Slashdot Mirror
Talk to One of the Chief Carnivore Reviewers
All right, this FBI Carnivore thing and the review it's undergoing at the Illinois Institute of Tech [IIT] has been getting lots of press and lots of flack. The person overseeing the legal end of the process is Dean Henry H. Perritt, Jr. of the IIT's Chicago-Kent College of Law. Ask Dean Perritt any question you want. Tomorrow afternoon we'll forward 10 of the highest-moderated ones to him, and we expect his answers back sometime next week. Note: Before you start questioning Dean Perritt, you may want to check this story in Slashdot's Your Rights Online section, which links to some interesting new Carnivore information. (Special thanks to pridkett for arranging this interview.)
Is it fair for an individual or group with clear political ties to a system to give that system a review? In other words, how can you be unbiased while still being politically tied to the situation?
Devolver's Homepage... more fun than a box of crackerjacks.
How do those of us concerned about Carnivore's immense power for invasion of privacy have any reason to believe what you and your institution produce will be other than a whitewash designed to make Carnivore appear in the most favorable light?
--
Disinfect the GNU General Public Virus!
Do you agree with Ben Franklin, that those who would trade liberty for security deserve neither?
The cake is a pie
Does Carnivore do anything more than what the FBI claims?
"Anyone that has ever gotten an idea based on any of my work and done something better with it-good for you."--J.Carmack
---------
Are you free to answer questions posted here, or does the FBI review your answers first?
-- Don't Tase me, bro!
Do you expect alumni donations to go up or down, now that you (dean of the college) are involved in this (high-profile) infamous activity?
-- Anne Marie
Will you be able to justify the time and expense of a) reviewing Carnivore, and b) deploying Carnivore, when Network ICE has created Altivore, an open source program which claims to do everything for which the DOJ says that they need to use Carnivore?
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
To wit, is this review to determine if Carnivore performs actions that are within the scope of the law (political), or is it to define the complete potential of Carnvore (technical)?
If the former has anything to do with it, how can you justify performing this review without bias with your clear political connections to the parties invovled?
Most of us feel like that Carnivore is a done deal, and anything you might say against it will only be pulled out of the final report.
Could you inconspicuosly add a keyword in the final report to indicate that there is something really bad here. Like maybe "peppered"??
So you might say "the source code is peppered with comments" or maybe "we peppered each other endlessly with questions" or maybe "the code is peppered with features to make sure abuse doesn't take place"??
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
What are your feelings on the cries of the privacy rights community on allowing a fully open review of the source code?
Would you have rather seen the code released on, something like www.fbi-carnivore.com (made up) for all to see/play with/use/abuse, or do you think that choosing a team of professionals to perform an independent review, with later possibilities to release more details (as is underway) is the right way to go?
What is your repsonse to those who call you "lackeys" and "government pawns" because of your participation?
All in all, best of luck. I personally feel that the semi-closed method is the better choice, because I know that holding a security clearance does not automatically cause you to lose your ability to think critically. I look forward to learning the results of your review (even if it is sometime "down the line".)
Can you give us any clue as to if there is any functionality in Carnivore to specifically sniff, filter and analyze encrypted IP traffic?
Is it conceivable after your team's analysis that future of current versions Carnivore would allow the FBI to flag certain encrypted traffic as "suspicous" ???
"Tension is the great integrity" -- R. Buckminster Fuller
After all major research universities refused to apply to review Carnivore because the restrictions imposed on the reviewers are too stringent, why did IIT apply? What do you hope to acheive by reviewing Carnivore under the government's current terms?
ByteMyCode.com: A Web 2.0 code sharing community.
Can you give us your first impressions of the concept of the Carnivore concept when you initially heard about it?
Can you give us your initial feelings as to the legal standings under the Fourth Amendment that allows Carnivore to be used for the purposes stated, which it would appear technically violates the Electronic Communications Privacy Act?
What is your impression of the amount of interest the Internet community at large is taking in the entire Carnivore concept? Do you feel there is too much paranoid fantasy going on, or do you feel there is some justification?
----
Brazil has decided you're cute.
How do we know that the FBI will only deploy that which you have reviewed? FOIA requests have shown that the FBI has used other technology, which has done more than capture email.
The basic problem here is that one connection to one wire gives them access to everyone's traffic passing on that wire. So the only limitation on the FBI's activities is your review and our trust that they are actually running what you have reviewed. What is to prevent them from running a new version of Carnivore, which has new capabilities. Given people's intolerance of "child porn" (including non-purient pictures of young nudists, pictures legal in one country but not another, and pictures of adults who look and dress younger than their age), what is to prevent the FBI from looking for people reading alt.binaries.pictures.kiddie-porn?
