
how to carefully and lawfully conduct electronic surveillance.
Aside from Executive and Judicial Branch review of FBI electronic
surveillance efforts, the Congress itself exercises frequent and
ongoing oversight over the FBI's conduct of electronic surveillance in
a number of ways. Year in and year out, numerous Congressional
Committees (and their staff) involved in authorizations and
appropriations scrutinize FBI expenditures, programs, and even
equipment. Committees on the Judiciary and Intelligence frequently hold
hearings, such as this, and submit written questions to be addressed by
the FBI. Further, since Title III's enactment in 1968, the Congress has
revisited the Federal electronic surveillance laws on a number of
occasions: in 1978 (FISA), in 1986 (ECPA), and in 1994 (CALEA). And, as
the Committee is well aware, each time the Federal electronic
surveillance laws are updated there is a substantial subtext to the
legislative initiative wherein the Congress considers and reconsiders
whether such laws are working well and whether there is any significant
indication of abuse such as to warrant the laws' curtailment or
modification. However, with each of these pieces of legislation, the
Congress has never found or suggested that the law enforcement
community, in general, or the FBI, as an agency, in particular, was
abusing the electronic surveillance authorities.
Further, in recent years, it has become somewhat commonplace for
members of the Congress to request a visit to the FBI's Engineering
Research Facility (ERF) to permit themselves and/or their staff to
understand FBI surveillance methodologies, etc., better. Beyond these,
every year the Administrative Office of the United States Courts sends
to the Congress the yearly "Wiretap Report" which specifies Federal,
State, and local law enforcement's Title III electronic surveillance
activities. Likewise, and also pursuant to Federal statute, every year
the Department of Justice submits to the Congress a report regarding
the use of pen register and traps and traces conducted by law
enforcement agency components within the Department. Further, several
years ago, as a part of the Anti-terrorism and Effective Death Penalty
Act of 1996, the Congress requested a Report from the Department of
Justice which was to specifically include a review of any abuse in law
enforcement's conduct of electronic surveillance. In the Report
submitted by the Department of Justice, it was pointed out that law
enforcement errancy in this area was rare, and did not suggest any
significant problem. In particular, there was no citation as to abuse
by the FBI.
At this point, it may be useful to briefly discuss another vital
component in the overall electronic surveillance/Carnivore mix: the FBI
personnel who use it.
In this regard, the Committee would truly be missing a significant
part of the story if we failed to point out the quality of the FBI
personnel involved and the ways in which they perform their tasks. To
begin with, to become and FBI employee requires a substantial showing
of trustworthiness, lawfulness, and personal and professional
intergrity--all of which must be demonstrated through the conduct of an
extensive and very thorough national security-level background
investigation. To be sure, the structure of the FBI would quickly
collapse if the agency and all of its onboard employees could not trust
without reservation its new employees. And the FBI certainly does not
recruit honest and law-abiding people only to turn around and employ
them in corrupt and dishonest ways. Indeed, in contrast with the
requirements placed upon many of the personnel employed by
telecommunications and computer network service providers (who may have
some role in implementing electronic surveillance orders), all FBI
employees are specifically sworn to uphold the Constitution, obey the
law, and to faithfully execute the laws of the land.
Of course, and as noted above, it is emphasized to all FBI
employees that any type of illegal electronic surveillance would be a
serious violation of the law--a federal felony, thereby subjecting the
employee to criminal prosecution, civil liability, and termination.
Further, FBI employees are made to fully understand that any unlawful
surveillance will likely lead to the suppression of any and all tainted
evidence and any evidence or fruits derived therefrom. In short, it is
made clear that any such unlawful behavior will not be tolerated.
All FBI personnel involved in conducting electronic surveillance
are thoroughly and specifically trained about the Federal electronic
surveillance laws. This is particularly so for the FBI Technically
Trained Agents (TTAs) who receive specialized training in the conduct
of electronic surveillance, including legal instruction, at the FBI's
Engineering Research Facility (ERF) in Quantico, Virginia. This
training weds together the black letter law with the ``hands on''
technical level implementations of electronic surveillance. Moreover,
FBI personnel involved in electronic surveillance are involved in
ongoing consultation with attorneys from the FBI's Office ofthe General
Counsel, the FBI Field Office's Chief Division Counsel, the Department
of Justice, and the Offices of United States Attorneys.
Access to and the use of FBI electronic surveillance equipment is
controlled administratively, and usually requires a trained specialist
to operate it. Hence, the large pool of FBI Special Agents and support
employees never have access to, or competency in the use of, such
highly-specialized pieces of surveillance equipment.
In sum, over the last 32 years, the FBI's record of properly
conducting court authorized electronic surveillance is a very good
one--one that we believe should command the trust of the public and the
Congress.
With regard to Carnivore, it is a relatively new electronic
surveillance tool, and has only been used within the last two years.
Trust in the FBI's use of Carnivore, we believe, should at least in
part rest upon the FBI's openness and willingness to discuss this
device. Indeed, perhaps the most telling fact about Carnivore, as an
electronic surveillance tool, is that in an unprecedented fashion, the
FBI has shared with numerous entities in the public Carnivore's (and/or
some of its technical counterparts') purpose and basic functionality--
long before any concerns were raised and before any Congressional
hearings were scheduled.
Ironically, the most central fact and aspect of the entire matter
has gotten lost: that the FBI has spent a considerable amount of time,
money, and energy in developing an electronic surveillance tool with
the exclusively laudable purposes of better satisfying the
Constitutional standard of particularity, the Title III and ECPA
precepts of minimization, as well as the legal, privacy-based, and
societal concerns associated with careful, precise, and lawful
surveillance efforts.
As the Committee may be aware, the FBI has briefed a wide-ranging
variety of entities: governmental attorneys, leading ISPs, leading
Information Technology (IT) companies, leading telecommunications
service providers, academic labs, and software manufacturers as to the
functionality of the Carnivore system. Hence, if, for the sake of
argument, the FBI had ever possessed any untoward intentions, in terms
of using Carnivore in a stealthy, illegal, or abusive way, it certainly
went about pursuing them in the wrong way. In fact, the FBI's openness
with regard to Carnivore should, in and of itself, properly and
reasonably instill public confidence and trust, notwithstanding that
some of its detractors may disagree with some aspect of Carnivore.
Of course, with regard to Carnivore, the same strict personnel,
legal, training, and security practices apply. Further, given that
relatively few of these devices are even available throughout the
entire FBI, those in existence are under the custody and control of but
a few FBI technically-trained personnel.
Finally, the FBI, in concert with the Department, has welcomed a
review of the Carnivore system. The FBI believes that when all is said
and done the FBI and the Carnivore device will receive a clean bill of
health, and thereby hopefully more fully instill public confidence and
trust in this important and critically needed investigative tool.
Conclusion
In conclusion, I would like to say that over the last ten years or
more, we have witnessed a continuing, steady growth in computer and
Internet-related crimes, including extremely serious acts in
furtherance of terrorism, espionage, infrastructure attack, as well as
the more conventional serious and violent crimes, to include child
pornography and exploitation. These activities which have been planned
or carried out, in part, using computers and the Internet pose
challenges to the U.S. law enforcement community that we dare not fail
to meet. In turn, the ability of the law enforcement community to
effectively investigate and prevent these serious crimes is, in part,
dependent upon our ability to lawfully and effectively intercept and
acquire vital evidence of these crimes, and our ability to promptly
respond to these harms that so threaten the American public. As the
Internet becomes more complex, so too do the challenges placed upon us
to keep pace. Without the continued cooperation of our industry
partners and important technological innovations such as the Carnivore
system, such a task would be futile.
I look forward to working with the Committee staff to provide more
information and welcome your suggestions on this important issue. I
will be happy to answer any questions that you may have. Thank You.
The Chairman. Thank you so much.
Mr. Di Gregory, we will turn to you.
STATEMENT OF KEVIN V. DI GREGORY
Mr. Di Gregory. Thank you, Mr. Chairman. Thank you for
allowing me the opportunity to testify about electronic
surveillance and privacy in the digital age.
We have seen, as you have already noted, the Internet
flourish over the last 10 years. In that relatively short
period of time, it has created vast benefits for citizens,
businesses and governments, and appears to hold boundless
promise. The Internet has spurred a new economy, and many
businesses have been built and people employed through Internet
sales of products and services.
Others have assisted in building, maintaining and improving
the Internet itself. The Internet has given people jobs,
supported families and communities, and created new
opportunities for commerce for America and the world. The
Internet has touched our working lives, our social lives, and
our family lives.
As we have seen throughout history, however, there are
those who would use powerful tools like the Internet to inflict
harm on others. The Internet has not escaped this historical
truth. Even in the Internet's relatively short existence, we
have seen a wide range of criminal use of this technology. It
has been used to commit traditional crimes against an ever
widening number of victims. There are also those criminals
intent on attacking and disrupting computers, computer
networks, and the Internet itself.
In short, although the Internet provides an unparalleled
opportunity for Americans to freely express ideas and conduct
business and government, it also provides a very effective
means for ill-motivated persons to breach the privacy and
security of others.
Many of the crimes that we confront everyday in the
physical world are beginning to appear in the online world.
Crimes like death threats, extortion, fraud, and child
pornography are migrating to the Internet at a startling pace.
The fourth amendment and laws addressing privacy and public
safety serve as a framework for law enforcement to respond to
this new forum for criminal activity.
If law enforcement fails properly to respect individual
privacy in its investigative techniques, the public's
confidence in government will be eroded, evidence will be
suppressed, and criminals will elude successful prosecution. If
law enforcement is too timid in responding to cyber crime,
however, we will, in effect, render cyberspace a safe haven for
criminals and terrorists to communicate and carry out crime
without fear of authorized government surveillance.
If we fail to make the Internet safe, people's confidence
in using the Internet and in e-commerce will decline,
endangering those very benefits brought about by the
information age. Proper balance is the key. Despite the fervor
over the unfortunately named Carnivore, the truth of the matter
is that Carnivore was created to provide us with a tool to help
us enforce the laws and preserve the privacy of our citizens.
To satisfy our obligations to the public to enforce the
laws and preserve public safety, we use the same sorts of
investigatory techniques and methods online as we do in the
physical world, with the same careful attention to the strict
constitutional and legal limits which apply. We must have an
investigatory tool that helps us to investigate online in the
same way as in the physical world, and enables us to obtain
only the information we are authorized to obtain through a
court order.
For example, if a man is suspected of luring children for
sex, law enforcement must determine with whom the suspect is
communicating. In the recent past, such communications would
have been carried out exclusively by telephone. To find out who
the suspect is communicating with, law enforcement would obtain
an order from a court authorizing the installation of a trap
and trace and a pen register device, and either the telephone
company or law enforcement would have installed the device to
comply with the court's order.
Thereafter, the source and destination of the calls would
have been recorded. This is information that the Supreme Court
has held in Smith v. Maryland is not subject to any reasonable
expectation of privacy. Given the personal nature of the
information, however, Congress required the Government to
obtain an order under these circumstances. In this way, privacy
is protected and law enforcement is able to conduct its
investigation in its efforts to protect the public.
Nowadays, that same suspect is more likely to operate
through e-mail or other kinds of online communications. In
attempting to investigate the criminal activity, law
enforcement can apply to a court for an order to obtain in real
time the e-mail addresses of those persons with whom the
suspect is communicating through or by e-mail.
Law enforcement needs to be able to quickly identify the
source and destination of such e-mails to fulfill its
obligations to the victims, in particular, and to the public
generally. In the event that the investigation requires viewing
the content of the e-mail, even just the subject line, then law
enforcement must comply with the strict internal FBI and
Department guidelines and the provisions of Title III of the
Omnibus Crime Control and Safe Streets Act of 1968.
When law enforcement uses a trap and trace, pen register,
or a title III order in the online context, however, we have
found that at times the Internet service provider has been able
or even unwilling to supply the information we need. It is for
that narrow set of circumstances that the FBI needs effective
online investigative tools.
Law enforcement cannot abdicate its responsibility to
protect public safety simply because technology has changed.
Rather, we believe the public rightfully expects that law
enforcement will continue to be effective as criminal activity
migrates to the Internet. Where the service provider cannot or
will not comply with a court order to reveal addressing
information or content of electronic communications, law
enforcement must have some mechanism to obtain that
information. It must have a tool that can obtain the
information authorized by the court order, and I say again only
that information authorized by the court order.
The tool should be configurable so that, for example, it
can be set to gather only the e-mail addresses of those persons
with whom the suspect is communicating without any human being
either from law enforcement or the service provider viewing the
private information that is outside of the scope of the court
order. Such a tool automatically reduces the data collected to
only that permitted by the court, thus allowing law enforcement
strictly to comply withthe order and safeguarding the privacy
of information outside the order.
The FBI created Carnivore to be such a tool. We have
numerous mechanisms in place to prevent possible misuse of
electronic surveillance tools. The fourth amendment, of course,
restricts what law enforcement can do with the software, as do
the statutory requirements of title III and the Electronic
Communications Privacy Act. And, further, implementing orders
of the courts will restrict us and will prevent possible misuse
of electronic surveillance tools.
For Federal title III applications, as you know, the
Justice Department imposes its own guidelines on top of the
privacy protections provided by the Constitution, statutes, and
the courts. For example, before Carnivore can be used to
intercept wire or electronic communications, with the limited
exception of digital display pagers, the requesting
investigative agency must obtain approval for the title III
application from the Department of Justice.
Specifically, the Office of Enforcement Operations in the
Criminal Division of the Department reviews each proposed title
III application to ensure that the interception satisfies
fourth amendment requirements and is in compliance with
applicable statutes and regulations. If the proposal clears the
Office of Enforcement Operations, approval must generally be
given then by a Deputy Assistant Attorney General in the
Criminal Division. Typically, investigative agencies such as
the FBI have similar but separate internal approval
requirements.
If the investigative agency and the Department of Justice
approve a Federal title III request, it still must, of course,
be approved by the proper court using familiar but exacting
standards. By statute and internal departmental regulation, the
interception may last no longer than 30 days without an
extension by the court. Courts, as I alluded to earlier, often
impose their own additional requirements.
In addition, the remedies for violating title III or ECPA
by improperly intercepting electronic communications include
criminal sanctions and civil suits. For violations of the
fourth amendment, of course, the remedy of suppression is also
available.
We recognize that notwithstanding the limited use of the
software and the many protections in place, concerns remain
about the computer program Carnivore. To address those
concerns, the Attorney General has asked, as you have noted,
Mr. Chairman, for an independent technical review of Carnivore
to evaluate whether it performs the functions it was designed
to perform, and does so without any greater threat to privacy
or to the smooth operation of private service providers than
would be posed by any other system that allows compliance with
the law related to court-ordered interceptions.
The technical reviewers will have whatever access they need
to discharge their responsibilities, and their report will be
made public to the maximum extent that is consistent with
otherwise applicable law or contractual obligations and with
preserving the continued effectiveness of the software.
The report will also be reviewed by a high-level Department
panel, chaired by the Assistant Attorney General for the
Justice Management Division, Mr. Stephen Colgate, and including
the Attorney General's chief science and technology officer;
the Department's chief privacy officer; the Assistant Director
of the FBI in charge of the Bureau's laboratory Division, Dr.
Kerr; and a representative of the Department's Criminal
Division. That panel will consider the positions of interested
parties, such as industry and privacy groups, concerning the
technical review and will report to the Attorney General.
Mr. Chairman, thank you again for allowing me this
opportunity to address our efforts to fight crime on the
Internet and preserve the privacy rights conferred by the
fourth amendment and statutes. The need to protect the privacy
of our citizens from criminals, as well as the Government, is
the paramount consideration in all our activities. The public
is undoubtedly concerned about their online privacy and the
potential for criminals, private industry and the Government to
infringe upon it.
The public is also deeply concerned, we believe, about
their safety and security when exploring and using the ever-
expanding reaches of the Internet. By deterring and punishing
those criminals who violate individual privacy, ensuring the
ability of law enforcement to fight cyber crime both promotes
safety and security of Internet users and enhances user
privacy. The Department of Justice stands ready to work with
the members of this committee and others to achieve these
important goals.
Mr. Chairman, that concludes my prepared statement. We have
provided the committee with my full written statement, and
thank you very much. Hopefully, later, we will be able to
answer any questions you or Senator Leahy may have.
[The prepared statement of Mr. Di Gregory follows:]
Prepared Statement of Kevin V. Di Gregory
Mr. Chairman and Members of the Committee, I appreciate your
providing me with this opportunity to testify about the computer
program ``Carnivore.'' This Committee has previously heard from Deputy
Attorney General Eric Holder and Assistant Attorney General for the
Criminal Division James K. Robinson and concerning cybercrime issues.
We are pleased to continue to participate in this very important
dialogue today, and to address the imperative of protecting individual
privacy on the Internet from unwarranted governmental intrusion, and
the critical role the Department plays to ensure that the Internet is a
safe and secure place for our citizens.
Privacy and the Obligation to Provide Public Safety
Our obligation to the public to enforce the laws is not limited to
activities in the physical world; our responsibilities to the citizens
to preserve their safety continues where illegal conduct is committed
on-line or facilitated by the Internet. The public rightfully expects,
for example, that law enforcement will investigate and prosecute child
molesters who prey on children using electronic mail or other Internet
communications tools.
Similarly, of course, the duty of law enforcement to preserve
privacy does not end where the Internet begins. The Fourth Amendment
protects the rights of our citizens as we go on-line to work, learn and
explore the Internet, just as the Fourth Amendment protects rights in
the physical world. The goal of the Department is long-honored and
noble: we must preserve the privacy of our citizens while protecting
their safety. History has taught us, and our founding fathers
recognized, that our citizens' liberty cannot thrive unless we can
investigate, apprehend and prosecute those who engage in criminal
conduct. At the same time, however, our founding fathers abhorred the
disregard and abuse of privacy by the government in England. Privacy
and public safety can be at odds in certain circumstances. The founders
of this nation adopted the Fourth Amendment to address those
situations. Under the Fourth Amendment, the government must demonstrate
probable cause to a neutral magistrate before obtaining a warrant for a
search, arrest, or other significant intrusion on privacy.
Congress and the courts have also recognized that less intrusive
investigate steps should be permitted under a less exacting threshold.
The Electronic Communications Privacy Act establishes a three-tier
system by which the government can obtain stored information from
electronic communication service providers. In general, the government
needs a search warrant to obtain the content of unretrieved
communications (like e-mail), a court order to obtain transactional
records, and a subpoena to obtain information identifying the
subscriber. See Sec. Sec. 18 U.S.C. 2701-11.
In addition, to obtain information identifying who is sending or
receiving communications to or from a particular suspect, the
government must obtain a ``trap and trace'' or ``pen register'' court
order authorizing the recording of such information. See 18 U.S. 3121
et seq.
Because of the privacy values it protects, the wiretap statute, 18
U.S.C. Sec. Sec. 2510-22, commonly known as Title III, places a higher
burden on the real-time interception of oral, wire and electronic
communications than even the Fourth Amendment requires. To listen to or
record communications as they are happening, law enforcement must
obtain a court order unless one of the specified statutory exceptions
applies. To obtain such an order, the government must show that normal
investigative techniques for obtaining the information have or are
likely to fail are too dangerous, and that any interception will be
conducted so as to ensure that the intrusion is minimized. The Fourth
Amendment and statutory restrictions on government access to
information do not prevent effective law enforcement. Rather, they
provide boundaries for law enforcement, clarifying what is acceptable
evidence gathering and what is not.
Often, our obligations to enforce the law and our goal to preserve
privacy are in complete harmony, such as when we apprehend and
prosecute a criminal who has hacked into a computer containing the
confidential records of others. In those instances where there is
tension, we must find a proper balance. Law enforcement has a critical
role to play in preserving privacy against intrusions by others.
Although the primary mission of the Department of Justice is law
enforcement, Attorney General Reno and the entire Department understand
and share the legitimate concerns of all Americans with regard to
personal privacy. If the Internet is to thrive and citizens' confidence
in the Internet is to remain high, we can abandon neither the goal of
on-line privacy nor the goal of public safety.
The Department has been and will remain committed to protecting the
privacy rights of individuals. We look forward to working with Congress
and other concerned individuals to address these important matters in
the months ahead.
Keeping the Peace in Cyberspace
Although the Fourth Amendment is over two centuries old, the
Internet as we know it is stillin its infancy. The huge advances in
communications technology over the past decade have forever altered the
landscape of society worldwide. The Internet provides a new forum in
which citizens can communicate, transfer information, engage in
commerce, play and expand their educational opportunities. These are
but a few of the wonderful benefits of this rapidly evolving
technology. As has happened to every major technological advance,
however, we are seeing individuals and groups use the Internet to
commit crimes. As the Department has noted in the past, this nation's
vulnerability to computer crime is astonishingly high and threatens not
only economic prosperity, but the privacy of our citizens and our
country's critical infrastructure.
Many of the crimes that we confront everyday in the physical world
are migrating to the on-line world. Crimes like death threats,
extortion, fraud and child pornography have migrated with startling
speed to the Internet. The Fourth Amendment and laws addressing privacy
and public safety serve as the framework for law enforcement to respond
to this new forum for criminal activity. If law enforcement fails
properly to respect individual privacy in its investigate techniques,
the public's confidence in government will be eroded, evidence will be
suppressed, and criminals will elude successful prosecution. If law
enforcement is too timid in responding to cybercrime, however, we will,
in effect, render cyberspace a safe haven for criminals and terrorists
to communicate and carry out crime, without fear of authorized
government surveillance. If we fail to make the Internet safe, people's
confidence in using the Internet and e-commerce will decline,
endangering the very benefits brought by the Information Age. Proper
balance is the key.
To meet our responsibilities to the public to enforce the laws and
preserve the safety, we use the same sorts of investigative techniques
and methods on-line as we do in the physical world, with the same
careful attention to the strict constitutional, statutory, internal and
court-ordered boundaries.
For example, if a man is suspected of luring children for sex, law
enforcement must determine with whom the suspect is communicating. In
the recent past, such communications would have been carried out
exclusively by telephone. To find out who the suspect is communicating
with, law enforcement would obtain an order from a court authorizing
the installation of a ``trap and trace'' and a ``pen register'' device,
and either the telephone companyor law enforcement would have installed
these devices to comply with the court's order. Thereafter, the source
and destination of calls would have been recorded. This is information
that the Supreme Court has held is not subject to any reasonable
expectation of privacy. Given the personal nature of this information,
however, the law requires government to obtain an order under these
circumstances. In this way, privacy is protected and law enforcement is
able to investigate to protect the public.
Now, that same suspect is more likely to operate through e-mail or
other kinds of online communications. In attempting to investigate the
criminal activity, law enforcement can apply to a court for an order to
obtain in real time the e-mail addresses of those persons with whom the
suspect is communicating through or by e-mail. Law enforcement needs to
be able to quickly identify the source and destination of such e-mails
to fulfill its obligations to the victims in particular and the public
generally. In the event that the investigation requires viewing the
content of the e-mail--even just the subject line--then law enforcement
must comply with strict internal FBI and Department guidelines, and the
provisions of Title III of the Omnibus Crime Control and Safe Streets
Act of 1968, 18 U.S.C. Sec. Sec. 2510-2521.
At times, Internet service providers may be unable to use their own
technology to comply with court orders directing them to supply source
and destination information or the content of communications. Law
enforcement cannot abdicate its responsibility to protect public safety
simply because technology has changed. Rather, the public rightfully
expects that law enforcement will continue to be effective as criminal
activity migrates to the Internet.
It is for such narrow set of circumstances that the FBI designed
``Carnivore.'' When a criminal uses e-mail to send a kidnaping demand,
to buy and sell illegal drugs or to distribute child pornography, law
enforcement needs to know to whom he is sending messages and from whom
he receives them. To get this information, we obtain a court order,
which we serve on the appropriate service provider. Because of the
nature of Internet communications, the addressing information (as
opposed to the content of the communication itself) is often mixed in
with other non-content data that we have no desire to gather. If the
service provider can comply with the order and provide us with only the
addressing information required by court order, it will do so and we
will not employ any investigative tool.
Where the service provider cannot or will not comply with a court
order to reveal addressing information or content of electronic
communications, law enforcement must have some mechanism to obtain the
information. It must have a tool that can obtain the information
authorized by court order, and only that information. The tool should
be configurable such that, for example, it can be set to gather only
the e-mail addresses of those persons with whom the kidnapper is
communicating, without allowing any human being, either from law
enforcement or the service provider, to view private information
outside of the scope of the court's order. Such a tool automatically
reduces the data collected to only that permitted by the court, thus
allowing law enforcement strictly to comply with the order, and
safeguarding the privacy of information outside the order. The FBI
created Carnivore to be such a tool.
We have numerous mechanisms in place to prevent possible misuse of
electronic surveillance tools. The Fourth Amendment, of course,
restricts what law enforcement can do with the software, as do the
statutory requirements of Title III and the Electronic Communications
Privacy Act, and the implementing orders of the courts.
For federal Title III applications, the Department of Justice
imposes its own guidelines on top of the privacy protections provided
by the Constitution, statutes and the courts. For example, before
Carnivore may be used to intercept the content of communications, the
requesting investigative agency must obtain approval from the
Department of Justice asking a court for a Title III order. The Office
of Enforcement Operations in the Criminal Division of the Department
reviews each proposed Title III application to ensure that the
interception satisfies the protections of the Fourth Amendment and
complies with applicable statutes and regulations. Even if the proposal
clears the OEO, the application cannot go to to a court without
approval by a Deputy Assistant Attorney General or higher-level
official in the Department. Although this requirement of high-level
review is required by Title III only with regard to proposed intercepts
of wire and oral communications, the Department voluntarily imposes the
same level of review for proposed interceptions of electronic
communications (except digital-display pagers). Typically,
investigative agencies such as the Federal Bureau of Investigation have
similar internal requirements, separate and apart from Constitutional,
statutory or Department of Justice requirements.
If the investigative agency and the Department of Justice approve a
federal Title III request, it still must, of course, be submitted to
and approved by a court of proper jurisdiction. The court will evaluate
the application under the Fourth Amendment and using the familiar
standards of Title III. By statute, for example, the application to the
court must show, through sworn affidavit, why the intercept is
necessary as opposed to other less-intrusive investigative techniques.
The application must also provide additional detail, including whether
there have been previous interceptions of communications of the target,
the identity of the target (if known), the nature and location of the
communications facilities, and a description of the type of
communications sought and the offenses to which the communications
relate. By statute and internal Department regulation, the interception
may last no longer than 30 days without an extension by the court.
Courts also often impose their own requirements. For example, many
federal courts require that the investigators provide periodic reports
setting forth information such as the number of communications
intercepted, steps taken to minimize irrelevant traffic, and whether
the interceptions have been fruitful. The court may, of course
terminate the interception at any time.
The remedies for violating Title II or ECPA by improperly
intercepting electronic communications can include criminal sanctions,
civil suit, and for law enforcement agents, adverse employment action.
For violations of the Fourth Amendment, of course, the remedy of
suppression is also available.
The Justice Department and law enforcement across this nation are
committed to continuing to work together and with their counterparts in
other countries to develop and implement investigative strategies to
successfully track, apprehend, and prosecute individuals who conduct
criminal activity on the Internet. In so doing, the same privacy
standards that apply in the physical world remain effective online.
As the Committee is aware, the Administration recently transmitted
to Congress a legislative proposal addressing various issues relating
to cyber-security. Two portions of the bill relate directly to today's
discussion. First, the Administration supports raising the statutory
standards for intercepting the content of electronic communications so
they are the same as those for intercepting telephone calls: high-level
approval, use only in cases involving certain predicate offenses that
are specified by statute, and statutory suppression of evidence derived
from improper intercepts. Second, the Administration bill requires
federal judges to confirm that the appropriate statutory predicates
have been satisfied before issuing a pen register or trap-and-trace
order. Those changes would apply to the use of Carnivore, and in
important respects wouldsimply confirm by statute the policies and
procedures already followed by the Department of Justice. The
Administration supports a balanced updating of laws to enhance
protection of both privacy and public safety, and the bill contains
important provisions that would be most helpful in the ongoing fight
against cyber-crime.
