MIT Declines to review Carnivore

[Riad S. Wahby]

This story is actually fairly old, but it's just now available in
electronic form (I didn't want to type it up!) and it's still a
relevant piece of news.

-----

Institute Declines Offer to Evaluate FBI Electronic Surveillance Program

-----

MIT has informally declined to review Carnivore, the FBI's e-mail
surveillance system.

The Department of Justice had approached MIT to do a "technical
evaluation" of the system, but MIT technicians and administrators
decided that it would not be appropriate for the Institute to
undertake the review.

The impetus for an independent review came in response to pressure
from civil liberties groups: the DOJ is seeking an impartial third
party to assuage fears that Carnivore is infringing privacy rights.

MIT researchers, including Information Systems Network Manager Jeff
Schiller and Professor of Electrical Engineering and Computer Science
Ronald L. Rivest, said that while the review was important, they
declined to review Carnivore based on two main concerns. First, the
government set unreasonable guidelines for the way the review was to
be carried out, and second, there was a lack of interest among MIT
personnel, probably due to problematic government restrictions and
time commitments.

Schiller said that the DOJ did not really want an independent review
at all. Instead, it wanted to "borrow our reputation" and allow the
FBI to say to the public, "`If you don't trust us, trust MIT.'"

Those involved agreed that as a research university, MIT cannot
publish a report without releasing all of the data that it used in
conducting the evaluation. Due to security issues, it would be up to
the FBI to decide what information to release.

In addition, Schiller was concerned with the government's power to
edit the report before releasing it to the public.

The internal MIT discussion as to whether to accept the DOJ's bid
included Schiller and high-level EECS professors Hal Abelson
Ph.D. '73, Jerome H. Saltzer, and M. Frans Kaashoek, as well as
Laboratory for Computer Science head Michael L. Dertouzos.

Schiller and Abelson said that the general consensus among those
involved in discussions was that the DOJ had set an improbable
deadline on the project, and that there were too many problems
inherent in the DOJ's proposal.

Abelson said that the government's concerns are valid, but given the
constraints the DOJ has imposed, "it shouldn't hope for an independent
review."

DOJ says restrictions are fair

DOJ Chief Science and Technical Officer Donald Prosnitz and Associate
Attorney General for Administration Stephen R. Colgate said that they
"understood the concerns of the universities." Along with the
Institute, Purdue University, Dartmouth College, University of
Michigan, and the Supercomputing Centre at the University of
California have all turned down bids extended by the DOJ, according to
published reports.

Prosnitz said, however, that there are actually "very few limits"
placed on the contractor that is to review Carnivore. He contended
that the only restrictions imposed by the government are standard
security procedures such as background checks of personnel involved in
the project. In addition, the source code for Carnivore will remain
confidential, Prosnitz said. The contractor has access to everything
else it needs, he said.

Prosnitz explained that the reason for the close deadline of December
1 is that the DOJ wants to have the report done during Attorney
General Janet Reno's tenure, so that she will have time to consider
the case. In addition, the DOJ hopes to have Congress vote on it in
their next session. The present administration will step down on
January 20, 2000, but Prosnitz said that he has total confidence that
the transition of government will not in any way affect the system's
operation.

The government is currently in negotiations with a possible
contractor. The unnamed contractor has said that it will finish the
project on schedule, Prosnitz said.

Schiller questions review

While Schiller said that an independent review is important, he said
that he has no doubt that the system will work the way it is supposed
to work. A more important question, he said, is whether or not the FBI
would abide by what the court order allows it legally to do.

Schiller suggested that a third party, most probably a user's Internet
service provider, be responsible for gathering evidence, and then
turning it over to the FBI.

Prosnitz and Colgate stated that it was actually their preference to
have the ISP gather and turn over evidence in the form of
e-mail. Carnivore is only used in cases when a small ISP does not have
the capabilities of giving the FBI what the court orders demand, he
said. Prosnitz added that Carnivore has been used less than 25 times
since its creation.

-----

This article originally appeared in The Tech, issue 41 volume 120. It
may be freely distributed electronically as long as it includes this
notice but cannot be reprinted without the express written permission
of The Tech. Write to archive at the-tech.mit.edu for additional details.

--
Riad Wahby
rsw at mit.edu
MIT VI-2/A 2002

5105
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 3717 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/20000922/407e7ab8/attachment.sig>