EarthLink just says no to FBI's Carnivore

The FBI has used Carnivore, as the surveillance device is called, in a number of criminal investigations. But EarthLink is the first ISP to offer a public account of an actual experience with Carnivore. The FBI has claimed that Carnivore won't interfere with an ISP's operations.

"It has the potential to hurt our network, to bring pieces of it down," Steve Dougherty, EarthLink's director of technology acquisition, said of Carnivore. "It could impact thousands of people."

While EarthLink (elnk) executives said they would continue to work with authorities in criminal investigations, they vowed not to allow the FBI to install Carnivore on the company's network. The company also has substantial privacy concerns.

EarthLink has already voiced its concerns in court. The ISP is the plaintiff in a legal fight launched against Carnivore earlier this year with the help of attorney Robert Corn-Revere, according to people close to the case. Previously, the identity of the plaintiff in the case, which is under seal, wasn't known. A federal magistrate ruled against EarthLink in the case early this year, forcing it to give the FBI access to its system. Mr. Corn-Revere declined to comment.

EarthLink's problems with Carnivore began earlier this year, when the FBI installed a Carnivore device on its network at a hub site in Pasadena, Calif. The FBI had a court order that allowed it to install the equipment as part of a criminal investigation.

The FBI connected Carnivore, a small computer box loaded with sophisticated software for monitoring e-mail messages and other online communications, to EarthLink's remote access servers, a set of networking equipment that answers incoming modem calls from customers. But Carnivore wasn't compatible with the operating system software on the remote access servers. So EarthLink had to install an older version of the system software that would work with Carnivore, according to Mr. Dougherty.

EarthLink says the older version of the software caused its remote access servers to crash, which in turn knocked out access for a number of its customers. Mr. Dougherty declined to specify how many, saying only that "many" people were affected.

EarthLink executives said they were also concerned about privacy. The company said it had no way of knowing whether Carnivore was limiting its surveillance to the criminal investigation at hand or trolling more broadly. Other ISPs have said there could be serious liability issues for them if the privacy of individuals not connected to an investigation is compromised.

"There ought to be some transparency to the methods and tools that law enforcement is using to search and seize communications," said John R. LoGalbo, vice president of public policy at PSINet Inc. (psix), an ISP in Ashburn, Va.

EarthLink executives declined to say whether the company has received court orders for information about other customers since the disruption earlier this year. EarthLink said it would help authorities in criminal investigations using techniques other than Carnivore.

The FBI insists that Carnivore doesn't affect the performance or stability of an ISP's existing networks. The bureau says Carnivore passively monitors traffic, recording only information that is relevant to FBI investigations.

In some cases, the FBI said, the ISP is equipped to turn over data without the use of Carnivore. This is common in cases where only e-mail messages are sought because that type of data can be obtained easily through less-intrusive means.

Attorney General Janet Reno said Thursday that she was putting the system under review. She said the Justice Department would investigate Carnivore's constitutional implications and make sure that the FBI was using it in "a consistent and balanced way."

One of the nation's largest Internet-service providers, EarthLink Inc., has refused to install a new Federal Bureau of Investigation electronic surveillance device on its network, saying technical adjustments required to use the device caused disruptions for customers.

The FBI has used Carnivore, as the surveillance device is called, in a number of criminal investigations. But EarthLink is the first ISP to offer a public account of an actual experience with Carnivore. The FBI has claimed that Carnivore won't interfere with an ISP's operations.

"It has the potential to hurt our network, to bring pieces of it down," Steve Dougherty, EarthLink's director of technology acquisition, said of Carnivore. "It could impact thousands of people."

While EarthLink (elnk) executives said they would continue to work with authorities in criminal investigations, they vowed not to allow the FBI to install Carnivore on the company's network. The company also has substantial privacy concerns.

EarthLink has already voiced its concerns in court. The ISP is the plaintiff in a legal fight launched against Carnivore earlier this year with the help of attorney Robert Corn-Revere, according to people close to the case. Previously, the identity of the plaintiff in the case, which is under seal, wasn't known. A federal magistrate ruled against EarthLink in the case early this year, forcing it to give the FBI access to its system. Mr. Corn-Revere declined to comment.

EarthLink's problems with Carnivore began earlier this year, when the FBI installed a Carnivore device on its network at a hub site in Pasadena, Calif. The FBI had a court order that allowed it to install the equipment as part of a criminal investigation.

The FBI connected Carnivore, a small computer box loaded with sophisticated software for monitoring e-mail messages and other online communications, to EarthLink's remote access servers, a set of networking equipment that answers incoming modem calls from customers. But Carnivore wasn't compatible with the operating system software on the remote access servers. So EarthLink had to install an older version of the system software that would work with Carnivore, according to Mr. Dougherty.

EarthLink says the older version of the software caused its remote access servers to crash, which in turn knocked out access for a number of its customers. Mr. Dougherty declined to specify how many, saying only that "many" people were affected.

EarthLink executives said they were also concerned about privacy. The company said it had no way of knowing whether Carnivore was limiting its surveillance to the criminal investigation at hand or trolling more broadly. Other ISPs have said there could be serious liability issues for them if the privacy of individuals not connected to an investigation is compromised.

"There ought to be some transparency to the methods and tools that law enforcement is using to search and seize communications," said John R. LoGalbo, vice president of public policy at PSINet Inc. (psix), an ISP in Ashburn, Va.

EarthLink executives declined to say whether the company has received court orders for information about other customers since the disruption earlier this year. EarthLink said it would help authorities in criminal investigations using techniques other than Carnivore.

The FBI insists that Carnivore doesn't affect the performance or stability of an ISP's existing networks. The bureau says Carnivore passively monitors traffic, recording only information that is relevant to FBI investigations.

In some cases, the FBI said, the ISP is equipped to turn over data without the use of Carnivore. This is common in cases where only e-mail messages are sought because that type of data can be obtained easily through less-intrusive means.

Attorney General Janet Reno said Thursday that she was putting the system under review. She said the Justice Department would investigate Carnivore's constitutional implications and make sure that the FBI was using it in "a consistent and balanced way."