We recognize that, notwithstanding the limited use of the software
and the many protections in place, concerns remain about the computer
program. To address those concerns, the Attorney General has asked for
an independent technical review of Carnivore to evaluate whether it
performs the functions it was designed to perform, and does so without
any greater threat to privacy or to the smooth operation of private
service providers then would be posed by any other system that allows
compliance with the law relating to court-ordered interceptions. The
technical reviewers will have whatever access they need to discharge
their responsibilities, and their report will be made public to the
maximum extent that is consistent with otherwise applicable law or
contractual obligations and with preserving the continued effectiveness
of the software as a law-enforcement tool. The report will also be
reviewed by a high-level Departmental panel, chaired by the Assistant
Attorney General for the Justice Management Division and including the
Attorney General's Chief Science & technology Advisory, the
Department's Chief Privacy Officer, the Assistant Director of the FBI
in charge of the Bureau's Laboratory Division, and me. That panel will
consider the positions of interested parties, such as industry and
privacy groups, concerning the technical review, and will report to the
Attorney General.
Mr. Chairman, the Department of Justice takes privacy concerns
seriously and takes a proactive leadership role in making cyberspace
safer for all Americans. The cornerstone of our cybercrime prosecutor
program is the Criminal Division's Computer Crime and Intellectual
Property Section, known as CCIPS. Founded in 1991 as the Computer Crime
Unit, CCIPS became a Section in 1996. CCIPS has grown from five
attorneys in 1996 to nineteen today, and we need more to keep pace with
the demand for their expertise. The attorneys in CCIPS work closely on
computer crime cases with Assistant United States Attorneys known as
``Computer and Telecommunications Coordinators,'' or CTC's, in U.S.
Attorney's Offices around the nation. Each CTC receives special
training and equipment and serves as the district's expert on computer
crime cases. CCIPS and the CTC's work together in prosecuting cases,
spearheading training for local, state and federal law enforcement,
working with international counterparts to address difficult
international challenges, and providing legal and technical instruction
to assist in the protection of this nation's critical infrastructes.
CCIPS also provides its expertise to the public through its Internet
website, www.cybercrime.gov. We are very proud of the work these people
do and we will continue to work diligently to help stop criminals from
victimizing people online.
I also note that public education is an important component of the
Attorney General's strategy on combating computer crime. As she often
notes, the same children who recognize that it is wrong to steal a
neighbor's mail or shoplift do not seem to understand that it is
equally wrong to steal a neighbor's e-mail or copy a proprietary
software or music file without paying for it. To remedy this problem,
the Department of Justice, together with the Information Technology
Association of America (ITAA), has embarked upon a national campaign to
educate and raise awareness of computer responsibility and to provide
resources to empower concerned citizens. The ``Cybercitizen Awareness
Program'' seeks to engage children, young adults, and others on the
basics of critical information protection and security and on the
limits of acceptable online behavior. The objectives of the program are
to give children an understanding of cyberspace benefits and
responsibilities, an awareness of consequences resulting from the
misuse of the medium and an understanding of the personal dangers that
exist on the Internet and techniques to avoid being harmed.
Conclusion
Mr. Chairman, thank you again for allowing me this opportunity to
address our efforts to fight crime on the Internet and preserve the
privacy rights conferred by the Fourth Amendment and statute. The need
to protect the privacy of our citizens from criminals as well as the
government, is a paramount consideration in all our activities. The
public is undoubtedly concerned about their on-line privacy, and the
potential for criminals, private industry, and the government to
infringe upon it. The public is also deeply concerned about their
safety and security when exploring and using the ever-expanding reaches
of the Internet. By deterring and punishing those criminals who violate
individual privacy, ensuring the ability of law enforcement to fight
cyber-crime both promotes the safety and security of Internet users and
enhances user privacy. The Department of Justice stands ready to work
with the Members of this Committee and others to achieve these
important goals.
Mr. Chairman, that concludes my prepared statement. I would be
pleased to answer you questions
The Chairman. Thank you so much.
Mr. Cerf, we will take your testimony at this time.
STATEMENT OF VINTON G. CERF
Mr. Cerf. Thank you very much, Mr. Chairman. It is a
pleasure to be here. Good morning, Senator Leahy. It is a
pleasure to see you again as well.
I am here representing the Internet Society, although for
purposes of identification, the chairman is quite correct, I
also serve as senior vice president at WorldCom for Internet
Architecture and Technology.
For many, many years I worked on the Internet, and for a
long time many of you know that getting the Internet protocol
out there was an important goal. So I even had a T-shirt made
to commemorative. It reads ``IP on everything,'' and that is
what I have been doing for a long time.
However, the FBI is now confronted with a serious problem
because now that the Internet protocol is going everywhere,
everyone wants to put all new applications on top of it. So, as
a result, we have Internet telephony and television and radio
and e-mail and World Wide Web. So now I have another T-shirt
that says ``Everything on IP,'' although one could read this
``IP Under Everything,'' which is another way of thinking about
it.
That is the problem confronting the FBI today, is that
these communications----
Senator Leahy. You have made sure this will be the one
thing that we will remember from this hearing. [Laughter.]
The Chairman. If you had any guts, you would have worn
those T-shirts.
Senator Leahy. Don't encourage him, Mr. Chairman.
[Laughter.]
Mr. Cerf. I don't know if I want to go there any further.
Thank you, Mr. Chairman.
The Chairman. But I have met a lot of your associates in
this business and they wear T-shirts.
Mr. Cerf. My purpose today is entirely technical. I am not
prepared to, and I don't even consider myself competent to
speak to the policy side of these questions. But I do want to
make some attempt to explain how difficult it is to achieve
what the Carnivore system tries to do, so let me remind you a
little bit about the Internet.
First of all, think of the packets that flow through it as
if they are postcards. Postcards don't necessarily stay in
order as they go through the Postal Service. This is true on
the Internet as well. They get lost. In fact, in the Internet
world sometimes we have to duplicate them in order to get
reliable delivery to the far end.
The other thing which is characteristic of the Internet is
that it works with computers with a lot of software in them and
the software is structured in layers. So the lowest layer is
the Internet protocol layer, but there are layers on top of
that, each one depending on the ones below it for performing
the functions that achieve reliability or implement things like
electronic mail.
So as an example of what happens when someone is sending e-
mail from place to place on the Net, let me start with an
example. This is a simple little e-mail from Tom Bell to Vinton
Cerf, and we will pretend like this is the original message
that--for people back there, there you are. That is the
original message that is prepared by the sender. But by the
time the FBI gets a chance to look at it through the Carnivore
System, what they will see is, in fact, not this message, but
rather a series of envelopes which I have numbered 1, 2, 3 and
4.
They may not see them in this order. They may see them in
the order 1, 3, 2 and 4, depending on where the Carnivore
system is actually located in the network. If it is close to
the source of the messages, then it may actually see them in
order. But because of retransmissions and other things, you may
still see them out of order.
What is more interesting is that when you open up one of
these Internet packets to see what is in inside, what you
discover is only a piece of the e-mail that started out as one
whole message. And, in fact, you may not be able to tell from
looking inside who it is from or where it is going because not
all of the message is there. All of the header information that
says ``to Vint Cerf'' and ``from Tom Bell'' may not be visible
in the particular packet that you happen to have detected.
So it is a big challenge for the Carnivore system to have
its parameters set to filter out only those packets that have
information in them that is useful to the surveillance. In
fact, because of the way this system has been implemented, it
is looking at each packet one at a time. It doesn't assemble
them together and then look at them. It sees each one as if it
were through a keyhole.
As a result, if you don't see enough information in here,
you will have discard it because you won't, in fact, be able to
identify it as useful to the surveillance. So they actually
lose quite a bit of information. They don't see as much as they
would if they were trying to assemble everything. The result is
that they will see, for example, a subset of all the messages I
may send and receive to someone as e-mail.
If, on the other hand, they are permitted to record all of
the information because the court order says they can see
everything, then after they have captured these packets, you
can put them back together and examine the complete messages
and extract from them the part of the information that you are
permitted to extract.
Now, in order to do that properly, you are going to
actually see everything in the message and you will have to
filter out the part that says ``to'' and ``from'' because the
physical way in which you pull these things together allows you
to see the entire thing if you are permitted to see all of the
traffic. If you are only permitted to see the packets, then you
will just see those messages that happen to have in them enough
information to identify this as an e-mail from Vint Cerf to a
particular target.
So I would argue that, technically speaking, the Carnivore
system sees less than would be absolutely allowed in the case
that they are only permitted to see the ``to'' and ``from''
addresses. If, however, they are permitted to see everything,
they can, in fact, see everything and then have to filter that
out and discard the portion of the traffic which is not
relevant.
Then the other thing that I want to point out, then, is
that the placement of the Carnivore system is pretty crucial to
all of this. I would like to make an analogy, if I could.
Let's imagine for the sake of argument that our postal
services are done with post office boxes, that we have no home
addresses, we have no home delivery of postal mail. We all have
to go to our post office boxes in order to retrieve our
messages. The Internet behaves a lot like that because the mail
systems are like post offices that contain postoffice boxes.
The FBI's problem is that if they were trying to observe
the traffic going from one party to another, from one post box
to another, the only thing that they can see is traffic going
between post offices, not post office boxes. All they get to
see in the Internet packet is something that says this is the
Annandale post office and this is the Springfield post office,
and that is all the traffic they can see. You have to open it
up and look deeper to figure out from which post office box it
is going.
That is why there is such concern that you may be seeing
more than you are allowed to see. But my understanding of the
way the Carnivore configuration is set up is it is very limited
in its ability to capture packets with respect to the ``to''
and ``from'' addresses or the equivalent post office box
addresses.
So the last thing I would like to point out in this
discussion is that the technology that allows people to protect
privacy makes life even harder for the FBI in the course of
doing this surveillance because if you use what is called end-
to-end cryptography--and there is plenty of that now available
both domestically and internationally--the object that they had
to look at that was inside this packet to figure out the ``to''
and ``from'' addresses of the mail could be encrypted. As a
result, the target may not be visible. So this makes the job of
the FBI even more difficult in the event that end-to-end
cryptography is used.
I see that I have overstayed my welcome, but let me stop
there and say that the FBI's implementation of Carnivore
attempts, in my estimation, to limit the amount of information
that is being captured, but it is very, very hard to do that
successfully, and the cryptography makes their job even more
difficult.
I would be happy to answer any questions that may come
about as a consequence of further discussion at this point.
Thank you very much.
[The prepared statement of Mr. Cerf follows:]
Prepared Statement of Dr. Vinton G. Cerf
Mr. Chairman, my name is Vinton Cerf. I am present on behalf of the
Internet Society; a non-profit educational and research institution
devoted to the continued evolution and spread of the Internet on a
global basis. For purposes of identification only, I am also senior
vice present at WorldCom where I am responsible for Internet
Architecture and Technology, but my testimony today is on behalf of the
Internet Society where I serve as a trustee. I served a the founding
president of the Society from 1992 to 1995 and have served on its board
of trustees since 1992. In 1997, President Clinton awarded the National
Medal of Technology to me and to Dr. Robert E. Kahn for our roles in
the invention and implementation of the Internet.
The purpose of my testimony today is technical. I hope to provide
you, Mr. Chairman and the other members of the committee with a sense
for how the Internet works and how the FBI Carnivore system operates
within the architectural framework of the Internet. I thank you for
this opportunity to share these technical ideas with you and I hope
that they will prove to be useful as the committee considers the policy
implications of the Carnivore technology.
Let me begin by offering a simple analogy that has proven to be
helpful in the past to explain some basic principles by which the
Internet functions. To begin with, the Internet is not a single network
but, rather a network of networks interlinked on a global scale. The
precise figure is not known but there are probably on the order of
300,000 networks, worldwide, interconnected to form the Internet. There
are an estimated 100 million service computers on the Internet and
approximately 330 million users. These figures do not include laptops,
desktops, mobile telephones and Internet-enabled appliances that are on
the Internet on a sporadic basis. The technology used by the Internet
to switch data among the computers on the network is called ``packet
switching'' and is quite different from the technology used to support
conventional voice telephony services.
In the traditional voice telephone network, the end devices
(telephones and fax machines, typically) ``dial'' each other up and the
network forms end-to-end electronic circuits the pair of communicating
devices. The connection remains in place until one or the other device
``hangs up'' or, as occasionally happens, the telephone system
accidentally disconnects the parties. As far back as 1961, it was
recognized by a few individuals that a very different mode of operation
would be appropriate to link networks of communicating computers. That
technology eventually became known as ``packet switching.''
In principle, computers communicate with each other in a ``bursty''
fashion. That is, they compute for a while and then emit a burst of
information, then go back to computing. This is particularly true in
time-shared machines that serve many users concurrently. Each user
feels as if he or she has the computer resource all to himself or
herself, but in fact the computer is so much faster than the user, it
is possible to appear to be a dedicated resource when, in fact, the
machine serves each user in turn. The service rate is fast enough that,
most of the time, the sharing is not noticed by users. Of course, if
the resources of the serving computer are over-subscribed, users may in
fact find themselves waiting for service.
A ``packet'' is a brief computer message of perhaps a few thousands
bits (up to a thousand or so characters) containing some indication of
the source of the message and the destination in addition to the
content. The best analogy that I have been able to come up with so far
is to compare a packets to ordinary post cards.
Each postcard has a ``from:'' address and a ``to:'' address. So
does each Internet packet, but the packet addresses are Internet
addresses that are something like telephone numbers. A postcard has a
finite amount of content, and so does an Internet packet. When you put
a postcard into the postal system, it is picked up from the postbox and
transported to the destination, passing through one or more post
offices and carried by truck, plane, train, boat or even on foot on its
way to the destination. Similarly, an Internet packet may be carried
over optical fiber, telephone twisted pair copper lines, coaxial
television cables, point to point radio or satellite.
When you put a postcard into the postal system, there is no
guarantee that it will come out! The same is true of an Internet
packet! When you put two postcards into the postal system there is not
guarantee that they will come out in the same order they went in, even
if addressed to the same destination. The same is true of Internet
packets. The Internet does one other thing that the Post Office does
not do. Occasionally it will deliver duplicate packets to the
destination--that's not a feature of the U.S. Postal Service, as far as
I am aware.
As postcards are routed through the postal service, they are
forwarded from one post office to another until they reach the
destination post office after which they are delivered to the target
address. Devices called ``routers'' serve the same function in the
Internet as post offices in the sense that they take in packets
andforward them from router to router until the destination is reached.
The Internet uses what is called the Internet Protocol to forward
packets between computers in what is, effectively, a kind of computer
post card service. A ``protocol'' is simply a set of conventions and
formats used to achieve communications. The postal service dictates
that addresses take a certain format and occupy certain places in a
postcard--Internet packets have their own format and procedures for
being injected into and taken out of the Internet. The standards and
procedures used by the Internet are essentially developed by a body
called the Internet Engineering Task Force and the architecture of the
Internet is looked after by the Internet Architecture Board. These two
groups operate under the auspices of the Internet Society.
There is more, however, to Internet than the basic Internet
Protocol (the electronic postcard system). The Internet architecture is
called a ``layered'' system because there are actually several layers
of procedures. Each higher level procedure or protocol relies on the
lower level protocol(s) to perform basic functions. One sometimes hears
or reads the expression ``TCP/IP'' in association with the Internet.
TCP stands for Transmission Control Protocol and IP stands for Internet
Protocol. These are the two basic protocols that Bob Kahn and I began
working on in 1973 and they form the basis of the Internet as we know
it today. The Internet Protocol was designed to operate on top of
virtually any digital transmission and switching system and, in fact, I
have had a T-shirt made to emphasize this notion. The T-shirt reads
``IP on Everything''!
The Internet Protocol, as you should now realize, does not
guarantee the reliability of the packets it transports, nor does it
assure ordering, or the path over which the packets are transported.
But there are a great many applications that require these features,
and more, to function successfully. The Transmission Control Protocol
(TCP) was designed to make up for the deficiencies of the Internet
Protocol by keeping things in sequence, recovering from loss and
filtering out duplicates.
To see how TCP does this, another analogy is useful. Let us suppose
that Senator Hatch wants to send a book to Senator Leahy by means of a
postal service that can only carry postcards. How would he set about
accomplishing this task? He would first have to remove pages of the
book and cut them up to fit on post cards. Then he would notice that
not every postcard had a page number so Senator Leahy might have
difficulty piecing the post cards back in the right order, so he would
decide to number each page. Then he would remember that not all the
postcards would necessarily reach Senator Leahy, so he would keep
copies of them in case duplicates had to be sent. Then he would wonder
how he would know when to send duplicates. Senator Leahy might then
think of a good idea: he would occasionally send a postcard back to
Senator Hatch to say that he'd gotten every postcard up to, say, number
402. But then Senator Leahy would remember that his postcard might not
reach Senator Hatch. At this point, both Senators would conclude that
Senator Hatch will have to have some kind of time-out, after which he
would begin sending copies of postcards that had not been acknowledged,
until he receives confirming postcards from Senator Leahy. Finally,
Senator Leahy would remind Senator Hatch that his mailbox can hold only
a finite number of postcards. If the book Senator Hatch wants to send
turns into 1000 postcards but Senator Leahy's mailbox can only hold 200
at a time, both Senators might conclude that if by a miracle, the US
Post Office actually delivered all 1000 postcards at the same time,
some of them might get lost if they didn't fit into Senator Leahy's
mailbox. This would lead them to conclude that they should agree that
Senator Hatch won't send more than 200 postcards at a time and would
not have more than that ``outstanding'' until Senator Leahy has
confirmed their receipt.
Well, in principle, that is the way the TCP protocol turns the
simpler Internet Protocol into a reliable, sequenced and flow-
controlled service. This isn't quite the way in which Bob Kahn and I
developed the TCP but it isn't very far away from the basic reasoning!
At this point, it is possible to explain how the FBI`s Carnivore
observation system makes use of the Internet and to outline the
limitations of its operation. In this brief exposition, I will assume
that the Senate Judiciary Committee members are well-acquainted with
the legal basis on which the FBI occasionally is granted permission to
intercept domestic communications in the course of enforcing the laws
of the United States. As I understand the law, such surveillance is
carried out only after the conduct of judicial proceedings intended to
assure that any such surveillance is documented and justified. In the
past, such surveillance has been associated with the interception of
telephone-based communications but just like the rest of the citizens
of the United States, law-breakers are making increasing use of
electronic mail and other kinds of Internet-based communication,
including such things as chat rooms, in the conduct of their
activities.
The FBI, in recognition of this trend, has developed new methods of
observing computer-based communications and one such system has been
named ``Carnivore.''
To understand what Carnivore is and how it works, we need to take
one more foray into the world of analogies. I mentioned earlier that
the Internet architecture is ``layered''--that is, it consists of a
number of different protocols each one layered on top of the other and
each layer relying on the one below it for certain functions. For
example, the Internet Protocol layer that performs the forwarding of
packets relies on the lower levels to actually transport the bits of
information that make up each packet. The TCP layer relies on the
Internet Protocol to deliver packets, and TCP makes sure they are put
back in order and retransmitted if any are lost. The electronic mail
service has its own protocol (called Simple Mail Transport Protocol or
SMTP) and that service makes use of TCP. It turns email messages into
TCP streams of data that are broken up into Internet packets and sent
by varying paths toward the destination where the packets are
reassembled first into a sequenced stream of information by TCP and
parsed into messages again by the SMTP.
The layered architecture is mirrored in the implementation of the
software that uses the protocols. The email client software that is
used to compose email produces the text of messages that look something
like:
Date: Tue, 05 Sep 2000 19:27:05 +0100
From:
Subject: Thank you
To:
Dear Sir,
I would like to thank you for the very useful information that you
included in reply to my request.
Sharon Bell
This text is to be sent to the electronic mail box of user
Vinton.G.Cerf on the computer on the Internet that has the ``domain
name'' wcom.com (``To: [email protected]''). However, the email
composition program knows that the TCP service does not know where
computer ``wcom.com'' is on the Internet. So it ``looks up'' the name
of this computer in a distributed directory called the Domain Name
System, and discovers that the Internet address of this computer is:
204.176.69.71. You can think of this as a kind of Internet telephone
number forpurposes of this exercise.
The email composition program creates a kind of envelope that it
addresses to 204.176.69.71, puts a return address of the Internet
address of the computer that is sending the email, say 170.127.34.16,
and places the email message in the envelope. In spirit, the envelope
looks something like:
From: 170.127.34.16
To: 204.176.69.71
(Attention: For the SMTP service via the TCP program)
The TCP program takes this envelope and cuts it into pieces
(including the contents!!) and sends the pieces in smaller envelopes
that are addressed, again by analogy:
From: 170.127.34.16
To: 204.176.69.71
(Attention: for the TCP Program via the Internet Protocol)
These smaller envelopes function like the Internet Postcards that
were introduced in the earlier part of this testimony. They are sent
through the series of computers we call ``routers'' that serve in the
same fashion as post offices, to forward the traffic by potentially
different paths to the destination.
At the destination computer (``wcom.com''), the process is reversed
and the small Internet Protocol envelopes are opened, the contents
reassembled by the TCP program into a message and the result is handled
to the SMTP receiving program. That program puts the received message
away in the mailbox associated with Vinton.G.Cerf on the wcom.com
computer. Later, when user Vinton.G.Cerf runs the email reading and
composition program he will be able to see the message and to respond
to it.
The important concept to take away from these preliminary remarks
are:
1. The concept of packets (``postcards'');
2. The idea that packets do not always stay in order, may be
lost, and may even travel on distinct paths through the
Internet;
3. The understanding that there are tens of thousands of
Internet Service Providers around the world operating hundreds
of thousands of networks that make up the Internet and that
traffic may flow through a number of such networks as it flows
from source to destination; and
4. The concept of layering and the notion that each layer
``envelopes'' the information generated by the layer above and
that anyone observing traffic on a particular circuit that
carries Internet packets will actually be observing pieces of
messages (or files or bits of digitized sound) carried in the
small Internet Protocol envelopes.
The Carnivore system is a computer that tries to observe the
traffic (Internet packets) flowing on a circuit within the Internet.
Its objective is to try to find only those packets that may be relevant
to an ongoing investigation and to ignore theirs (both for legal
reasons and simply to deal with the potentially enormous flow of
traffic that may require filtering). It's a bit like trying to find a
particular shrimp in the intake of a baleen whale!
The physical location of the Carnivore computer is important. If it
is observing traffic somewhere in the middle of the Internet, it may
not even see all the packets that correspond to a particular exchange
between computers or even a complete transmission from one computer to
another. One could try to place Carnivore computers at different
locations in the Internet, hoping to catch all the requisite traffic
but in fact, the only way to achieve reasonable success is to locate
the Carnivore computer so it can observe all the traffic going to and
from the computer under observation. That may mean locating the
Carnivore computer where it can see everything going into and out of
the location of the subject of surveillance, watching all traffic going
to and from the subject's laptop or desktop, or locating the Carnivore
computer at the Internet Service Provider who serves that subject and
placing it in such a way that the traffic going to and from the
subject's email server computer can be observed.
Furthermove, since the Carnivore looks at each individual Internet
packet and does not perform reassembly of the packets in real time,
there are some limits to what the software can do to recognize relevant
traffic. It can plainly see the ``to:'' and ``from'' Internet address
of the Internet packets (e.g., 170.127.34.16). It may not be able to
see the ``To: [email protected]'' in every packet because this is
NOT contained in every Internet packet. One has to reassemble the
massage at the SMTP level of protocol (two layers above the Internet
Protocol) to be assured of seeing this. But this may require that all
the packets or most of the Internet packers carrying the email be
intercepted and this may or may not be assured, depending on the rate
at which these Internet packets must be examined by Carnivore and
whether most of the packets are actually present on the circuit being
monitored.
The Carnivore operators have the ability to be very precise about
which Internet addresses are of interest and can ignore all other
traffic. They can tell which protocols are being carried in these
Internet packets (TCP, among others, including steaming protocols based
on the so-called User Datagram Protocol). If the contents of the IP
packers are NOT encrypted they will be able to see for what layer of
protocol above TCP or UDP the traffic is intended so they could
distinguish email (SMTP) from file transfer (FTP) from World Wide Web
traffic (HTTP).
If the contents of the TCP traffic is encrypted, as it often is
with the World Wide Web for financial transactions, it is not possible
in real time for the Carnivore system to see any deeper into the
traffic than to know that it is World Wide Web traffic. The encryption
is often quite robust, using up to 128 bit keys and strong
cryptographic codes.
Some of the more recent standards for security for the Internet
even introduce cryptography at the level of the Internet Packet so that
it contents are encrypted end to end. Both the current version 4 IP
protocol and the more recent version 6IP protocol have provisions for
such encryption using the so-called IPSEC standard.
The Carnivore system has been configured so that it is possible to
limit the amount of information retrieved from any particular packet so
that, for example, the only information that might be collected is the
source or designation address of the Internet packet and none of the
content. It is may understanding that the Carnivore implements have
gone to considerable length to build in mechanisms to restrict traffic
capture to conform to the limitations that any particular court-
approved surveillance may impose.
In summary, the Carnivore system is fairly basic system that must
do itswork by observing single packets of traffic at a time and attempt
to determine based on a limited set of parameters whether this packet
is relevant to the desired surveillance. It is not a system that is
capable of observing all the traffic flowing through the Internet at
once nor even all the traffic flowing through any one reasonably-sized
Internet Service Provider's system.
It is also important to note that this system is not unlike
commercially available tools that help network operators debug problems
in the network by analyzing the protocols that are in use and observing
the states that these protocols go through in the course of an
interaction. These protocol analyzers generally do not capture packet
contents but rather work their way up through the ``envelopes'' to
understand the sequences of events that may be causing a problem for
the users or operators of a particular ISP or a collection of them.
Readers of this testimony should remember that reasoning by analogy
can sometimes lead to incorrect conclusions. I hope the use of analogy
has been educational and not misleading, but precision answers about
Carnivore should be sought from the engineers who have designed it, and
not drawn solely on the basis of the analogies I have tried to use to
explain the concepts behind its operation.
Thank you.
The Chairman. Thank you, Mr. Cerf.
Professor O'Neill, we will turn to you.
STATEMENT OF MICHAEL O'NEILL
Mr. O'Neill. Chairman Hatch, Senator Leahy, I welcome this
opportunity to testify regarding a topic that should obviously
be of great interest to us all, and that is, namely, the
appropriate way in which law enforcement interests should be
balanced against what Justice Douglas once called our
fundamental right to be left alone.
I think I would also like to just take a second and just
thank Mr. Cerf, as well, for helping to design something that
has helped break the grip that TV formerly held on my life.
I do not wish to belabor points that have already been
made, nor am I here to make claims that Carnivore is going to
eat the Constitution or that if we fail to deploy it that crime
will somehow run rampant. I think it is safe to say that none
of us in this room likely wishes to live in a police state, nor
do we particularly wish to live in a state of anarchy either.
We live now in a time of profound technological change, and
the communications revolution has been a part of that change.
Change, however, is not without its costs. Privacy, one of the
fundamental rights underpinning our society, is presently under
assault as perhaps never before, and not only by the
government, but also by business interests.
On the other side of the equation, however, criminal
enterprises have been increasingly willing to utilize
technological innovations to achieve their own ends and thereby
threaten our personal security. While we may stand at the brink
of a new world in terms of information, however, we still have
old rules, rules that have served to guide us well for over 200
years and that will continue to serve as a guide for us for our
understanding and ultimately controlling the many technological
transformations surrounding us.
