WASHINGTON (08/07/2000) - Less than a year ago, when a top priority of privacy advocates was to get rid of the U.S. government's tight encryption export policy, government officials told an interesting anecdote that helped explain why they wanted to maintain the tight controls.
They said the investigators who cracked the case of the 1993 World Trade Center bombing in New York were able to capture evidence from the bomber's laptop only because he used low-grade encryption. Had he used the stronger encryption that at the time was being restricted, evidence needed to convict him would have been much harder to obtain.
It's a story that helped explain why the government wanted to maintain the tight encryption export rules, and it's the kind of story the Federal Bureau of Investigation (FBI) could use right now as it defends its Carnivore sniffer program, which is used under U.S. wiretap law to garner evidence from e-mail in criminal and national security investigations.
The FBI has been asked a number of times to disclose details of the cases in which Carnivore has been deployed, but so far it hasn't commented because, it says, the cases are still being litigated.
So there're no stories about how Carnivore has been used to trap a terrorist, a child pornographer or a drug ring. Instead, the public and Congress are left to speculate, leading to "Big Brother" scenarios and bad publicity over a system that so far has been used just 25 times. Some of the reports, when coupled with the system's aggressive-sounding name, make it sound like the government has a big appetite for snooping through the private e-mail of American citizens.
The privacy advocates' alarm is not undue, but anyone who fears that the U.S. government is peeking indiscriminately into their e-mail should consider the many steps law enforcement officials have to take in order to use Carnivore.
To start with, the prosecutor must obtain approval from a high-level Department of Justice official, which is more than it takes to get a search warrant.
Applications for electronic surveillance also must demonstrate "probable cause" to believe an illegal activity is taking place, and specify the offenses being committed, the names of the people involved and the Internet service provider (ISP) that the subject is using. The focus is on gathering specific evidence, not on randomly gathered intelligence.
In every case, the surveillance is conducted under a court order that restricts collection of data to the named targets.
Some of these existing protections have been skimmed over by critics amid the uproar over Carnivore, and deserve a more thorough airing. The FBI says reports have failed to mention that all but one of the ISPs it has gone to with a Carnivore-related court order has cooperated fully.
But the FBI's reliance on laws that were written for a different telecommunications era to justify Carnivore isn't entirely satisfying. Congress shouldn't ignore some of the suggestions of privacy advocates, such as those made by the Center for Democracy and Technology, that would make adjustments to the wiretap law to spell out specific rules for Carnivore.
There are a number of reasons privacy advocates think Carnivore is dangerous.
Chief among them is that it gives investigators access to more data than the government is entitled to collect. Unlike the wiretap of a telephone line, in which the investigator listens in on a single line running between a suspect's home and the telephone company, Carnivore sweeps over a lot of digital packets, including the e-mail of people who have nothing to do with the investigation.
Although the FBI says not to worry, because any officer who misuses electronic surveillance systems risks a fine and up to five years in jail, CDT wants to make that assurance more iron-clad, a reasonable change Congress should make.
There's no question that systems like Carnivore will be needed in the future as criminals make use of the Internet. Congress found a way to conduct surveillance of telephones and other electronic communications without requiring huge sacrifices of privacy. We should expect that it would be equally judicious in protecting the privacy of digital communications.
Until then, it would be nice if FBI were to come forward with at least one story about how the teeth of its Carnivore helped rip apart a criminal enterprise.