Carnivore in cyberspace: extending the Electronic Communications Privacy Act's framework to Carnivore surveillance.

• Author: North, Geoffrey A.
• Position: Government surveillance software

1. INTRODUCTION

   With each advance of communications technology comes a correlated advance in the technology of surveillance: if the developments of the Internet and e-mail constitutes a revolution in the way Americans communicate, these developments have fomented a similar revolution in the way the United States government investigates crime. While some advances in surveillance have been facilitated by the passage of the Communications Assistance for Law Enforcement Act of 1994 (CALEA) (1), perhaps the single most powerful and far-reaching surveillance tool to monitor Internet communications arose out of the governmental concern of preventing cyberspace from being overrun with crime. This tool has been ominously dubbed "Carnivore." (2)

   If advances in communications and surveillance technology occur in distinct and evenly matched steps, it should not be surprising that Carnivore's features mirror the elements of the major telephonic surveillance devices: wiretaps, pen registers and trap-and-trace devices. Carnivore, however, is believed to impound information transmitted through cyberspace with unprecedented efficiency.

   While privacy advocates have expressed deep concerns about the potential abuses of Carnivore's capabilities, government officials have argued powerfully for the need to patrol the electronic frontier for potential crime.

   The balancing of the interests of these sometimes polarized groups will shape the structure of this note. In Part II of this Note, the known facts surrounding Carnivore will be examined, with a discussion of Carnivore's similarity to telephonic surveillance devices. Part III will survey the current state of pertinent Fourth Amendment law, including the Katz doctrine, its progeny, and cases decided under Title III of the Omnibus Crime Control and Safe Streets Act (3) and the Electronic Communications Privacy Act of 1996 (ECPA) (4). Finally, this Note will conclude that the safeguards provided under those two Acts are readily applicable to Carnivore, and should be used to develop a balance between the privacy interests of the public at large and the law enforcement interests of the government.

2. PRIVACY AND LAW ENFORCEMENT IN CYBERSPACE

   The FBI computer labs in Quantico, Virginia recently developed "Carnivore," with the express intent of creating a tool capable of tapping into and monitoring Internet traffic. (5) The specter of Carnivore now looms heavily over cyberspace, for it is feared that the application will be used by the FBI to "police cyberspace." (6) While government agencies such as the FBI and the Department of Justice have long had the ability to monitor private telephone conversations with a variety of technological devices, electronic communication was believed to be secure from monitoring by the government. Now, however, the advent of Carnivore has officially extended the reach of the FBI into cyberspace.

   It is not merely that the FBI now has the ability to monitor private electronic communications that has made civil liberties groups apprehensive, it is the breadth of the government's reach. Barry Steinhardt, the Associate Director of the American Civil Liberties Union (ACLU) recognizes the governmental interest in preventing the Internet from becoming overrun with criminal plotting and actual illegal acts, but believes some boundaries must be set for governmental agencies. (7) As Steinhardt notes, "[t]he central issue is how much liberty the government should be able to destroy in order to `catch a few perps.'" (8)

   Due to its vast information-gathering capacity, Carnivore's targets will not necessarily be limited to specific e-mail transmissions that are suspected of communicating details of illegal activities. Carnivore is not subject to the concerns of efficiency and time which force the government to target specific individuals for conventional telephone wiretaps. Rather, Carnivore may have the ability to impound all electronic communications, then filter out those that do not give rise to investigation. One commentator, James H. Johnston, recalls:

   [T]he apocryphal story of the ruthless commander of the Ottoman forces that sacked Constantinople. When he saw the defenders and residents of the city take sanctuary in a church, he ordered his men to set it afire. A lieutenant pointed out that there were faithful as well as infidels inside, but the general said, `Burn it anyway, and let God sort them out.' (9) A great deal of concern has arisen among civil liberties groups such as the ACLU because so little is known about Carnivore's reach and capabilities.