With that in mind, I would like to address two fundamental
issues. One, is Carnivore, at least as I understand the
software to operate, compatible with the requirements of the
Fourth Amendment? And, two, what role should Congress play in
ensuring that both significant privacy and security interests
are addressed?
Our Constitution presupposes that, as citizens, we enjoy a
sphere of action free from governmental interference. To this
end, the Drafters of the Bill of Rights had the foresight to
include as a fundamental guarantee to protect the right of the
people in their persons, houses, papers and effects against
unreasonable searches and seizures. The term ``unreasonable''
is really key here. We are protected, at least from the
government, only against those searches that are per se
unreasonable.
The fourth amendment's reasonableness requirement has an
important application to today's debate; namely, after all,
what is deemed unreasonable is entirely and ultimately a social
construct. It is, at the end of the day, for the people to
decide what is and is not a reasonable intrusion into their
private affairs.
The difficulty I have in coming before you today is that I
am not at all confident that I know what is reasonable in this
particular context. If polled, most individuals, I suspect,
would assume and likely prefer that their e-mails be every bit
as secure, if not more so, than standard snail mail.
The evolution of the privacy/security struggle has been
well defined in the development of fourth amendment law. In
Olmstead v. United States, a 1928 case that was sort of the
harbinger of the wiretap and ultimately the electronic
surveillance revolution, the Supreme Court considered whether
warrantless wiretapping violated the fourth amendment. The
Court found ultimately no constitutional violation because
surveillance was accomplished without intruding upon the
defendant's physical property.
Justice Brandeis, however, penned a thoughtful dissent in
which he observed that constitutional principles were
undermined to the extent that the Court focused exclusively on
the means of communication. He reasoned that the Constitution
must be interpreted with technological advancements in mind to
preserve fundamental rights and liberties.
Foreshadowing those advancements, he warned that, quote,
``Discovery and invention have made it possible for the
Government, by means far more effective than stretching upon
the rack, to obtain disclosure in court of what is whispered at
in the closet.''
Now, the Court ultimately adopted Justice Brandeis' view
toward wiretapping. In Katz v. United States, it declared that
the Fourth Amendment protects people, not places, and held
wiretapping permissible only after the issuance of a valid
warrant. This decision expressly overruled Olmstead, replacing
the previous focus on the means of the communication with an
appreciation for the fact that the communication itself was the
source of the constitutional right.
The Court subsequently revisited this area in Maryland v.
Smith, a 1979 case that you have heard the executive branch
relied upon to justify its claim that there is no expectation
of privacy in an Internet address. In Smith, however, the Court
reasoned that there is no legitimate expectation of privacy in
a number being dialed on a telephone.
It is important to understand, however, that the Court
found that individuals do not have this expectation of privacy
because pen registers themselves do not acquire the contents of
communications. The technology in question was limited to this
single function. This neat categorization, however, may not
apply to technologies such as Carnivore which may have far
greater information-gathering abilities.
A URL, for example, can disclose specific pages visited,
sites visited, or even items that have been purchased or
browsed on the Internet. And as people move more of their lives
online, a list of e-mails sent or Web sites visited can provide
a very detailed dossier of activities, all available without
the heightened standards of a wiretap or even a regular fourth
amendment warrant. This is far more akin to walking into
somebody's office and snooping around in their file cabinet
than it is to standing on the street corner and writing down
their physical address.
Given the wealth of information obtainable by means of an
Internet address, perhaps it is time to rethink our privacy
expectations online. Indeed, I think it is increasingly
difficult to say that you don't have an expectation of privacy
in information that is in the hands of a third party. If the
vision of an open, PC-less Internet world is to come to pass,
it will be the case that much of our lives will be in the hands
of third parties.
Indeed, currently I do all of my banking and manage my
meager stock portfolio all on the Internet. All of this
information is contained online. To simply treat the ``to'' and
``from'' lines in e-mails as though they were the phone numbers
that you dial out on just doesn't make sense anymore.
Moreover, the physical ease with which information is
obtained becomes important. Ordinarily, a search is limited by
a number of physical properties. You have to be on site, you
have certain time limitations. Internet searches, however, make
the retrieval of vital data, even otherwise public data, far
more routine. For example, while property tax assessment
records are public, people generally had to take the time and
hassle to schlep on down to the court house to retrieve them.
In a matter of minutes, however, just the other night I was
able to retrieve fairly easily Chairman Hatch's property tax
records. And basically now I know what the value of his current
assessed land is. I know how many bedrooms he has in his house.
The Chairman. I wouldn't mind knowing that myself.
[Laughter.]
Mr. O'Neill. Well, sir, I would be happy afterwards--I
won't submit this for the record, but I will be happy to give
it to you after we have finished.
Now, again, that is public information, information that is
always obtainable at the court house. But the mere fact that
late last night, in a process of about, I don't know, maybe
half a dozen keystrokes and a matter of about five minutes or
so I could obtain all this information, should give us at least
some cause for pause about what we are getting ourselves into.
Mr. Cerf. You are not making a threat, are you?
Mr. O'Neill. Oh, not at all.
Mr. Cerf. OK; I am just checking.
Mr. O'Neill. I used to work for him, so I felt it was okay.
Mr. Cerf. OK.
Mr. O'Neill. But I did the same thing for Senator Leahy as
well.
Senator Leahy. I was thinking. I mentioned to the chairman
that he must have paid you too much if you have got a stock
portfolio.
Mr. O'Neill. Senator, I was smart; I married a doctor.
The Chairman. That is a typical Democrat comment--failing
to recognize the importance of the Internet and all of these
other great programs that we have.
Senator Leahy. We Democrats try to keep down the cost of
Government. That is why.
The Chairman. We hadn't noticed that. [Laughter.]
Mr. O'Neill. I will try to remain silent on that issue.
Similarly, I think another problem that we have to address
is we don't even know how certain Fourth Amendment doctrines
will apply in this field and to a device like Carnivore which,
although it may have physical limitations and may, in fact, be
limited in its application, may be configured or updated in
ways that we are not necessarily aware of. It may have the
potential of reading e-mail or looking at other addresses that
people visit.
The plain view doctrine, for example, permits, among other
things, law enforcement officers to seize items in their plain
view when they are executing a warrant. Well, if we allow law
enforcement to filter nonspecific pieces of mail, does that
mean that they can seize anything else that they may happen to
find of a criminal nature which is not necessarily contained
within the plain language of the warrant? These are among the
fundamental issues that we will ultimately need to address as
the law struggles to cope with technological advancements.
Now, I don't want to go too far over the red light here,
but I have ten fairly specific recommendations that I would
consider that perhaps Congress ought to consider in terms of
deciding and securing our privacy online. I will actually
submit those for the record and I won't belabor those points
now.
But I think that this hearing is an important first step in
looking at these important privacy issues as they come before
us, and one simple suggestion that I might make is that
government, specifically the Congress of the United States,
should set itself up as the primary protector of people's
liberty and security interests. And it is not a bad idea at
all, I think, either to place within the Intelligence Committee
or perhaps one of the other committees of jurisdiction careful
congressional oversight of precisely the types of information
and the sources of information that the Department of Justice
is seeking to obtain when it does things such as Carnivore to
search out people's private information.
But, again, I will submit those and the remainder of my
remarks for the record. I again thank you for this opportunity
to testify and look forward to answering any questions you may
have later.
The Chairman. Well, thank you, professor. I think the FBI
and Justice are going to want to look at your ten suggestions
those fairly carefully because there are some very interesting
suggestions there.
[The prepared statement of Mr. O'Neill follows:]
Prepared Statement of Michael O'Neill
Chairman Hatch, Senator Leahy, and members of the Committee, I
welcome this opportunity to testify regarding a topic that should be of
great interest to us all, namely the appropriate way in which law
enforcement interests should be balanced against what Justice Douglas
once called our fundamental right ``to left alone.'' [U.S. v. Davis,
328 U.S. 582 (1946).
I do not wish to belabor points that have already been made. Nor am
I here to make claims that Carnivore will eat the Constitution, or that
if we fail to deploy it, crime will run rampant. I think it is safe to
say that none of us in this room likely wishes to live in a police
state, nor, however, do we desire to live in a state of anarchy.
We live in a time of profound technological change, and the
communications revolution has been a vital part of that change. Change,
however, is not without its costs. Privacy, one of the fundamental
rights underpinning our society, is presently under assault as perhaps
never before. On the other side of the equation, however, criminal
enterprises have been increasingly willing to utilize technological
innovations to achieve their own ends and thereby threaten our personal
security.
While we may stand at the brink of a new world in terms of
information, however, we still have old rules, rules that have served
us well for over 200 years, and that continue to serve as a guide to
understanding, and controlling, the transformations surrounding us.
With that in mind, I would like to address two fundamental issues:
(1) is Carnivore, at least as I understand the software to operate,
compatible with the Fourth Amendment? And (2) What role should Congress
play in ensuring that both significant privacy and security concerns
are addressed?
Our constitution presupposes that as citizens, we enjoy a sphere of
action free from governmental interference. to this end, Drafters of
theBill of Rights had the foresight to include as a fundamental
guarantee to protect ``the right of the people * * * in their persons,
houses, papers, and effects, against unreasonable, searches and
seizures.'' The term ``unreasonable'' is the key here * * * we are only
protected against those searches that are unreasonable. The Fourth
Amendment's reasonableness requirement has an important application to
today's debate. After all, what is deemed ``unreasonable'' is
ultimately a social construct * * * it is at the end of the day for the
people to decide what is and is not a reasonable intrusion into their
private affairs.
The difficulty I have in coming before you today is that I am not
at all confident that I know what is ``reasonable'' in this particular
context. If polled, most individuals, I suspect, would assume, and
likely prefer, that their e-mails be every bit as secure, if not more
so, than their snail mail.
The evolution of the privacy/security struggle has been well-
defined in the development of Fourth Amendment law. In Olmstead v.
United States (1928), the Supreme Court considered whether warrantless
wiretapping violated the Fourth Amendment. The Court found no
constitutional violation because the surveillance was accomplished
without intruding on the defendant's physical property. Justice
Brandeis, however, penned a thoughtful dissent in which he observed
that constitutional principles were undermined to the extent the Court
focused exclusively on the means of communication. He reasoned that the
Constitution must be interpreted with technological advancements in
mind to preserve fundamental rights. Foreshadowing those advancements,
he warned that: ``Discovery and invention have made it possible for the
Government, by means far more effective than stretching upon the rack,
to obtain disclosure in court of what is whispered in the closet.''
The Court ultimately adopted Justice Brandeis' view toward
wiretapping. In Katz v. United States, it declared that the Fourth
Amendment ``protects people, not places'' and held wiretapping
permissible only after the issuance of a valid warrant. This decision
expressly overruled Olmstead, replacing the previous focus on the means
of communication with an appreciation of the fact of communication as
the source of the constitutional right.
The Court subsequently revisited this area in Maryland v. Smith
(1979), a case the executive branch has often relied upon to justify
its claim that there is no expectation of privacy in an internet
address. In Smith, the Court reasoned that there is no legitimate
expectation of privacy in a number being dialed on the phone. It is
important to understand, however, that the Court found that individuals
do not have a reasonable expectation of privacy in such information
because ``pen registers do not acquire the contents of communications.
Smith v. Maryland, 442 U.S. 735, 742 (1979). The technology in question
was limited to this single function. This neat categorization may not
apply to technologies such as Carnivore, however, which may have far
greater information gathering abilities.
An URL, for example, can disclose specific pages visited, sites
visited, or even items purchased or browsed. And as people move more of
their lives online, a list of e-mails sent or web sites visited can
provide a very detailed dossier of activities--all available without
the heightened protections of a wiretap or even a standard Fourth
Amendment warrant. This is much more akin to walking into someone's
office and snooping around in their file cabinet than it is to standing
on the street corner and writing down their address. Given the wealth
of information obtainable by means of an internet address, perhaps it
is time to re-think our privacy expectations on-line. Indeed, I think
it is increasingly difficult to say that you don't have an expectation
of privacy in information that is in the hands of a third party. If the
vision of an open, pc-less internet world is to come to pass, it will
be the case that our entire lives will be in the hands of third
parties. To treat the ``To'' and ``From'' lines in e-mails as though
they were just the same as the phone numbers that you dial makes little
sense.
Moreover, the physical ease with which information is obtained
becomes more important. Ordinarily, a search is limited by a number of
physical properties. Internet ``searches,'' however, make the retrieval
of vital data, even otherwise public data, far more routine. For
example, while property tax assessment records are public, people
generally had to take the time, and hassle, to go to a court house to
retrieve them. In a matter of minutes, however, I was able to easily
retrieve [hold up records] Chairman Hatch's property tax data. Don't
worry, I won't disclose it * * * but I do know how many bedrooms,
bathrooms, and fireplaces you have in your home * * *!
Similarly, we don't know exactly how certain Fourth Amendment
doctrines will apply to a device, such as Carnivore, that has the
potential of reading personal e-mail, as well as, via the internet
address, entering the individual's hard drive and scoping it out. The
plain view doctrine, for example, permits (among other things) law
enforcement officers to seize items in their ``plain view'' when they
are executing a warrant. Well, if we allow law enforcement to filter
non-specific pieces of mail, does that mean they can seize anything
they happen to find? These are among the fundamental issues that will
need to be addressed as the law struggles to cope with technological
advancements.
what questions ought congress be asking?
Law enforcement has pointed out that the law must be changed to
preserve its mission to prevent and punish crime, while the civil
liberties community has warned of grave dangers to personal privacy and
the Fourth Amendment. Although each group may emphasize different
aspects of the problem, each agrees that the law must be updated to
keep pace with technological change. Remarkably, the 1986 Electronic
Communications Privacy Act was the last significant update to the
privacy standards of the electronic surveillance laws. Significant
changes have occurred since then, including--the development of the
Internet; data convergence; the creation of wireless systems; and the
movement of information out of people's homes and offices onto networks
controlled by third parties. As a result of these developments, more
information is being held and communicated in configurations where it
is in the hands of third parties and not afforded the full protections
of the Fourth Amendment.
The following steps might therefore be in order.
(1) With respect to Carnivore itself, Congress ought to obtain
briefings, classified, if necessary, to get a better understanding of
what Carnivore is designed to do and how it does it, and whether there
exists potential for abuse.
(2) Congress ought to determine what the statutory authorization
for Carnivore is and whether law enforcement has the authority to
insist that a service provider install Carnivore.
(3) If implemented in some fashion, Congress should require that
statistics be maintained by the Justice Department, and that these so-
called ``audit trails'' be routinely provided for legislative
oversight.
(4) Congress should seek to learn whether Carnivore can easily be
defeated by encryption software or E.A. Poe type purloined letter
schemes.
More broadly,
(5) Hearings out to be conducted to determine whether all internet
trap and trace orders should be issued only on the basis of a judicial
finding that reasonable cause exists to believe that a target has or is
about to commit a crime;
(6) The executive branch ought to be required to provide consumers
with notice whenever the government obtains information about their
Internet transactions;
(7) Specific statistical reports for Internet trap orders similar
to the reports required under Title III ought to be require;
(8) Congress should explicitly provide that Internet queries, e-
mail subject lines, URL's of sites visited and other information which
provides more than the equivalent of a dialed number cannot be
disclosed without a probably cause order.
(9) Congress should consider requiring notice and an opportunity
for defendants to object when civil subpoenas seek personal information
about Internet usage.
(10) Finally, Congress ought to provide enhanced protection for
information on networks: including the establishment of probably cause
for seizure without prior notice, and providing a meaningful
opportunity to object to subpoena access.
At bottom, I would urge a cautious, thoughtful approach when it
comes to expanding surveillance capabilities. The conflict between
increased security and enhanced privacy protection is not easily
resolvable, nor will it likely ever be. But Congress ought to seize the
moment to ensure that robust debate occurs before law enforcement's
powers are enhanced, and regardless of how the balance is struck.
The Chairman. Mr. Dempsey, we will turn to you.
STATEMENT OF JAMES X. DEMPSEY
Mr. Dempsey. Mr. Chairman, Senator Leahy, good morning.
Thank you again for holding this hearing and for giving me the
opportunity to testify. I am at a certain point, I think, going
to use just one overhead, if I could, but in order not to delay
things I will talk while they are setting up the projector.
I think I wanted to start out by responding to one of the
points that the FBI and the Justice Department make which they
regularly make and I think which needs to be regularly rebutted
or balanced, and that is the point about the use of the
Internet by criminals.
Undoubtedly, criminals do use the Internet, but I think if
you look at the facts over the past two or three years, it is
clear that the Justice Department and the FBI have been
extremely successful in using the new technology to track
criminals online and to make cases, including some cases that
they probably couldn't have made in the offline environment.
Online surveillance and tracking led to the arrest of the
Phonemasters, who were stealing and selling credit card numbers
worldwide; Solar Sunrise culprits, one of whom was tracked down
to Israel; an intruder on NASA computers who was arrested and
prosecuted in Canada; the thieves who broke into the Citibank
computers and who were tracked and arrested in Russia; Ardita,
who was tracked down electronically to Argentina; the creator
of the Melissa virus. All of these people were tracked online
using this very technology.
Innocent Images is another example of where FBI agents are
able to pretend online to be young girls or to be pedophiles
and to legally entrap people. In the Emulex case that you
referred to, Mr. Chairman, investigators said that they learned
within hours of the stock's plunge where the computer was
located that the perpetrator had used, and they obviously have
arrested that person.
Back in August, two Kazhaks were arrested in a cyber
extortion case. Their communications went from Kazhakstan to
London and to the target in New York, which was Bloomberg. Yet,
they were traced back using this very technology, and in
response to that Bloomberg pointed out these arrests show that
our law enforcement agencies can find, catch, and bring
criminals to justice online. Criminals believe that they have a
totally anonymous presence on the Internet. They believe that
they can intimidate companies. This operation shows that they
do not have that kind of anonymity.
So I think we need to recognize--and Professor O'Neill in
his online search showed us how easy it is to find so much
information. And I think, if anything, what we need to do is to
not abandon the traditional rules that we have had to protect
privacy but, in fact, to strengthen those rules in the face of
the surveillance and investigative power of this new
technology.
Now, turning specifically to Carnivore, the first problem
that we have with Carnivore is that we don't know really what
it is and how it works. It is something that is now totally
controlled by the FBI. It is a black box. They have refused to
share publicly the details of that, and they have put out a
request for proposal to conduct an independent review, which is
a good idea even if it were conducted outside of the public
light.
But the FBI and the Justice Department have set out for
this independent review so many restrictions and they have put
such burdens on anybody who would sign up to do that, such
secrecy burdens, that a lot of the good people are backing out
of that, are backing out, it seems, from competing for that.
And it does call into question, with the kinds of restrictions
the FBI has set, whether they will be able to get the best
people to do that review.
Today, in USA Today Online, there is a story by Will Roger
in which he states that MIT, Purdue University, Dartmouth, the
University of Michigan, and the Super Computer Center at the
University of California at San Diego have all indicated their
reluctance to participate in that review, given the constraints
that the FBI has posed in terms of pre-review, and so on.
The second issue I would like to emphasize is that
Carnivore is fundamentally inconsistent with the way that
wiretaps have been done in the past, and fundamentally
inconsistent with the understandings of this committee
repeatedly over the years.
Traditionally, we have not allowed the FBI into the
networks, into the switching systems and into the property of
ISP's. A major, major problem with Carnivore, and I think a lot
of the source for the concern about it, is that it is a black
box that the FBI imposes on the ISP.
Now, this committee in 1986, when it was adopting ECPA--and
Senator Leahy was the prime author of that legislation in the
Senate--this committee in its report on ECPA emphasized
telephone company customers have a reasonable expectation,
traditionally enhanced by telephone company practice and
policies, that their company will not become, in effect, a
branch of government law enforcement.
The committee went on to say that they understand that the
practice has been that the telephone company premises are not
used for wiretap activity. And the committee actually
directed--I don't know if it happened--the Justice Department
in its wiretap manual to state that there would be a statement
there in the manual that U.S. attorneys should not attempt to
compel any company to make its premises available for wiretap
activity.
And the committee in 1986 asked for notification if there
was a change in that policy and if the Justice Department did
decide to try to compel carriers to make their premises
available and what is Carnivore to basically latch this
software and hardware into the network.
Again, in CALEA, in 1994, this committee reemphasized that,
and there is section 105 in CALEA which specifically says that
telephone companies--CALEA does not apply to the ISP's, but it
is the principle here that the committee cared about quite
strongly. CALEA says that a telecommunications service provider
shall design its system so that a wiretap is activated within
the switching premises and controlled by telephone company
personnel, not by law enforcement personnel, precisely because
this committee was concerned about the problem of remote FBI
access to the actual guts of the network of a service provider.
I think a lot of the concerns that people have with
Carnivore would be mitigated if the software and the ability to
control the software were placed in the hands of the service
providers rather than held and controlled by the FBI.
Now, I wanted to talk a little bit about the way----
The Chairman. How can you trust the service providersany
more than you trust the FBI?
Mr. Dempsey. Well, I think what we have to do is we have to
have a system of checks and balances; that is, we have to have
some buffer or barrier between the customer and the Government.
The Chairman. It is one thing for the telephone companies
to have control over how the transmission is made. It is
another thing to have the ISP's--who have tremendous software
capabilities themselves in control of the transmissions.
Mr. Dempsey. Well, many of the ISP's already perform and
comply with court orders, as Dr. Kerr made clear. Many ISP's do
not need Carnivore, do not accept Carnivore, and do comply on
their own with the court orders.
Mr. Cerf. May I? I have just two comments to make. One
observation is that the Carnivore equipment is a passive
device. In other words, it doesn't actively enter into the
control stream or anything like that. It simply taps
information. In fact, as was pointed out by the FBI, it is
prohibited technically from transmitting anything into the Net.
So in that sense, that is helpful because it is passive.
I would certainly debate the advisability of having the ISP
personnel setting the parameters and managing the capture of e-
mail-related information. In fact, I would be more concerned
about----
The Chairman. I think it is a different situation than
phone companies.
Mr. Cerf. Sir?
The Chairman. I think it is a different situation than
phone companies--much broader.
Mr. Cerf. Well, even going and setting parameters, let
alone inventing software, the side effect of having the ISP
personnel do that is that you may not get protection of the
evidence in the evidentiary chain. You may get exposures of
information that are not legal. The FBI operators are well
aware of those restrictions, but the ISP operators are probably
not.
So I am not sure that I would be as comfortable as you
sound like.
Mr. Dempsey. We have headed pretty far down the road in
allowing ISP's who can perform to do so. Of course, the FBI can
go back and say you didn't give us everything that we wanted,
and that process can go forward.
In the telephone realm, the way we are heading in CALEA is
that it will be an intercept function that is activated by
carrier, pursuant to an order----
The Chairman. Yes, but collected by the FBI.
Mr. Dempsey [continuing]. To isolate and identify what is
the stream of communications. In the Internet, it is harder
because we do not have a circuit-switched system.
Mr. Cerf. You actually have to work your way up in those
layers of protocol in order to see what is going on. In fact,
the simple analogy here, these little letters, is that if you
watch a stream going from a customer's personal computer going
into or coming from the Internet, it could contain a variety of
information all at the same time. There could be some voice
communication, there could be video, there could be e-mail,
there could be a World Wide Web exchange, all of this happening
at once. And the stream of packets going by in these little
envelopes have to be opened up and examined in order to figure
out which one is it.
The Chairman. One of the questions I am going to have is
how does the FBI protect this information from the ISP
collecting it? That is a question that I think----
Senator Leahy. But the ISP could look at it any time they
wanted anyway.
The Chairman. Yes, but they may not know what they are
looking for, where the FBI knows what they are looking for.
Mr. Cerf. In order for the ISP to perform the same function
that the Carnivore system does, they would have to essentially
build the same kind of software that the FBI is using and
configure it to capture the portion of the stream that is of
interest. In a sense, they would have to reproduce all of the
technology that goes into Carnivore.
There are systems like that. They are called sniffers, but
they are not as sophisticated, in fact, at restricting the
information that is captured. Moreover, there are none of the
safeguards that the Carnivore system has for keeping track of
who did what.
Senator Leahy. Well, are you saying by that then that no
ISP system today, whether they have sniffers or not, can match
Carnivore? And if so, does that mean the FBI are going to have
to say, well, we have always got to use our own system because
you are not good enough?
Mr. Cerf. What I am saying is that the devices that are
available that are used to help debug problems on the network
that will allow you to crawl up and down in the so-called
layers can capture everything. The problem is that that is not
what the FBI wants to do. What it wants to do is to capture
only that part that is----
Senator Leahy. But that goes, then, to my particular point.
Are you saying that nobody today can duplicate what the FBI is
doing? Thus, the FBI whenever they have one of these court
orders is going to have to use their own?
I see Ms. Stansell-Gamm shaking her head no, but I just----
Mr. Cerf. What I am trying to say is that the technology
exists to capture information off the Net. An ISP has that
capability because these are off-the-shelf devices. The
implementation of Carnivore is intended to constrain the way
that capture is done and the ISP doesn't have the particular
motivation to go and do that, to invest in all that.
The Chairman. They don't have the same interests as the
FBI. They are not going to be doing that.
Mr. Cerf. That is correct.
The Chairman. Well, let me finish with Mr. Dempsey and then
go to Professor Rosen.
Mr. Cerf. I am sorry I interrupted you.
Mr. Dempsey. If I could, to round out this dialog, I think
that there is an answer to the dilemma here, and that is to
take the Carnivore software and make it available to the ISP's
so that they know what it is, know how it works. They can
configure it, they can set the parameters as ordered by the
court order. And then you do have that protection in the middle
that you don't have the FBI, in essence, taking control of a
part of a network or inserting itself into the network. I think
that a lot of the concerns about Carnivore would be mitigated
if this software technology were disclosed and made available
to ISPs.
The Chairman. Well, let's go to Professor Rosen, but I have
a lot of problems with that because then you have a nonlaw
enforcement agency--a private company--being able to do
whatever they want to do with people's knowledge andpeople's
information.
You have made some interesting suggestions. I want to
really look at those because I don't know what the answer is
here. All I can say is that I don't want to have 1984 in 2004,
but we are already there. With nanotechnology coming up now--if
you read Kurtzweil's book--it is enough to scare the living
daylights out of every one of us. And if you read Bill Joy's
article, I mean, my gosh, it is mind-boggling.
Senator Leahy. But, Orrin, they can do this now.
The Chairman. Yes, I know.
Senator Leahy. The ISP's can do this now anyway.
The Chairman. They can do it now anyway.
Senator Leahy. They can step through and get most of this
now. They might have a different reason, a different purpose,
but they can do it.
The Chairman. But they don't need to have the assistance of
the FBI to do it.
Mr. Dempsey. If I could, Mr. Chairman, just before you go
to Professor Rosen--and we can go back to this later in the
questions--I just wanted to lay out two other areas that I
think merit discussion here, one of which is the question of
whether Carnivore constitutes a search for fourth amendment
purposes and an interception for title III purposes. I believe
that, at least as the FBI has explained it on their Website,
Carnivore does constitute a search and seizure for
constitutional purposes and an interception for title III
purposes.
Finally, I would just like to say that once again we are
back to the question of how do you translate the wiretap laws
to the Internet. And Professor O'Neill, I think, referred to
this quite well, but by developing Carnivore and by controlling
and programming Carnivore and putting it out there, the FBI has
basically decided that question technologically by saying that
Carnivore can collect, under a pen register order, e-mail
``to'' and ``from'' addresses and other Internet addressing and
routing information without ever finishing a debate which we
started back here, I think, in May before this committee, which
is the question of what should be the legal standards for
application of pen registers to this very different medium of
the Internet.
