Talk to One of the Chief Carnivore Reviewers 79
All right, this FBI Carnivore thing and the review it's undergoing at the Illinois Institute of Tech [IIT] has been getting lots of press and lots of flack. The person overseeing the legal end of the process is Dean Henry H. Perritt, Jr. of the IIT's Chicago-Kent College of Law. Ask Dean Perritt any question you want. Tomorrow afternoon we'll forward 10 of the highest-moderated ones to him, and we expect his answers back sometime next week. Note: Before you start questioning Dean Perritt, you may want to check this story in Slashdot's Your Rights Online section, which links to some interesting new Carnivore information. (Special thanks to pridkett for arranging this interview.)
How does it feel... (Score:1)
And how do you explain the legality of snooping through the email of potentially thousands of people to extract the evidence on a specific individual? How is this different from tapping every public payphone in a city to get at one drug dealer?
Ethical question (Score:5)
Is a whitewash inevitable? (Score:4)
How do those of us concerned about Carnivore's immense power for invasion of privacy have any reason to believe what you and your institution produce will be other than a whitewash designed to make Carnivore appear in the most favorable light?
--
Franklin (Score:5)
What does it do? (Score:2)
Why IIT? (Score:5)
---------
Oversight of this interview (Score:5)
How will this publicity help/hurt? (Score:3)
Carnivore (Score:1)
Can you justify... (Score:5)
Will you be able to justify the time and expense of a) reviewing Carnivore, and b) deploying Carnivore, when Network ICE [networkice.com] has created Altivore [networkice.com], an open source program which claims to do everything for which the DOJ says that they need to use Carnivore?
Political or Technical Review? (Score:5)
To wit, is this review to determine if Carnivore performs actions that are within the scope of the law (political), or is it to define the complete potential of Carnvore (technical)?
If the former has anything to do with it, how can you justify performing this review without bias with your clear political connections to the parties invovled?
So you think you could use a keyword??? (Score:3)
Could you inconspicuosly add a keyword in the final report to indicate that there is something really bad here. Like maybe "peppered"??
So you might say "the source code is peppered with comments" or maybe "we peppered each other endlessly with questions" or maybe "the code is peppered with features to make sure abuse doesn't take place"??
Your views on full-open vs (initial) closed review (Score:4)
Would you have rather seen the code released on, something like www.fbi-carnivore.com (made up) for all to see/play with/use/abuse, or do you think that choosing a team of professionals to perform an independent review, with later possibilities to release more details (as is underway) is the right way to go?
What is your repsonse to those who call you "lackeys" and "government pawns" because of your participation?
All in all, best of luck. I personally feel that the semi-closed method is the better choice, because I know that holding a security clearance does not automatically cause you to lose your ability to think critically. I look forward to learning the results of your review (even if it is sometime "down the line".)
Encrypted Traffic? (Score:4)
Is it conceivable after your team's analysis that future of current versions Carnivore would allow the FBI to flag certain encrypted traffic as "suspicous" ???
Re:Is a whitewash inevitable? (Score:2)
Obviously this is an analogy, but its a pretty accurate one.
Why? (Score:5)
Your impressions. (Score:5)
Can you give us your first impressions of the concept of the Carnivore concept when you initially heard about it?
Can you give us your initial feelings as to the legal standings under the Fourth Amendment that allows Carnivore to be used for the purposes stated, which it would appear technically violates the Electronic Communications Privacy Act?
What is your impression of the amount of interest the Internet community at large is taking in the entire Carnivore concept? Do you feel there is too much paranoid fantasy going on, or do you feel there is some justification?
----
Re:Oversight of this interview (Score:1)
However, law school deans can be bought as easily as anyone else by the FBI, who sent letters to all major newspapers revealing that Martin Luther King, Jr. was having affairs, but on the condition of secrecy. None of the newspapers were willing to print the information on that condition, btw. The FBI also sent a letter to MLK telling him he should probably commit suicide because they were about to tell on him. True story.
Nevermind whether we trust you; do we trust FBI? (Score:4)
The basic problem here is that one connection to one wire gives them access to everyone's traffic passing on that wire. So the only limitation on the FBI's activities is your review and our trust that they are actually running what you have reviewed. What is to prevent them from running a new version of Carnivore, which has new capabilities. Given people's intolerance of "child porn" (including non-purient pictures of young nudists, pictures legal in one country but not another, and pictures of adults who look and dress younger than their age), what is to prevent the FBI from looking for people reading alt.binaries.pictures.kiddie-porn?
