Slashdot Mirror
Talk to One of the Chief Carnivore Reviewers
All right, this FBI Carnivore thing and the review it's undergoing at the Illinois Institute of Tech [IIT] has been getting lots of press and lots of flack. The person overseeing the legal end of the process is Dean Henry H. Perritt, Jr. of the IIT's Chicago-Kent College of Law. Ask Dean Perritt any question you want. Tomorrow afternoon we'll forward 10 of the highest-moderated ones to him, and we expect his answers back sometime next week. Note: Before you start questioning Dean Perritt, you may want to check this story in Slashdot's Your Rights Online section, which links to some interesting new Carnivore information. (Special thanks to pridkett for arranging this interview.)
To be one of the people responsible for destroying the rights of every American citizen (including your own)?
And how do you explain the legality of snooping through the email of potentially thousands of people to extract the evidence on a specific individual? How is this different from tapping every public payphone in a city to get at one drug dealer?
Is it fair for an individual or group with clear political ties to a system to give that system a review? In other words, how can you be unbiased while still being politically tied to the situation?
Devolver's Homepage... more fun than a box of crackerjacks.
How do those of us concerned about Carnivore's immense power for invasion of privacy have any reason to believe what you and your institution produce will be other than a whitewash designed to make Carnivore appear in the most favorable light?
--
Disinfect the GNU General Public Virus!
Do you agree with Ben Franklin, that those who would trade liberty for security deserve neither?
The cake is a pie
Does Carnivore do anything more than what the FBI claims?
"Anyone that has ever gotten an idea based on any of my work and done something better with it-good for you."--J.Carmack
---------
Are you free to answer questions posted here, or does the FBI review your answers first?
-- Don't Tase me, bro!
Do you expect alumni donations to go up or down, now that you (dean of the college) are involved in this (high-profile) infamous activity?
-- Anne Marie
Why does the goverment think they can forcefully police various ISP's and demand that they install their system? If the FBI has a court-order to monitor someone then they should request that the ISP give them monitoring options. They shouldn't be able to monitor whoever they wish. They have to present to the court a VALID reason and go through the ISP. What gives them the right to log my e-mails, web pages or something of the sort? I have done nothing, I pay my taxes, and you can't invade my privacy.
Will you be able to justify the time and expense of a) reviewing Carnivore, and b) deploying Carnivore, when Network ICE has created Altivore, an open source program which claims to do everything for which the DOJ says that they need to use Carnivore?
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
To wit, is this review to determine if Carnivore performs actions that are within the scope of the law (political), or is it to define the complete potential of Carnvore (technical)?
If the former has anything to do with it, how can you justify performing this review without bias with your clear political connections to the parties invovled?
Most of us feel like that Carnivore is a done deal, and anything you might say against it will only be pulled out of the final report.
Could you inconspicuosly add a keyword in the final report to indicate that there is something really bad here. Like maybe "peppered"??
So you might say "the source code is peppered with comments" or maybe "we peppered each other endlessly with questions" or maybe "the code is peppered with features to make sure abuse doesn't take place"??
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
What are your feelings on the cries of the privacy rights community on allowing a fully open review of the source code?
Would you have rather seen the code released on, something like www.fbi-carnivore.com (made up) for all to see/play with/use/abuse, or do you think that choosing a team of professionals to perform an independent review, with later possibilities to release more details (as is underway) is the right way to go?
What is your repsonse to those who call you "lackeys" and "government pawns" because of your participation?
All in all, best of luck. I personally feel that the semi-closed method is the better choice, because I know that holding a security clearance does not automatically cause you to lose your ability to think critically. I look forward to learning the results of your review (even if it is sometime "down the line".)
Can you give us any clue as to if there is any functionality in Carnivore to specifically sniff, filter and analyze encrypted IP traffic?
Is it conceivable after your team's analysis that future of current versions Carnivore would allow the FBI to flag certain encrypted traffic as "suspicous" ???
"Tension is the great integrity" -- R. Buckminster Fuller
After all major research universities refused to apply to review Carnivore because the restrictions imposed on the reviewers are too stringent, why did IIT apply? What do you hope to acheive by reviewing Carnivore under the government's current terms?