So with that, I will conclude. Thank you, Mr. Chairman.
[The prepared statement and attachments of Mr. Dempsey
follow:]
Prepared Statement of James X. Dempsey
Mr. Chairman, and members of the Committee, thank you for calling
this hearing and giving CDT* the opportunity to testify on the FBI's
``Carnivore'' initiative and its implications for Fourth Amendment
privacy protections in the digital age.
---------------------------------------------------------------------------
* The Center for Democracy and Technology is a non-profit, public
interest organization dedicated to promoting civil liberties and
democratic value on the Internet. Our core goals include ensuring that
the Constitution's protections extend to the Internet and other new
media. CDT also coordinates the Digital Privacy and Security Working
Group (DPSWG) a forum for more than 50 computer, communications, and
public interest organizations, companies, and associations working on
information privacy and security issue.
---------------------------------------------------------------------------
Summary
We can all appreciate that new communications technologies pose
challenges to law enforcement agencies carrying out important duties.
But as a black box controlled by the FBI and inserted into the network
of an Internet service provider to search through thousands or millions
of messages, including those of innocent people, Carnivore is not the
right solution. It is not consistent with the way that electronic
surveillance was conducted in the past. It is not consistent with the
Fourth Amendment nor with the Supreme Court's image in the Katz and
Berger decisions of how electronic surveillance could permissibly be
conducted. It is not consistent with the federal wiretap statute, Title
III. And it is not consistent with CALEA. The FBI has to find a better
way to conduct surveillance of Internet communications, one that does
not entail taking control of a portion of the network of a service
provider and that does not entail a general search through the
communications of innocent persons.
In order to moot the serious questions about Carnivore's legality,
the FBI should immediately cease insisting that it be installed outside
the control of Internet service providers (ISPs). Instead, the FBI
should immediately begin making the technology of Carnivore available--
including the source code and the right to modify it--to any ISP that
needs it to comply with a surveillance order. (Most ISPs don't need
it.) If any ISP needs to adopt Carnivore or something like it, the ISP
should control its own network, isolating and delivering to the
government only what the government is entitled to intercept, and thus
serving as a buffer between the government and the communications of
their innocent customers. This would reinstitute the kind of checks and
balances we depend on to preserve our rights.
Looking more broadly, Carnivore is the latest in a series of wake-
up calls about the perils facing personal privacy in the digital age.
Carnivore illustrates the extend to which the FBI claims the authority
to actually control the design or functioning of communications
networks.\1\ Yet the deployment of Carnivore and other design or
functional mandates for surveillance creates new and largely
unappreciated threats to the security of communications. Moreover, even
apart from FBI efforts to control the technology, it is clear that,
despite the ways in which the newer digital technologies are harder to
tap, on balance the government is acquiring far more surveillance
powers as a result of the digital revolution: Market-driven changes in
the technology and the ways we use it mean that we are generating more
electronic information than ever before about our lives and making it
available on networks and computers where it can be readily obtained by
the government. Law enforcement agencies are not loosing ground--they
are gaining surveillance and tracking capabilities by leaps and bounds.
For all of these reasons, Carnivore highlights the need for Congress to
enact greater privacy protections in the outdated statutory framework.
---------------------------------------------------------------------------
\1\ For other examples, see Neil King Jr. and David S. Cloud, Hang-
Ups: Global Phone Deals Face Scrutiny from New Source: the FBI, Wall
Street Journal, August 24, 2000, at A1. The implementation of CALEA has
been one long struggle over the FBI's insistence on dictating very
precise surveillance features to the telephone industry. See United
States Telecomm Assoc. v. FCC, No. 99-1442 (D.C. Cir Aug. 15, 2000).
---------------------------------------------------------------------------
Among the specific points we would like to make about Carnivore:
The first problem with Carnivore is that we do not know
how it works. There is little understanding of how Carnivore searches
are limited, and little chance for judicial or public oversight. Such a
situation is ripe for mistake or misuse. The government should embrace
an open source model allowing public scrutiny of Carnivore's design.
Unfortunately, the ``independent review'' promised by the Justice
Department at this point is so circumscribed and under such control of
the FBI and the Department that it holds little promise of giving
Congress, industry or the public reliable answers.
So long as Carnivore is a black box owned and controlled
by the government, its forced installation in the network of an ISP
means that, in essence, the government takes control of part of the
ISP's network. ISPs should control their own networks. Installing a
closed Carnivore system outside of ISP control introduces new risks to
the security of these networks. ISPs are in the best position to
respond to court orders in a fashion that protects user privacy.
As far as we can tell, Carnivore searches more information
than the government is legally entitled to search. Indeed, based on
current description. Carnivore, when controlled by the FBI, has to be
characterized as an unconstitutional governal search and an
interception in violation of Title III. If Carnivore is used as a pen
register under the pen register statute as currently interpreted by the
DOJ, it is likely that it searches (and intercepts, in Title III terms)
content of the target. Even worse, whether used under the pen register
order or a Title III probable cause order, it searches and intercepts
the communications of innocent persons outside the scope of any
properly issued Title III order.
Carnivore's use as a pen registers has pre-judged--in fact
has surrendered to Executive Branch discretion and ex parte legal
proceedings--the important public policy question of what data should
the government collect about Internet transactions under the weak
privacy standard of the pen register statute. Without explicit
statutory language, the Justice Department is asserting that it can use
the rubber-stamp pen register authority to collect information from the
Internet that is much more revealing than the information collected by
pen registers from telephone lines. There seems to be a growing
consensus that the low legal standard authorizing their use should be
raised for plain old telephones. But if the government is to collect on
the Internet transactional information more personally revealing than
that collected on telephone lines, then it would seem that an
intermediate standard must be developed for Internet transactional
data.
Context: Privacy and Surveillance in the Internet Age
The Internet has already demonstrated its potential to promote
democracy, spur economic growth, and enhance human development.
Individuals, civil society, businesses and governments are all rushing
to use the Internet for work, activism, education, social services,
human contact, artistic expression and consumerism. The Internet has
become a necessity in most workplaces and a fixture in most schools and
libraries. Soon, it may converge with the television and wireless
phones, and thereby become nearly ubiquitous.
Every day, Americans use the Internet to access and transfer vast
amounts of private data. Financial statements, medical records, and
information about our children--once kept on paper and secure in a home
or office--now travel through the network. Electronic mail, online
reading and shopping habits, business transactions and Web surfing can
reveal detailed profiles of people's lives. And as more and more of our
lives are conducted online and more and more personal information is
transmitted and stored electronically, the result has been a massive
increase in the amount of sensitive data available to government
investigators.
While the Justice Department frequently emphasizes the ways in
which digital technologies pose new challenges to law enforcement, the
fact is that the digital revolution has been a boon to government
surveillance and information collection. The FBI estimates that over
the next decade, given planned improvements in the digital collection
and analysis of communications, the number of wiretaps will increase
300 percent. Computer files are a rich source of evidence: In a single
case last year, the FBI seized enough computer evidence to nearly fill
the Library of Congress twice. As most people sense with growing
unease, everywhere we go on the Internet we leave digital fingerprints,
which can be tracked by marketers and government agencies alike. The
FBI in its budget request for FY 2001 sought additional funds to ``data
mine'' these public and private sources of digital information for
their intelligence value.
Wiretapping the Internet
Our legal framework for electronic surveillance was developed in an
era of circuit-switched telephone networks, where it was relatively
easy to isolate the communications of a particular target to the
exclusion of the communications of innocent persons, and where it was
relatively easy to distinguish between transactional data, which was
limited and not very revealing, and Constitutionally-protected content.
Even at the time CALEA (the Communications Assistance for Law
Enforcement Act) was adopted in 1994, the telephone system, while going
digital, was still largely based on a circuit-switched architecture,
and CALEA assumed that central telephone company switches, if loaded
with special software, would provide ready access to the communications
and call-identifying information of surveillance subjects. This
Committee, in drafting CALEA, wisely excluded the Internet from CALEA
specifically because those technical assumptions did not apply to the
packetized, decentralized Internet.
By design, the Internet's architecture is not like that of the
phone system. It is not centralized. It does not dedicate a channel or
circuit to one conversation. It does not have permanent addresses. But
surely these technological differences do not mean that we can abandon
the principles of the fourth Amendment. As the D.C. Circuit recently
made clear in the CALEA appeal, the mere fact that government agencies
are encountering a new technology does not give them the authority to
redefine the rules of interception, even where the government promises
it will not record or use the information it is not entitled to.
Instead, we must find ways to ensure that the fundamental distinctions
of the law are maintained, and where they cannot be, the government
must meet the higher, not the lower, legal standard. ``Wiretapping''
the Internet may require greater oversight and protection. If pen
registers on the Internet reveal more than the ``numbers dialed'' they
once provided for telephones, then the standard must be higher than the
standard for telephone pen registers. And we must recognize that the
government's desire to translate every current telephone surveillance
capability into the Internet world (with a kind of 100% guaranteed
success rate never really available with traditional telephone
surveillance) would require a new technical architecture for the
Internet with huge security risks.
It is in this context that the FBI's Carnivore initiative must be
viewed.
Questions about Carnivore
Carnivore reportedly serves at least two functions. Installed at an
ISP, it monitors communications on the ISP network and records messages
sent or received by a targeted user. This is presumably designed to
effectuate an electronic ``wiretap'' order served on an ISP. Carnivore
can reportedly also isolate the origin and destination of all
communications to and from a particular ISP customer. This is
presumably designed to satisfy what law enforcement claims is the
Internet equivalent of ``pen register'' and ``trap and trace'' orders,
which in the telephone context provide digits dialed and incoming phone
numbers. (Note that there are fundamental questions about what
information pen register and trap and trace orders should collect in
the Internet context.)
There are many unanswered questions about Carnivore:
How does Carnivore isolate and record only the information that the
government is legally entitled to collect under a particular wiretap or
pen register order? Carnivore has the potential to capture the content
of communications even when a pen register order would limit collection
to addressing information. Indeed, as we explain below, getting the
addressing information the government claims it is entitled to often
requires capturing and analyzing content. Does Carnivore avoid that?
Moreover, since Carnivore operates on a network link, it has the
potential to capture the traffic of customers who are not the subjects
of an order. For example, Internet Protocol (IP) addresses may be used
to identify the communications of a target. But in many systems such
addresses are dynamically allocated (meaning that the same address will
be assigned to many users sequentially, and a given user will not have
the same address from day to day or hour to hour), making it quite easy
to monitor the wrong user.
Is Carnivore itself a secure system? Can it be compromised? Does it
provide secure audit trails, and is it tamper resistant? Is it true
that Carnivore installed on an ISP's system can be remotely accessed
and reprogrammed by the FBI? If Carnivore, an eavesdropping device with
access to a vast stream of traffic independent of any ISP control, were
itself somehow compromised, the damage to privacy and security could be
tremendous.
The technical community has developed a method to improve trust in
complex systems: Open source review. Review of the source code and
design specifications by a community of experts might reveal mistakes,
bugs, or security holes unknown to the FBI. Such mistakes are quite
common in the design of complex technical systems. Open source review
of Carnivore's hardware, software, and technical design is essential to
ensuring that Carnivore does not exceed its legal authority. It would
also seem necessary for defense lawyers and judges to test in the
adversarial process the reliability of evidence it generates.
Undoubtedly, the FBI will initially argue that revealing source
code will compromise the effectiveness of Carnivore. If true, one must
question the general security and usefulness of a system that can be so
easily circumvented by anyone with knowledge of its operation.
The Department of Justice has promised to contract for an
``independent review'' of Carnivore. Unfortunately, the review has been
wrapped in conditions and controls that undermine its credibility and
seem to be discouraging the best experts from participating.Two in
particular are especially troubling: (1) The contract documents for the
review specify that the government will retain control over what
portions of the reviewers' comments are released to the public. The
government says that it will release as much as possible, consistent
with contractual obligations and ``preserving the effectiveness of
Carnivore.'' This would seem to preclude release of conclusions about
the vulnerability or effectiveness of Carnivore. Since the FBI has
claimed that its contractual obligations preclude it from disclosing
even the name of the company that built Carnivore, that could be
another huge justification for censoring the contractor's report. (2)
The implications of this are compounded by the blanket non-disclosure
agreement that contractor personnel would be required to sign, in which
they would promise not to disclose to anyone anything they learned in
the course of their review without FBI permission. Under the agreement,
sensitive information is defined as ``any and all information received
from the FBI'' and ``any and all other information associated with the
Carnivore device and system.'' This gag order would mean that persons
who now can talk about Carnivore based on their general understanding
of it would be permanently silence if they participated in the review.
In a Departure from Tradition and Best Practice, Carnivore Is Not
Controlled by ISPs
Even were there open review of Carnivore's system, installation of
a ``black box'' out of an ISP's control creates new privacy and
security risks. The parameters for how Carnivore is used once installed
are likely to be extremely important. Such parameters could control who
the targets are, how they are identified, and what information is
collected about them. Yet with Carnivore, ISPs appear to have no
control over how the system operates. Such a system provides no checks
on its use, and is an invitation for misuse or mistake. Indeed, we
understand that the FBI retains the sole right to alter how Carnivore
operates when it is in place, and that the FBI can do so remotely,
without the knowledge or cooperation of the service provider.
Carnivore is a radical departure from the way interceptions have
traditionally been performed. In the world of telephone wiretaps, phone
companies are extremely reluctant to allow law enforcement officials
into their switching facilities. In the past, and up through the
present time, telephone companies have been adamant that the would
activate any interception from within their central offices. (Companies
would allow law enforcement agents to activate intercepts from access
points on their outside plant, like neighborhood or apartment building
junction boxes, but that type of access is disappearing.) The reasons
were both privacy and security.
In 1994, Congress confirmed that this principle was an important
additional check on abuse. So section 105 of CALEA expressly provides
that wiretaps shall be activated and controlled by telephone company
personnnel:
A telecommunications service provided shall ensure that any
interception of communications or access to call-identifying
information effected within its switching premises can be
activated only in accordance with a court order or other lawful
authorization and with the affirmative intervention of an
individual officer or employee of the carrier * * * 47 U.S.C.
1004, Pub. L. 103-414, section 105.
CALEA does not apply to ISPs (and should not be extended to ISPs), but
Carnivore is a radical departure from the principle that service
providers must keep government agents out of their systems.
ISPs themselves are in the best position to comply with lawful
orders for electronic surveillance. ISPs have a dual duty, to both
produce information for law enforcement and to protect the privacy of
their customers by only revealing such information where required by
lawful order. Moreover, ISPs are in the best position to understand
their own networks and the most effective ways of complying with lawful
orders. They are also in the best position to understand potential
implications or threats from installation of a Carnivore device.
Carnivore Performs an Unconstitutional General Search and an Illegal
Intercept Under Title III
Carnivore operates very differently from an ordinary wiretap or pen
register. In the telephone world, it has always been possible to
isolate a pair of wires or a channel or circuit that is dedicated to a
targeted individual's communication. The Supreme Court's approval of
wiretapping under the Fourth Amendment was based on the understanding
that the government would be accessing only the communications on a
particularly identified line (the ``facility,'' in Title III terms).
All of the Court's concern about ensuring that on that particularly
identified line the government only intercepted communications that
involved specified criminal conduct would be rendered absurd if the
government could search the lines of many subscribers. See Berger v.
New York, 388 U.S. 41, 58-60 (1967); Katz v. United States, 389 U.S.
347, 355-56 (1967).
According to published accounts, including information on the FBI's
Web site, http://www.fbi.gov/programs/carnivore/carnlrgmap.htm,
Carnivore operates by monitoring (according to the FBI's description,
redirecting and copying) all traffic on the network link where it is
installed. Carnivore searches through all this traffic. (A copy of the
FBI's description is attached to this testimony.) In theory, Carnivore
then only records data appropriate to the order under which it
operates--i.e., data relating to the target of an order, or even
narrower information pertaining to pen register or trap and trace
orders.
Nevertheless, in Fourth Amendment terms, Carnivore, as it has been
described, is conducting a ``search'' of all the communications on the
network segment to which it is attached, including the traffic of
innocent persons. That is, even if Carnivore functions as promised and
only records the traffic of the target, it is searching through the
email of many innocent persons--it is conducting an unconstitutional
general search. The ISP redirects to Carnivore a stream of packets from
many different customers. Carnivore filters those packets. That is a
search. The fact that Carnivore is automated and that no human ever
reads innocent messages does not make it any less of a search. The use
of machines to carry out searches does not make them any less a search
for Constitutional purposes.
In Title III terms, it also seems clear that what Carnivore does is
an ``intercept.'' As the Second Circuit states, ``It seems clear that
when the contents of a wire communication are captured or redirected in
any way, an interception occurs at that time. * * * Redirection
presupposes interception.'' United States v. Rodriguez, 968 F.2d 130
(2nd Cir. 1992), cert. denied, 113 S.Ct 139, 140, 663 (19992). See also
United States v. Denman, 100 F.3d 399, 403 (5th Cir. 1996), cert
denied, 117 S. Ct 1256 (1997); United States v. Tavarex, 40 F.3d 1136
(10th Cir. 1994); United States v. Nelson, 837 F.2d 1519, 1527 (11th
Cir. 1988), reh'g denied en banc, 845 F.2d 1032 (1988), cert denied,
488 U.S. (1988). Thus, use of Carnivore under control of the FBI is an
illegal interception of the redirected communications of innocent
subscribers.
Pen Registers Do Not Translate Neatly Onto the Internet
A pen register collects the ``electronic or other impulses'' that
identify ``the numbers dialed'' for outgoing calls and a trap and trace
device collects ``the orginiating number'' for incoming calls. 18
U.S.C. Sec. 3121 et seq. The Supreme Court has held that the numbers
collected by a pen register on a telephone line reveal so little about
a person's communication that they are not constitutionally protected.
Smith v. Maryland, 442 U.S. 735 (1979). The Court has stated, ``Neither
the surpost of any communication between the callerand the recipient of
the call, their identities, nor whether the call was even completed is
disclosed by pen registers.'' United States v. New York Tel. Co., 434
U.S. 159, 167 (1977). (While the information is not constitutionally
protected, it is sensitive, and as CDT and others have noted, the
standard for pen registers in the telephone world is now too low, since
even phone numbers dialed can draw a profile of a person's life.)
Carnivore's apparent attempt to extend ``pen registers'' and ``trap
and trace'' orders to the Internet is not a simple matter. Access to
Internet transactional data is not clearly supported by the pen
register statute, which refers to the collection only of ``numbers
dialed'' on the ``telephone line'' to which the device is attached.
Moreover, Internet origin and destination addresses can be far more
revealing than the Supreme Court contemplated in Smith v. Maryland and
New York Tel. Co.
Extending the use of pen registers to new telephone devices and
services--such as pagers, or numbers dialed after a call is completed--
has been the subject of debate \2\ and was one of the issues in the
CALEA lawsuit where the Court of Appeals reversed the FCC. \3\ But
Carnivore is indicative of a whole new and problematic expansion of the
pen register to the Internet. See CDT memo dated April 4, 2000,
``Amending the Pen Register and Trap and Trace Statute in response to
Recent Internet Denial of Service Attacks, and to Establish Meaningful
Privacy Protections,'' http://www.cdt.org/security/
000404amending.shtml.
---------------------------------------------------------------------------
\2\ See,. e.g., Brown v. Waddell, 50 F.3d 285, 290-91 (4th Cir.
1995) (refusing to classify a digital display pager clone as a pen
register).
\3\ See United States Telecomm Assoc. v. FCC, No. 99-1442 (D.C. Cir
Aug. 15, 2000).
---------------------------------------------------------------------------
The first question is what Internet transactional data may be
collected and under what standard. It is one thing if the FBI were
using the pen register authority only to collect IP addresses
(provided, of course, that the isolation were done by the service
provider rather than by an FBI-controlled Carnivore). In the packet-
switched Internet, the literal ``destination'' of an intercepted
message is often the Internet Protocol (IP) address of the link on
which it is observed. This information is found in the header of a
packet. So is the Ethernet address it is being sent to on a local
network. If the government is seeking just IP or Ethernet address
information, it can find it in the header of a packet, which is easily
separated form the content.
But if by destination the government means the ``To:'' line of an
e-mail message, that is often within the packet's content payload, and
as the DC Circuit recently made clear, intercepting addressing
information that is commingled with content requires authority to
intercept content. United States Telecomm Assoc. v. FCC (Aug., 12,
2000).
In an effort to illustrate this point, I have attached some packets
we ``sniffed'' off our own DCT network. Example 1 shows a packet for a
visit to Chairman Hatch's web page. The header of the packet includes
the source the destination IP addresses. In this case, the source IP
address 207.2263.15 is a computer at CDT and the destination
199.95.76.12 is the U.S. Senate web server. (If you type 199.95.76.12
into your browser after http://, it takes you to the Senate home page
just as if you had typed www.senate.gov.) So the header, which can be
easily separated from the content payload, would provide information
that might be similar to the information that a pen register would
provide on a person at CDT who called 224-3121, the Senate switchboard.
However, if the FBI wanted to know what precise page I was viewing,
they would need to reach into the content (TCP data) portion of the
packet. There they would find that I had asked for (``Get'') a copy of
/-hatch/greeting.ram. Anybody typing that into a browser would find
that I had downloaded the video greeting on the Chairman's web page.
Thus, they would know the precise content of my Web viewing.
In other cases, where law enforcement is apparently seeking origin
and destination addresses that are more than link IP addresses, they
will be forced to analyze the contents of packets. For example,
attached in Example 2 are three sample IP packet ``sniffed'' as they
went from CDT's network to our ISP. The packets are part of an e-mail
message from me to Makan Delrahim, a member of the Committee staff. The
header of each packet shows the IP addresses of the packet's origin (a
computer at CDT) and destination (our ISP's mail server, which will
next send the packet to the Senate mail server). To find out to whom
the e-mail is addressed to, one would need to read and analyze the
contents of specific packets. Is Carnivore able to pick out only the
one packet that contains only the ``To:'' information and the one
packet that contains only the ``From:'' information? It would be nice
to have some assurance other than the FBI's say-so.
The e-mail addresses in the To and From lines are much more
revealing than ``numbers dialed'' in that they are associated with
specific persons. In the case of a Web site, the URL can disclose
specific pages visited, books browsed, or items purchases. And as
people move more of their lives online, a list of e-mail recipients by
name or web sites visited can provide a very detailed dossier of
activities--all available without the heightened protections of a
wiretap or even a standard Fourth Amendment warrant. For example,
attached in Example 3 is a sample IP packet showing a search for a book
on the Barnes and Noble web site. Again, the IP address information is
available in the header; the URL in the body of the message reveals
information about what books the user is looking at--here, books on
prostate cancer. (A subsequent URL might indicate that the person
actually bought the book.) Taken together, a collection of such
``destination'' information could generate a revealing list of a
person's interests and activities. In this way, Internet transactional
information is more revealing than telephone transactional data.
CDT has long urged, and there seems to be a consensus, that
Congress should raise the standards for use of pen registers across the
board. Under the current standards, a judge ``shall'' approve any
request signed by a prosecutor certifying that ``the information likely
to be obtained is relevant to an ongoing criminal investigation.'' 18
U.S.C.Sec. Sec. 3122-23. This is low standard of proof, similar to that
for a subpoena, and judges are given no discretion in the granting of
orders. Pen registers are executed with neither public nor judicial
oversight: in contrast to wiretap orders, there is no requirement that
the government ever report back to the authorizing judge on the results
of a pen register and no requirement of notice to the targets of pen
registers. Unlike wiretaps, there are no national reporting reqirements
on the use of pen registers. The Justice Department reports on its own
use, but this does not include numerous federal, state and local use.
The Carnivore debate raises Fourth Amendment questions for pen
registers online. Courts have found that consumers have no
``expectation of privacy'' in the digits they dial on a telephone.\4\
Given the revealing nature of Internet transactional information, it
would seem that users do have a reasonable expectation of privacy in
the URLs of Web sites they visit and the email addresses of those with
whom they communicate, such that an intermediate standard is necessary
for collecting certain Internet transactional data. See 18 U.S.C.
2703(d) and H.R. 5018, the ``Electronic Communications Privacy Act of
2000,'' introduced by Reps. Canady and Hutchinson.
---------------------------------------------------------------------------
\4\See Smith v. Maryland, 442 U.S. 735 (1979). The Court's
reasoning relied in part on its understanding that ``pen registers do
not acquire the contents of communications.''
---------------------------------------------------------------------------
Reinvigorating the Fourth Amendment in Cyberspace
On May 25, 2000, I testified before this Committee about the ways
in which the statutory and constitutional framework governing
electronic surveillance has been outpaced by technological change.
http://www.senate.gov/-judiciary/52520jxd.htm.
To update the privacy laws, and respond specifically to Carnivore,
Congress could start with the following issues:
Increase the standard for pen registers across the board.
Define and limit what Internet transactional information
can be disclosed to the government and under what standard.
Add electronic communications to the Title III
exclusionary rule in 18 USC Sec. 2515 and add a similar rule to the
section 2703 authority. This would prohibit the government from using
improperly obtained information about electronic communications.
Require notice and an opportunity to object when civil
subpoenas seek personal information about Internet usage.
Improve the notice requirement under ECPA to ensure that
consumers receive notice whenever the government obtains information
about their Internet transactions.
Require statistical reports for Sec. 2703 disclosures,
similar to those required by Title III.
Make it clear that Internet queries are content, which
cannot be disclosed without consent or a probable cause order.
Provide enhanced protection for information on networks:
probable cause for seizure without prior notice, and a meaningful
opportunity to object for subpoena access.
The recent White House announcement \5\ on privacy and surveillance
adopts some of these proposals. Extension of the wiretapping
exclusionary protections to electronic interceptions is a particularly
welcome step. Increasing the standard for pen registers is an
improvement, but will not be sufficient if such orders are applied
broadly (i.e., include URLs) to the Internet. On the other hand, the
proposed expansion of the Computer Fraud and Abuse Act criminalizes an
unnecessarily broad range of activities online. The proposal fails to
address the need for heightened protections for private data held in
the hands of third parties. And there are other changes buried in the
proposal that we are still analyzing. CDT is prepared to work with
Congress and the Justice Department to continue to flesh out the needed
privacy enhancements, and to convene DPSWG as a forum for discussion
and consensus building on these issues.
---------------------------------------------------------------------------
\5\ See Ted Bridis, Updating of Wiretap Law for E-Mail Age is Urged
by the Clinton Administration, Wall Street Journal., July 18, 2000, at
A3.
---------------------------------------------------------------------------
Conclusion
The Carnivore system requires greater public scrutiny. It should be
controlled by the ISPs. More broadly, it speaks to the need for
modernization of our surveillance laws and greater privacy protections
to counteract the real threats to privacy online.
Protecting national security and public safety in this new digital
age is a major challenge and priority for our country. On balance,
however, the new sources of data and new tools available are proving to
be a boon to government surveillance and law enforcement. We do not
need to ignore traditional standards in order to respond to the new
technologies. The attempt to literally translate all current
surveillance capabilities directly onto the Internet may not be
possible or desirable in all cases, or may require new privacy
protections.*ERR03*
[GRAPHIC] [TIFF OMITTED] T4729A.001
[GRAPHIC] [TIFF OMITTED] T4729A.002
[GRAPHIC] [TIFF OMITTED] T4729A.003
[GRAPHIC] [TIFF OMITTED] T4729A.004
[GRAPHIC] [TIFF OMITTED] T4729A.005
[GRAPHIC] [TIFF OMITTED] T4729A.006
[GRAPHIC] [TIFF OMITTED] T4729A.007
The Chairman. Professor Rosen, we will conclude with you.
We would like to have some questions here before we finish.