Re:Is a whitewash inevitable? (Score:1)
Postal Mail vs. Electronic Mail (Score:5)
So in short, is this whole thing just a moot point? Who would Carnivore really catch?
Comparing to wire-tapping laws (Score:5)
How does this effect our form of govrnment? (Score:3)
Being able to speak one's mind while remaining anonymous is one the the many tentant of our government. Collecting this information will not limit with thoughts we will be willing to express to our own private groups of friends.
Should be not let the guilty party go unmonitored, and thus protect the rights of the public to not be monitored, to in fact have some liberty?
(In my case I will premote having server to server communication encrypted, using a thrid party key sytem such as SSL)
Be seeing you.
Will the FBI (Score:2)
Re:Comparing to wire-tapping laws (Score:1)
Good point! This is the best question so far, I second it.
Are you willing to lose everything for your rights (Score:5)
Or...
Would you shrug your shoulders, and knowing that some day the truth will out, say nothing if the FBI completely changed your report, and hope that when exposed your reputation is not too badly tarnished?
the AC
Re:Oversight of this interview (Score:1)
Yes, interesting, but you do realize there's only one possible answer he can give to this, right? (OK, two if you count "[REDACTED]" as an answer.)
--
Exactly what will you be looking for? (Score:5)
And the irony of the interview (Score:1)
Why should Carnivore be required? (Score:1)
In that case, why should a court compel the installation of a secret, closed-source FBI Carnivore 'black-box' at the ISP?
What happens if something goes wrong with Carnivor (Score:1)
Examples: A cracker finds a way to use Carnivore to gain entry to and damage the ISPs systems. A cracker gains access to Carnivore discloses to the targeted parties that they are being watched. Carnivore is incompatible in some way with the ISPs systems and causes them damage.
Is the FBI off the hook for any damages the system causes?
If the evaluation team certifies Carnivore as "secure" what is its liability if it later is cracked?
What prevents Carnivore from being reconfigured to collect data on individuals who are not court ordered to be so?
What prevents Carnivore from being configured by the FBI to collect data on individuals who are not court ordered to be so?
Foreigners (Score:2)
Is it difficult to defend against Carnivore? (Score:2)
-Water Paradox
Re:Postal Mail vs. Electronic Mail (Score:1)
Question for IIT (Score:1)
Carnivore Question (Score:1)
How much of the IIT review will be for process, meaning how the information is used, what kinds of warrants are required, etc. versus the actual how does Carnivore work and can it be abused?
What does Carnivore do? (Score:2)
This is important because encrypting a message does no good against traffic analysis.
Is this a real review? (Score:5)
has declined to review Carnivore,
saying that "what they want is a rubber stamp."
Obviously, you will say you intend to do a genuine
review.
Why should anyone take your word over Schiller's?
standards for classification (Score:2)
I notice in the documents released by EFF that vast portions of the Carnivore docs are blacked out.
I am used to this type of release when it comes to Department of Defense, CIA, or NSA docs since those involve national security.
However these are FBI docs. What criteria determine when a document should be classified by the FBI?
How far can Carnivore go? (Score:1)
Why do you get privacy but deny the rest of us? (Score:4)
Legal end? (Score:3)
Dean Perrit,
The Slashdot story soliciting the questions you're now answering indicates that you're responsible for overseeing the "legal end" of the Carnivore review.
Would you please clarify what this entails? What legal issues are involved in performing a technology review?
Moderation alone not the most appropriate method (Score:1)
Wiretaps and the Law (Score:1)
Re:How does this effect our form of govrnment? (Score:1)
Big Brother and the Poll's (Score:1)
Re:How does this effect our form of govrnment? (Score:1)
Anonymous free speach, is free speach. The founders of the States believed that is was a much needed right. They did not call out "anonymous", but they did speak about it that way, as I recall.
I will need to do some digging to get specifics though.
The idea was that people could express an opinion, even an unpopular one, without having any harm or respisal. Unless people are completely free to express themselves then they will not.
Remember that each and every person within the USA is a member of the government. The idea was a self governing social order. I wonder how that plays into the whole thing also. Basically the "people" are the top governing body.
Well who has not wanted to spy on their bosses email. We've all been tempted, but most have resisted.
I hope the FBI resists.
Be seeing you.
