This story is actually fairly old, but it's just now available in electronic form (I didn't want to type it up!) and it's still a relevant piece of news. ----- Institute Declines Offer to Evaluate FBI Electronic Surveillance Program ----- MIT has informally declined to review Carnivore, the FBI's e-mail surveillance system. The Department of Justice had approached MIT to do a "technical evaluation" of the system, but MIT technicians and administrators decided that it would not be appropriate for the Institute to undertake the review. The impetus for an independent review came in response to pressure from civil liberties groups: the DOJ is seeking an impartial third party to assuage fears that Carnivore is infringing privacy rights. MIT researchers, including Information Systems Network Manager Jeff Schiller and Professor of Electrical Engineering and Computer Science Ronald L. Rivest, said that while the review was important, they declined to review Carnivore based on two main concerns. First, the government set unreasonable guidelines for the way the review was to be carried out, and second, there was a lack of interest among MIT personnel, probably due to problematic government restrictions and time commitments. Schiller said that the DOJ did not really want an independent review at all. Instead, it wanted to "borrow our reputation" and allow the FBI to say to the public, "`If you don't trust us, trust MIT.'" Those involved agreed that as a research university, MIT cannot publish a report without releasing all of the data that it used in conducting the evaluation. Due to security issues, it would be up to the FBI to decide what information to release. In addition, Schiller was concerned with the government's power to edit the report before releasing it to the public. The internal MIT discussion as to whether to accept the DOJ's bid included Schiller and high-level EECS professors Hal Abelson Ph.D. '73, Jerome H. Saltzer, and M. Frans Kaashoek, as well as Laboratory for Computer Science head Michael L. Dertouzos. Schiller and Abelson said that the general consensus among those involved in discussions was that the DOJ had set an improbable deadline on the project, and that there were too many problems inherent in the DOJ's proposal. Abelson said that the government's concerns are valid, but given the constraints the DOJ has imposed, "it shouldn't hope for an independent review." DOJ says restrictions are fair DOJ Chief Science and Technical Officer Donald Prosnitz and Associate Attorney General for Administration Stephen R. Colgate said that they "understood the concerns of the universities." Along with the Institute, Purdue University, Dartmouth College, University of Michigan, and the Supercomputing Centre at the University of California have all turned down bids extended by the DOJ, according to published reports. Prosnitz said, however, that there are actually "very few limits" placed on the contractor that is to review Carnivore. He contended that the only restrictions imposed by the government are standard security procedures such as background checks of personnel involved in the project. In addition, the source code for Carnivore will remain confidential, Prosnitz said. The contractor has access to everything else it needs, he said. Prosnitz explained that the reason for the close deadline of December 1 is that the DOJ wants to have the report done during Attorney General Janet Reno's tenure, so that she will have time to consider the case. In addition, the DOJ hopes to have Congress vote on it in their next session. The present administration will step down on January 20, 2000, but Prosnitz said that he has total confidence that the transition of government will not in any way affect the system's operation. The government is currently in negotiations with a possible contractor. The unnamed contractor has said that it will finish the project on schedule, Prosnitz said. Schiller questions review While Schiller said that an independent review is important, he said that he has no doubt that the system will work the way it is supposed to work. A more important question, he said, is whether or not the FBI would abide by what the court order allows it legally to do. Schiller suggested that a third party, most probably a user's Internet service provider, be responsible for gathering evidence, and then turning it over to the FBI. Prosnitz and Colgate stated that it was actually their preference to have the ISP gather and turn over evidence in the form of e-mail. Carnivore is only used in cases when a small ISP does not have the capabilities of giving the FBI what the court orders demand, he said. Prosnitz added that Carnivore has been used less than 25 times since its creation. ----- This article originally appeared in The Tech, issue 41 volume 120. It may be freely distributed electronically as long as it includes this notice but cannot be reprinted without the express written permission of The Tech. Write to archive@the-tech.mit.edu for additional details. -- Riad Wahby rsw@mit.edu MIT VI-2/A 2002 5105