STATEMENT OF JEFFREY ROSEN
Mr. Rosen. Thank you so much, Senator. It is an honor to be
here. I just want to talk very briefly at the end of this
hearing about uncertainty, and in particular about the cost of
the uncertainty that results from covert monitoring on the
Internet, and this is the uncertainty of innocent citizens who
can't be sure whether or not their intimate communications are
being intercepted by State officials or by ISP's.
It strikes me that even at the end of this fascinating and
informative hearing, there is a great deal of uncertainty that
continues to be associated with Carnivore. I was interested and
encouraged to hear Dr. Kerr testify that Carnivore is only made
available to ISP's if they are unwilling or unable to conduct
the search themselves, and that it is removed as soon as the
court order expires. Surely, this procedural regulation should
be codified to reduce the uncertainty of innocent citizens who
may fear that their Government has technical access to their
messages without their knowledge or consent.
There are, as you began by saying, Senator Hatch, other
uncertainties associated with Carnivore. The FBI is legally
forbidden from monitoring the communications of citizens who
are not targets, but the mere knowledge that Government agents
have the technical capacity to read e-mail messages will
greatly increase the uncertainty of innocent citizens at a time
of widespread concern over privacy over the Internet.
It is also true that one of the safeguards of the system,
the audit trail records that record precisely which
communications are intercepted, is made available to targets
only if a prosecution actually results. So innocent citizens
who are not targets have no notice when they are being
monitored and no confidence that they are not being monitored.
Senator Hatch, I would be delighted to give you a copy of
my book. It is called ``The Unwanted Gaze: The Destruction of
Privacy in America,'' available everywhere from Random House.
And I will take this opportunity to note that the title, ``The
Unwanted Gaze,'' actually describes the consequences when
people are not certain about whether or not they are being
observed.
It comes from a beautiful passage actually in Jewish law
that describes the anxiety and inhibition that results when
citizens are being watched without their knowledge. There is a
body of doctrine called hezzek re'iyyah, which means the injury
caused by seeing or the injury caused by being seen. So when
your neighbor puts up a window, observing you in a common
courtyard, you are entitled not only to prohibit the neighbor
from observing you, but also actually to require that the
window be taken down because medieval authorities recognized
that it was not only the surveillance itself, but uncertainty
about whether or not surveillance is taking place, that forces
us to lead more constricted lives and inhibits us from speaking
and acting freely in private places.
So, understandably, the consensus among these medieval
jurists was that the window had to come down even if the
individual whose privacy was violated failed to protest because
there was this uncertainty that made everyone act in a more
inhibited way in spaces that should be considered private.
I am concerned particularly at this moment of uncertainty
about the Internet that the Carnivore System, even if it were
administered scrupulously, would increase the anxiety about
monitoring on the Internet at precisely the moment when many
citizens are afraid to use e-mail because of concerns about
privacy.
There are several surveys of the health effects of
monitoring in the workplace that suggest that electronically-
monitored workers express higher levels of depression, tension
and anxiety, and lower levels of productivity than those who
are not monitored.
Now, let me briefly address the constitutional issue which
has been touched on, but seems to me a very hard one, and this
is the question does Carnivore violate the fourth amendment. It
seems to me that one could make a strong argument on either
side. Is this the quintessential example of an unreasonable
search or is it the precisely tailored example of the perfectly
reasonable search?
Carnivore operates very much like an ingenious and
hypothetical search that was discussed in a fascinating article
in the Yale Law Journal recently, and this is a program called
the worm. So the worm is a form of computer software that the
Government can dispatch to enter your computer without notice.
It scans your hard drive for illegal software or specified
words or images, pornographic pictures or any other evidence
that the Government is looking for. If the worm finds what it
is looking for, it can alert the FBI. And if not, it destroys
itself, leaving no trace of its presence.
So in some respects, the worm seems very much like
Carnivore, and it looks precisely like the general warrants
that the Framers of the fourth amendment meant to prohibit.
Both Carnivore and the worm can monitor millions of computer
users without probable cause to believe that a crime has been
committed, and they search broadly without particularized
suspicion of people or places.
But in other respects, the worm, like Carnivore, avoids all
of the spillover effects that led the Framers of the fourth
amendment to condemn general warrants in the first place.
Rather than exposing innocent as well as illegal material, it
focuses on the illegal material with greater precision.
So, Senator Leahy, you began by noting that in the 18th
century if you wanted to read someone's diary, you had to break
into their house and rifle through their desk drawer, and then
you would see a lot of innocent information in the course of
searching for guilty information. Carnivore, if properly
administered, might be said to avoid all of those effects and
only reveal the guilty information. So I don't think we should
be alarmist or hyperbolic about this difficult question of
constitutional translation.
Senator Leahy. Are there people who are being alarmist or
hyperbolic here?
Mr. Rosen. Are people being hyperbolic? I should say that I
have a hyperbolic instinct when I hear about Carnivore because
my fourth amendment knee jerks. But when we think about this
responsibly, it seems to me a hard constitutional question.
Senator, let's remind ourselves, too, how far we have moved
from the world of searches of private diaries in desk drawers.
In the 18th century, the search of a private diary was
considered the quintessential example of an unreasonable
search. We have the story of John Wilkes, the famousEnglish
patriot whose diary was searched by King George, sued in trespass and
won ruinous damages. It is only recently that private diaries have lost
their constitutional protection, we learned from the case of Senator
Packwood.
It is also true that in the famous article about the right
to privacy written by the future Justice Brandeis, he noted
that if a man wrote in a letter to his wife that he hadn't
dined with his son that day, not only the content of the letter
but also a general list of its subject matter would be
protected from public exposure because it wasn't the
information itself, but the domestic occurrence.
We have fallen very far from there to a world where the
list of the subject matters of e-mails are available on a
general standard of relevancy. And one of the things you might
consider, Senator, because I know both of you have been so
important in thinking about pen registers, is whether a higher
standard for the subject matter of e-mails, some more like
reasonable cause, might be appropriate.
I will conclude by echoing Michael O'Neill's notion that
the search of this subject matter information seems far more
invasive than a pen register because they reveal so much more
identity, both the names of the recipient and the sender, and
in the case of URL's the bookstores that you have searched and
the actual search terms themselves. So this is why a reasonable
cause standard might be appropriate.
It seems to me that none of the FBI's testimony at previous
hearings suggests compelling reasons why e-mail interception
should depart from traditional statutory models for regulating
wiretaps. I agree with James Dempsey that Internet service
providers rather than the FBI should at least have the first
opportunity of producing relevant communications specified by a
court order, and Carnivore should not be imposed but made
available to those who can't afford to undertake this search.
You might also think about other possibilities, keeping
audit logs for all communications monitored by Carnivore, not
simply those that result in prosecution, and increasing
procedural protections for innocent communications to reduce
the uncertainty of citizens who have no notice about whether or
not monitoring has occurred.
But my big point is just the costs of uncertainty are
great. This is an anxious time for the Internet. At the very
least, innocent citizens need to be reassured that their
Government is not observing their intimate messages without
their knowledge or consent.
Thank you.
The Chairman. Mr. Cerf, let me just turn to you first, and
perhaps I should express the gratitude of the Vice President
for your assistance in helping him to invent the Internet.
[Laughter.]
I just couldn't resist.
I notice you had some differences, or at least you looked
like you had some differences with Professor Rosen. I will give
you a chance to respond.
Mr. Cerf. Senator, I am sorry. I am having trouble hearing
you. I am hearing-impaired and my hearing aids are not picking
you up.
The Chairman. That is fine. I do have a soft voice, too
soft--my wife says.
I noticed you had some difficulties with what Professor
Rosen was saying.
Mr. Cerf. I had some reactions.
The Chairman. I would like to see what you have to say.
Mr. Cerf. I would like to suggest two things to our
panelists. One suggestion about putting the Carnivore software,
or the equivalent thereof, in the hands of the ISPs for
purposes of having them perform these searches strikes me as
alarming, frankly.
If I were a member of the public wondering who is managing
that software and doing things with it, I would be more
concerned if it were available to and generally in use by ISP
personnel, who need not necessarily understand or follow all
the restrictions and constraints that the FBI would follow. So
it seems to proliferate that strikes me as being excessive
compared to what the FBI proposes, as I understand it, which is
to place the equipment there only during the period of time
that surveillance is required and then remove it again.
Have I misunderstood that?
Mr. Kerr. No. That is correct.
Mr. Cerf. So in some sense, the proposition puts the
facility at broader spread than it would otherwise. That is one
point.
You wanted to respond to that?
Mr. Dempsey. Well, I was just going to say that this use of
Carnivore or unauthorized access to electronic communications
is equally a crime. The sanctions are the same and the
definition of the offense is the same----
Mr. Cerf. No debate there.
Mr. Dempsey [continuing]. Whether it is done by Government
officials or by ISP's.
Mr. Cerf. But I have the feeling that the ISP geeks may be
less familiar with the penalties and with the restraints than
the gentlemen from the FBI. So I would propose that that is not
the best idea in the whole world.
The other reaction that I had, Mr. Chairman, was any
comparison of the Carnivore system with the worm is technically
ill considered. The worm is a very different kind of beast. It
is a mobile piece of software. That is not the way the
Carnivore system functions.
I did have the opportunity to go down to Quantico and have
a pretty thorough briefing and to see the Carnivore system in
operation. I regret that other members of the technical
community appear to have felt unable to do that or are
reluctant to do so. It was a helpful briefing, and I feel as
though I have a much more firm understanding of what it can and
cannot do.
I still have concerns about it, as you could tell, I hope,
from my comments on how much you have to look at in order to
filter appropriate content. But I think the comparison with the
worm is not well considered and I think should be rethought,
Mr. Rosen.
Mr. Rosen. I should suggest I was not making a technical
comparison between Carnivore and the worm, but simply in the
nature of the focused search. Limited to that particular
aspect, it seems to me they are exactly analogous in the sense
that it only reveals the information it is looking for and
doesn't reveal to any human agent information it is not looking
for. That was the limit ofthe comparison.
Mr. Cerf. OK, then you are not proposing that the Carnivore
is a mobile piece of software that moves around and jumps into
millions of machines, which it does not do?
Mr. Rosen. I am a lawyer, not a technician, sir. I will
defer to you on----
Mr. Cerf. I will forgive you for that.
Mr. O'Neill. If I could just make a point, sort of a means
of follow-up, I think one of the difficulties and what perhaps
concerns people is the idea that there is software and also
hardware, because Carnivore apparently is both, and it is
unclear precisely what it does or what its capabilities either
currently are or can be.
I mean, we all know--and I am not a technician particularly
either, but we all know that software is not only dependent
upon what it is, but how it is updatable, how it is modifiable,
and how in any individual case it can be configured.
Now, I happen to be not in the camp of those who would like
to see the Carnivore source code released to the public. I
think that would, in part, defeat its purpose. But I do think
that it is important for this body to have oversight to make
sure that at least someone is watching the watchers. And it
seems to me that that is the important role that Congress can
play in this whole decisionmaking process.
The Chairman. Go ahead.
Mr. Cerf. Well, I am thinking that the existing
surveillance mechanisms are in place now and we must have
someone watching the watchers, I hope. I mean, I would assume
that that is true. So wouldn't the same watchers who currently
oversee this----
Senator Leahy. Don't always assume that, Mr. Cerf.
The Chairman. No, you can't always assume that.
Mr. Cerf. I am sorry?
Senator Leahy. I said don't always assume that.
Mr. Cerf. Well, all right. If I am incorrect, then we have
a bigger problem than just Carnivore.
The Chairman. It is a big problem. We want you to know it
is a big problem.
Professor O'Neill, you gave us 10 reasons that you didn't
define, but let me just go through those. No. 1, you say with
respect to Carnivore itself, Congress ought to obtain
briefings, classified if necessary, to get a better
understanding of what Carnivore is designed to do, how it does
it, and whether there exists potential for abuse.
No. 2, Congress ought to determine what the statutory
authorization for Carnivore is and whether law enforcement has
the authority to insist that a service provider install
Carnivore.
No. 3, if implemented in some fashion, Congress should
require that statistics be maintained by the Justice Department
and that these so-called, ``audit trails,'' be routinely
provided for legislative oversight.
No. 4, Congress should seek to learn whether Carnivore can
easily be defeated by encryption software or E.A. Poe-type
purloined letter schemes.
More broadly, No. 5, hearings ought to be conducted to
determine whether all Internet trap and trace orders should be
issued only on the basis of the judicial finding that
reasonable cause exists to believe that a target has or is
about to commit a crime.
No. 6, the executive branch ought to be required to provide
consumers with notice whenever the Government obtains
information about their Internet transactions.
No. 7, specific statistical reports for pen register or
trap orders for Internet communications similar to the reports
required under title III ought to be required.
No. 8, Congress should explicitly provide that Internet
queries, e-mail subject lines, URL's of sites visited, and
other information which provides more than the equivalent of a
dialed number cannot be disclosed without a probable cause
order.
No. 9, Congress should consider requiring notice and
opportunity for defendants to object when civil subpoenas seek
personal information about Internet usage.
And, No. 10, provide enhance protection for information on
networks, probable cause for seizure without prior notice, and
a meaningful opportunity to object for subpoena access.
Then you say, ``At bottom, I would urge a cautious,
thoughtful approach when it comes to expanding surveillance
capabilities. The conflict between increased security and
enhanced privacy protection is not easily resolvable, nor will
it likely ever be. But Congress ought to seize the moment to
ensure that robust debate occurs before law enforcement's
powers are enhanced and regardless of how the balance is
struck.''
I thought those were pretty good suggestions, to be honest
with you. I don't know how the FBI feels, but having heard
them, what do you think, Mr. Kerr.
Mr. Kerr. Well, I must say that I have just heard them for
the first time, as you have read them off.
But if you would permit me, Mr. Chairman, there were some
questions and suggestions raised about our interactions with
the Internet service providers and I think I can help you on
that.
The Chairman. Well, let me add to that because it was
raised here in this article in USA Today, which I have read--it
appears to cast doubt on whether any university is willing to
take the study of Carnivore under the restrictions that have
been placed on such a study by the FBI, or at least the
restrictions they think are placed by the FBI. In fact, Mr.
Dempsey has pointed that out, I think, fairly strongly, and I
would just like you to comment about that in your overall
comments.
Mr. Kerr. All right. The first point I should make
absolutely clear is that the FBI is not soliciting this review.
It is being done by the Department of Justice, and in
particular under the auspices of Steve Colgate, the Assistant
Attorney General, head of the Justice Management Division.
While I will be part of reviewing the report once it is
prepared, I will have nothing to do with determining the scope
of that study or the acceptability of the outcome. We did it
precisely to avoid having the FBI funding a look at its own
equipment and capabilities.
Senator Leahy. Does the FBI support the study, though?
Mr. Kerr. Yes, absolutely.
Senator Leahy. Thank you.
The Chairman. Have you set the restrictions on the study,
though, or has the Justice Department set the restrictions?
Mr. Kerr. The Justice Department.
The Chairman. Mr. Di Gregory, is that right?
Mr. Di Gregory. That is correct, Senator.
The Chairman. Why have restrictions?
Mr. Di Gregory. Well, there are certain restrictions that
we believe are necessary. The one restriction, for example, is
the restriction on the release of the source code. We don't
believe that the source code should be released publicly
because that could hamper law enforcement efforts.
The Chairman. I can understand that.
Mr. Di Gregory. And a general restriction with respect to
the scope and the nature of the review is that the review is a
technical review. The review was never intended to be a legal
review, but a technical review to determine whether or not
Carnivore does the things it claims it does.
The Chairman. Then why are these universities having such a
difficult time taking on that review?
Mr. Di Gregory. I don't know. That is probably a question
you would have to ask the particular universities involved, and
I can't comment any further on the procurement process.
The Chairman. But am I correct in inferring that all the
universities approached thus far have refused to take on the
review?
Mr. Di Gregory. First of all, I don't know the answer to
that, and even if I did know, I wouldn't comment on it because
there are restrictions with respect to commenting on the
procurement process that I am not completely familiar with, but
am familiar enough with to know that I don't want to get in
trouble. So if you wouldn't mind my----
The Chairman. Well, you don't want to get in trouble with
us either, do you?
Mr. Di Gregory. I don't, Senator. [Laughter.]
The Chairman. I understand.
Mr. O'Neill. One thing I would add to that, Senator, is it
is interesting, though, that--and I think the Department of
Justice ought to be commended for taking these steps, but I
think it is interesting that it seems to be--if you sort of
follow the time line, at least, it is in large part because
Congress chose to take oversight of this because this
information was leaked to the press that the Department of
Justice then sought this outside independent review, which is
entirely the appropriate and proper thing to do, and it is, of
course, the role that Congress ought to be playing here.
The Chairman. Well, your ten suggestions are very broadly
written. I would like you and Mr. Rosen and others, and
especially you, Mr. Cerf and Mr. Dempsey, to look at these and
see if you can improve upon them and make suggestions for us
and for the Justice Department and for the FBI as to how we
might do this.
Look, this is something that is really terrifying a lot of
people around the country. Are we going to have an Orwellian
type of investigative Government now that we are in this
Orwellian type of a world which is doubling now in capacities
in revolutionary ways?
This is scary stuff. We have people who don't want anything
to be done in this area. And, of course, we have people that
are terrified that if we keep allowing the Internet to be used
as a source for crime and criminal activity, this society is
going to be very badly damaged. So I would like you all to
spend some time on that.
Mr. Cerf, go ahead, and then I will go to Mr. Kerr.
Mr. Cerf. There is a book that was published recently by a
gentleman named Amitai Etzione. The title, if I remember
correctly, is something like ``The Limits to Privacy.''
The Chairman. Right.
Mr. Cerf. In that book is what I thought was a fairly
reasoned and balanced discourse about the protection of
personal privacy.
The Chairman. And you think Etzione's discourse would apply
in this case, in this digital world?
Mr. Cerf. You say it would not apply?
The Chairman. No. Do you think it would apply?
Mr. Cerf. I believe that it would because his premise is
that there is a balance to be reached, as I think several
panelists have said, between the protection of personal privacy
and personal information, and the need to protect the general
public's well-being from people who don't mean it well,
criminal elements.
And what Etzione argues in this book is that it is possible
that we have gone too far in one direction or another. It is a
worthwhile book to read, if only to be provoked into thinking
about what the balance could be or should be.
The Chairman. Mr. Kerr.
Mr. Kerr. Two points that I would like to make very
briefly, Mr. Chairman. First, the suggestion that in any way
information about Carnivore was leaked to the press and has led
to hearings and press coverage is absolutely wrong. We have
been briefing on Carnivore for about 18 months. It has been
reviewed substantially within the Department of Justice. It has
been briefed to many companies, many trade associations.
We have offered two ISP's complete access for them to
review the product and its performance, and in no way have we
attempted to conceal its existence or its intended purpose. And
so I find it rather surprising at this juncture that that is
still the view. We have briefed many members of the
congressional staff as well.
With respect to the concern about ISP's and their access,
the thing we safeguard is the integrity of the evidence. The
box where we record the information is locked and accessible
only to an FBI agent. Also, the PC on which the system is based
has its keyboard and monitor removed so that, in fact, a
passer-by can't make a change either maliciously or
inadvertently. And we don't allow them to use the remote dial-
up access which we employ and log, but that is what tells us
when the memory is full and an agent needs to go and remove the
disk.
So we have tried to design it not only with great
specificity to respond to the court orders, but, in fact, with
a view toward maintaining the integrity and authenticity of the
evidence we collect, and to be able to testify after the fact
in court that we did so, who had access, when they had access,
and what the settings of the device were.
I hope that clarifies the point.
The Chairman. Well, it helps, except for one thing. As I
understand your testimony, you indicated that Carnivore has
been used in some 25 cases so far. Is that correct?
Mr. Kerr. Yes, sir. It is now between 25 and 30. That is
correct.
The Chairman. There are reports that the Attorney General
was not aware of it--according to press reports, was not aware
of Carnivore. And I hear from constituents that their concern
with Government surveillance is not their objection to
authorized uses of it, but the potential uses without the
proper checks and balances on Government search and seizure
that our country and Constitution are based on.
What concerns most citizens and concerns me deeply are
reports that the FBI developed and deployed the Carnivore
system without even the knowledge of the Attorney General
herself. That may be par for the course for this Justice
Department, but you cannot take this lightly, given the
fundamental civil liberties that are implicated here.
Now, my sense is that much of the controversy surrounding
Carnivore is due to the apparent perception, rightly or
wrongly--and I would like you to clarify this--that there is no
check on its use by the FBI. Now, I would like, Mr. Kerr, you
and Mr. Di Gregory to explain to us to what extent the
development and deployment of new surveillance technologies by
Federal law enforcement have to be authorized by Congress.
In other words, under what delegated authorities are new
technologies, in general--and Carnivore in particular--
developed, and was there specific authorization by Congress or
the Attorney General to develop and use Carnivore or other
similar systems?
Are these press reports right that the Attorney General
didn't even know about it until recently? And answer the
question as far as what rights do you have to go ahead with it.
Mr. Kerr. Mr. Di Gregory is going to give the first part of
the answer and I will give the second.
The Chairman. Okay, that will be great.
Mr. Di Gregory. From what I understand, Senator, without
knowing of the name ``Carnivore'' or without knowing of the
specific program--this is my understanding--the Attorney
General was aware of the FBI's capacity to do this kind of
surveillance. I think Ms. Stansell-Gamm may have some more
detail about that.
The Chairman. But the Attorney General was unaware of the
actual software that was being developed or has been developed?
Ms. Stansell-Gamm. I simply don't know at what point the
Attorney General became aware of this specific tool or the name
of the tool.
The Chairman. Then answer the second question. What
authority do you have to do this and to have used it in 25
cases? Has Congress given you any authority?
Mr. Kerr. Well, in fact, Congress appropriated the money,
pursuant to our budget request, within which there is a
specific line related to electronic surveillance, and
particularly the development of tools for access to data
networks, the Internet, and the like. It has been in our budget
for a number of years. It is part of our continuing response to
be able to carry out our mission to lawfully intercept
communications as technology evolves.
The Chairman. We are happy to have Mr. Parkinson and Ms.
Stansell-Gamm here with us today.
Ms. Stansell-Gamm. I would like to answer your question
another way, if I could. It has been at least 3 years ago since
the Attorney General made a press announcement about the case
called Ardita, which Mr. Dempsey referred to, kindly, as one of
our law enforcement success stories. And she briefed that case
in great detail to the press, and the core of that story was
what we were able to do and how we were able to do it.
It involved an electronic wiretap at a network at Harvard
University that this hacker, who turned out to be in Argentina,
was using as a platform for attacking DOD systems all over the
world. The investigative problem that we had was how to find
the needle in the haystack, how to find Mr. Ardita's
communications in the haystack of legitimate traffic.
The Attorney General understood how we were able to do
that, which was supervised very closely by a court in Boston. I
think there were two separate title III orders. And because the
tool that we were using to do that was a tool that was not as
sophisticated as Carnivore but, as Mr. Cerf has pointed out,
captured a great deal more hay than the needle, the minimizing
process was far more exacting, required several steps and, in
fact, required an agent to look at some text strings.
The irony of all of this is that while----
Senator Leahy. Instead of carnivore, was that omnivore?
Mr. Stansell-Gamm. No, that was not omnivore. In fact, it
was a tool developed by the Navy called NIDS, Network Intrusion
Defense System. The Air Force has one that they call Sniffy.
You know, they all have their different names, but these tools
have been used by law enforcement in a variety of agencies for
some time, under the strict supervision of courts.
As I say, the irony of all of this is that the tool
Carnivore is the most selective, the most discreet, the most
controllable, the one that is most likely to be able to reach
in and pull out only the needle, although, as you say, it is a
very hard problem.
The Chairman. Maybe bits of needles.
Ms. Stansell-Gamm. Bits of needles, exactly, while the
haystack is moving by.
The Chairman. Right.
Ms. Stansell-Gamm. It is a very difficult technological
challenge. So this represents, in my view, quite a good-faith
attempt on the part of the FBI engineers to respond to the
challenge of collecting information on the Internet in ways
that comply strictly with our legal authorities, and to do it
in very discreet, controlled ways that create records. That is
what this tool does.
The Chairman. Let me turn to Senator Leahy. I have taken
long enough.
Senator Leahy. You know, it is interesting as we examine
these issues to look back at lost opportunities. A few years
ago, I suggested some better procedures for applying for
warrants on pen registers, and so forth, and the FBI has always
been reluctant to talk about that.
Now, I find, since Carnivore came out, some of my
colleagues in the House have proposed that we change not just
the procedures, but also the standard for pen registers and
traps and traces to an extent that I think that probably
Justice and the FBI would wish that they had paid more
attention to the suggestions that Imade. But I assume from the
fact that they haven't expressed any change of heart about my prior
proposal that, they reject that and would prefer that I support the
legislation, for example, of Representatives Canady and Hutchinson,
H.R. 5018, which proposes a more stringent standard for pen registers,
trap and trace, and similar devices that would identify e-mail
addresses, like Carnivore.
That legislation would require specific and articulable
facts reasonably indicating that a crime has been or is being
or will be committed, plus a showing of relevance of the
information sought to the investigation of that crime. Another
bill introduced by Representatives Barr and Emerson, H.R. 4987,
would apply that same greater standard to all pen registers and
traps and traces, whether or not they would identify e-mail
addresses.
Since the source and destination information about e-mail
may have content in a way that a dialed telephone does not,
should we change the standard for pen registers and traps and
traces, or do my earlier suggestions now suddenly sound better
to you?
Mr. Di Gregory. As you may know, Senator, the
administration has put forth a proposal which would elevate the
standard required for trap and trace or pen register
information, though not quite the same standard that is put
forth by Barr and Canady. Our standard would require the
prosecutor--the one that is proposed would require the
prosecutor to submit a factual statement rather than merely a
certification, and that that factual statement would be viewed
by a court and a court would determine whether or not the
factual statement was sufficient to establish that the
information to be obtained from pen register or trap and trace
was information relevant to an ongoing criminal investigation.
Senator Leahy. Does that mean you don't like their
legislation?
Mr. Di Gregory. There are problems with their legislation.
The one that comes to mind initially is that the legislation
submitted by specifically Representative Canady is e-mail-
specific. It is not even Internet-specific, but it is e-mail-
specific, and that creates a problem.
As we have said in other contexts and have said before
Chairman Canady's subcommittee, we believe that any legislation
that is developed with respect to the substantive criminal law,
or even the procedural criminal law as it relates to the
Internet should be as much as possible technology-neutral. We
don't think that there should be a different standard for the
interception of e-mails versus the interception of telephones--
excuse me; I used the word ``interception''--for a pen register
or a trap and trace for e-mails as opposed to a pen register or
trap and trace for telephones.
Senator Leahy. Dr. Kerr, do you feel the same way?
Mr. Kerr. I will take the easy-out, sir. As you know, I am
a physicist and I don't normally opine on matters of the law.
Senator Leahy. Thank you. There is nothing wrong with that
answer.
We got a letter from the FBI last month that described the
operation of Carnivore. It said, ``It does not snoop through e-
mail traveling through an ISP network by searching for key
words or reading the subject line or any other content.''
But the nature of how the Internet works, as I see it
anyway, is that the specific communications or addressing
information of a suspected criminal, one who has been targeted
under a court order, are mixed all up like a stew with all the
other packets of different Internet users carried by the ISP.
Somehow, Carnivore has to snoop through all these other
different packets to find the right one, the needle in the
haystack. Is that correct?
Mr. Kerr. Let me start to answer and certainly welcome any
assistance Mr. Cerf would like to give, but go back to his
envelopes for a minute. What we are looking at in the first
instance is the address on the outside of the envelope. With
the address matching the one we are authorized to capture, we
collect the envelope and we subsequently go and we only take
from that envelope the information we are authorized to take.
