Slashdot Mirror
Carnivore-like tool released as Open Source
Joe Smith writes "NetworkICE released a new Carnivore-like tool that does *everything* FBI said Carnivore is supposed to do." Of course there's no way the FBI will accept this, and the conspiracy theorists will use this as proof that Carnivore is doing more then the FBI is 'fessing up to.
From a "Kill Carnivore" POV this was an excellent move. As noted in the summary, the FBI now has to explain why Carnivore is to be preferred over the open version with the same functionality.
But from a "Promote Open Source/Free Software" POV it's unfortunate because the explanation the FBI is likely to use is "open source can't be trusted". We already know that's false (whether diametrically opposed or orthogonal is a matter of debate), but how imagine Bill Gates quoting Louis Freeh or Janet Reno as saying that "our secrets have to be protected by secret software" or "open source == child molesting terrorists".
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
While I agree with most of your sentiments, my real dislike of the Carnivore (or RIP in the UK) situation is this:
Citizens don't mind that their government agents are able to obtain wiretap warrants on specific people, because the warrants have to come from a particularly high authority and there must be a valid reason for obtaining each and every individual wiretap. The privellege of being able to legally listen in on someone's conversations is balanced against the level of evidence required to be submitted in advance, and also the accountability for your actions if you wiretap for malicious reasons rather than investigating crime.
However, with these new systems, the government agents now have full unguarded access to most but not all of the country's email. There is full anonymity for the agents involved, and there is no accountability. They do not need to give any reasoning to obtain the authority to spy on people, because they've installed near-blanket surveillance on their nation.
Onto the topic of an open-source versus secret carnivore, I'd like to see that there really was a system of authority in operation, ie only the named person's email is captured. As for criminals reading the code to get out of the surveillance, firstly the FBI would be using this to _monitor_ someone, and if it all goes quiet they would investigate why, and if it's via manipulations to get out of the monitored stream, they could trace through that with the ISP and close any hole. Secondly, simply not using email or using an ISP without Carnivore will get you out of trouble, as will end-to-end encrypted IPv6 streams when they hit mainstream, much more effective than reading thorough source code.
Carnivore is the stuff of Orwellian futures, and I just want to see some declaration of accountability to the public here, not demonizing of Internet users as drug dealing terrorist paedophiles.
Does my bum look big in this?
I was just thinking (dangerous, I know) that perhaps this whole Carnivore debate is really just a smokescreen. After all, if you're suspected of being involved in a federal crime, how difficult is it to track your e-mail? I'm sure that if the FBI came in with a subpoena, they could easily set up an e-mail wiretap at the ISP level. They could try packet sniffing, set up a dummy DNS server to intercept their transmissions, all without infringing on the privacy of others. The fact that an open-source project can do the same does seem to indicate that they have something to hide.
What exactly is the rationale for Carnivore then? It's like wiretapping every phone in America then saying that they'll only turn it on with a court order... you'd never be able to trust them at their word. Why shouldn't the same protections that protect us from unauthorized wiretaps protect our e-mail?
The real purpose behind Carnivore is probably less about catching criminals, and more about government testing the waters. They can get by with an Echelon in other countries because the average American wouldn't care if we spied on France. But, what would be the reaction if Echelon were used for domestic surveillance? (Which only the FBI can legally do?) Carnivore probably isn't going to do much to fight crime, just lead to criminals forging their e-mails, getting multiple Hotmail accounts, and generally making it impossible to accurately trace.
Carnivore as a system is irrelevant. It's real purpose is to see how far the FBI can go in this area, one step more on the slippery slope towards a Big Brother police state. Perhaps the intentions of Carnivore are good, but we all know what the road to hell is paved with...
Want to see more of the DMCA? Vote Gore, the favorite of the MPAA!
A. The governent has the ability to catch all the paedophiles, terrorists and so on by means of black boxes which read all their email. Since the boxes are black, you have to take it on Government say-so that they operate legally and only under warrant. The government therefore has the capability to silently upgrade the box to spy at any time on the private communication of all its law-abiding citizens, and send the men in balaclavas round to fetch anyone that seems subversive. Meanwhile all terrorists and paedophiles with two brain cells to rub together are not using the internet to discuss their evil plans.
B. The black box is not in place, or an open solution is used instead, and a few people use the internet to plan crimes.
I would suggest that under the US constitution option B is the only viable one. Ditto the European Human Rights laws. And personally I would certainly prefer option B.
To put it a different way: If a relative of yours was blown up after two men in trench coats planted a bomb, and this could have been prevented had all policemen had orders to shoot on sight all people wearing trench coats, would this have been the right thing to do? Sometimes we have to choose the lesser of two evils.
