"TRUST US. We are the government." That's what the FBI and other federal law enforcement agencies are asking the American public to do when they seek to assure us that no one's privacy is being violated by its new online wiretapping system.
The system, aptly if chillingly dubbed Carnivore by the FBI itself, forces Internet Service Providers to attach a black box to their networks -- essentially a powerful computer running specialized software -- through which all their subscribers' communications traffic flows.
With all due respect to the FBI, the American Civil Liberties Union is not prepared to take the giant leap of faith that the FBI will only look at or capture the small set of communications to which they are entitled under a court order. We are determined to discover what exactly is being devoured by Carnivore and how the information is being used by federal law enforcement agencies.
To do so, last week we filed a first-of-its- kind request under the Freedom of Information Act asking the FBI to disclose the computer source code and other technical details about Carnivore and its predecessors, Omnivore and Etherpeek. Our request seeks all agency records, including ``letters, correspondence, tape recordings, data, memoranda, computer source and object code, technical manuals and technical specifications.''
It is our belief that only through careful examination of Carnivore's computer code -- the set of instructions for a program -- can the public determine whether the e- mail privacy of millions of innocent people is being violated. But the outlook isn't good.
Many in the Internet industry and Congress have said that they are disturbed by reports of Carnivore because it has the potential to eavesdrop on all customers' digital communications, from e-mail and instant messages to online banking and Web surfing. The ISPs have also emphasized that Carnivore is unnecessary since they can and have been providing law enforcement with the targeted communications for which they have an order. There is no need for a dragnet when you can zero in on a target.
In traditional wiretaps, the government is required to ``minimize'' its interception of nonincriminating -- or innocent communications. But Carnivore does just the opposite by scanning through tens of millions of e-mails from innocent Internet users as well as the targeted suspect.
It is as though the FBI suddenly believes it has the right and legal authority to send agents into the post office to rip open each and every mailbag and search for one specific letter. To use another analogy, Carnivore is like the telephone company being forced to give the FBI access to all the calls on its network when it only has permission to seek the calls for one subscriber.
The discovery of the Carnivore system has put a media spotlight on efforts by law enforcement officials to expand the government's snooping abilities in the electronic age. It used to be, of course, that most of the information people wanted to keep private was stored in their home and government officials had to obtain a warrant to search the property. And to the extent that anyone else gained access to a person's most private information, it was difficult to store and tougher to collate.
In today's electronic age, however, an invasion of personal privacy is only a point and click away, which the American public seems to recognize all too well. A Wall Street Journal poll conducted at the end of the last year indicated that Americans were more concerned in the new millennium about loss of personal privacy than things like terrorism, crime or even the economy. In some ways, the government is listening. Just this week, John Podesta, the White House chief of staff, delivered a major policy address on electronic privacy that included two potentially promising, although limited, legislative proposals for tightening the rules on electronic wiretaps. But the speech was long on rhetoric and short on action. The administration should have announced a suspension of the use of Carnivore. And the president could have issued an executive order requiring federal law enforcement agencies under his command to adhere to the stricter standards he is proposing be enacted into law.
Those steps would have represented significant advances in protecting privacy. Instead, the administration offered legislative proposals that are probably doomed to failure since Congress has little time left before it recesses for the fall elections. Even though it has tried to persuade the American public that it cares about cyberprivacy, the Clinton administration's failure to take decisive action has proven that the old axiom "watch what we do, not what we say" applies all too well. The ACLU continues to reject the government's "trust us" attitude and will work with the next administration and Congress to protect the privacy of all Americans by ensuring that these latest black-box snooping efforts are banned outright.
Published on Friday, July 21, 2000 in the San Francisco Chronicle
Reproduced as historical documentation. Fair use.