ByteMyCode.com: A Web 2.0 code sharing community.
Can you give us your first impressions of the concept of the Carnivore concept when you initially heard about it?
Can you give us your initial feelings as to the legal standings under the Fourth Amendment that allows Carnivore to be used for the purposes stated, which it would appear technically violates the Electronic Communications Privacy Act?
What is your impression of the amount of interest the Internet community at large is taking in the entire Carnivore concept? Do you feel there is too much paranoid fantasy going on, or do you feel there is some justification?
----
Brazil has decided you're cute.
How do we know that the FBI will only deploy that which you have reviewed? FOIA requests have shown that the FBI has used other technology, which has done more than capture email.
The basic problem here is that one connection to one wire gives them access to everyone's traffic passing on that wire. So the only limitation on the FBI's activities is your review and our trust that they are actually running what you have reviewed. What is to prevent them from running a new version of Carnivore, which has new capabilities. Given people's intolerance of "child porn" (including non-purient pictures of young nudists, pictures legal in one country but not another, and pictures of adults who look and dress younger than their age), what is to prevent the FBI from looking for people reading alt.binaries.pictures.kiddie-porn?
Don't piss off The Angry Economist
In the end a system like carnivore will only work for a while, and only against fairly unintelligent users because end-to-end strong encryption is no longer compuationally infeasable. Joe Schmoe with the middle of the road prebuilt gateway could easily handle the processor load of encrypting all his e-mail with 2048 bit RSA (which is now freely available, and even exportable). Not only that, but even with existing (and reasonably near-term) quantum computers, we are not even near enough qbits to start tackling these cyphers, since they can't be broken down when being fed to a quantum computer.
So in short, is this whole thing just a moot point? Who would Carnivore really catch?
---
Play Six Pack Man. I
During the congressional hearing on Carnivore, the FBI stated that current wire-tapping laws are adequate for the use of Carnivore. Further more, they revealed that the uses so far of Carnivore had been according to the regulations of optaining a "pen-register" wire tap. Are you aware that (from what we know) technically Carnivore is much closer to the concept of trunk-tapping, as most, if not all the traffic at the ISP has to go through Carnivore? AFAIK, trunk-tapping is illegal - would you be of the opinion that Carnivore automatically falls under the same illegal category of wire-tapping?
Being able to speak one's mind while remaining anonymous is one the the many tentant of our government. Collecting this information will not limit with thoughts we will be willing to express to our own private groups of friends.
Should be not let the guilty party go unmonitored, and thus protect the rights of the public to not be monitored, to in fact have some liberty?
(In my case I will premote having server to server communication encrypted, using a thrid party key sytem such as SSL)
Be seeing you.
-- Prepared at the direction of, or to be sent to Legal Counsel, in anticipation of litigation. Attorney Client Pri
Will the FBI be reviewing/editing your answers to are questions?
I want a gmail account. Can someone help me
If you found that carnivore did more than the FBI is claiming, would you stand up to their threats if you published your results to counter their "edited" report? Would you be willing to lose everything you have to stand up for the rights of Americans, your property, your retirement, your liberty, and your professional reputation? You would be vilified and persecuted by the FBI for your actions, even though you would win the admiration of liberty loving individuals all over America.
Or...
Would you shrug your shoulders, and knowing that some day the truth will out, say nothing if the FBI completely changed your report, and hope that when exposed your reputation is not too badly tarnished?
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Right now, most people think of Carnivore as a black box that basically looks at email headers, grabs the emails of headers of marked addresses, and copies that off to somewhere else. Certainly enough speculation on the technical aspects of this, and many on the ethical side. What will you be looking for when you actually start this study? Are you trying to understand the technology behind it? Are you looking at it's effectiveness? The invasion of privacy issues that come from it? Will you be allowed to make suggestions and recommendations to the FBI, or are you mainly there to try to tell us, the American public, what and what not the Carnivore system can do?
"Pinky, you've left the lens cap of your mind on again." - P&TB
"I can see my house from here!" - ST:
I wonder how the FBIs will redact portions of an email? Hopefully with something better than the PDF fodder floating around with the review teams names....