Don't piss off The Angry Economist
In the end a system like carnivore will only work for a while, and only against fairly unintelligent users because end-to-end strong encryption is no longer compuationally infeasable. Joe Schmoe with the middle of the road prebuilt gateway could easily handle the processor load of encrypting all his e-mail with 2048 bit RSA (which is now freely available, and even exportable). Not only that, but even with existing (and reasonably near-term) quantum computers, we are not even near enough qbits to start tackling these cyphers, since they can't be broken down when being fed to a quantum computer.
So in short, is this whole thing just a moot point? Who would Carnivore really catch?
---
Play Six Pack Man. I
During the congressional hearing on Carnivore, the FBI stated that current wire-tapping laws are adequate for the use of Carnivore. Further more, they revealed that the uses so far of Carnivore had been according to the regulations of optaining a "pen-register" wire tap. Are you aware that (from what we know) technically Carnivore is much closer to the concept of trunk-tapping, as most, if not all the traffic at the ISP has to go through Carnivore? AFAIK, trunk-tapping is illegal - would you be of the opinion that Carnivore automatically falls under the same illegal category of wire-tapping?
Being able to speak one's mind while remaining anonymous is one the the many tentant of our government. Collecting this information will not limit with thoughts we will be willing to express to our own private groups of friends.
Should be not let the guilty party go unmonitored, and thus protect the rights of the public to not be monitored, to in fact have some liberty?
(In my case I will premote having server to server communication encrypted, using a thrid party key sytem such as SSL)
Be seeing you.
-- Prepared at the direction of, or to be sent to Legal Counsel, in anticipation of litigation. Attorney Client Pri
Will the FBI be reviewing/editing your answers to are questions?
I want a gmail account. Can someone help me
If you found that carnivore did more than the FBI is claiming, would you stand up to their threats if you published your results to counter their "edited" report? Would you be willing to lose everything you have to stand up for the rights of Americans, your property, your retirement, your liberty, and your professional reputation? You would be vilified and persecuted by the FBI for your actions, even though you would win the admiration of liberty loving individuals all over America.
Or...
Would you shrug your shoulders, and knowing that some day the truth will out, say nothing if the FBI completely changed your report, and hope that when exposed your reputation is not too badly tarnished?
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Right now, most people think of Carnivore as a black box that basically looks at email headers, grabs the emails of headers of marked addresses, and copies that off to somewhere else. Certainly enough speculation on the technical aspects of this, and many on the ethical side. What will you be looking for when you actually start this study? Are you trying to understand the technology behind it? Are you looking at it's effectiveness? The invasion of privacy issues that come from it? Will you be allowed to make suggestions and recommendations to the FBI, or are you mainly there to try to tell us, the American public, what and what not the Carnivore system can do?
"Pinky, you've left the lens cap of your mind on again." - P&TB
"I can see my house from here!" - ST:
Americans may enjoy some legal protection against FBI (or others) abusing the carnivore system. WHat legal or moral protection exists to people who are not blessed with an U.S. citizenship? Are we fair game when ever our communications happen to be routed via USA?
In Murphy We Turst
-Water Paradox
information is immaterial
This is important because encrypting a message does no good against traffic analysis.
Jeff Schiller of MIT
has declined to review Carnivore,
saying that "what they want is a rubber stamp."
Obviously, you will say you intend to do a genuine
review.
Why should anyone take your word over Schiller's?
I notice in the documents released by EFF that vast portions of the Carnivore docs are blacked out.
I am used to this type of release when it comes to Department of Defense, CIA, or NSA docs since those involve national security.
However these are FBI docs. What criteria determine when a document should be classified by the FBI?
The names of the IIT reviewers were initially redacted and only revealed when it turned out that the electronic version was poorly constructed. Why were the names hidden? Do you feel that it's hypocritical to demand privacy for your reviewers while stripping away the privacy of everyone else? If it's so important that our actions be open, why can't yours be open?
Dean Perrit,
The Slashdot story soliciting the questions you're now answering indicates that you're responsible for overseeing the "legal end" of the Carnivore review.
Would you please clarify what this entails? What legal issues are involved in performing a technology review?
-- He's fantastic, made of plastic....
Will Carnivore allow anyone to read my mail without a warrant signed by a judge?
--
Sheesh, evil *and* a jerk. -- Jade
Packet reassembly and state-based protocol analysis are critical to the minimization function. My believe is that Carnivore is essentially stateless, just like my own Altivore. I can create real-world scenarios where Altivore fails the minimization test. Sure, they occur less than 1% of the time; I don't know how that fits within the law. However, software can be written to meet minimization requirements 100% of the time (e.g. BlackICE does this for detecting cr/hacking).
My question is: will a sniffing expert be analyzing the packet reassembly and protocol analysis part of the source code in order to validate that Carnivore captures all the data authorized by the court order, but no additional data? Moreover, is there really somebody on your team that understands even what I'm talking about?