But we use the addressing properties of the Internet
itself, the Internet protocols, to select out just those
packets. We don't read them at that point. The machine is doing
it. There is no content being viewed by any human. And, in
fact, those packets that contain information we are not
authorized to obtain disappear at that point. We don't control
them.
Senator Leahy. But to use the envelope thing, it is like
getting a big bag of envelopes and you are looking just for the
one addressed to Dr. Kerr, but there is also an envelope in
there to Mr. Parkinson, Mr. Di Gregory, and on and on. I mean,
you have got to go down through all those envelopes at some
point.
Mr. Kerr. Well, think of it better perhaps, you are
standing at the post office and all the envelopes are going by
you on a conveyor belt. And we are just picking off those
envelopes that have the right address on them. The others go
away; they are not in our life anymore.
Senator Leahy. Mr. Cerf.
Mr. Cerf. If I could interject, the problem here is a
language and terminology problem. The term ``address''
unfortunately is overused for a variety of different purposes
even in the Internet. And so we speak, for example, of Internet
addresses, by which we sometimes mean 170.127.34.16, which is a
numeric indicator of where a computer is in the Internet. It is
sort of like a telephone number.
On the other hand, we also say what is your Internet
address, and by this we often mean what is your e-mail address,
which in my case would be [email protected]. Those are different,
and so the way the Carnivore works is it starts with the
lowest-level physical numeric addresses of the source and
destinations that are under observation. And it only selects
out--the conveyer belt model is a good one--it only selects out
those ones that happen to contain those physical addresses.
Now, we can argue separately about whether you have got the
right addresses. I mean, there are some issues about the
stability of IP address assignment and whether or not a
particular computer has the same IP address forever and ever or
whether it changes from time to time. I am sure that the
members of this committee don't want to know all the details
right here on the spot, though I am prepared to provide them if
needed.
But after you have selected the set of envelopes thatmay
contain information of interest, only then do you then look inside. And
if I have any concerns at all--and I want the FBI folks here to know I
do have concerns--you do have to see quite a bit; you have to suck into
the Carnivore machine quite a bit before you can find that part which
you are interested in after you have determined that this envelope
might contain something of interest.
The point that the Carnivore programmers make is that the
software is intended to look at the collection of material that
makes up an e-mail message like this one, that amount of which
happens to be in one packet, and only if it finds, for example,
a ``to'' and ``from'' e-mail does it capture that packet. If it
can't find that, if it can't parse the contents, it throws it
away. That is the design, that is the intent, and that is the
way it is used. So it is true that the machine pulls in more
than is needed, but it then is programmed to throw away that
part which doesn't match their search criteria.
Senator Leahy. And what you are saying, Dr. Kerr, is you
can't go back to the machine and find out what was thrown away?
Mr. Kerr. That is correct.
Mr. Cerf. Except in the case, of course, where you have
been authorized to obtain and capture content as well. I don't
know whether you are ever allowed to do that.
Mr. Kerr. The answer I was giving was that packets that we
have discarded aren't available to us at all.
Mr. Cerf. They are not. They have disappeared on the
conveyor belt and have gone away. So it is a multilevel filter
that is being applied, and at each stage in the filtering
process less and less information is retained.
Senator Leahy. Mr. Dempsey, you wanted to add something to
that.
Mr. Dempsey. Yes, Senator. I have two comments, one of
which addresses the question which is, is it good enough that
Vint Cerf has looked at Carnivore and has come away relatively
satisfied with it. And I have to say that----
Mr. Cerf. I won't take any offense if you say that it isn't
because I would agree with you.
Mr. Dempsey. That it isn't good enough?
Mr. Cerf. That is right.
Mr. Dempsey. And so we have to somehow get beyond the fact
that one person has been in, or that several people have been
in. I really don't think we have had the kind of review of
Carnivore that would really satisfy this committee and satisfy
the public, and I do agree with the chairman that somehow the
FBI needs to work and the Justice Department needs to work on
that independent review.
I would note in response to Dr. Kerr's comments it is a
Justice Department review, but this nondisclosure agreement
which Vint Cerf signed but which other people are rather
reluctant to sign--the nondisclosure agreement is between the
contract personnel and the FBI. You are signing an agreement
with the FBI and you are responsible to the FBI as to what you
can say and not say.
I also think that I am a little bit reminded of the----
Senator Leahy. Responsible to the FBI, even though the
review is that of the Justice Department, or did I miss the
point?
Mr. Dempsey. Well, the question was who is controlling
the----
Senator Leahy. You are talking about when it goes in.
Mr. Dempsey. Controlling the review.
Senator Leahy. Yes, OK.
Mr. Dempsey. Who is controlling the review, and Dr. Kerr
made the point, well, people needn't worry; it is a Justice
Department-controlled review. And I am making the point that
the nondisclosure--people are going to be bound to the FBI.
Mr. Cerf. May I just interject that I agreed to sign the
nondisclosure on the principle that when you are dealing with
surveillance, just as you would with other intelligence
situations, sources and methods are always a sensitive issue.
Mr. Dempsey. But the concern on the part of people, as I
understand it, is that this agreement is so broadly drafted
that it will prohibit people from talking more broadly or more
generally. Now, you feel comfortable coming here today and
speaking, but other people are worried, particularly if they
would be critical as opposed to moderately supportive, that
they would then be accused that they had--particularly if they
talk about ways in which Carnivore may be vulnerable, may be
subject to abuse, may be avoidable or evadable, that they
would--the point is we need to get beyond one person knowing.
Mr. Cerf. Absolutely, and I believe that the FBI has, in
fact, introduced this system to more than one person.
But I just want to emphasize two things. First of all, I am
conscious of the concern over methods of collection and I
recognize the need to keep those reasonably under control.
However, I do agree with Mr. Dempsey that one person is not
enough and that you need a broader substantiation that this
system does what it, in fact, claims to do. So I would
certainly agree with what I think Mr. Dempsey is suggesting, is
that there be a broader review of this system and some
confirmation coming back to this committee that it does as it
is advertised.
Senator Leahy. I would like that.
And let me ask you--I think this would probably be for the
FBI or DOJ--the D.C. Circuit Court of Appeals had a recent
decision on the FCC's implementation of CALEA and it raised
some interesting questions both about the legality of
Carnivore, but also I think the liability of ISP's. The court
agreed with the FCC that a standard adopted by
telecommunications carriers could provide both packet headers
and the content or payload to law enforcement.
The carriers argued, though, that they couldn't technically
separate the two, while the FBI said, that is OK, we have got
equipment that could, ``distinguish between a packet's header
and its communications payload, and make only the relevant
header information available for recording or decoding.''
Now, I assume the FBI was referring to its Carnivore
equipment when it made that representation to the court. It
actually made the same representation to the FCC. The reason I
say this is the representation was critical, since both the FCC
and the court noted that, ``privacy concerns could be
implicated if carriers were to give to law enforcement packets
containing both the addressing information and the content,
when only the former''--that is, the addressing information--
``was authorized.''
Now, both the FCC and the court noted that CALEA imposes an
affirmative duty on carriers to protect the privacy and
security of communications not authorized to be intercepted. It
also requires that they do not give lawenforcement access to
any communications or addressing information not covered by a court
order.
I put all that as a basis to this question: do you believe
that the way in which Carnivore operates gives law enforcement
access to more than just the communications or addressing
information covered in a court order? And if so, could it put
the ISP in jeopardy of violating its duty under CALEA of
protecting the privacy and security of communications not
authorized to be intercepted?
Mr. Kerr. The very simple answer to your question is that
CALEA covers telecommunications carriers. The Internet service
providers are not covered under CALEA. We have only used
Carnivore in conjunction with the networks of Internet service
providers.
We did, in fact, brief the standards committee for the
companies and others involved in CALEA on the technology used
in Carnivore in order that they would be aware of it as they
develop a CALEA-based standard for telecommunications carriers
using packet-switched networks. But there is no carryover
between CALEA and what we have been talking about with
Carnivore.
Senator Leahy. Then what did the FBI mean, after the
carriers had argued they couldn't separate packet headers and
content--I am talking about telecommunications carriers when
they argued that before the court, and the FBI said, well, that
is OK, we have got equipment that could distinguish between
packet headers and communications payload. Were they referring
to Carnivore?
Mr. Kerr. I think they were likely referring to Carnivore,
but as a demonstration of a technical approach. To repeat, we
have not used and don't expect to use Carnivore in a CALEA-
covered intercept.
Senator Leahy. Mr. Di Gregory, is that your understanding,
too?
Mr. Di Gregory. My understanding of what the FBI intends to
use?
Senator Leahy. Yes.
Mr. Di Gregory. As I understand it, the FBI only intends to
use Carnivore when the ISP is unable to provide the information
or not willing to do so.
Senator Leahy. Mr. Dempsey.
Mr. Dempsey. Well, Senator, Dr. Kerr is 100-percent correct
when he says that CALEA does not apply to ISP's. And I have to
say that was one of the smartest decisions that was made in the
course of CALEA because implementing CALEA for the telephone
companies has been a nightmare. It would be even worse trying
to apply CALEA to the Internet and to ISP's.
But I think what the court and----
Senator Leahy. It is a matter that we thought of at the
time, as you recall. You were involved in some of that debate
at that time.
Mr. Dempsey. Yes, I was, Senator. I take responsibility for
all the mistakes we made there.
Senator Leahy. No, no, no.
Mr. Dempsey. But keeping the Internet out was your and
Congressman Edwards' decision, and it was a wise one, it turns
out.
I think what the FBI was referring to was not Carnivore,
per se, but this notion that we will let the technology make
this distinction, this constitutionally-based distinction
between content and something other than content.
We have a huge issue on the Internet about what about this
transactional information? It is not just numbers dialed, and
what should be the standard? Professor O'Neill referred to
that. But assuming that you can distinguish between content and
noncontent, the FBI said in the CALEA debate if the carriers
can't separate it, give it all to us. Even under a pen register
order, give us the whole packets and we, the FBI, will sort it
out, and we will only keep what we are authorized to keep. We
won't look at or keep what we are not authorized to keep. And
if it is a pen register, content, we are not authorized to keep
content. We have a machine, we have a capability to disregard
that.
And what the court of appeals said, I think, is that is not
good enough. The technology, the FBI, the Commission, the
industry cannot modify the constitutionally-based rules for
interception of content, and that in order to obtain and grab
and look at and analyze and redirect content, you need a full
probable cause-based order. And the FBI is using Carnivore
under the pen register authority on the ``trust us'' standard
that our technology will solve the problem of what is the
distinction.
Now, Mr. Cerf has said it is very hard to distinguish
between what is content and what is, ``addressing
information.''
Mr. Cerf. No, I didn't say it was hard to distinguish
between the two. What I said is that you have to capture a lot
before you can filter out the part which is considered header.
Yes, you must capture it. Because of the structuring of the
protocols, you have to capture essentially a lot of this piece
of text before you can then find the part that you want to
capture.
Mr. Dempsey. That poses huge constitutional problems.
Mr. Cerf. Hang on, folks.
Senator Leahy. Just a minute. To make sure I understand it,
part of the problem is the ``just trust us'' standard, but it
actually even goes beyond that, the fact that it is even being
collected to begin with. Is that what you are saying, Mr.
Dempsey?
Mr. Dempsey. Yes.
Mr. O'Neill. If I may interject, this is part of the
difficulty, I think, that Congress has to deal with. The fact
that the Department of Justice--and I was very proud to have
worked for the Department of Justice, and frankly in a lot of
circumstances I much prefer the Department of Justice having
any personal or private information about me than I do some
industry groups or whether the ISP does. I mean, that is sort
of my general default.
Part of the difficulty, though, is that the Department of
Justice perceives its mission, and rightly so, as making sure
that we are secure in our homes, preventing and stopping crime.
In an effort to do that, what the Department has done, and
rightly so, is to make sure that it stays technically relevant.
The Internet is a big change over the way people
communicated in the past. In order for the FBI to be able to
fight and deal with the perceived threat and the actual threat,
whether it is crime or international terrorism or what have
you, it then develops software and it develops new and
innovative approaches to collect information to continue doing
what it has done in the past.
The difficulty and I think the challenge for Congress is to
make sure that all of this technological innovation,all of
these changes in the way that the FBI or Federal law enforcement
assembles information-- that someone is watching it. Judges frankly are
in a very poor position to monitor this because judges frankly don't
have the information available. They are only trained as lawyers. They
are not in a situation like the U.S. Congress is to have people who are
expert in these very complicated, and as we have seen from the
discussion here today, very esoteric parts of technology.
Congress frankly is in the best position to be able to do
that, and I think it is in Congress where the American people's
trust has to reside to make sure that this just doesn't happen
with nobody watching it, to make sure the Department of Justice
isn't too good in fulfilling its mission, and that there is a
public watchdog, namely the Congress, making sure that the
appropriate balance between personal security and personal
privacy is maintained.
Senator Leahy. Well, I would agree there. I am happy we are
having this hearing. Whether Congress is going to be adequate
in this kind of oversight--I mean, we can be if we want to be.
It is whether we set that as a priority, and you have worked up
here and you know that there are a million things coming
through at any given time, some substantive and some symbolic,
and we tend to spend a lot of time on one or the other
depending on what we are doing.
But the Sunday afternoon emergency court order is not going
to be--the oversight is not going to be in the Congress, but it
is going to be at the Department of Justice.
Mr. O'Neill. But Congress should be setting the baselines.
Senator Leahy. I agree.
Mr. O'Neill. And once the baselines are set, then judges
and the FBI and law enforcement can properly administer those
baselines when they are out there in the field.
Mr. Rosen. Can I just make a point on that?
Senator Leahy. Well, Mr. Cerf had been trying to respond.
Mr. Cerf. Only to support Mr. O'Neill's argument. It seems
to me that it is inescapable that this technology will
proliferate, not the Carnivore technology, the Internet
technology, and that it will become the basis for most of our
communications. Even if the other systems survive and persist,
the Internet will carry television and telephony and radio, and
so on.
So we need to learn how to deal with that. We need to deal
with it in the context of the problems that the Justice
Department and the FBI have, and other law enforcement people
do, at the same time trying to protect individual rights to
privacy. That balance has to be struck, and the terms and
conditions for it surely lie squarely with our Congress.
Senator Leahy. Mr. Rosen.
Mr. Rosen. I wonder if I could make a concrete suggestion
about striking that balance, to pick up on the suggestion. We
have been focusing on the different standards for different
forms of technology, for pen registers, for content, for header
information. There is another approach that Congress took in
the title III area which is really a model for protecting
privacy and striking the balance that we are thinking about
here, and that is limiting the most intrusive searches to the
most serious crimes. A search of a diary, for example, might be
reasonable in the context of the Unabomber, but not for a
relatively trivial civil suit.
Now, there is a tendency, as you know, for the list of
these crimes to expand exponentially. So originally the title
III list was limited to really serious and violent crimes, and
now it includes all felonies. But for searches of e-mail and
for any content-based searches, you have the ability and the
opportunity right now to really create a very limited number of
crimes that can justify these searches.
And I think that citizens would just feel much more
comfortable about having intimate information revealed when
they know that there are violent and serious criminals involved
than when they think that any of them may be caught up in a
relatively trivial offense.
Senator Leahy. What you are saying is the constitutional
threshold remains the same, no matter what the crime is, but we
will just simply say that constitutional threshold or not, you
can only do these searches for certain types of crimes.
Mr. Rosen. I guess the notion is the constitutional
threshold is reasonableness, and a search is more likely to be
reasonable if a serious crime is involved than if it is not. So
in trying to substantiate that constitutional standard, just
make sure that the list is limited when the searches are
intrusive.
Senator Leahy. Mr. Cerf, there is something I have always
meant to ask you. Are you relation to the late Vincent Cerf?
Mr. Cerf. To whom?
Senator Leahy. The late Vincent Cerf.
Mr. Cerf. Are you thinking of the late Bennett Cerf,
perhaps?
Senator Leahy. Well, there is also a Vincent Cerf.
Mr. Cerf. There is a Vincent?
Senator Leahy. Yes.
Mr. Cerf. Gee, no, not that I am aware of. I am related to
Bennett Cerf, both of them. One of them is my son and the other
one, of course, is the former publisher at Random House. But I
do not know Vincent Cerf.
Senator Leahy. Bennett Cerf has the ability to come up with
some of the wildest puns, as you probably know.
Mr. Cerf. It is a genetic defect and it runs in the family.
Senator Leahy. I have been accused of using some from years
back.
Obviously, you are an acknowledged pioneer of the Internet,
and you were kind enough to help out the Internet Caucus, and
so on. You worked on ARPANet, which is the precursor to the
Internet. You were there when the Internet was first discussed
and began being developed into what it is today. I suspect that
neither you nor anybody else could have envisioned just how
quickly it has gone so far. You may have known that it would go
like this, but the fact that it has moved so quickly.
But Congress also played an essential role. We funded not
only ARPANet, but also the NSPNet and the backbone that led to
the Internet. The reason I ask this is that some--I wouldn't
suggest anybody on this committee, but some have poked fun at
Al Gore on this issue. But I think they fail to acknowledge his
role in Congress when he pushed fordevelopment and saw the
potential of the Internet years ago when a lot of others didn't.
I remember back in the 1980's--and I remember this because
his office was down the hall from mine--that then Senator Gore
chaired a hearing that had the first ever live computer
demonstration exhibiting the possibilities of a high-speed
computer network. I know of nobody else who had done it up to
that point.
So would you at least agree with me that the Vice President
played a significant role in pushing for funding and
development of what became the Internet, and may deserve some
praise for his vision in that regard?
Mr. Cerf. I would have to agree with that, Senator. The
Vice President while he was Senator, in fact, was one of the
first in this august body to realize that there might be
something important about super computers and optical fiber and
computer networking. He held a number of hearings, some of
which had a direct impact and influence on legislation that
supported the research that has led to the continued evolution
of the Internet.
He has been a strong supporter, as I am sure you are aware,
both in his senatorial role and as Vice President. And so I
think it is quite proper for him to receive some credit for
that interest and that support. I regret, as I suspect he does,
the slip of the tongue that led him to characterize his role
more broadly than I think it deserves.
Senator Leahy. More broadly than he intended, too, I think.
Mr. Cerf. I believe that is correct. On the other hand, I
feel very strongly that he does deserve considerable credit for
his consistent support for the Internet and related
technologies.
Senator Leahy. One of the national news media gave me what
I thought was too flattering, but I am not going to ask for a
retraction, profile referring to me as the Cyber Senator. I
have got to admit that a lot of that interest came from then
Senator Gore. When we were coming back from votes, he would
start pounding my ear and then would grab me into office and
keep on going until I agree that, yes, I would learn more about
it, and then he would turn me loose.
Thank you. Thank you, Mr. Chairman.
The Chairman. Well, I want to thank all of you for being
here today. This has been an excellent hearing. We have raised
a lot of issues that are important. Naturally, all of us want
to support law enforcement, it seems to me, in legitimate
pursuit of those who are breaking the laws. I certainly do. On
the other hand, we certainly want to be concerned about the
privacy aspects of individual citizens in our society.
There are no easy answers to all of these very significant
questions, but we are hopeful that you can continue to help us
to understand this. So we will keep the record open for a week
for any additional comments or statements anybody cares to make
and any additional materials you would want to submit to us.
Senator Leahy. Mr. Chairman, could I emphasize regarding
submitting anything further, if you have further thoughts on
that court of appeals case, I think it would be very helpful to
both the chairman and myself if any of you would like to add to
it. I mean, that is not a trick question in any way whatsoever,
as you know. I am trying to figure out where it goes. So if you
want to add something, if you want to ask your own question and
answer it, please feel free to do so.
The Chairman. We will keep the record open for that.
We want to thank each and every one of you. You have been
great here today, and this has helped us to understand this
much better.
So with that, we will recess until further notice.
[Whereupon, at 12:31 p.m., the committee was adjourned.]
----------
Questions and Answers
Responses of Donald M. Kerr to Questions From Senator Hatch
Question 1. Is Carnivore set up to intercept all of the
communications of all of the ISP Subscribers Within an ISP's Computer
Network?
Answer 1. No. First of all, the FBI intentionally works closely
with the computer network Administrator to decide on the best and most
appropriate interception access point. This access point is determined
with the specific purpose of finding the smallest segment within that
ISP's computer network into which the criminal subject's communications
traffic can be funneled, so as to minimize the amount of network
traffic involved. Technically speaking, most ISPs can and do identify
such a limited segment within the overall ISP network which contains
the criminal subject's communications traffic. Second, the FBI uses a
commercial device to attach Carnivore to, yet isolate it from, the
network.
More to the point, the FBI has absolutely no intention of being put
into a situation where Carnivore would have to interface with an entire
ISP network. If someone had the erroneous idea that the FBI might
desire to ``capture'' all such ISP network traffic--which it certainly
does not want to and will not do--the Carnivore system could very
quickly be overwhelmed with traffic. That is, Carnivore software is
deployed on a standard PC and the largest hard drive that has been
deployed is 18Gb. With the total traffic of many ISPs running at
thousands of Mbps, even if this hard drive was storing only 100Mbps of
network traffic, the Carnivore system would fill up in about three
minutes.
The only exception to the aforementioned rule would be with regard
to very small ISPs where all subscribers' communications traffic was
traversing the same segment of the network as the criminal subject's
traffic. Of course, under this unusual circumstances, Carnivore would,
as it always does, filter out all of the traffic other than that of the
criminal subject.
Question 2. Does the use of the Carnivore System legitimately raise
the concern of Carnivore broadly conducting illegal searches as to
other innocent, non-criminal subject subscribers' communications
addressing information or communications content?
Answer 2. No. It is important to understand that Carnivore's
filtering operates in stages--and that all filtering occurs exclusively
within the ``Carnivore box.'' Carnivore's first operation is
exclusively to detect the criminal subject's identifying information.
The first stage of filtering in the Carnivore system is to match (in
purely binary computer code) the ``pattern'' of ``1's'' and ``0's'' in
the computer bit stream that matches the subject's ``pattern,'' based
upon the criminal subject's identifying information, as set forth in
the court order. So, in a very simplified example, with the filter
exclusively set to detect the criminal subject's computer bit pattern
``1100,'' if the first bit in the compute bit stream was an ``0,''
Carnivore would automatically conclude that since ``0'' and ``1'' are
not a match, that this circumstances does not meet the filter pattern
criteria, and it would quickly move on to conduct the next pattern
match effort. If the first digit is a match, Carnivore would then go to
the next digit in the computer bit stream, and repeat the process,
until an exact, complete match is arrived at.
Importantly, nothing happens at all, by way of any interception of
communications content or acquisition of communications addressing
information, unless and until the criminal subject's unique identifying
information has been matched. Then, and only then, does Carnivore move
on to the second stage of filtering, in terms of applying the
appropriate filters required to filter either for communications
addressing information acquisition or for full communications content
interception, depending upon the particular authorization found within
the court's order.
Finally, FBI personnel only receive and ``see'' the communications
addressing information or communications content of the criminal
subject, as appropriate--based upon the court's order--after all of the
Carnivore filtering has been completed exclusively within the Carnivore
box.
In short, Carnivore never conducts a search of the communications
addressing information or communications content of any innocent, non-
criminal subject at all. Indeed, even with the criminal's subject's
communications traffic, Carnivore filters the criminal subject's
``machine readable only'' binary code exclusively within the box; and
FBI personnel only obtain, in a humanly intelligible format--and
``outside of the box''--the criminal evidence sought after Carnivore
has completely concluded its programmed filtering efforts within the
box.
Question 3. Does the FBI ``view'' computer network traffic as it
passes through the Carnivore System?
Answer 3. No. First of all, Carnivore's filtering program renders
Carnivore effectively blind to any network traffic other than that of
the criminal subject, concerning whom a court has issued an order
authorizing the acquisition of communications addressing and
transactional information or the interception of communications
content, all based upon identifying information unique to the criminal
subject. Only such information about or communications content of the
criminal subject is collected by Carnivore. Second, the computer
network traffic passes through the Carnivore system at a speed far
beyond human comprehension. The network traffic consists solely of a
series of ``machine readable only'' 0's and 1's, flashing through
Carnivore at a rate of 40 million ``0''s/``1''s per second (and often
at much higher speeds). Whenever any network traffic is stored on the
Carnivore system, it remains in the same format of 0's and 1's; and,
importantly, it is not turned into a format intelligible to humans
until after it is transferred from the Carnivore system. Again, it
bears repeating that Carnivore is a configurable system that will
provide FBI personnel only that information that it has been programmed
to deliver through its filtering--information that equates with the
information authorized for interception/acquisition in the court's
order.
Question 4. If the FBI were to conduct a pen register type
investigation, wherein Carnivore would be programmed to only acquire
the criminal subject's addressing information, and if the subject
visited different web sites, would the carnivore system acquire
information such as URL subdirectories? For example, if the subject
went to Amazon.com to buy a book, would the FBI be able to tell what
book he/she bought?
Answer 4. No. URL subdirectories are not acquired. The IP address
and port number for Amazon.com alone would be acquired. Hence, the FBI
would only know that the subject went to Amazon.com, and whether or not
the subject established a ``secure'' connection (i.e., secure socket
layer (SSL)).
Question 5. Can the FBI use Carnivore to intercept computer network
communications other than e-mail?
Answer 5. Yes. Carnivore can be configured to intercept various
types of computer network communications which match its filters. It
has been used to intercept several protocols in the TCP/IP protocol
suite (e.g., Telnet, FTP, IRC, and HTTP). Of course, in all instances,
the appropriate legal process under Title III, FISA, or the ECPA would
first have been obtained. If the electronic surveillance is for
communications ``content,'' a full Title III court order (probable
cause showings and more) would be required.
Question 6. Does Carnivore interfere with the service or operations
of an ISP computer network?
Answer 6. No. By design, Carnivore does not interfere with an ISP
network.
First, the FBI works closely with the ISP computer network
Administrator to decide on the appropriate interception access point.
This access point is determined with the specific purpose of finding
the smallest segment within that ISP's computer network into which the
criminal subject's communications traffic can be funneled, so as to
minimize the amount of network traffic involved. Then, importantly, a
commercial device is used to attach Carnivore to, yet isolate it from,
the network, such that, as a technological matter, it physically cannot
and will not transmit anything whatsoever into the network or otherwise
intrude into the network.
Second, by design, Carnivore's attachment to a network will not
crash or interrupt network service. Recent comments reported in the
media suggesting that Carnivore had interrupted or ``crashed'' the
service or operations of a major ISP are completely false. In reality,
a small loss of bandwidth did occur with the ISP in question, within
only one segment of that ISP's network, when technicians from the ISP
chose on their own to alter their software code to facilitate
interception access. In fact, Carnivore was not even attached to the
ISP network at the time when this ISP network problem arose.
Question 7. Does the Carnivore System use trojan horses or viruses
to collect a criminal subject's communications content or addressing
information?
Answer 7. No. The Carnivore system is totally passive. No software
is added to a subject's computer.
Question 8. Once Carnivore has been deployed, can the filters be
accessed and changed remotely?
Answer 8. Yes. Carnivore can be accessed remotely and the filters
may be changed--but, (1) only a select few technical persons specially
dedicated to the Carnivore program, (2) only when those few persons are
privy to the specific dial-up access number, (3) only when those
persons possess a hardware security device that is specifically
required for remote access, and (4) only when such persons have the
necessary two-tiered password access authority required.
Currently, within the FBI there are only a limited number of
technically-trained personnel who implement the Carnivore program. As
noted, the dial-up access is secured by both hardware and software
protections, and any access, or attempted access, automatically
generates a series of recorded logs which disclose precisely who, if
anyone, has ever accessed Carnivore remotely and/or changed the filters
in any given case. Importantly, any filter changes would be based upon
some significant reason, such as a change in the legal process (e.g.,
moving from a pen register or trap and trace investigation to a full
Title III, pursuant to obtaining a Title III court order), the
termination of the surveillance period and Carnivore's attendant
``shutdown,'' or for technical ``trouble-shooting,'' if some technical
problem or glitch arose.
