``TRUST US. We are the government.'' That's what the FBI and other
federal law enforcement agencies are asking the American public to do
when they seek to assure us that no one's privacy is being violated
by its new online wiretapping system.
The system, aptly if chillingly dubbed Carnivore by the FBI
itself, forces Internet Service Providers to attach a black box to
their networks -- essentially a powerful computer running specialized
software -- through which all their subscribers' communications
With all due respect to the FBI, the American Civil Liberties
Union is not prepared to take the giant leap of faith that the FBI
will only look at or capture the small set of communications to which
they are entitled under a court order. We are determined to discover
what exactly is being devoured by Carnivore and how the information
is being used by federal law enforcement agencies.
To do so, last week we filed a first-of-its-
kind request under the Freedom of Information Act asking the FBI to
disclose the computer source code and other technical details about
Carnivore and its predecessors, Omnivore and Etherpeek. Our request
seeks all agency records, including ``letters, correspondence, tape
recordings, data, memoranda, computer source and object code,
technical manuals and technical specifications.''
It is our belief that only through careful
examination of Carnivore's computer code -- the set of instructions
for a program -- can the public determine whether the e-
mail privacy of millions of innocent people is being violated. But
the outlook isn't good.
Many in the Internet industry and Congress have said that they are
disturbed by reports of Carnivore because it has the potential to
eavesdrop on all customers' digital communications, from e-mail and
instant messages to online banking and Web surfing. The ISPs have
also emphasized that Carnivore is unnecessary since they can and have
been providing law enforcement with the targeted communications for
which they have an order. There is no need for a dragnet when you can
zero in on a target.
In traditional wiretaps, the government is required to
``minimize'' its interception of nonincriminating -- or innocent
communications. But Carnivore does just the opposite by scanning
through tens of millions of e-mails from innocent Internet users as
well as the targeted suspect.
It is as though the FBI suddenly believes it has the right and
legal authority to send agents into the post office to rip open each
and every mailbag and search for one specific letter. To use another
analogy, Carnivore is like the telephone company being forced to give
the FBI access to all the calls on its network when it only has
permission to seek the calls for one subscriber.
The discovery of the Carnivore system has put a media spotlight on
efforts by law enforcement officials to expand the government's
snooping abilities in the electronic age. It used to be, of course,
that most of the information people wanted to keep private was stored
in their home and government officials had to obtain a warrant to
search the property. And to the extent that anyone else gained access
to a person's most private information, it was
difficult to store and tougher to collate.
In today's electronic age, however, an invasion of personal
privacy is only a point and click away, which the American public
seems to recognize all too well. A Wall Street Journal poll conducted
at the end of the last year indicated that Americans were more
concerned in the new millennium about loss of personal privacy than
things like terrorism, crime or even the economy.
In some ways, the government is listening. Just this week, John
Podesta, the White House chief of staff, delivered a major policy
address on electronic privacy that included two potentially
promising, although limited, legislative proposals for tightening the
rules on electronic wiretaps. But the speech was long on rhetoric and
short on action. The administration should have announced a
suspension of the use of Carnivore. And the president could have
issued an executive order requiring federal law enforcement agencies
under his command to adhere to the stricter standards he is proposing
be enacted into law.
Those steps would have represented significant advances in
protecting privacy. Instead, the administration offered legislative
proposals that are probably doomed to failure since Congress has
little time left before it recesses for the fall elections. Even
though it has tried to persuade the American public that it cares
about cyberprivacy, the Clinton administration's failure to take
decisive action has proven that the old axiom ``watch what we do, not
what we say'' applies all too well. The ACLU continues to reject the
government's ``trust us'' attitude and will work with the next
administration and Congress to protect the privacy of all Americans
by ensuring that these latest black-box snooping efforts are banned
Barry Steinhardt is the associate director of the American Civil Liberties Union.
©2000 San Francisco Chronicle