Suppose that FBI wishes, with appropriate authority, to intercept the e-mail of a particular person. Suppose further that the person's ISP volunteers to monitor such e-mail and send the results to the FBI, using an open-source program that will demonstrably satisfy the FBI's legitimate needs.
In that case, why should a court compel the installation of a secret, closed-source FBI Carnivore 'black-box' at the ISP?
Assuming that an ISP has been forced to use Carnivore, what happens if something goes wrong?
Examples: A cracker finds a way to use Carnivore to gain entry to and damage the ISPs systems. A cracker gains access to Carnivore discloses to the targeted parties that they are being watched. Carnivore is incompatible in some way with the ISPs systems and causes them damage.
Is the FBI off the hook for any damages the system causes?
If the evaluation team certifies Carnivore as "secure" what is its liability if it later is cracked?
What prevents Carnivore from being reconfigured to collect data on individuals who are not court ordered to be so?
What prevents Carnivore from being configured by the FBI to collect data on individuals who are not court ordered to be so?
Americans may enjoy some legal protection against FBI (or others) abusing the carnivore system. WHat legal or moral protection exists to people who are not blessed with an U.S. citizenship? Are we fair game when ever our communications happen to be routed via USA?
In Murphy We Turst
-Water Paradox
information is immaterial
Will IIT and the participants identified with the Carnivore study accept financial responsibility for any abuse of and/or vulnerabilities in Carnivore not disclosed in their report?
How much of the IIT review will be for process, meaning how the information is used, what kinds of warrants are required, etc. versus the actual how does Carnivore work and can it be abused?
This is important because encrypting a message does no good against traffic analysis.
Jeff Schiller of MIT
has declined to review Carnivore,
saying that "what they want is a rubber stamp."
Obviously, you will say you intend to do a genuine
review.
Why should anyone take your word over Schiller's?
I notice in the documents released by EFF that vast portions of the Carnivore docs are blacked out.
I am used to this type of release when it comes to Department of Defense, CIA, or NSA docs since those involve national security.
However these are FBI docs. What criteria determine when a document should be classified by the FBI?
Let's suppose I run my own server. I provide the connections to 10 users, with my own cabling, etc. I am not using one ounce of government lines. Someone uses my server and connects to m$n.com for some (ungodly) reason. Will Carnivore be able to penetrate the server and look at my 10 users on my "private" network?
Fast, cheap, correct. You get to pick two.
The names of the IIT reviewers were initially redacted and only revealed when it turned out that the electronic version was poorly constructed. Why were the names hidden? Do you feel that it's hypocritical to demand privacy for your reviewers while stripping away the privacy of everyone else? If it's so important that our actions be open, why can't yours be open?
Dean Perrit,
The Slashdot story soliciting the questions you're now answering indicates that you're responsible for overseeing the "legal end" of the Carnivore review.
Would you please clarify what this entails? What legal issues are involved in performing a technology review?
-- He's fantastic, made of plastic....
Several questions which are insightful are receiving 1, while off-topic material is receiving higher scores. Whoever is making the decision on the final 10 questions, please consider supplementing the moderation process with something that reveals diversity, controversy, and insight.
information is immaterial
What is the history of the whole practice of intercepting electronic communication? As far as I know, it is unlawful for any US government branch to intercept the mail of suspects in criminal investigations, so why is it that they are allowed to intercept phone and email? Why should service providers be forced to compromise the integrity of their dealings with their customers to allow government access to private conversations? What do you think is the correct application of Ammendment IV to conversations and correspondence?
What type of impact do you think this will have on the Presidental and Senate races?. I for one am taking both Carnivour and the H1B Visa increase issues to the poll's with me this year. How long do you think will it take for the american citizen to get fed up with our current government's actions?.
Got Code?
Will Carnivore allow anyone to read my mail without a warrant signed by a judge?
--
Sheesh, evil *and* a jerk. -- Jade
Packet reassembly and state-based protocol analysis are critical to the minimization function. My believe is that Carnivore is essentially stateless, just like my own Altivore. I can create real-world scenarios where Altivore fails the minimization test. Sure, they occur less than 1% of the time; I don't know how that fits within the law. However, software can be written to meet minimization requirements 100% of the time (e.g. BlackICE does this for detecting cr/hacking).