Although investigative personnel have limited remote access
capabilities for investigative purposes only--that is, to access the
raw data that subsequently, through later processing, will constitute
the evidence in the investigation--they are never given the second tier
password required to access or change the Carnivore filter sets.
______
Responses of Donald M. Kerr to Questions From Senator Thurmond
Question 1. Dr. Kerr, please explain the obstacles that law
enforcement faces in getting information on electronic communications,
especially with less encryption controls and with the increased use of
digital messages.
Answer. As your question correctly suggests, technological
obstacles to electronic surveillance are arising in the environment of
electronic communications. These obstacles are varied and pose
significant challenges to the law enforcement community's lawful
conduct of court-ordered electronic surveillance.
In working with the vast array of large, medium, and small size
Internet Service Providers (ISPs), we have encountered some unusual
network-based obstacles. For example, even though the FBI always works
very closely with such ISPs (both by desire and necessity) before we
ever undertake an electronic surveillance effort, we have nonetheless
encountered some unusual, non-standardized, and proprietary network
protocols and other network controls within such ISP networks; and
these complicate electronic surveillance efforts. Indeed, somewhat
remarkably, we have found, in some instances, that a given ISP's most
expert technical personnel themselves may not always be fully aware of,
or conversant with, the protocols being utilized within their network
and/or how they have been implemented. Such a situation can adversely
impact upon the smooth effectuation of certain electronic surveillance
orders.
In another vein, certain very high-speed electronic communications
can likewise challenge, or threaten to undermine, the ability of law
enforcement to fully and properly execute electronic surveillance court
orders.
Finally, the use of encryption by criminal subjects (absent some
lawful and efficacious law enforcement decryption capability), can
threaten to undermine Federal District court electronic surveillance
orders and the ability of law enforcement agencies to investigate and
prevent serious acts of terrorism, espionage, and violent criminality.
As to the foregoing challenges and many others, the FBI
historically has worked (and continues to work) closely with various
business and technological components within the electronic
communications industry. and, by necessity, the FBI also steps in and
develops its own tools, as necessary, when commercial tools are not
available which fully meet legal, evidentiary, investigative, and
operational requirements placed upon law enforcement's lawful conduct
of electronic surveillance.
Question 2. Dr. Kerr, there has been considerable concern about the
F.B.I. possibly using Carnivore to search randomly through all e-mails
or other electronic communications that contain specific words or
phrases like ``bombs'' or ``drugs''. Does the F.B.I. have the authority
to gather intelligence on non-specific targets in this manner?
Answer 2. First of all, the FBI's Carnivore system simply does not
work, as suggested by some, in a fashion of randomly searching through
all E-mails or other communications that contain specific words or
phrases like ``bombs'' or ``drugs,'' etc. To the contrary, Carnivore is
a ``filtering'' tool which the FBI has developed to carefully,
precisely, and lawfully conduct electronic surveillance of electronic
communications regarding a specific criminal subject--based upon that
criminal subject's identifying information (e.g., his/her IP address)--
occurring over a particular computer network, in complicance with the
Constitution and the Federal electronic surveillance laws.
Whenever Carnivore is used, the FBI never deploys it without the
cooperation and technical assistance of the ISP network technicians
and/or engineers. Further, through working with the ISP, Carnivore is
positioned and isolated in the network so as to focus exclusively upon
just that small segment of the network traffic where the criminal
subject's communications can be funneled. This is roughly analogous to
using an electronic surveillance device only within in a single trunk
or cable within a telephone network. Stated differently, and contrary
to the assertions of some critics, Carnivore does not access `in a big
Brother mode, all subscriber communications throughout an ISP network.'
Carnivore's filtering operates in stages. Carnivore's first action
is to filter only within a small portion of an ISP's network.
Specifically, Carnivore filters binary code--streams of 0's and 1's
that flow through an ISP network, for example, at 40 mega-bits per
second, and often at much higher speeds. To visualize this, imagine a
huge screen containing 40 million 0's and 1's flashing by on this
screen for one screen for one second, and for one second only.
Carnivore's first effort--entirely within the Carnivore box--is to
identify within those 40 million 0's and 1's whether the particular
identifying information of the criminal subject, such as his/her IP
address, (for which a court order has been authorized) is there. If the
subject's identifying information is detected, the packets of that
criminal subject's communication associated with the identifying
information that was detected, and those alone, are segregated for
additional filtering or storage. However, it's very important to
understand that all of those 40 million 0's and 1's associated with
other communications are instantaneously vaporized after that one
second. They are totally destroyed; they are not collected, saved, or
stored. Hence, FBI personnel never see any of these 40 million 0's and
1's, not even for that one second.
After exclusively segregating the criminal subject's information
for further machine processing, then a second stage of filtlering is
employed. At this point, and again all within the Carnivore box,
Carnivore checks its programming to see what it should filter and
collect for processing. In other words, it determines, as required by
the specific wording of the court order, if it's supposed to
comprehensively collect communications content--in a full Title III or
FISA mode--or, alternatively, whether it's only to collect pen register
or trap and trace transactional and addressing information. Only that
information specified in the court order is being collected and passed
on to FBI personnel by Carnivore.
As to the second part of the question, the FBI does not have the
authority to--certainly does not--gather intelligence on non-criminal
targets in some broad brush manner. FBI electronic surveillance under
title III and the ECPA focuses on gathering hard evidence about
particular criminal subjects with regard to particular facilities being
used by such criminal subjects and with reference to particular crimes
and criminal communications, and with reference to identified co-
conspirators.
Question 3. Dr. Kerr, what controls exist on the F.B.I. to insure
that Carnivore is not misused for a fishing expedition or to obtain
electronic communications that lie outside of the scope of a court
order?
Answer 3. There are numerous legal, technological, and
administrative controls that prevent the misuse of Carnivore for a
fishing expedition or for intercepting communications outside the scope
of the court order.
Legal Controls: First of all, the law itself is a powerful control
to ensure that only properly authorized, lawful electronic surveillance
occurs. The FBI certainly is of this opinion. As such, the FBI only
conducts electronic surveillance--whether conducted through the use of
Carnivore or otherwise--pursuant to a lawful court order or lawful
voluntary consent of a party to the communication. This has been the
case since 1968, when the first Federal electronic surveillance laws
were enacted in the Title III legislation. Importantly, the FBI has an
outstanding record of compliance with the electronic surveillance laws
since their enactment over 30 years ago. In addition, it is very
noteworthy that the electronic surveillance laws contain stringent
deterrents to unauthorized (illegal) electronic surveillance, including
criminal (felony) and civil sanctions for any individual who violates
the law. Further, under the Constitution, suppression of illegally
obtained evidence (and fruits thereof) may be applied by Federal courts
if electronic communications content is unlawfully intercepted.
Technological Controls: The Carnivore system, by design and
functionality, is set up to establish an ``audit record'' for
evidentiary purposes. Of course, a secondary aspect and value of this
design and functionality would be to aid in the prevention of any
potential infringement of privacy rights. Moreover, as you may be
aware, Carnivore, by design, is a device which only functions to filter
out. In its first filtering action, carnivore filters out anything not
associated with the unique and specific identifier associated with a
particular criminal subject's service, as identified in a given court
order. Stated differently, Carnivore ``ignores'' and is ``blind to''
anything not associated with a criminal subject's unique identifier
that relates to the specific authorization set forth in the court's
order. In its second filtering action, Carnivore filters out content
when the order is only for communications addressing and transactional
information. Thus, as a special purpose electronic surveillance tool,
Carnivore fundamentally and purposely works as a ``filter.'' By
contrast, Carnivore fundamentally and purposely does not work,
descriptively speaking, as a ``vacuum cleaner'' which, by design, would
purposely acquire electronic communications broadly and
indiscriminately from all network users, including those of innocent
subscribers. Hence, Carnivore's design does serve as an effective check
against any potentiality of infringing upon privacy rights.
Adminstrative Controls: There are numerous administrative and
criminal justice system-based controls which preclude the errant use of
Carnivore, both in terms of internal and external oversight to control
how Carnivore is being used at any point in time. To begin with, it
should be emphasized that the FBI does not deploy or use Carnivore or
any other non-consensual electronic surveillance tool in a vacuum. With
regard to applications for pen registers or trap and trace devices,
section 3121 of Title 18 of the United States Code prohibits
Carnivore's use, as such a device, without a court order. In order to
acquire a court order, the FBI may not act alone, but must seek the
approval of an appropriate official within the Department of Justice.
Section 3122 mandates that an ``attorney for the government'' be the
applicant for a pen register or trap and trace device. Typically, this
requires the approval of the Office of United States Attorney for the
district in which the device is to be used. Of course, more stringent
requirements, mandating high-level Department of Justice approval, are
found in Title III/FISA provisions and practices controlling the
interception of electronic communications.
Within the FBI itself, there are also a number of administrative,
technological, and physical access controls which prevent the
unauthorized use of any electronic surveillance tool, including
Carnivore. First, as a general matter, all covert electronic
surveillance equipment is carefully controlled and overseen within the
FBI by FBI Headquarters program managers and by each field officer's
Technical Advisor (TA). Second, with regard to Carnivore specifically,
there are only a few Carnivore devices and only a limited number of FBI
personnel who are trained to operate this special purpose tool, under
FBI Headquarter's overnight. Third, to use Carnivore in any given case,
such personnel must be privy to the specific access number for a
targeted account number. Fourth, such personnel can use Carnivore only
when they possess a hardware security device that is specifically
required for access. And fifth, such personnel can use Carnivore only
when they have the necessary two-tiered password access authority
required.
Finally, if any FBI employee ever were to conduct such unlawful
activity, he/she would be terminated from employment with the FBI.
There is ``zero tolerance'' for any such illegal conduct within the
FBI.
In sum, Carnivore has many legal, technological, and administrative
controls. Such controls effectively act to prevent any ``fishing
expedition'' or infringement of privacy rights when using Carnivore.
Question 4. Dr. Kerr, is Carnivore used in routine criminal
investigations or is it limited to rare cases when the information
cannot be obtained through the Internet Service Provider or another
manner?
Answer 4. Carnivore has been used in important ECPA-based criminal
investigations and in important FISA-based national security
investigations. As noted in our testimony, we have used Carnivore when
the interception of electronic communications content or the
acquisition of electronic communications addressing information could
not be fully or properly effectuated by the Internet Service Provider
(ISP) (with reference to legal, evidentiary, investigative, and
operational requirements which need to be met) or when the ISP has
indicated that it is ill-equipped to effect the interception or that it
would be more efficient for the FBI to effectuate the order using
Carnivore.
Question 5. Dr. Kerr, some have called upon the F.B.I. to release
the source code for Carnivore. What impact would this have on the
ability of Carnivore to operate?
Answer 5. To begin with, in enacting the first comprehensive U.S.
electronic surveillance laws, Title III of the Omnibus Crime Control
and Safe Streets Act of 1968 (Title III), 18 U.S.C. 2510-2522, as
amended, the Congress instituted a balanced regime which both affords
clear statutory authority and Constitutionally-compliant procedures to
enable law enforcement to lawfully conduct electronic surveillance
pursuant to court order and which criminalizes the unauthorized conduct
of electronic surveillance in order to underscore the Congress'
intention of preventing unlawful searches and seizures and of
preserving communications privacy. To advance both of these principles,
the Congress also crafted Title III provisions to prevent the
proliferation of surreptitious electronic surveillance interception
devices. See 18 U.S.C. 2512 (Manufacture, distribution, possession, and
advertising of wire, oral, and electronic communication intercepting
devices prohibited). The only two categories of users exempted under
Section 2512 are providers of wire or electronic communication service,
with regard to equipment utilized by them in the normal course of
providing their service, and governmental officials, with regard to
equipment utilized by them in the normal course of carrying out
governmental activities.
Similarly, there are statutory and regulatory U.S. export control
regimes which govern the export of electronic surveillance-related
equipment (e.g., the Arms Export Control Act, as implemented by the
International Traffic in Arms Regulations, and the Export Control Act,
as implemented by the Export Administration Regulations). Depending
upon the type of electronic surveillance equipment involved, one or
both of these regimes will likely govern the export of electronic
surveillance equipment.
In short, electronic surveillance equipment generally, and that
used by the FBI in particular (at least that electronic surveillance
equipment used in covert, non-consensual efforts--i.e. surreptitious
electronic surveillance devices) is treated as sensitive, at a minimum.
In many cases, such equipment may also be classified. Hence, in light
of the above, and as a starting point, the FBI is concerned about the
legal and policy constraints associated with the disclosure of such
electronic surveillance equipment, including its software.
With regard to Carnivore, and again in light of the above laws,
controls, and constraints, we believe that it would be improper to
disclose to the public generally the source code of Carnivore. The
source code, after all, is for a special purpose surreptitious
electronic surveillance system which should be treated with
circumspection. Public disclosure of the source code could lead to the
unintended and harmful effect of facilitating unauthorized, and hence
unlawful, electronic surveillance. Further, it may be that disclosure
could inform the criminal community about aspects of Carnivore that
might suggest some potential for circumvention.
However, as you may be aware, the FBI will disclose the Carnivore
source code to the independent, outside review team which the Attorney
General has called for (the Illinois Institute of Technology and
Research Institute (IITRI)) in a controlled environment and under
controlled circumstances, in order to give assurance to the public that
Carnivore operates properly and lawfully, as the FBI claims it does.
Question 6. Dr. Kerr, do you think the name Carnivore has
contributed to public perceptions about the program being extremely
intrusive?
Answer 6. It's probably fair to say that the name ``Carnivore'' has
unintendedly and unhappily lent itself to some negative comments by
those who have not understood Carnivore's actual use, functionality,
and core purpose in making electronic surveillance efforts more--not
less--surgical and precise. As noted in our testimony, in a number of
regards, Carnivore is superior, as an electronic surveillance tool, to
the ``sniffers'' that are sold commercially and often used by ISPs for
network trouble-shooting and management (such sniffers were never
intended for use as a law enforcement electronic surveillance tool).
Indeed, in the furor, the public appears to have lost sight of the core
fact that the FBI has spent considerable time, money, and energy in
trying to develop an electronic surveillance tool which better meets
the dictates of the Constitution and the Federal electronic
surveillance laws.
Responses of Donald M. Kerr to Questions From Senator Leahy
Question 1. By letter dated August 16, 2000, the FBI informed me
that ``Carnivore is only used in those small number of instances when
an ISP cannot on its own deliver what the court order instructs,''
suggesting that Carnivore is an investigative tool of last resort.
Others have expressed the view that Carnivore should be a tool of first
resort because the responsibility for executing court orders for
electronic surveillance and protecting privacy rights is best
discharged by the Department of Justice, not private ISPs. What is your
view?
Answer 1. In the past, the FBI's decision to use Carnivore or to
permit an ISP to implement a court-authorized electronic surveillance
order for either the full interception of electronic communications
content or for the acquisition of electronic communications addressing
and transactional information within an ISP's network has been decided
on a case-by-case basis. Given the complexities and the great number of
variables related to any given court-authorized electronic surveillance
technical effort within an ISP network, the FBI has always viewed such
electronic surveillance efforts from a tactical and effectiveness
perspective. Central factors considered by the FBI in making
determinations have been the ISP's ability to implement a particular
order fully, properly, securely and in a timely manner. If the ISP can
meet these requirements, we would normally let the ISP implement the
order.
Further, it is important to remember that both as a technological
and practical matter, the FBI's conduct of electronic surveillance
within such ISP's computer network always requires a cooperative and
collaborative effort between the ISP and the FBI. This is so because an
ISP's network administrators and engineers are really the only ones
possessing the knowledge required as to their network to identify
within it the transmission pathway(s) of a particular criminal subject,
the best access vantage point(s), the protocols being used, etc.--all
of which are required to effectively execute a surveillance order.
Hence, the FBI believes the best approach will continue to be a
case-by-case approach, based upon considerations such as those outlined
above.
Question 2. The FBI has testified that Carnivore has been used, as
of September 6, 2000, in approximately 25 instances and that ``in many
instances, ISPs, particularly the larger ones, maintain certain
technical capabilities which allow them to comply, or partially comply,
with court order.''
A. Is it fair to say the majority of court orders for electronic
surveillance of Internet communications or source and destination
information of Internet communications are executed by ISPs without the
use of Carnivore?
B. Since the FBI employs Carnivore only on rare occasions when its
use is necessary, should the FBI retain the right to use Carnivore in
all cases?
C. Should the government be required to make a showing that use of
Carnivore is necessary and obtain court permission before using this
tool?
D. Would concern about abuse of Carnivore be allayed if its use
were limited to circumstances when a court has granted explicit
permission for the electronic surveillance order to be executed by law
enforcement on the ISP's premises?
Answer 2 A and B. Again, owing to a number of factors and
variables, as outlined above in Answer #1, and their interrelationship,
we cannot give an unqualified answer. Generally speaking, certain very
large ISPs do tend to have greater electronic surveillance capabilities
than the small ISPs. For example, if the electronic surveillance order
were for the interception of E-mail content, certain ISPs could
``clone'' the E-mail and accomplish, or very substantially accomplish,
such an interception effort. When the ISP can meet electronic
surveillance requirements, we have permitted the ISP to effect the
surveillance effort. However, since most ISPs have developed with
little emphasis being placed on conducting electronic surveillance for
law enforcement, and since the ``tools'' that they might typically
resort to in order to effect such efforts (e.g., ``commercial
sniffers'') were never designed for such a law enforcement electronic
surveillance purpose, surveillance shortfalls can occur. By comparison,
the FBI's Carnivore system was specially designed to effect such
surveillances. In this regard, it bears noting that, when an ISP does
lack the capability to implement a court order fully, properly,
securely, and in a timely manner, the ISP usually is the first to
recognize that it is more effective for the FBI to use its electronic
surveillance tools.
Given the different and sometimes unique factors and variables that
arise from case to case, as noted above, we believe that the FBI must
retain the right to use its electronic surveillance equipment in order
to ensure that electronic surveillance orders can be implemented fully,
properly, securely and in a timely manner. However, in the rare
instances where a dispute may arise between the government and the ISP,
as with any matter in contention, resolution of such matter is through
the courts, with a judge or magistrate resolving it. Resolution is
never dictated unilaterally by the government, much less by the FBI.
Answer 2 C and D. We believe, based upon different factors and
variables, as outlined above, as well as our past experience in this
area, that the best course is one where the ISP and the FBI work
closely together in a consultative, cooperative, and collaborative
fashion to implement a particular electronic surveillance order in the
best way possible, so that the court's order is properly implemented
and not frustrated. The technical and administrative staff of an ISP is
best positioned, in concert with law enforcement, to make complex
technological judgments, which often arise only after the court issues
its order. Relatedly, the FBI does not have the resources that would be
required to initiate in-depth discussions with all the ISPs (some in
industry estimate the number of ISPs to be in the thousands) that
conceivably could be involved in a potential future court-ordered
electronic surveillance interception (with an eye to pre-determining
what technological approach might be best) prior to the time when an
actual and specific order may in fact be issued by a particular court.
Further, and as indicated above, suchpre-determination could, at best,
only be general and tentative in nature since, as noted, many different
technological variables and factors come into play, and, importantly,
they change over time as the ISPs' networks change over time. Thus,
especially in fast-paced investigations where time is of the essence,
such as in computer hacker cases, to require in advance a specialized
demonstration of need to a court in order to utilize Carnivore, as
suggested, would impose very problematic procedural delays. Neither FBI
nor ISP engineers would be in a position to make a final determination
until after a particular order authorizing interception or acquisition
of particular information had been issued at a particular juncture in
time with reference to the then technological state of the given ISP's
network.
As to the issue of concern about abuse, as noted in our hearing
testimony, Carnivore has a built-in audit record. This audit record
feature was designed into Carnivore for the purpose of making a
permanent record as to the particular filter settings that have been
used in each case with Carnivore--and hence what information has been
acquired by Carnivore--at any point in time. Thus, this Carnivore
feature creates a record to afford assurance to any interested party
(FBI managers, Offices of the United States Attorney, U.S. District
Courts, juries, criminal defendants, and defense counsel) as to
precisely what Carnivore is or is not acquiring at any point of time in
each investigation. Also, as with any type of electronic surveillance
within any service provider network (wire or electronic), the criminal
and civil penalties within our electronic surveillance laws, along with
close DOJ and FBI administrative oversight, prevent misuse of
electronic surveillance. Indeed, the FBI has an outstanding record of
compliance with the electronic surveillance laws since their enactment
over 30 years ago.
Question 3. The FBI and Department of Justice have asserted that
Carnivore is the functional equivalent of pen register and trap-and-
trace devices used on telephone lines. The Supreme Court held in Smith
v. Maryland, 442 U.S. 735 (1979), that telephone callers do not have an
expectation of privacy in dialed numbers used in placing a call since
such numbers are necessarily divulged to a telephone company, which
makes a permanent record for purposes of billing operations and
maintenance of the service. The Court specifically distinguished such
dialed numbers from ``content,'' which are protected by the Fourth
Amendment.
A. An Internet user may go to a particular URL that specifies not
only the computer on the Internet on which a particular document can be
found, but also the directory in which the document is located, the
file name of the document and the page within the document that the
user seeks and retrieves. Does such a URL or ``Internet address''
contain more or less information about the subject of a communication
than a dialed telephone number?
B. Is Carnivore capable of intercepting information about a
specific URL searched by an Internet user who is the subject of a pen
register order? If so, at what point in the searching, or addressing,
information would the Justice Department believe that the line has been
crossed into ``content''?
C. Is Carnivore capable of intercepting information about all the
URLs visited by an Internet user who is the subject of a pen register
order during a particular session?
Answer 3 A, B, and C. To clarify, a Uniform Resource Locator (URL)
is simply an electronic Internet Protocol (IP) domain name address
(e.g., xyzcorp.com). Further, also riding underneath the alphabetic URL
address is a numeric address associated with the server that is
supporting the contacted URL. Accordingly, when, pursuant to a pen
register court order, the FBI uses Carnivore and acquires URL address
information that is all that is being acquired--i.e., the fact that a
criminal subject has electronically connected to a given URL address.
As such, the URL address information does not include any subdirectory
or any other information about the site. In such a case, the FBI would
only know that the criminal subject had contacted the xyzcorp.com site
and whether or not his/her computer had established a ``secure''
connection (i.e., secure socket layer (SSL))--no more. Hence, in light
of the foregoing, we believe that such URL information is essentially
identical to a telephone number within a telephone network that a
criminal subject may dial. Thus, it is worth noting that a Carnivore-
based pen register would provide the FBI with virtually the same
information as a telephone pen register would, i.e., the telephone
number dialed by the criminal subject reflecting that a communication
to XYZ Corp. had occurred. No ``content'' information (substance,
purport or meaning) is gleaned from either type of pen register as to
the nature of the call.
Question 4. Under current law, a judge must issue a pen register
order upon a prosecutor's certification that the information likely to
be obtained is relevant to an ongoing investigation. I have proposed in
the E-RIGHTS Act, S. 854, that the law be changed to authorize a judge
to issue such an order upon finding that the prosecutor has shown that
the information is likely to be relevant. The Administration has
proposed a similar change in current law. By contrast, Professor
O'Neill suggested at the hearing that Congress should consider whether
all Internet trap and trace orders should issue only on the basis of a
judicial finding that probable cause exists to believe that a target
has or is about to commit a crime. Representatives Canady and
Hutchinson have proposed a bill that would require a prosecutor seeking
e-mail source/destination information to show specific and articulable
facts reasonably indicating that a crime has been, is being or will be
committed, plus a showing of relevance of the information sought to
investigation of that crime. A bill sponsored by Representatives Barr
and Emerson would apply that standard to all pen registers and traps-
and-traces whether or not they would identify e-mail addresses. What
modifications, if any, to the existing standard for pen registers and
traps-and-traces do you favor?
Answer 4. We believe now, as we did in 1986 when agreement was
reached in the Congress (and amongst all of the interested parties) in
enacting the Electronic Communications Privacy Act of 1986 (ECPA), that
the current (ECPA) standard with regard to the use of pen registers and
traps and traces is appropriate for the acquisition of non-content-
based pen register-related addressing and transactional information. On
March 28, 2000, Director Freeh testified in support of S. 2092, a bi-
partisan bill co-sponsored by Senator Schumer and Senator Kyl. The FBI
believes S. 2092 maintains the appropriate 1986 ECPA standard with
regard to the acquisition of non-content-based ``addressing and
routing'' information while rendering the pen register statute
technologically neutral.
Question 5. According to the FBI, Carnivore operates by sifting
through network traffic where a subject's communications are expected
to be found ``roughly analogous to using anelectronic surveillance
device . . . on a single trunk or cable within a telephone network.''
In your view, does the manner in which Carnivore operates give law
enforcement access to more than just the communications or addressing
information covered in a court order and, if so, would a
telecommunications carrier that is also serving as an ISP be put in
jeopardy of violating its duty under CALEA of protecting ``the privacy
and security of communications . . . not authorized to be
intercepted''? (47 U.S.C. 1002).
Answer 5. As to the first part of your question, the way Carnivore
operates, as described at some length in Answer #9(B), below, does not
give the FBI more than the communications or addressing information
covered by a particular court order. As to the second part of your
question, no, we believe that the CALEA directive concerning protecting
``the privacy and security of communications not authorized to be
intercepted'' applies only to those technological approaches and
technical requirements that are developed to provide solutions covered
by CALEA.
Question 6. Professor O'Neill has suggested a number of steps to be
taken by Congress to address questions raised by Carnivore, including
obtaining answers to the following questions:
A. Please explain the legal authority for law enforcement to insist
that an ISP install Carnivore?
B. Can Carnivore be easily defeated by encryption software or does
this tool capture IP addresses that are more difficult to encrypt than
the contents of messages?
Answer 6A. The primary legal authority for the FBI and the United
States Attorney's Office requiring that an ISP cooperate in installing
Carnivore would be to avoid the ``frustration'' of a particular court
order. The prospect of frustration, in the first instance, would stem
from an ISP's inability to implement a given order fully, properly,
securely, and in a timely manner. Both the Title III and the pen
register/trap and trace statutes have specific ``assistance''
provisions addressed to, among others, ``providers of wire or
electronic communications service'' for the purpose of avoiding
frustration of court orders. The statutes state that such providers
``shall furnish . . . [the] investigative or law enforcement officer
forthwith all information, facilities, and technical assistance
necessary to accomplish [the Title III interception or the installation
of the pen resister].'' Accomplish necessarily means fully accomplish,
such that valuable evidence is not lost and such that its accuracy/
integrity is not challengeable. Second, it is to be done securely. And
third, as indicated by the statutory language (``forthwith''), a
service provider must be able to assist very promptly. 18 U.S.C.
2518(4), 18 U.S.C. 3124, respectively. The language in the ``assistance
order'' issued by the judge or magistrate usually mirrors the statutory
language exactly.
As emphasized in the FBI's testimony, anytime the FBI has a
surveillance order where an ISP can (1) fully and properly accomplish
the surveillance, (2) do it securely, (3) do it very promptly, the FBI
has been content to permit the ISP to implement the order. However,
noting the foregoing statutory and court order language, the FBI and
the United States Attorney's Office legitimately and properly could
insist upon an ISP's cooperation with regard to the use of FBI
electronic surveillance equipment (whether it be Carnivore or other
equipment) that would work to execute an order fully, properly,
securely, and in a timely manner, whenever the ISP does not have the
capability to satisfy such requirements. Of course, if there were to be
a dispute in this regard between the FBI and the ISP, as with any
matter in contention, the resolution of the matter would be through the
court, with a judge or magistrate resolving the issue. Resolution would
not be dictated unilaterally by the government, much less by the FBI.