Will Carnivore allow...? (Score:2)
--
Carnivore vs. Sniffer vs. Altivore (Score:5)
Packet reassembly and state-based protocol analysis are critical to the minimization function. My believe is that Carnivore is essentially stateless, just like my own Altivore. I can create real-world scenarios where Altivore fails the minimization test. Sure, they occur less than 1% of the time; I don't know how that fits within the law. However, software can be written to meet minimization requirements 100% of the time (e.g. BlackICE does this for detecting cr/hacking).
My question is: will a sniffing expert be analyzing the packet reassembly and protocol analysis part of the source code in order to validate that Carnivore captures all the data authorized by the court order, but no additional data? Moreover, is there really somebody on your team that understands even what I'm talking about?
Indemnity? (Score:2)
--
Software vs Hardware (Score:2)
Re:What does it do? (Score:1)
Re:Is a whitewash inevitable? (Score:1)
*scoove*
from the FBI archives, now suitable for general public consumption:
Article ## of the #.#. ############
The ##### of the ###### to be ###### in their #######, houses, ######, and effects, against ############ ######## and ########, shall not be ########, and no ######## shall issue but upon probable #####, supported by #### or ###########, and particularly describing the place to be ########, and the persons or things to be ######.
An Open-Source Inquiry? (Score:3)
Suppose this were an open-source investigation, incorporating the concerns of privacy advocates, free-speakers, independent technical experts, and other stakeholders. Without intending to speak for those stakeholders, I can imagine some of the issues that might be raised (I'm not asking you to answer these now):
- What technical, legal, and procedural information is required from the DoJ?
- What questions must be answered about the device, software, procedures, etc?
- What safeguards are required on the deployment of the device, software, procedures, etc?
- What should be done to assure that the government isn't abusing its power or threatening the privacy of bystanders?
- How can the results of a "stacked-deck" inquiry be made credible?
- How can minority opinions of the review team be published (without risking their careers or liberty)?
Would you be willing to incorporate lines of inquiry and specific questions from privacy advocates, free-speakers, independent technical experts, and other stakeholders into the review process and the resulting report?
Will you include failover tests? (Score:2)
One of the issues with Carnivores deployment is that ISPs do not want a box which they do not control interfering with their services.
Will your analysis include any investigations into the potentially detrimental effects this could have on an ISPs service, and if such are found can you use that as reason to prevent its deployment?
Concerns that Carnivore is not secure (Score:3)
The security of a system is offen compromised by secrecy; holes in the system are often not fixed but glossed over through or patched by obfuscation instead of fixing the problem.
A review by a large body of people often brings problems to light, and would force correct security fixes. Furthermore, it would put away any fear that Carnivore does anything that breaches the power of any government agency using it.
I understand there is an argument for secrecy, but if Carnivore truly does not violate any laws, then I find it hard to believe it does anything out of the ordinary or uses any technology that is already not widely implemented.
So to restate the question, why is Carnivore not Open Sourced to the online community (or at least 10-20 universities and organizations) if it does nothing illegal and doesn't use some supposed 'secret' technology?
Excellent excellent question! (Score:2)
--
Re:Will Carnivore allow...? (Score:1)
Unless it contacts a central warrant server and verifies the appropriate information before allowing an FBI agent to log in, or has an OCR warrant scanner to activate it, then yes.
___
Re:Comparing to wire-tapping laws (Score:1)
Re:Political or Technical Review? (Score:1)
from earlier reports, my understanding is, both.
the iitri (government lab) researchers are doing a technical review of the system. knowing what i do about iitri, i, and i would imagine the doj, expect that to be little more than a rubber stamp review of the system. they will say "yes carnivore does what it's inteneded to do, and nothing else" and we have to take their word for it, because they are probably the only people outside the fbi that will ever see the source.
dean perrit and the other people from iit-kent law school, on the other hand, will be doing a legal review of the system. (much different than a political review, if only in connotation) this is what i expect to be interesting, and i would say the only hope we have of a positive outcome regarding carnivore. while the government can edit their report, and they have legal recourse for preventing people from sharing technical details, they have no means of preventing someone (esp. a respected law teacher) from sharing his interpretation of the legality of the system.
and i wish people would not automatically assume everyone involved in this review (or the entire iit community) has "clear political connections to the parties invovled" while it is true that iitri has heavy government ties (it is essentially a privately owned government run research lab) the iit-kent law school, at least so far as i am aware, does not. i have met and dealt with dean perritt in the past, and i see no reason to expect that his opinions will be biased by political ties.