My question is: will a sniffing expert be analyzing the packet reassembly and protocol analysis part of the source code in order to validate that Carnivore captures all the data authorized by the court order, but no additional data? Moreover, is there really somebody on your team that understands even what I'm talking about?
Has the government indemnified IIT and/or the individuals taking part in this review against legal actions arising from your participation in it? Formally or off-the-record?
--
Sheesh, evil *and* a jerk. -- Jade
Couldn't Carnivore do many of the things it claims to do simply by being a software package installed on an ISP's host machines? Why does it require a seperate 'box' when everything it's been purported to do can be acomplished by a script kiddie with a floppy disk of programs run from any Windows box on the 'net?
You must realize that the credibility of your review is very low, before it has hardly begun. It seems unlikely, in the present climate of suspicion, that you can achieve the objectives of DoJ, and the needs of the American people, to allay concerns that "the FBI's temporary use of the Carnivore system could interfere with the proper functioning of an ISP's network; concern that the system might, when used properly, provide investigators with more information than is authorized by a given court order; and concern that even if the system functions appropriately when properly used, its capabilities give rise to a risk of misuse, leading to improper invasions of privacy" [quoted from the Executive Summary of the DoJ RFP].
Suppose this were an open-source investigation, incorporating the concerns of privacy advocates, free-speakers, independent technical experts, and other stakeholders. Without intending to speak for those stakeholders, I can imagine some of the issues that might be raised (I'm not asking you to answer these now):
- What technical, legal, and procedural information is required from the DoJ?
- What questions must be answered about the device, software, procedures, etc?
- What safeguards are required on the deployment of the device, software, procedures, etc?
- What should be done to assure that the government isn't abusing its power or threatening the privacy of bystanders?
- How can the results of a "stacked-deck" inquiry be made credible?
- How can minority opinions of the review team be published (without risking their careers or liberty)?
Would you be willing to incorporate lines of inquiry and specific questions from privacy advocates, free-speakers, independent technical experts, and other stakeholders into the review process and the resulting report?
One of the issues with Carnivores deployment is that ISPs do not want a box which they do not control interfering with their services.
Will your analysis include any investigations into the potentially detrimental effects this could have on an ISPs service, and if such are found can you use that as reason to prevent its deployment?
Slashdot: Proof that a million monkeys at a million typewriters can create a masterpiece
The security of a system is offen compromised by secrecy; holes in the system are often not fixed but glossed over through or patched by obfuscation instead of fixing the problem.
A review by a large body of people often brings problems to light, and would force correct security fixes. Furthermore, it would put away any fear that Carnivore does anything that breaches the power of any government agency using it.
I understand there is an argument for secrecy, but if Carnivore truly does not violate any laws, then I find it hard to believe it does anything out of the ordinary or uses any technology that is already not widely implemented.
So to restate the question, why is Carnivore not Open Sourced to the online community (or at least 10-20 universities and organizations) if it does nothing illegal and doesn't use some supposed 'secret' technology?
After all, isn't this exactly what Carnivore is going to do? The proponents say "if you don't do anything wrong you won't even know it's there and therefore it's OK." WRONG! Censorship is not when the gov't keeps me from talking. Censorship is when the gov't reviews everything I want to say beforehand even if I always get approval.
--
Non-meta-modded "Overrated" mods are killing Slashdot
(Hey Ryan! Here's your proof!)
I could see the temporary installation during a specific investigation (with warrant) being constitutional, if there is no other way to get the data they need, but the permanant installation of these boxes goes directly contrary to this ruling. I quote Justice White, "The authority to make warrantless searches devolves almost unbridled discretion upon executive and administrative officers, particularly those in the field, as to when to search and whom to search".
This ruling gives businesses power to refuse entry to any agent that does not have a warrant. How exactly are they going to install these boxes, if the ISP has the legal right to refuse them entry without a warrant?
-
I've had enough abrasive sigs. Kittens are cute and fuzzy.
I have this sinking feeling that the stated objectives of carnivore are not the end goal here. I am curious if Carnivore could in fact me a means for the federal government to essentially put an "on/off" switch at every major traffic distribution point in U.S., with the intent that someday when the need presents itself, any and/or all of these points can very quickly be shut off.
