IP: read it and weep for your freedom -- ACLU "Carnivore" Letter

[Dave Farber <farber@cis.upenn.edu>]

>
>Date: Wed, 12 Jul 2000 01:42:15 -0700
>From: Barry Steinhardt <Barrys@aclu.org> (by way of Stanton McCandlish)
>Subject: Carnivore Letter
>
>
>
>Below is the text of the letter that the ACLU sent today to the House
>Judiciary Subcommittee on the Constitution regarding the FBI's aptly
>named "CARNIVORE" system for intercepting email. This is the system
>that was the subject of this morning's story in the Wall Street Journal
>and David Sobel's earlier posting.
>I
>
>Barry Steinhardt
>
>
>
>July 11, 2000
>
>VIA FAX
>Hon. Charles T. Canady, Chairman                Hon. Melvin L. Watt,
>Ranking Member
>Constitution Subcommittee of the                Constitution
>Subcommittee of the
>House Judiciary Committee                       House Judiciary Committee
>362 Ford House Office Bldg.                     362 Ford House Office Bldg.
>Washington, D.C. 20515-6220             Washington, D.C. 20515-6220
>
>Dear Representatives Canady and Watt:
>
>We are writing to you about the new FBI email surveillance system aptly
>named "Carnivore," which gives law enforcement extraordinary power to
>intercept and analyze huge volumes of email. The Carnivore system gives
>law enforcement email interception capabilities that were never
>contemplated when Congress passed the Electronic Communications Privacy
>Act  (ECPA), codified in relevant part at 18 U.S.C. 2510-22 and 18 USC
>3121-27. Carnivore raises new legal issues that cry out for
>Congressional attention if we are to preserve Fourth Amendment rights
>in the digital age.
>
>The existence of Carnivore first came to light in the April 6 testimony
>of Attorney Robert Corn-Revere to the Constitution Subcommittee. Its
>operation was further detailed in a report that appeared in today's
>Wall Street Journal (copy attached).  According to these reports, the
>Carnivore system -- essentially a computer running specialized
>software-- is attached directly to an Internet Service Provider's (ISP)
>network. Carnivore is attached either when law enforcement has a Title
>III order from a court permitting it to intercept in real time the
>contents of the electronic communications of a specific individual, or
>a trap and trace or pen register order allowing to it obtain the
>"numbers" related to communications from or to a specified target.
>
>But unlike the operation of a traditional a pen register, trap and
>trace device, or wiretap of a conventional phone line, Carnivore gives
>the FBI access to all traffic over the ISP's network, not just the
>communications to or from a particular target. Carnivore, which is
>capable of analyzing millions of messages per second, purportedly
>retains only the messages of the specified target, although this
>process takes place without scrutiny of either the ISP or a court.
>
>Carnivore permits access to the email of every customer of an ISP and
>the email of every person who communicates with them. Carnivore is
>roughly equivalent to a wiretap capable of accessing the contents of
>the conversations of all of the phone companyÌs customers, with the
>ÏassuranceÓ that the FBI will record only conversations of the
>specified target.  This Ïtrust us, we are the Government" approach is
>the antithesis of the procedures required under our the wiretapping
>laws. They authorize limited electronic surveillance of the
>communications of specified persons, usually conducted by means of
>specified communications devices.  They place on the provider of the
>communications medium the responsibility to separate the communications
>of persons authorized to be intercepted from other communications.
>
>Currently, law enforcement is required to ÏminimizeÓ its interception
>of non-incriminating communications of a target of a wiretap order.
>Carnivore is not a minimization tool. Instead, Carnivore maximizes law
>enforcement access to the communications of non-targets.
>
>In his testimony to your subcommittee Mr. Corn-Revere described the
>experience of his client, an ISP that was required to install Carnivore
>when presented with a trap and trace order. He detailed his client's
>concerns that a trap and trace order in the context of the Internet
>revealed information that Congress did not contemplate when it
>authorized their limited use. In the traditional telephone context,
>those orders reveal nothing more than the numbers dialed to or from a
>single telephone line. In the Internet context, these orders and
>certainly Carnivore, likely involve ascertaining the suspectÌs e-mail
>address, as well as header information that may provide information
>regarding the content of the communication.
>
>As we have stated previously, the ACLU does not believe that it is
>clear that the Government can serve an order on an Internet service
>provider and obtain the e-mail addresses of incoming and outgoing
>messages for a particular subscriber.  Further, it is not clear whether
>law enforcement agents use or should use authority under the pen
>register statute to access a variety of data, including Internet
>Protocol addresses, dialup numbers and e-mail logs.  We certainly do
>not believe that it is clear that law enforcement can install a super
>trap and trace device that access to such information for all of an
>ISP's subscribers.
>
>In light of the new revelations about Carnivore, the ACLU urges the
>Subcommittee to accelerate its consideration of the application of the
>4th Amendment in the digital age.  Legislation should make it clear
>that law enforcement agents may not use devices that allow access to
>electronic communications involving only persons other than a specified
>target for which it has a proper order. Such legislation should make
>clear that a trap and trace order served on an ISP does not authorize
>access to the contents of any communication  including the subject line
>of a communication -- and that the ISP bears the burden of protecting
>the privacy of communications to which FBI access has not been granted.
>
>We would be happy to work with the Subcommittee on drafting legislation
>that protects the privacy rights of Americans.
>
>Sincerely,
>
>
>
>Laura W. Murphy
>Director, ACLU Washington National Office
>
>
>
>Barry Steinhardt
>Associate Director, ACLU
>
>
>
>Gregory T.  Nojeim
>Legislative Counsel, ACLU Washington National Office
>
>cc:  Members of the Constitution Subcommittee of the House Judiciary Committee
>
>
>
>
>
>
>
>
>
>
>
>
>Barry Steinhardt
>Barrys@aclu.org
>Associate Director
>American Civil Liberties Union
>125 Broad St. New York, NY 10004
>212 549 2508 (v) 212 549 2656 (f)
>
><< end of forwarded material >>
>--
>
>
>--
>Stanton McCandlish      mech@eff.org       http://www.eff.org/~mech
>Online Communications Director/Webmaster, Electronic Frontier Foundation
>voice: +1 415 436 9333 x105   fax: +1 415 436 9993