FBI turns to broad new wiretap method

FBI turns to broad new wiretap method

Summary: FBI's Internet wiretaps after retiring "Carnivore" appear to involve compiling massive databases of information on thousands of users at a time.

FBI turns to broad new wiretap method The FBI appears to have adopted an invasive Internet surveillance technique that collects far more data on innocent Americans than previously has been disclosed.

Instead of recording only what a particular suspect is doing, agents conducting investigations appear to be assembling the activities of thousands of Internet users at a time into massive databases, according to current and former officials. That database can subsequently be queried for names, e-mail addresses or keywords.

Such a technique is broader and potentially more intrusive than the FBI's Carnivore surveillance system, later renamed DCS1000. It raises concerns similar to those stirred by widespread Internet monitoring that the National Security Agency is said to have done, according to documents that have surfaced in one federal lawsuit, and may stretch the bounds of what's legally permissible.

Call it the vacuum-cleaner approach. It's employed when police have obtained a court order and an Internet service provider can't "isolate the particular person or IP address" because of technical constraints, says Paul Ohm, a former trial attorney at the Justice Department's Computer Crime and Intellectual Property Section. (An Internet Protocol address is a series of digits that can identify an individual computer.)

That kind of full-pipe surveillance can record all Internet traffic, including Web browsing--or, optionally, only certain subsets such as all e-mail messages flowing through the network. Interception typically takes place inside an Internet provider's network at the junction point of a router or network switch.

The technique came to light at the Search & Seizure in the Digital Age symposium held at Stanford University's law school on Friday. Ohm, who is now a law professor at the University of Colorado at Boulder, and Richard Downing, a CCIPS assistant deputy chief, discussed it during the symposium.

In a telephone conversation afterward, Ohm said that full-pipe recording has become federal agents' default method for Internet surveillance. "You collect wherever you can on the (network) segment," he said. "If it happens to be the segment that has a lot of IP addresses, you don't throw away the other IP addresses. You do that after the fact."

related blog
DOJ takes issue with wiretapping story
Justice Department
spokesman responds
to CNET News.com report.

"You intercept first and you use whatever filtering, data mining to get at the information about the person you're trying to monitor," he added.

On Monday, a Justice Department representative would not immediately answer questions about this kind of surveillance technique. (Late Tuesday, the Justice Department responded with a statement taking issue with this description of the FBI's surveillance practices.)

"What they're doing is even worse than Carnivore," said Kevin Bankston, a staff attorney at the Electronic Frontier Foundation who attended the Stanford event. "What they're doing is intercepting everyone and then choosing their targets."

When the FBI announced two years ago it had abandoned Carnivore, news reports said that the bureau would increasingly rely on Internet providers to conduct the surveillance and reimburse them for costs. While Carnivore was the subject of congressional scrutiny and outside audits, the FBI's current Internet eavesdropping techniques have received little attention.

Carnivore apparently did not perform full-pipe recording. A technical report (PDF: "Independent Technical Review of the Carnivore System") from December 2000 prepared for the Justice Department said that Carnivore "accumulates no data other than that which passes its filters" and that it saves packets "for later analysis only after they are positively linked by the filter settings to a target."

One reason why the full-pipe technique raises novel legal questions is that under federal law, the FBI must perform what's called "minimization."

Federal law says that agents must "minimize the interception of communications not otherwise subject to interception" and keep the supervising judge informed of what's happening. Minimization is designed to provide at least a modicum of privacy by limiting police eavesdropping on innocuous conversations.

"The question that's interesting...is whether this is illegal, whether it's constitutional. Is Congress even aware they're doing this?"
--Paul Ohm, law professor
University of Colorado at Boulder

Prosecutors routinely hold presurveillance "minimization meetings" with investigators to discuss ground rules. Common investigatory rules permit agents to listen in on a phone call for two minutes at a time, with at least one minute elapsing between the spot-monitoring sessions.

That section of federal law mentions only real-time interception--and does not explicitly authorize the creation of a database with information on thousands of innocent targets.

But a nearby sentence adds: "In the event the intercepted communication is in a code or foreign language, and an expert in that foreign language or code is not reasonably available during the interception period, minimization may be accomplished as soon as practicable after such interception."

Downing, the assistant deputy chief at the Justice Department's computer crime section, pointed to that language on Friday. Because digital communications amount to a foreign language or code, he said, federal agents are legally permitted to record everything and sort through it later. (Downing stressed that he was not speaking on behalf of the Justice Department.)

"Take a look at the legislative history from the mid '90s," Downing said. "It's pretty clear from that that Congress very much intended it to apply to electronic types of wiretapping."