Rather than having to hire specialists to pore over the OS Carnivore alternative and fix any holes or weaknesses that they find, they can, at no cost, simply use the version that they paid for.
That argument doesn't hold water, because the furor over Carnivore stems not from the fact that it might have flaws or weaknesses, but that nobody quite knows what Carnivore's capabilities are. Are you absolutely sure it's just tapping email? Or maybe there's built-in packet sniffing, as well. Perhaps it maintains its own duplicate cache of every web page you access.
Or, since Carnivore is a black box, perhaps it scans *every* email or web page request and does some fancy pattern matching on it. Under the auspices of looking at Joe Blow's email, the FBI has a tool in which to look for whatever they want: people downloading kiddie porn, people building bombs, people passing military secrets... which they have NO RIGHT to look for beyond look at Joe Blow's email.
Nobody's bitching about Carnivore because it might have a flaw. The big stink is the fact the FBI won't give any more information on Carnivore than sound bites, and people are justifiably worried that Carnivore might do more than just tap one persons emails.
I also don't understand how an alternative that is different in only one respect (open sourced) and supposedly has the exact same functionality is superior to the closed source version. To me, a well-designed program is a well-designed program, whether it was designed in total secrecy or GPLed.
It's not about the design. If this were simply about security flaws you'd be correct.
This is about the capability of software you know nothing about. An open version allows an ISP to make 100% sure that all it does is tap email. With the FBI's black box, you have to take your chances.
Open source, in this instance, provides a much greater level of security and comfort than proprietary software.
--
A better analogy which captures more of what the FBI is doing would be: "Suppose some terrorist group was using the US postal service to plot its plans." Unencrypted e-mail is like a post card, encrypted e-mail is like a letter inside of an envelope.
While e-mail is faster than snail mail, it lacks the immediate feedback of a phone conversation; in addition it leaves an audit trail that any terrorist organization would be fools to leave.
I would think that something like ICQ would be a better choice for clandestine plotting than e-mail.
Another way of handling communication would be through https and some secure forms to a .com site; your 'order' could be "Bomb the UN building at 3:OO PM".
In any case the whole "We've got to read your mail" paranoia on the part of the FBI is mostly unnecessary; traffic analysis alone will give them the vast majority of the information they need to have on any terrorist organization.
Besides, sending an e-mail message like "You da bomb" gets you looked at by Echelon anyway.
The FBI just wants Carnivore because it is full of petty snoopy people who like to read other peoples mail. Since 99.9999% of all email is of the innocent variety, they have to read an awful lot of innocuous stuff to find the sort of criminal communications that they claim are "flooding the Internet".
Anyone who is seriously worried that their daughter is going to be kidnapped and raped by political terrorists also needs to be worried about being electrocuted by a lightning strike in a dust storm; since the two events are roughly equal in probability.
The broadcast media and newspapers have a hidden agenda; both of these groups are terrified of the potential competition that the Internet can be for them - so they want the Internet as crippled as they can make it. That is the real motivating reason for all of the stories of "slavering pedophile boogie men who are going to turn your rosy cheeked 8 year old into a porn - ho".
If you want to see how ridiculous all of these stories are remember that the Internet is just a medium of communication like the air or the US Mail is. Substitute "Air" or "Postal Service" for Internet and the absurdity of the stories is apparent:
"A Pedophile was arrested today. Authorities said that he 'talked' to a little girl on her way to school. The FBI renewed its demand before congress to get parabolic microphones and laser snooping devices on every street corner so that they could listen in to all conversations to prevent that sort of crime from happening."
"You can never tell who is plotting crimes by using the air to talk to each other, so we need to have the ability to snoop on all conversations. Besides, if you aren't doing anything wrong how could you object? Warrants, we don't need no steenking warrants; this is an emergency, all civil rights need to be suspended for the duration."
Curious that no one has listed the links for the Page, Company, or Source Code. Let alone the Forum or associated presentation. Maybe this will help: http://www.networkice.com/altivore/
-a.e.mossberg
If the Australian Government passed a bill approving a carnivore-like system to be used in Australia, you wouldn't hear too many complaints from the public. ASIO (equiv to CIA) has the power to intercept and read your e-mail if they suspect you of engaging in criminal activities. No guidelines are given to what constitutes 'suspicion', it's completely arbitrary and at the discretion of the agent involved.
--
Daniel Zeaiter
daniel@academytiles.com.au
http://www.academytiles.com.au
ICQ: 16889511