Who Let the Carnivores Out?

"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin
Don't Worry, We're Just Reading the Headers

For its part, the FBI denies that Carnivore is designed to read the mail of anyone who isn't targeted for a legal investigation. Conceding that Carnivore indeed reads the headers (address information) of all mail sent and received via an ISP on whose premises a Carnivore system is installed, the FBI asserts that the system contains adequate safeguards. However, independent technical evaluations of Carnivore (see Bellovin et al., 2000) show clearly that Carnivore all but invites investigators to exceed the bounds of lawful investigation. Let's take a closer look at what is known about Carnivore's technology, and you'll see why.

Carnivore is a "computer system"--a PC equipped with the Carnivore software--installed in cooperation with an Internet service provider (ISP) in order to facilitate the collection of information pertaining to the target of an investigation. Apparently, the system uses an IP sniffer as a capture filter. An IP sniffer is a program that detects Internet Protocol (IP) addresses in the stream of ongoing Internet traffic and, thus, able to identify (and differentiate) individual messages within the stream. Operating in real time, Carnivore writes all the data going to and coming from the Internet address of the individual targeted for an investigation to a Jaz disk. The system is used in two ways:

  • As a pen register (also called trap and trace) to capture all the e-mail headers going to and from a specified account, as well as URLs of all the servers accessed by the account; alternatively, the system can be used to record the IP addresses of everyone who accesses a specific Web page or FTP site. To collect this type of information, investigators still need a search warrant, but they can obtain one from a lower court judge.

  • As a content wiretap to capture all e-mail messages to and from a specific account and to capture all the network traffic to and from a specific account or IP address. To trap content, investigators must obtain a search warrant from the Federal judge--and it's tough to get. Investigators must show probable cause (i.e., evidence that the individual targeted for investigation is indeed involved in an illegal activity).

The distinction between trap and trace vs. content wiretaps goes back to telephone days. For telephone wiretapping, a trap and trace warrant involves no direct intervention; the judge merely authorizes the telephone company to release to investigators a record of all the calls handled by a particular number. Content wiretaps are much more intrusive which is why they require the assent of an independent Federal judge.

Whoops! I Recorded All the Data! Darn!

Here's the point raised by those concerned about Carnivore. Even if investigators have obtained a trap and trace (header-only) warrant, the Jaz disk created, nevertheless, contains the full content of the e-mail messages sent to and received by the individual targeted for the investigation. C'mon, do you think they're not going to look at it? Who would know, anyway? Carnivore lacks the security and auditing services that would be needed to make sure investigators did not abuse their lawfully granted authority. In short, the Carnivore system enables investigators to circumvent the distinction between the easily obtained trap and trace warrant and the much-more-difficult-to-obtain content warrant.

From an investigator's viewpoint, here's the genius of Carnivore: For the price of a trap and trace warrant, you get the content. And the price is right, because lower court judges cannot refuse a request for trap and trace warrants if investigators affirm the warrant is needed for an investigation. Of course, it's illegal for investigators to look at the content, but that hasn't stopped the FBI in the past. It's common knowledge in the law enforcement community that illegal telephone wiretaps have been used for years to establish the basis of investigations; a legal wiretap is obtained only when investigators are certain they've identified the correct suspect and want to produce evidence that is admissible in court.

Who Wins and Who Loses?

If you're a law-and-order type, you're probably wondering why Carnivore is so bad. After all, there's an ever increasing risk posed by terrorists, drug dealers, racketeers, child pornographers and organized crime. Systems such as Carnivore will help law enforcement investigators detect and prosecute criminals more efficiently. If some of our mail gets read by accident, who cares--especially if you have nothing to hide?

But this view misses the point. Any criminal with a modicum of technical knowledge has nothing to fear from Carnivore. As a leading computer security expert (Forno 2000) recently pointed out, you need only a Hotmail account to escape Carnivore's monitoring; Hotmail supports encrypted e-mail via SSL, which means that the data intercepted by Carnivore will appear as gibberish. Encrypted virtual private network (VPN) connections take Carnivore out of the picture as well, and eliminate the risks posed by plain text message storage on an ISP's mail server. In short, the only criminals who will be apprehended by Carnivore are those who are too stupid--or unprofessional--to know how to protect themselves from Carnivore's surveillance.

And that's precisely the risk that Carnivore poses. Because Carnivore enables investigators to obtain full message content on the basis of an easily obtained trap and trace warrant, it gives them an open invitation to go on hunting missions against people who would never dream that they are the subject of an investigation and have, therefore, taken no steps to encrypt their communications. Perhaps such people really are criminals--very stupid criminals. However, it's far more likely that Carnivore and future Carnivore-like tools will be used to monitor huge numbers of law-abiding people suspected of some sort of involvement in dissident organizations. If this situation develops, Carnivore will have helped to circumvent the very protection that the Fourth Amendment to the U.S. Constitution sought to bestow on its citizens: the right to remain free from unreasonable searches and seizures that violate a lawful citizen's basic right to engage in private life undisturbed, to maintain views and opinions that may not sit well with those in power.

So, what does all of this mean for Linux users worldwide? It's simple: Even if you are (to the best of your knowledge) a law-abiding citizen, don't wait to encrypt your communications. The existence of systems such as Carnivore in a country such as the U.S., which (supposedly) has strong constitutional guarantees against unreasonable searches and seizures, should remove any doubt on this score. Without encryption, your communications are an open book that can be read by anyone, including government investigators, who might have some reason, perhaps ideological or political, to use your own electronic communications against you. What's truly scary about Carnivore is that it all but encourages investigators to target the dissident activities of law-abiding citizens. And that's why such citizens should not hesitate to use strong, impenetrable encryption to protect the privacy of their letters and papers.