Transatlantic Cable: Tap, tap tapping on the net's door

While the RIP Bill has been hogging headlines in the UK, a new net tapping system is attracting attention in the US. Richard Baguley reports on the FBI's Carnivore.

You might think the UK is alone in having problems in dealing with the issues of encryption, intercepting email and the law. However, recent events here in the US have proven that the issues surrounding tapping the net are global. In particular, the news that the FBI has developed a system - with the attractive name of Carnivore - capable of sniffing out a suspect's email via an ISP has civil liberties groups up in arms. It is worth remembering there is nothing new in the FBI, CIA, NSA et al being allowed to read people's email. The US was one of the first countries to pass laws allowing this, through the 1986 Electronic Communications Privacy Act. Despite its name, this law allowed law enforcement organisations (usually the FBI) to tap the internet traffic of a suspect with a court order (called a 'tap-and-trace'). This court order had to be signed by a judge, and the law also forced ISPs to build the infrastructure required to tap the data on their networks - usually in the form of a place for the FBI to put its equipment. The way the Carnivore system works is impressive, assuming it is as good as the FBI claims. When the FBI wants to tap the traffic of a suspect, they install a Carnivore box on the network of the ISP. It then scans all the traffic flying past it, and stores that which relates to the suspect. This gives the FBI access to the email of suspects, as well as any other traffic, such as which web sites they browse, what their lag times are like for Quake III and so on. The FBI has developed other net tapping systems before, but they stored net traffic indiscriminately, so it had to be filtered later to find the relevant stuff - one was supposedly called Omnivore, because it ate everything. This new system reportedly automatically filters traffic and compares it with a list of suspects, storing only the data that relates to them. That's why they call it Carnivore - because it gets to the meat of the matter. According to a report in the Wall Street Journal, Carnivore was developed last year, and has already been used in several cases. It has also already been called into question - the WSJ report claims that one ISP went to court to try and stop the FBI installing a Carnivore on their network, but the judge turned them down. Not surprisingly, this news has angered civil rights groups. The American Civil Liberties Union (ACLU) has written to the US government urging them to "put a leash on Carnivore, unlike the operation of a traditional trap and trace device... Carnivore gives the FBI access to all traffic over an ISP's network, not just the communications to or from a particular target." Their concern is that once a Carnivore is installed, the FBI can use the system to tap the communications of any user - not just the suspect named in the court order. As the ACLU says: "Carnivore is roughly equivalent to a wiretap capable of accessing the contents of the conversations of all of the phone company's customers, with the 'assurance' that the FBI will record only conversations of the specified target. This 'trust us, we are the Government' approach is the antithesis of the procedures required under our wiretapping laws." However, the FBI denies the system will be used to read other emails. "It limits the messages viewable by human eyes to those which are strictly included in the court order," said an FBI spokesperson. "If Jill Smith's communications are flagged, we don't see Sally's, Jane's, or anyone else's. We just see Jill Smith's." Of course, tapping net traffic is nothing new. If reports of the Echelon system are anything to go by, one of the first people to read this column will be the US National Security Agency (NSA), who supposedly tap a large amount of net traffic - particularly the stuff that leaves or enters the US. As a foreign national in the US, I am a legitimate target for their surveillance, so they could quite likely read this when I email it to my editor. And it will no doubt be flagged up for attention even quicker (thanks to their scanning systems that apparently pick out certain words) if I throw in phrases like "Bill Clinton must die" or "Milosevic for President". The UK government is trying to legalise similar surveillance techniques, through the RIP Bill. Let's not be surprised if a few Carnivores make it over to the UK - after all, according to reports, the FBI has twenty or so lying around spare.