Unites States politicians demand to know more about the FBI's three-year-old e-mail surveillance software.
Officials from the FBI and the US Department of Justice faced a sceptical -- and at times downright hostile -- US House Judiciary Committee during an oversight hearing on the constitutional issues raised by the FBI's Carnivore electronic monitoring program.
Both Republican and Democrats representatives raised repeated concerns about how the FBI's e-mail surveillance software operates. Committee members demanded to know why the FBI didn't inform Congress about it sooner and how the agency planned to keep Carnivore from eroding users' increasingly ill-protected online privacy.
Carnivore is a program that the FBI has been developing for three years, which allows US federal law enforcement agents to monitor e-mail communications in criminal investigations once the software is attached to the network of an Internet Service Provider.
During Monday's hearing, FBI officials acknowledged that Carnivore had been deployed 25 times since its inception, 16 times during the current calendar year.
It has been used to gather evidence in six criminal cases and 10 national security cases, FBI officials testified. E-mail messages were scrutinised in all cases but one, when Carnivore was used to monitor an FTP packet.
Now you tell us
Despite the FBI's and DOJ's assurances, committee members raised questions
about everything from Carnivore's predatory name, to the checks and balances
the agency has in place to prevent potential misuse of the system.
Republican Melvin Watt asked FBI and DOJ officials what took them so long to come forward with information about Carnivore.
The FBI acknowledged that Carnivore has been deployed 25 times since its inception, 16 times this year.
"You've engaged in 25 uses ... but only now are attempting third-party verification?" Watt said.
"The essence of a development program is to learn as you develop and deploy," said Donald Kerr, assistant director of the FBI's lab division, who said a number of DOJ and Judiciary committee members had received briefings on Carnivore months ago.
Another committee member, Republican Robert Barr, was even more combative in his line of questioning. "This is new legal ground you are trying to make here," Barr told FBI and DOJ witnesses at Monday's hearing. "You can go in and harvest large quantities of information and harvest out what you want. ISPs have indicated they can do the very same thing... but with more protection of users' privacy."
FBI on the defensive
The FBI said that all uses of Carnivore had been reported in the agency's
annual wiretap report in the "other" category.
"We have the legal authority to do what we're doing today," testified Kevin DiGregory, a deputy associate attorney general with the DOJ. E-mail "addressing information on the Internet is a useful and appropriate analog to phone numbers," he added, when asked how Carnivore compares with the FBI's existing wiretapping techniques.
FBI and DOJ officials stated that without Carnivore, federal law enforcement would be unable to fight growing numbers of Net-related crimes -- from child porn to online fraud.
Only Friday, after repeated media reports and industry questions, did the FBI hold a press conference to explain Carnivore and how it works. The FBI subsequently posted some information on Carnivore to its Web site.
FBI officials testifying on Monday told House Judiciary members that the agency had agreed to submit the source code for the Carnivore software to an independent, academic third-party body for review. The results will be distributed to the US government, academia and industry.
Kerr, of the FBI, hinted outside the hearing room that the source code might go to either the San Diego Supercomputer Centre or NASA some time within the next few months.
But FBI and Department of Justice officials held fast to their position that supplying Carnivore's source code to a larger industry group could risk exploitation of the program by Internet criminals.
ACLU wants a look inside
Several of the third parties testifying during Monday's hearing, including
the American Civil Liberties Union, have filed for access to the FBI's
Carnivore source code under the Freedom of Information Act.
In a statement released during the hearing, the ACLU characterised Carnivore as the latest piece of evidence that the FBI "is engaged in an 'unprecedented' power grab that threatens the privacy of all Americans.
Both FBI and DOJ officials emphasised that without Carnivore, US federal law enforcement officials would be unable to combat the growing number of Internet-related crimes, ranging from child pornography to hacking and online fraud.
DiGregory, of the DOJ, went so far as to claim that if the government "fails to make the Internet safe," e-commerce could be in jeopardy.
The FBI's Kerr said the structure of Carnivore wasn't very different from commercial packet-sniffing programs. Filters that are part of the program allow the agency to sniff only the "To" and "From" lines in e-mail messages or entire e-mail threads "if we have an order to capture all the packets," he explained.
Carnivore vs. Earthlink
He added that the FBI had deployed Carnivore with the permission and
cooperation of ISP's, only if the providers were too small or not
technically savvy enough to produce information requested by the agency as
part of criminal investigations.
"In every case, a court order is required" to deploy Carnivore, he reassured House committee members repeatedly. "We don't do broad surveillance."
But Republican Charles Canady wanted to know more about the EarthLink Network's experiences with Carnivore, specifically whether the software had caused a crash and disruption of service for the ISP's customers.
Kerr attributed the problem to Earthlink's failure to supply the FBI with e-mail information without the installation of Carnivore.
Robert Corn-Revere, an attorney with Hogan & Hartson representing Eathlink in an FBI lawsuit over Carnivore, also testified Monday. He advocated a "more cautious approach" when it comes to expanding electronic surveillance.
Corn-Revere said Carnivore goes far beyond the "very limited surveillance authority provided by a trap and trace order," since it allows both content and header information for all messages received or sent by ISPs to be collected.