Has the government indemnified IIT and/or the individuals taking part in this review against legal actions arising from your participation in it? Formally or off-the-record?
--
Sheesh, evil *and* a jerk. -- Jade
Couldn't Carnivore do many of the things it claims to do simply by being a software package installed on an ISP's host machines? Why does it require a seperate 'box' when everything it's been purported to do can be acomplished by a script kiddie with a floppy disk of programs run from any Windows box on the 'net?
You must realize that the credibility of your review is very low, before it has hardly begun. It seems unlikely, in the present climate of suspicion, that you can achieve the objectives of DoJ, and the needs of the American people, to allay concerns that "the FBI's temporary use of the Carnivore system could interfere with the proper functioning of an ISP's network; concern that the system might, when used properly, provide investigators with more information than is authorized by a given court order; and concern that even if the system functions appropriately when properly used, its capabilities give rise to a risk of misuse, leading to improper invasions of privacy" [quoted from the Executive Summary of the DoJ RFP].
Suppose this were an open-source investigation, incorporating the concerns of privacy advocates, free-speakers, independent technical experts, and other stakeholders. Without intending to speak for those stakeholders, I can imagine some of the issues that might be raised (I'm not asking you to answer these now):
- What technical, legal, and procedural information is required from the DoJ?
- What questions must be answered about the device, software, procedures, etc?
- What safeguards are required on the deployment of the device, software, procedures, etc?
- What should be done to assure that the government isn't abusing its power or threatening the privacy of bystanders?
- How can the results of a "stacked-deck" inquiry be made credible?
- How can minority opinions of the review team be published (without risking their careers or liberty)?
Would you be willing to incorporate lines of inquiry and specific questions from privacy advocates, free-speakers, independent technical experts, and other stakeholders into the review process and the resulting report?
One of the issues with Carnivores deployment is that ISPs do not want a box which they do not control interfering with their services.
Will your analysis include any investigations into the potentially detrimental effects this could have on an ISPs service, and if such are found can you use that as reason to prevent its deployment?
Slashdot: Proof that a million monkeys at a million typewriters can create a masterpiece
The security of a system is offen compromised by secrecy; holes in the system are often not fixed but glossed over through or patched by obfuscation instead of fixing the problem.
A review by a large body of people often brings problems to light, and would force correct security fixes. Furthermore, it would put away any fear that Carnivore does anything that breaches the power of any government agency using it.
I understand there is an argument for secrecy, but if Carnivore truly does not violate any laws, then I find it hard to believe it does anything out of the ordinary or uses any technology that is already not widely implemented.
So to restate the question, why is Carnivore not Open Sourced to the online community (or at least 10-20 universities and organizations) if it does nothing illegal and doesn't use some supposed 'secret' technology?
After all, isn't this exactly what Carnivore is going to do? The proponents say "if you don't do anything wrong you won't even know it's there and therefore it's OK." WRONG! Censorship is not when the gov't keeps me from talking. Censorship is when the gov't reviews everything I want to say beforehand even if I always get approval.
--
Non-meta-modded "Overrated" mods are killing Slashdot
(Hey Ryan! Here's your proof!)
I could see the temporary installation during a specific investigation (with warrant) being constitutional, if there is no other way to get the data they need, but the permanant installation of these boxes goes directly contrary to this ruling. I quote Justice White, "The authority to make warrantless searches devolves almost unbridled discretion upon executive and administrative officers, particularly those in the field, as to when to search and whom to search".
This ruling gives businesses power to refuse entry to any agent that does not have a warrant. How exactly are they going to install these boxes, if the ISP has the legal right to refuse them entry without a warrant?
-
I've had enough abrasive sigs. Kittens are cute and fuzzy.
The core nature of the Carnivore system is that it forces an ISP to grant the Government both raw and remote access to all data flows coming in and out of the ISP. This data is ostensibly filtered and selected out by the Carnivore system, but this is pretty clearly a classic case of "trusting the client" not to extract more information than its otherwise authorized to by the spec.
However pristine the code may be that you've been asked to evaluate, could you ever deny that the capability exists for a remote administrator to add new code which extracts additional information--or perhaps even spoofs new information onto ISP networks from the trusted perch of the Carnivore station?
Indeed, given the precarious and difficult growth of secure remote access protocols over the years, can you really determine in a closed environment that only authorized U.S. government administrators, and not foreign agents, corporate spies, or even 15 year old children will not be handed the keys to an NT machine with direct access and control over all inbound and outbound network traffic for the Internet's major ISPs?
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
Much of the original specification for carnivore is still considered classified (see redactions here: http://www.epic.org/privacy/carnivore/foia_documen ts.html). So just what will the FBI allow you to disclose in this interview?