EFF's Bankston disagrees. He said that the FBI is "collecting and apparently storing indefinitely the communications of thousands--if not hundreds of thousands--of innocent Americans in violation of the Wiretap Act and the 4th Amendment to the Constitution."

Marc Rotenberg, director of the Electronic Privacy Information Center in Washington, D.C., said a reasonable approach would be to require that federal agents only receive information that's explicitly permitted by the court order. "The obligation should be on both the (Internet provider) and the government to make sure that only the information responsive to the warrant is disclosed to the government," he said.

Courts have been wrestling with minimization requirements for over a generation. In a 1978 Supreme Court decision, Scott v. United States, the justices upheld police wiretaps of people suspected of selling illegal drugs.

But in his majority opinion, Justice William Rehnquist said that broad monitoring to nab one suspect might go too far. "If the agents are permitted to tap a public telephone because one individual is thought to be placing bets over the phone, substantial doubts as to minimization may arise if the agents listen to every call which goes out over that phone regardless of who places the call," he wrote.

Another unanswered question is whether a database of recorded Internet communications can legally be mined for information about unrelated criminal offenses such as drug use, copyright infringement or tax crimes. One 1978 case, U.S. v. Pine, said that investigators could continue to listen in on a telephone line when other illegal activities--not specified in the original wiretap order--were being discussed. Those discussions could then be used against a defendant in a criminal prosecution.

Ohm, the former Justice Department attorney who presented a paper on the Fourth Amendment, said he has doubts about the constitutionality of full-pipe recording. "The question that's interesting, although I don't know whether it's so clear, is whether this is illegal, whether it's constitutional," he said. "Is Congress even aware they're doing this? I don't know the answers."

Topics: Networking, Government

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • RE: FBI turns to broad new wiretap method

    Besides whether this is illegal, another question is whether this is any effective, and more to the point, cost-effective. Taking into account that very major part of all law enforcement activities amounts to the phony "war on drugs", I think there's little doubt that these data mining projects are just another fraud and misuse of tax dollars. I guess, if 1/1000 of the funds spent on this was spent on fight with online fraud and spam, which amounts to 90% of all email traffic, the resulting public good would be 1000 times more.<br><br>To put this in perspective, here's practical fact. Two years ago someone stole the number of my credit card and placed some online orders. It was promptly detected, and the IP address of the thief was known. But the police (PD chief, no less) explained that even though they could find the criminal by the subpoena to the ISP, still they couldn't do anything because the crime occurred "in noone's jurisdiction". Now compare this reality to these monitoring efforts, and you see how bogus this is. Just another phony government project pretending to do good while having zero real outcome.
  • RE: FBI turns to broad new wiretap method

    we need to dump the patriot act in its entirety, keep tight security at airports, and shipping and handeling ports etc; dump the no child left behind, make social behavior skills part of each stage of k-12 part of the curriculum. and we need to cap costs of health care and all imports being sold to consumers. and tax all imports being sold to Consumers, and give tax cut incentives to corporations who operate their business in the USA and create manufacturing industry and jobs. as a reward per each ten years of business their taxes decrease. and the taxes to do business with American consumers for foreigner corporations goes directly to pay social security and health care costs as a fund. dump the DHS and the ICE, wipe the laws clean that have not shown any progress ,and dump the WHTI, Tear down the Wall of the Border, open commerce with Mexico and close with China. End the Dare program, arrest and deport all hate gang/hate groups . Drug Dealers given rehab, as choice to prison, poverty crimes made to work for states to pay back debts and have trade schools and education for them, for mental and emotional crimes rehab , that way they dont repeat offend and lower the cost and crime rate. make all custodial parents pay 50 percent of Child Support to deter single parenting as a reward to deter marriage and responsibility burdening and penalizing men to pay for children only , which would also deter abortions as well, since contraceptives is a dual role responsibility. create new energy discovery and re implement all regualtions that were de regulated in the past, end corporate monopolies such as walmart giants and mergers etc; and close all donations from corporations and higher than the middle class american, close all unethical loopholes and kicbacks in law making, make a legal standard constitutionality test before any law is created, and make all state courts follow the federal court precedences again. end all state legislation that conflicts federal court precedences and constitutional laws that should go through the US Congress. Use the Fbi Atf, Cia to work in uniform, along with all other agencies that share the same type work on non classified issues. end all wars, bring the troops home. Make a tri country pact with canada and mexico to build infrastructure on the borders and to make the borders secure with tri country border guard. create a guest worker in all three countries to open commerce in all three nations with a uniform legal standard and safety standard compliance to operate and do business in each others nation. that should end the bs. going on for the past 30 years.