FBI'S 'CARNIVORE' E-MAIL TOOL CHEWED UP BY LAWMAKERS

WASHINGTON--Federal law enforcement officials faced a bipartisan
firestorm of criticism Monday as they testified before Congress about
the FBI's new Internet wiretapping technology, which critics argue
could violate the privacy rights of law-abiding citizens.

At a hearing before the House Judiciary subcommittee on the
Constitution, both Republican and Democratic legislators expressed
concern that federal authorities could misuse a recently developed
software program called Carnivore, designed to screen e-mail messages
in felony investigations. Led by subcommittee Chairman Charles T.
Canady (R-Fla.) and ranking member Melvin L. Watt (D-N.C.), the panel
repeatedly questioned assurances from an FBI technician that the
bureau would monitor the use of the system internally.

FBI Assistant Director Donald M. Kerr testified that Carnivore has
been used 25 times since it was first deployed two years ago, with 16
of those times occurring in the last year. He listed terrorism, child
pornography and credit card fraud as crimes now being planned or
committed over the Internet and suggested that Carnivore would improve
the FBI's ability to prosecute them.

To operate the software, the FBI must install it on the servers of an
Internet service provider. The system first came under scrutiny from
Congress last April, when a lawyer who has represented ISPs complained
that Carnivore would violate citizens' 4th Amendment right to
protection against unreasonable searches and seizures.

Once implanted in an ISP's servers, Kerr said, Carnivore filters the
stream of correspondence passing through the ISP and weeds out either
complete messages or simply "to" and "from" addresses of
court-approved targets. Whether the contents of the e-mail are
included along with the address depends on the scope of the court
order the FBI has obtained, Kerr said.

Rep. John Conyers Jr. (D-Mich.) set the tone for the hearing in his
opening statement, when he asked whether Carnivore "minimizes" the
interception of nontargeted communication or "maximizes" the FBI's
access to private correspondence.

"This system should not bite off more than it can chew," he said.
"Should we feel comfortable with a 'Trust us, we're the government'
approach?"

In an interview after the hearing, witness Chris Painter, deputy chief
of the Justice Department's Computer Crime and Intellectual Property
section, said that extending the FBI's wiretapping ability to the Web
does not break with legal precedents.

But lawmakers on both sides of the aisle suggested that the new
software broadens the scope of federal law enforcement's search
activity and unnecessarily extends the FBI's reach into the territory
of private ISP companies.

"Why do we need to put terminals on site at the ISPs rather than let
the ISP itself turn over needed information much in the way that
telephone companies do?" Conyers asked.

Kerr responded that the FBI's first choice is to let ISPs conduct
searches for the bureau and then report their findings, but that
Carnivore is needed because not all ISPs have the equipment to filter
through their telecommunication traffic.

The FBI and Justice Department witnesses also stressed that it would
be a violation of federal law for an agent to abuse the
intelligence-gathering ability of Carnivore to collect information
about non-suspects.

Though lawmakers appeared dubious, Tom Talleur, a former federal law
enforcement official who recently joined the accounting firm KPMG Peat
Marwick as a cyber forensics analyst, said he believes agents would
respect existing statutes.

"They're not going to unilaterally break the law," he said. "If they
do, they're going to go to jail."

Law professor Jonathan Zittrain of the Berkman Center for Internet &
Society at Harvard Law School reduced the debate over Carnivore to the
level of technology.

"It used to be that to tap your phone, FBI agents would have to pull
up in a truck and sweat it out," he said. "We're just not used to the
idea of its being trivially easy for the government to . . . monitor
our communications."