   While an independent review of Carnivore has recently been completed, it has faced pointed criticisms from advocates of personal privacy. The review team that was chosen from the Illinois Institute of Technology's Research Institute "include[d] a large number of White House insiders, including a former Clinton information policy advisor, and a former Justice Department official." (10) This research group's stated objective was to "determine whether it's technically possible for Carnivore to snoop on e-mail beyond the scope of a wiretap order, and whether it poses other privacy risks." (11)

   The Attorney General for the Clinton Administration, Janet Reno, allowed for the eventual release of thousands of pages of information regarding Carnivore. However, an initial block of information released, totaling over seven hundred pages of material, has encountered reactions of deep disappointment. (12) Much of the material that has thus far been declassified and released has been stripped of any value, its meaning obscured by the blocking out of apparently key portions censored by the government before its release. (13) The anticipated release of an additional two hundred pages was withheld completely. (14)

   There have also been numerous calls for the FBI to make Carnivore's source code publicly available. (15) Due to the inadequacies that have riddled the independent review and releases of information thus far, many critics believe that this step will be the most effective way to ascertain the potential reach of Carnivore. The FBI, however, has resisted, fearing that such a release will, in effect, hand over the use of Carnivore's capabilities to hackers. (16)

   The lack of available information about Carnivore, combined with what some believe is a lack of candor on the part of the government in disclosing only the most general details has fueled the fears of civil liberties groups that Carnivore really does possess the power to conduct all-encompassing surveillance of communications carried out in cyberspace.

   Among such groups' greatest worries is that Carnivore has the far-reaching power to surveil either all correspondence that takes place over the Internet or through e-mail, or any that the investigating governmental agency chooses, regardless of whether a warrant to seize such information has been obtained. (17) In addition, opponents of Carnivore fear that the program gives the FBI the power to read all correspondence it intercepts and then filter out the innocuous transmissions. Donald Kerr, FBI Assistant Director, has testified to Congress that Carnivore "does not search through the contents of every message and collect those that contain key words like `bomb' and `drugs.'" (18) The ACLU, however, has claimed that the FBI is engaged in an "`unprecedented' power grab that threatens the privacy of all Americans." (19) Moreover, the FBI has offered only its word as assurance that Carnivore's power is not being abused. (20)

   The federal government has an undeniable interest in protecting the safety of American citizens. This governmental interest extends into cyberspace as well. (21) Privacy groups argue, however, that this interest must stop somewhere short of observing the contents of e-mail messages that pass between private individuals, tracking the destinations of Internet users, and monitoring an individual's electronic communications. Just as some commentators have looked to the "interest that a law enforcement officer might have in examining the contents of a hard drive ... [for] the trove of information there may yield important insights into crimes that the owner may have committed," there is a similar temptation for law enforcement officers to observe the communications and correspondence of an individual through the Internet and through e-mail. (22) In fact, because Carnivore gives the government the ability to sift through all e-mail correspondence that passes through an Internet Service Provider ("ISP"), the governmental reach may be even more insidious.

   1. How does Carnivore work?

      The greatest source of apprehension surrounding Carnivore is the lack of both public and expert understanding of how the application functions, and then, to what extent Carnivore can and will be implemented to monitor or intercept e-mail and other electronic correspondence. (23) James Dempsey, senior staff counsel for the Center for Democracy and Technology, explains that "[t]he first problem with Carnivore is that even [the] ISPs [where Carnivore has been installed] do not know how it works and how its searches are limited." (24)

      Installed and configured to properly reflect the specifications detailed in a warrant, Carnivore does not possess the sinister characteristics that privacy advocates attribute to it. Donald Kerr, Assistant Director of the FBI, testified at a Senate Judiciary Committee Hearing in 2000 that Carnivore "can be configured to specifically comply with each court order." (25) The Carnivore system is made up of several seemingly harmless components. First, it is a "conventional personal computer ... installed on the premises of an Internet Service Provider." (26) This computer is equipped with a modified version of commercially available software: a "customized" version of a "Windows 2000 application." (27)

      However, Carnivore is more than merely the sum of its parts. The modifications to the...