Is Carnivore really a way for the federal government to attempt to put into place a means to shut down the Internet on a large scale when it suits their purpose?
Casca
The core nature of the Carnivore system is that it forces an ISP to grant the Government both raw and remote access to all data flows coming in and out of the ISP. This data is ostensibly filtered and selected out by the Carnivore system, but this is pretty clearly a classic case of "trusting the client" not to extract more information than its otherwise authorized to by the spec.
However pristine the code may be that you've been asked to evaluate, could you ever deny that the capability exists for a remote administrator to add new code which extracts additional information--or perhaps even spoofs new information onto ISP networks from the trusted perch of the Carnivore station?
Indeed, given the precarious and difficult growth of secure remote access protocols over the years, can you really determine in a closed environment that only authorized U.S. government administrators, and not foreign agents, corporate spies, or even 15 year old children will not be handed the keys to an NT machine with direct access and control over all inbound and outbound network traffic for the Internet's major ISPs?
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
Much of the original specification for carnivore is still considered classified (see redactions here: http://www.epic.org/privacy/carnivore/foia_documen ts.html). So just what will the FBI allow you to disclose in this interview?
It's a brave new world. We work at internet speed. And the world changes every day. So our software changes with us. Even high quality products that are tested extensively eventually become outdated. I'm sure that Carnivore will need to be tweaked and updated on a regular basis to stay one step ahead (or behind!) of the more technicaly minded citizens and criminals. Once your team has finished it's review of the Carnivore system, what guarantees do we have that the next update to allow Carnivore to work with the "Next Big Thing" wont also include a hack to work around the privacy controls that allowed Carnviore to pass your review?
Or, more importantly, will it be running after the results are posted?
./ to educate myself on your remarks? (I run my own networks through fairly non-interesting ISPs).
Additionally, as someone else who posted asked, can Carnivore monitor my reviewing of the interview simply by my connecting to
Linux rocks!!! www.dedserius.com
www.dedserius.com
VB != VisualBasic
Thanks =:-) My brain was definetely not all there =:-)
---
Play Six Pack Man. I
All software/hardware packages require upgrades or at least changes from time to time. Carnivore will be almost certainly not be an exception to this rule.
Is the review process going to be repeated whenever Carnivore is upgraded? If it is capable of remote administration, will we/you even know if Carnivore has been changed?
If either answer above is 'No', then what additional confidence does this exercise give us?
You're only jealous cos the little penguins are talking to me.
you troll you
Speaking as a student of IIT, I've already heard his nice soothing words for the student government, and wasn't a bit impressed. I wish better luck to you in wringing some truth from him.
For clarification, this review is being carried out by IITRI, the research institute on the south end of campus that bears our name but doesn't communicate with the campus. In fact, until we saw the register and slashdot and raised a fuss, they weren't even going to tell us the review was ongoing.
and when they did send in the guys with the very expensive suits and impressive titles to kill two birds with one stone (at that particular student gov. meeting, we were wrangling over other thorny issues) I found that they actually said usefull things when it came to the U-Pass (thorny issue in question) but when it came to carnivore, they seemed eager to lay the issue to rest and shut us up... and I've hear more honest sincerity and truthfulness from Microsoft ads than from those guys.
*shakes head* I have no love for this institution, and no trust in it, having dealt too much with it. I wish you luck, but beg you to take everything it puts out with a very healthy dose of skepticism.
What can I say? I looked up the info that EPIC has gotten...90% of it blacked out. What are the packet sniffin' capibilities of this program? It spooks me, also...as said before. Who is going to stop them from turning this thing on and snooping though everyone's e-mail? It's documented that the FBI cannot be trusted. I suppose it goes back to '91 when I first got on the net. The first thing I did was obtain a digital signature. The second thing I did was encrypt all my e-mail with PGP. There is nothing else that you can do if you want security. Even PGP can be broken with time, but if someone is so intrested in snooping into my e-mail to listen to my conversations with my girl overseas then let them. But it doesn't make me happy. I would be more happy if they would keep their noses outta my business. All in all this makes me sick, but this has turned into a rant. Unfortunatly, and I was going to say something decent...maybe I'll remeber sometime! ^_^
Om, nomnomnom...