Re:Ethical question (Score:1)
while it is true that there are clear ties between iitri and many government agencies, iitri is doing the technical review of the system.
dean perritt and the group from iit-kent is, as i understand, part of a separate group, doing a legal review of carnivore. I am unaware of any reason that anybody automatically should assume before the review begins that there is anyone in the iit-kent group that is politically tied to the situation.
see my post further down the page for a bit more clarification.
Re:Postal Mail vs. Electronic Mail (Score:1)
Even I can answer this... Carnivore will catch the same criminals that are caught by wiretaps.... or by fingerprints. Both of these techniques can be mitigated by careful use of technology (or gloves), and yet they are powerful and effective tools.
Criminals are generally dumb because they commit crimes, and because they are dumb they tend to get caught. Think of it this way. There is a set of people who know how to use the internet, and the security tools that would keep them from getting caught. There is another set of people who prefer, for monetary or personal reasons, to commit crimes over normal legal behavior. The intersection of these sets is very small. The technoliterate with criminal intent are a rare breed, and will escape carnivore. Hoever, carnivore is going to catch all the dumb criminals. Carnivore was built because like AOL users, dumb criminals are flooding to the net, and the FBI needed a way to crack down on the majority of criminals who have net access, but not the saavy to have secure net access.
Rights of Business. (Score:3)
I could see the temporary installation during a specific investigation (with warrant) being constitutional, if there is no other way to get the data they need, but the permanant installation of these boxes goes directly contrary to this ruling. I quote Justice White, "The authority to make warrantless searches devolves almost unbridled discretion upon executive and administrative officers, particularly those in the field, as to when to search and whom to search".
This ruling gives businesses power to refuse entry to any agent that does not have a warrant. How exactly are they going to install these boxes, if the ISP has the legal right to refuse them entry without a warrant?
-
Re:Postal Mail vs. Electronic Mail (Score:2)
- Robin
True intent of Carnivore (Score:1)
Is Carnivore really a way for the federal government to attempt to put into place a means to shut down the Internet on a large scale when it suits their purpose?
Isn't Carnivore About Trusting The Client? (Score:2)
However pristine the code may be that you've been asked to evaluate, could you ever deny that the capability exists for a remote administrator to add new code which extracts additional information--or perhaps even spoofs new information onto ISP networks from the trusted perch of the Carnivore station?
Indeed, given the precarious and difficult growth of secure remote access protocols over the years, can you really determine in a closed environment that only authorized U.S. government administrators, and not foreign agents, corporate spies, or even 15 year old children will not be handed the keys to an NT machine with direct access and control over all inbound and outbound network traffic for the Internet's major ISPs?
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
What is an allowable response? (Score:2)
Updates, Patches, and the like (Score:1)
What if the FBI abuses your reputation? (Score:1)
Is the Carnivore Running On Slashdot, Right Now? (Score:1)
Additionally, as someone else who posted asked, can Carnivore monitor my reviewing of the interview simply by my connecting to
Linux rocks!!! www.dedserius.com [dedserius.com]
Re:What does it do? (Score:1)
Thanks... (Score:1)
Carnivore changes and repeat reviews (Score:1)
Is the review process going to be repeated whenever Carnivore is upgraded? If it is capable of remote administration, will we/you even know if Carnivore has been changed?
If either answer above is 'No', then what additional confidence does this exercise give us?
tolerance of diverse opinion? on /.? HAHAHAHAHA (Score:1)
IIT student review (Score:1)
Speaking as a student of IIT, I've already heard his nice soothing words for the student government, and wasn't a bit impressed. I wish better luck to you in wringing some truth from him.
For clarification, this review is being carried out by IITRI, the research institute on the south end of campus that bears our name but doesn't communicate with the campus. In fact, until we saw the register and slashdot and raised a fuss, they weren't even going to tell us the review was ongoing.
and when they did send in the guys with the very expensive suits and impressive titles to kill two birds with one stone (at that particular student gov. meeting, we were wrangling over other thorny issues) I found that they actually said usefull things when it came to the U-Pass (thorny issue in question) but when it came to carnivore, they seemed eager to lay the issue to rest and shut us up... and I've hear more honest sincerity and truthfulness from Microsoft ads than from those guys.
*shakes head* I have no love for this institution, and no trust in it, having dealt too much with it. I wish you luck, but beg you to take everything it puts out with a very healthy dose of skepticism.
Re:Carnivore (Score:1)
Aye, this is troublesome. (Score:1)
Re:Encrypted Traffic? (Score:1)
Re:Postal Mail vs. Electronic Mail (Score:1)