Answer 6B. Carnivore was not designed to address encryption. Any
encryption that was encountered would require decryption through other
means or devices.
Question 7. At the hearing, Dr. Kerr testified that Carnivore had
recently been updated and improved. Presumably, the FBI will continue
to update and improve Carnivore even after the independent technical
review for which the Attorney General is now arranging. According to
the FBI, one way to monitor Carnivore's use and modifications after
conclusion of the technical review is by a so-called ``audit trail''
which allows a defendant to see how the FBI conducted a Carnivore
search keystroke-by-keystroke. If the search was improperly conducted,
the defendant might have grounds for suppression. Even if the audit
trail operates as advertised, however, it will only be available to
criminal defendants against whom prosecutors seek to introduce evidence
obtained by Carnivore. How do we assure the law-abiding public after
the anticipated technical review that Carnivore will not infringe on
privacy rights? Should Congress consider an independent monitor for
that purpose?
Anwser 7. There are numerous legal, technological, and
administrative controls in place that prevent the misuse of Carnivore
and any infringement upon privacy rights.
Legal Controls: First of all, the law itself is a powerful control
to ensure that only properly authorized, lawful electronic surveillance
occurs. The FBI certainly is of this opinion. As such, the FBI only
conducts electronic surveillance--whether conducted through the use of
Carnivore of otherwise--pursuant to a lawful court order or lawful
voluntary consent of a party to the communication. This has been the
case since 1968, when the first Federal electronic surveillance laws
were enacted in the Title III legislation. Importantly, the FBI has an
outstanding record of compliance with the electronic surveillance laws
since their enactment over 30 years ago. In addition, it is very
noteworthy that the electronic surveillance laws contain stringent
deterrents to unauthorized (illegal) electronic surveillance, including
criminal (felony) and civil sanctions for any individual who violates
the law. Further, under the Constitution, suppression of illegally
obtained evidence (and fruits thereof) may be applied by Federal courts
if electronic communications content is unlawfully intercepted.
Technological Controls: As you note in your question, the Carnivore
system, by design and functionality, is set up to establish an ``audit
record'' for evidentiary purposes. Of course, a secondary aspect and
value of this design and functionality would be to aid in the
prevention of any potential infringement of privacy rights. Moreover,
as you may be aware, Carnivore, by design, is a device which only
functions to filter out. In its first filtering action, Carnivore
filters out anything not associated with the unique and specific
identifier associated with a particular criminal subject's service, as
identified in a given court order. Stated differently, Carnivore
``ignores'' and is ``blind to'' anything not associated with a criminal
subject's unique identifierthat relates to the specific authorization
set forth in the court's order. In its second filtering action,
Carnivore filters out content when the order is only for communications
addressing and transactional information. Thus, as a special purpose
electronic surveillance tool, Carnivore fundamentally and purposely
works as a ``filter.'' By contrast, Carnivore fundamentally and
purposely does not work, descriptively speaking, as a ``vacuum
cleaner'' which, by design, would purposely acquire electronic
communications broadly and indiscriminately from all network users,
including those of innocent subscribers. Hence, Carnivore's design does
serve as an effective check against any potentiality of infringing upon
privacy rights.
Administrative Controls: There are numerous administrative and
criminal justice system-based controls which preclude the errant use of
Carnivore, both in terms of internal and external oversight to control
how Carnivore is being used at any point in time. To begin with, it
should be emphasized that the FBI does not deploy or use Carnivore or
any other non-consensual electronic surveillance tool in a vacuum. With
regard to applications for pen registers or trap and trace devises,
section 3121 of Title 18 of the United States Code prohibits
Carnivore's use, as such a device, without a court order. In order to
acquire a court order, the FBI may not act alone, but must seek the
approval of an appropriate official within the Department of Justice.
Section 3122 mandates that an ``attorney for the government'' be the
applicant for a pen register or trap and trace device. Typically, this
requires the approval of the Office of the United States Attorney for
the district in which the device is to be used. Of course, more
stringent requirements mandating high-level Department of Justice
approval, are found in Title III/FISA provisions and practices
controlling the interception of electronic communications.
Within the FBI itself, there are also a number of administrative,
technological, and physical access controls which prevent the
authorized use of any electronic surveillance tool, including
Carnivore. First, as a general matter, all covert electronic
surveillance equipment is carefully controlled and overseen within the
FBI by FBI Headquarters program managers and by each field office's
Technical Advisor (TA). Second, with regard to Carnivore specifically,
there are only a few Carnivore devices and only a limited number of FBI
personnel who are trained to operate this special purpose tool, under
FBI Headquarter's oversight. Third, to use Carnivore in any given case,
such personnel must be privy to the specific access number for a
targeted account number. Fourth, such personnel can use Carnivore only
when they possess a hardware security device that is specifically
required for access. And fifth, such personnel can use Carnivore only
when they have the necessary two-tiered password access authority
required.
Finally, if any FBI employee ever were to conduct such unlawful
activity, he/she would be terminated from employment with the FBI.
There is ``zero tolerance'' for any such illegal conduct within the
FBI.
In sum, Carnivore has many legal, technological, and administrative
controls. Such controls effectively act to prevent any infringement of
privacy rights when using Carnivore.
As to the second part of your question, we believe that it would be
imprudent for the Congress to contemplate as a course of action, in the
context of the concerns expressed with regard to Carnivore, the
establishment of an outside ``independent monitor.'' There are a number
of reasons why resort of such an independent monitor would be
problematic, including, but not necessarily limited to, the following.
First, there is a likely separation of powers issue with regard to the
Executive Branch's Constitutionally-reserved right to fashion and
utilize proper sources and methods in order to lawfully and fully
execute warrants and court orders (including electronic surveillance
orders). Second, as a general proposition, such an approach, if
adopted, could give rise to the unintended result of casting the
independent monitor in the awkward role of being a sort of ``electronic
surveillance technology police,'' a role particularly ill-suited to a
complex environment of fast-moving technology and the associated need
for nimble electronic surveillance response. Third, it would appear to
use that for this approach to really work the independent monitor may
also have to assume an unprecedented and ongoing supervisory role
throughout the duration of an execution of a given court-ordered
surveillance. As can be seen, significant philosophical and legal
including Constitutional) problems arise with the prospect of having
the government itself ``surveilled'' by an ``independent monitor'' as
the FBI proceeds to lawfully execute a warrant or court order.
If assuring the propriety of FBI surveillance is the core issue, as
noted immediately above, other effective checks and balances are in
place. Also, although the focus of the instant suggestion pertains to
Carnivore, as a matter of precedent, the notion associated with using
an independent electronic surveillance monitor could in principle be
applied to every piece of electronic surveillance equipment that might
be designed and used by the FBI, by other Federal law enforcement and/
or security agencies, and by State and local law enforcement agencies.
We would strongly recommend against pursing such an approach.
Question 8. Some universities interested in responding to DOJ's
solicitation of bids to conduct the independent technical review of
Carnivore have reportedly criticized certain terms of a non-disclosure
agreement which the chosen contractor would be required to sign. One
witness at the hearing said that the FBI would be a party to the
required agreement. Please provide a copy of the non-disclosure
agreement, identify the terms that have been criticized and explain why
they are necessary.
Answer 8. Attached at the end of this document is a copy of the
``Sensitive Information Nondisclosure Agreement'' (NDA) executed by the
Carnivore review team contractor.
In the recent Senate hearing on Carnivore, Mr. James Dempsey cited
a USA Today On Line story where certain universities reportedly had
indicated a reluctance to participate. One point noted in the story was
that ``Universities and any other contractors must agree not to publish
anything the government deems sensitive.'' Hence, it appears, based
upon the USA Today's characterization, that the university community's
objection is more global as to the general proposition of not
disclosing ``sensitive'' information as opposed to any particular
``term'' or provision in the NDA.
To begin with, the attached NDA is derived from a standard FBI NDA
form (FD 857) which the FBI sues when sharing sensitive information
with outside entities such as contractors and other persons. Such NDAs
are also typically included in FBI/DOJ federal contracting. In the
instant case, the FBI worked with the Carnivore review team contractor,
the Illinois Institute of Technology Research Institute (IITRI), in
formulating final NDA language which satisfied the contractor and which
did not stifle the full review of Carnivore by the contractor.
As to the second part of the question, electronic surveillance
equipment, including software, is sensitive and, under law, information
about it is strictly controlled and constrained.
As you are aware, in enacting the first comprehensive U.S.
electronic surveillance laws, Title III of the Omnibus Crime Control
and Safe Streets Act of 1968 (Title III), 18 U.S.C. 2510-2522, as
amended, the Congress instituted a balanced regime which both affords
clear statutory authority and Constitutionally-compliant procedures to
enable law enforcement to lawfully conduct electronic surveillance
pursuant to court order and which also criminalizes the unauthorized
conduct of electronic surveillance in order to underscore the Congress'
intention of preventing unlawful searches and seizures and of
preserving communications privacy. To advance both of these principles,
the Congress also crafted a particular Title III provision to prevent
the proliferation of surreptitious electronic surveillance interception
devices. See 18 U.S.C. 2512 (Manufacture, distribution, possession, and
advertising of wire, oral, and electronic communication intercepting
devices prohibited). The only two categories of users exempted under
Section 2512 from using such devices are providers of wire or
electronic communication service, with regard to equipment utilized by
them in the normal course of providing their service, and governmental
officials, with regard to equipment utilized by them in the normal
course of carrying out governmental activities.
Similarly, there are statutory and regulatory U.S. export control
regimes which govern the export of electronic surveillance equipment
(e.g., the Arms Export Control Act, as implemented by the International
Traffic in Arms Regulations, and the Export Control Act, as implemented
by the Export Administration Regulations). Depending on the type of
electronic surveillance device involved, one or both of these regimes
govern the export of electronic surveillance equipment.
In short, electronic surveillance equipment generally, and that
used by the FBI in particular (at least that electronic surveillance
equipment used in covert, non-consensual efforts--i.e. surreptitious
electronic surveillance devices) is treated as sensitive, at a minimum.
In many cases, such equipment may also be classified. Hence, in light
of the above, the FBI is concerned about the legal and policy
constraints and controls that would conflict with the open-ended public
disclosure of such electronic surveillance equipment, including its
software.
With regard to Carnivore, and again in light of the above laws,
controls, and constraints, we believe that it would be improper to
disclose to the public generally the source code of Carnivore. The
source code, after all, is for a special purpose surreptitious
electronic surveillance system which should be treated with
circumspection. Public disclosure of the source code could lead to the
unintended and harmful effect of facilitating unauthorized, and hence
unlawful electronic surveillance. Also, it may well be that disclosure
could inform the criminal community about aspects of Carnivore that
might suggest some potential for circumvention.
However, as you are aware, the FBI will disclose the Carnivore
source code to the IITRI review team under controlled circumstances in
order to give assurance to the public that Carnivore operates properly
and lawfully, as the FBI claims it does. In so sharing such sensitive
information, it is altogether appropriate that an NDA be utilized to
protect the information. It is important to note, however, that nothing
in the NDA can reasonably be read to prohibit or stifle the disclosure
of information of findings, potentially critical of Carnivore or the
FBI, to the Attorney General and the Department of Justice. In
conclusion, the testimony of the respected Internet expert, Mr. Vint
Cerf (who previously was briefed as to Carnivore and who signed an
NDA), is worth noting in this regard. At the hearing, Mr. Cerf
testified, ``May I just interject that I agreed to sign the
nondisclosure on the principle that when you're dealing with
surveillance just as you would with other intelligence situations,
sources and methods are always a sensitive issue.''
Question 9. In the D.C. Circuit Court of Appeals recent decision on
the FCC's implementation of CALEA (the ``Communications Assistance for
Law Enforcement Act''), the Court agreed with the FCC that under a
standard adopted by telecommunications carriers for packet-switched
networks, the carriers could provide both packet headers and the
content, or ``payload,'' to law enforcement. Carriers argued that
technically they could not separate the two, while the FBI contended
that it had equipment which could ``distinguish between a packet's
header and its communications payload and make[] only the relevant
header information available for recording or decoding.''
A. Was the FBI referring to its ``Carnivore'' equipment when it
made this representation to both the FCC and the Court?
B. The FBI's representation was critical, since both the FCC and
the Court noted that ``privacy concerns could be implicated if carriers
were to give to [law enforcement] packets containing both [the
addressing information and the content] when only the former was
authorized.'' When Carnivore is installed, is the ISP essentially
giving law enforcement the entire traffic flow over that particular
part of the network, including both addressing information and content
of packets?
C. The FBI testified at the hearing that CALEA does not apply to
ISPs. In fact, CALEA, by its terms, applies only to telecommunications
carriers. Are there telecommunications carriers that are also ISPs? If
so, please provide examples.
D. Should the privacy concerns expressed by the Court for packet-
switched networks apply only to telecommunications carriers, as defined
in CALEA, or do those concerns apply more broadly to ISPs?
Answer 9A. The reference in question was not to Carnivore. The
representation was generic as to what the FBI believes can be designed
to separate communications from call-identifying information.
Answer 9B. First, we would like to clarify a couple of points
included in the opening paragraph of this CALEA-related question. One
point is that the FBI has asserted in its FCC filings regarding CALEA
that, as a matter of technology, it believes that devices can be
designed that would be capable of separating the communications content
from the communications call-identifying information. A second point is
that, assuming the availability of such devices, any entity, including
a ``telecommunications carrier'' under CALEA, presumably could avail
itself of them and use any such device itself.
As to your specific question, ``[w]hen Carnivore is installed, is
the ISP essentially giving law enforcement the entire traffic flow over
that particular part of the network, including both addressing
information and content of packets?'' (emphasis added), some
clarification is in order. First, what an ISP ``gives'' to law
enforcement, when it identifies a ``particular part of [its] . . .
network]'' is a vantage point through which ``access'' can be achieved
as to the specific communications traffic of a particular criminal
subject, based exclusively upon that particular criminal subject's
unique identifying information.
Further, to better respond to your question, it is useful to
explain more particularly how Carnivore actually works. As we set forth
in our statement for the record, Carnivore is a special purpose
electronic surveillance system which, pursuant to an appropriate court
order or lawful consent, is used to acquire or intercept a criminal
subject's communications addressing and transactional information or
communications content, respectively, based exclusively upon filtering
that segregates a criminal subject's communications traffic based upon
his/her unique identifying information (e.g., his/her E-mail address,
IP address). Carnivore does not acquire or intercept any innocent, non-
criminal subject's communications addressing or transactional
information or communications content.
Moreover, it is important to understand that Carnivore's filtering
operates in stages--and that all filtering occurs exclusively within
the ``Carnivore box.'' As noted, Carnivore's first operation is
exclusively to detect the criminal subject's identifying information.
The first stage of filtering in the Carnivore system is to match (in
purely binary computer code) the ``pattern'' of ``1's'' and ``0's'' in
the computer bit stream that matches the criminal subject's identifying
information ``pattern''--which identifying information is set forth in
the court's order. So, in a very simplified example, with the filter
exclusively set to detect the criminal subjects's computer bit pattern
``1100,'' if the first bit in the computer bit stream was an ``0,''
Carnivore would automatically conclude that since ``0'' and ``1'' are
not a match, that this circumstance does not meet the filter pattern
criteria, and it would quickly move onto conduct the next pattern match
effort. If the first digit is a match, Carnivore would then go to the
next digit in the computer bit stream, and repeat the process, until an
exact, complete match is arrived at.
Importantly, nothing happens at all, by way of any interception of
communications content or acquisition of communications addressing
information, unless and until the criminal subject's unique identifying
information has been matched. Then, and only then, does Carnivore move
on to the second stage of filtering, in terms of applying the
appropriate filters required to filter either for communications
addressing information acquisition or for full communications content
interception, depending upon the particular authorization found within
the court's order. Finally, FBI personnel only receive and ``see'' the
communications addressing information or communications content of the
criminal subject, as appropriate--based upon the court's order--after
all of the Carnivore filtering has been completed exclusively within
the Carnivore box. Indeed, whenever any network traffic is stored on
the Carnivore system, it remains in the same format of 0's and 1's;
and, importantly, it is not turned into a format intelligible to humans
until after it is transferred from the Carnivore system.
In sum, Carnivore never conducts a search of the communications
addressing or transactional information or communications content of
any innocent, non-criminal subject at all. Indeed, even with the
criminal subject's communications traffic, Carnivore filters the
criminal subject's ``machine readable only'' binary code exclusively
within the box; and FBI personnel only obtain, in a humanly
intelligible format--and ``outside of the box''--the appropriate
criminal evidence sought after Carnivore has completely concluded its
programmed filtering efforts within the box.
Answer 9C As implied in your question, and as anticipated in CALEA,
a communications service provider's business could offer both
telecommunications services and information services. Examples of such
companies are AT&T and MCI WorldCom. CALEA's coverage with reference to
the definition of ``telecommunications carrier'' ``does not include (i)
persons or entities insofar as they are engaged in providing
information services (emphasis added). `` See 47 U.S.C. 1001(8)(C).
Answer 9D. The D.C. Court of Appeals decision pertained to the
actions taken by the Federal Communications Commission in light of its
CALEA-implementing Third Report and Order, and with reference to
actions taken by the Telecommunications Industry Association in its
CALEA-implementing J-Standard. The court's decision, hence, was CALEA-
centric. The FBI and the Department of Justice (DOJ) have articulated
their perspectives with regard to packet mode communications at some
length in their comments before the FCC (see FBI and Department of
Justice ``Comments Regarding Further Notice of Proposed Rulemaking,''
CC Docket No. 97-213 at 77-81) and in their brief before the D.C.
Circuit Court of Appeals (see Final Brief for the United States at 15-
18).
With reference to the aforementioned FBI/DOJ Comments before the
FCC, we note, as did the FBI/DOJ Comments at pages 79-80, that there is
nothing in CALEA or its legislative history to indicate that Congress
meant to prohibit the use of law enforcement electronic surveillance
equipment which has the capability of separating signals of
communications content from communications transactional information.
For example, all ``local loop'' electronic surveillance efforts
necessitate such tools and approaches. And no one, to our knowledge, is
suggesting,for example, that ``local loop'' interceptions are in any
way affected or curtailed by CALEA or otherwise. Further, to quote from
the Comments:
``It is worth noting that Section 103(a)(4) does not state that
carriers ``shall no deliver'' communications and call-identifying
information that law enforcement is not authorized to intercept, but
only that carriers shall ``protect the privacy and security'' of such
information. A carrier is entitled to rely on enforcement's discharge
of its legal obligation under 18 U.S.C. Sec. 3121(c) as a means of
``protecting the privacy'' and security'' of information that law
enforcement is not authorized to intercept. Accordingly, the J-Standard
is not deficient in this regard.''
Comments at 80. Moreover, with reference to the aforementioned FBI/
DOJ Brief, we quote the following:
``* * * because the use of minimizing technology under Section
3121(c) can prevent law enforcement agencies from hearing or seeing the
content portion of a packet stream, the J-Standard does not offend
Title III or the Fourth Amendment. Cf. United States v.Miller, 116F.3d
641, 659-60 (2d Cir. 1997) (use of pen register device that is capable
of recording call content as well as dialing information does not
violate Title III), Sanders v. Robert Bosch Corp., 38 F.3d 736, 742
(4th Cir. 1994) (no Title III interception occurred when oral
conversations were monitored and transmitted by hidden microphone but
contents of conversations were neither heard nor recorded).''
Brief at 17. Thus, in light of the above, and notwithstanding any
concerns which may have been expressed by the court with regard to
packet-switched communications generally, we believe, both with regard
to networks of telecommunications carriers and the networks of
computer-based ``information services,'' that privacy and security
protection can be satisfied in privacy-enhancing electronic
surveillance tools such as Carnivore. Since we believe that privacy and
security protection can be, and is being, maintained, we do not
necessarily share the rendition of ``privacy concerns'' as alluded to
in the dicta of the D.C. Court of Appeal's CALEA-based decision.
Question 10. The public concern about use of Carnivore and
government surveillance of the Internet has prompted at least one
witness at the hearing to call for more Congressional oversight. In
this connection, I introduced last year as part of the E-RIGHTS Act, S.
854, a proposal to require the Attorney General to provide the Congress
annual reports on the number of warrants, court orders and subpoenas
for government interceptions of e-mail and other electronic
communications under 18 U.S.C. section 2703. What is your view of
whether this proposal would assist Congress in providing appropriate
oversight and necessary information about government practices under
the law?
Answer 10. The FBI is certainly on record as being amenable to
Congressional oversight, including in the area of electronic
surveillance. As noted in the last section of our Hearing statement for
the record, a great deal of Congressional oversight already exists,
particularly in the area of electronic surveillance. With regard to
whether it is a good idea to require the Attorney General to provide to
the Congress detailed annual reports regarding all of the Department of
Justice agency components' warrants, court orders, and subpoenas
pertaining to governmental acquisitions of stored E-mail and other
electronic communications obtained under 18 U.S.C. Sec. 2703, we would
defer to the Department of Justice.
Sensitive Information Nondisclosure Agreement
An Agreement between __________ and the Federal Bureau of
Investigation (FBI) regarding the nondisclosure of sensitive FBI
information, to wit: any and all information received, observed, or
otherwise required from the FBI or the U.S. Department of Justice (DOJ)
arising from a review requested by the Attorney General of the United
States (the Review) of the FBI's Carnivore device and system,
including, but not limited to, any and all information pertaining to
the Carnivore software and associated software and hardware devices and
systems; any and all information pertaining to investigations,
investigative uses, operations, procedures, policies, practices,
guidelines, contracts, sensitive (including proprietary) governmental
information, nongovernmental proprietary information, training,
training documents, manuals, technical descriptions, source code,
object code, executable software, designs and design information,
documentation, descriptions, tests, test results, test scenarios,
deficiencies, and vulnerabilities associated with the Carnivore device
and system (``Sensitive Information'').
1. Intending to be legally bound, I hereby accept the obligations
contained in this Agreement in consideration of my being granted access
to Sensitive Information from the FBI or the DOJ arising from the
Review as required to perform my duties. I also understand and accept
that by being granted access to this Sensitive Information, special
confidence and trust shall be placed in me by the FBI.
2. I hereby acknowledge that I have been briefed concerning the
nature and protection of Sensitive Information, including the
procedures to be followed in ascertaining whether other persons to whom
I contemplate disclosing this information have been approved for access
to it, and that I understand these procedures. Further, I understand
that unauthorized use or disclosure of Sensitive Information, marked or
unmarked, including, but not limited to, oral communications or
information observed or gleaned arising from the Review, may
compromise, jeopardize or subvert current, past, or future law
enforcement activities, investigations, or investigative techniques and
may compromise, jeopardize or subvert existing or future FBI contracts,
contractual relationships between the FBI and vendors, or the ability
of the FBI to effectively contract with vendors now or in the future.
3. I agree to manage all Sensitive Information in a manner
consistent with procedures recommended by the FBI or DOJ, and I will
not now or in the future use, disclose, or retain Sensitive Information
unless such disclosure is necessary in the performance of the Review,
and I have either officially verified that the recipient of such
information has been properly authorized by the FBI or DOJ to receive
it, or been given prior written notice of authorizationfrom the FBI or
the DOJ that such use, disclosure or retention is permitted. I
understand that if I am uncertain as to the sensitive nature or status
of information as Sensitive Information, I am required to confirm from
an authorized FBI or DOJ official that such information may be used,
disclosed or retained prior to its use, disclosure or retention. The
obligations imposed upon me herein shall not apply to Sensitive
Information which is disclosed pursuant to a valid order of a court or
governmental body or any political subdivision thereof; provided,
however, that I shall first have given notice to the FBI or DOJ in
order to permit them to seek a protective order and in such case I
shall assist the FBI or DOJ in filing a protective order in accordance
with applicable rules; and if such order issues, disclosure under this
provision shall be made only in accordance with the terms of the
protective order. Not withstanding this provision, IITRI shall be able
to retain one (1) copy of the draft and final reports provided to the
FBI or DOJ as a result of the Review for a period of one year after
completion of the Review, after which time such copies shall be
returned to the FBI or DOJ.
4. I have been advised that except as necessary for the Review, any
effort to reverse engineer the Carnivore software or other software,
including software code, to which I may be given access during the
Review may cause irreparable damage to (a) FBI investigations and
investigative techniques; (b) FBI contracts, contracting capabilities,
contractual relationships between the FBI and vendors, or the ability
of the FBI to effectively contract with vendors now and in the future;
or (c) the rights of third parties to protect their proprietary
information; and I will not undertake any such action, use, or effort
to reverse engineer Carnivore or other software, including software
code, or undertake any other action, use, or effort that is
inconsistent with the sensitive and protected nature of this software,
unless I have been given prior and explicit written authorization from
the FBI or DOJ that such action, use, or effort is permitted. I will
also not duplicate or copy Sensitive Information arising from the
Review in a manner inconsistent with the procedures recommended by the
FBI or DOJ. I acknowledge that unauthorized duplication or copying of
Sensitive Information arising from the Review may cause irreparable
damage to FBI investigations, investigative techniques, or contracting
capabilities.
5. I have been advised that any breach of this Agreement may result
in the termination of my relationship with the FBI and the DOJ and my
removal from the Review. In addition, I have been advised that any
unauthorized disclosure, use, or retention of Sensitive Information by
me may constitute a violation or violations of United States criminal
laws, including those codified in title 18, United States code, or may
lead to criminal prosecution for obstruction of lawful government
functions. I realize that nothing in this Agreement constitutes a
waiver by the United States of the right to prosecute me for any
statutory violation.
6. I understand that all Sensitive Information to which I have
access or may obtain access by signing this Agreement is now and will
remain the property of, or in the control of the FBI or DOJ unless
otherwise determined by an authorized FBI or DOJ official or final
ruling in a court of law. I agree that I shall return all Sensitive
Information provided to me by the FBI or DOJ in written or any other
tangible form which has come or may come into my possession, or for
which I am responsible because of such access: (a) upon demand by an
authorized representative of the FBI or the DOJ, or (b) upon the
conclusion of my relationship with the FBI or the DOJ incidental to
this Review, whichever occurs first.
7. Unless and until I am released in writing by an authorized
representative of the FBI or the DOJ, I understand that all conditions
and obligations imposed upon me by this Agreement apply during the time
I am granted access to the Sensitive Information and at all times
thereafter.
8. Each provision of this Agreement is severable. If a court should
find any provision of this Agreement to be unenforceable, all other
provisions of this Agreement shall remain in full force and effect.
9. I understand that the United States Government may seek any
remedy available to it to enforce this Agreement including, but not
limited to, application for a court order prohibiting disclosure or use
of Sensitive Information in breach of this Agreement. I hereby assign
to the United States Government all royalties, remunerations, and
emoluments that have resulted, will result, or may result from any
disclosure, use, or retention of Sensitive Information not consistent
with the terms of this Agreement.
10. I have read this Agreement carefully and my questions, if any,
have been answered.
Signature____________ Date____________
Organization (if contractor, provide name and address):
The briefing and execution of this Agreement was witnessed by
(type or print name)
Signature____________ Date ____________
______
Security Debriefing Acknowledgment
I reaffirm that the provisions of the Federal criminal laws
applicable to the safeguarding of Sensitive Information have been made
available to me by the FBI or DOJ; that I have returned all Sensitive
Information in my custody; that I will not use, disclose or retain
myself Sensitive Information to any unauthorized person or
organization; that I will promptly report to the FBI any attempt by an
unauthorized person to solicit Sensitive Information; and that I have
received a debriefing regarding the security of Sensitive Information.
Signature____________ Date ____________
Name of Witness (type or print)____________
Signature of Witness____________ Date ____________