Slashdot Mirror
Carnivore Meta-Report Released
matt_blaze writes: "I've been part of a group of five security researchers invited by the
Chief Technologist of the Justice Department to identify technical
issues with the FBI's "Carnivore" Internet wiretapping system to be
addressed by an "independent review". As Slashdot readers know, the
contractor chosen to conduct the review, IITRI, recently released a
draft report of its findings. We've studied that report and continue
to have serious concerns about Carnivore. Our report, released today,
can be found here." Telling stuff. Also, check out today's Suck regarding Carnivore as well.
- No list of precision specifications. [This would be vulnerable to political feedback/interferance]
- No Quality Assurance work at all [bug checking, compatibility testing, etc.]except the minimal done by the developers
- No Quality checking on the design parameters to make sure that it would pass muster with someone beside a political hack.
Add to the list at your leisureAll in all, an excellent example of how NOT to design and code a peice of software.
sorta sounds like a peice of spaghetti coding [ie: throwing it spaghetti at the wall and seeing what sticks]
"It is a greater offense to steal men's labor, than their clothes"
And I'm a fucking pessimist.
Blaze (et al) refers to the technical review as a "good starting point". He also mentions that a number of institutions refused to touch the review contract because of contract conditions.
Translation into layman's terms: IITRI took the job because respectable institutions wouldn't give the FBI a rubber stamp on their Orwellian program.
The group also mentions that the technical review didn't adequately discuss security issues-- and in fact notes a number of suggested practices that fly in the face of good security design.
Translation: Not only is the FBI going to be privy to your communications, but so is every fourteen-year-old sociopathic script kiddie. Oh, and IITRI, due to politics or stupidity (or both), suggests making it even easier for pubescent net punks to get their hands on your e-mail.
Okay, that's Blaze out of the way. Now on to Suck.
The basic gist of the article is this: Carnivore is real, the public has to admit it. So now everybody is going to want high-grade crypto to keep the FBI out of their stuff.
Sorry, Suck, but it ain't gonna happen. Consider:
* For a company to realize demand for a feature, enough people have to get excited about it enough to demand/request it. After "billions of dollars" in damage from Melissa/LoveBug/etc., plenty of people put the blame squarely on Microsoft. Pundits screamed, analysts yelled-- and Microsoft still hasn't seen enough demand to turn off scripting by default.
* To include "encrypted by default", people would have to have some sort of method for getting their best buddies' keys. Yeah, we have PGP key servers, but let's be realistic: we need a new standard. That'll be a few years. On top of that, Microsoft/Netscape/AOL/Yahoo/etc. would all have to take into account backwards-compatibility with standard e-mail. The technical issues behind doing something like this are a *bitch*.
* A lot of people actually support the Carnivore program. Out of ignorance or belief in government (the two *do* go hand-in-hand quite nicely, no?), many of the people I talk to don't have a problem with the Carnivore program. They trust the FBI to "only do it when they have a warrant". As well, they claim that they don't do anything important through e-mail anyway. And my mother thinks that Carnivore could be just the thing to catch drug dealers.
------
Come on people. I'm not saying that we shouldn't be optimistic, but this *is* a serious problem. The free market will *not* create enough demand for products that will stop Carnivore dead. People don't know, or don't care. If we want everything Suck says to come true, we have to inform people and get them to care. This is NOT a time to just sit on our laurels.
Tell your friends about Carnivore and why it's wrong. Tell them about the borderline-fraudulent methods the FBI has used in the "review" process. Let them know *what* is at stake and *why* it matters!
So you're innocent, but you just happen to be out taking a spin by yourself during the time of the murder. Hard to defend alibi. You could conceivably become indicted. That costs money. Whether or not you are innocent, it costs lot's of money (lost wages, bail, lawyers, etc.) and the information still has to be judged in your favor for you to be cleared since it is pretty obvious you made a death threat as revenge for some strife. If the pocketbook argument doesn't work, think about your personal credibility. If that doesn't work, remember bail is not usually given in murder one cases in my parts. Perhaps a suspension of your civil liberties may convince you.
You must remember that it is the context not the content that determines legitimacy. Carnivore can capture tons of content. However, it is impossible to ensure that it captures enough content to discern context. In some cases, like the one I mentioned above, it is impossible for it to determine any context. The English language (as a matter of fact, all sufficiently complex languages) is open for interpretation and your interpretation of a harmless note is not always the easiest to believe.
Was it Ben Franklin who said something to the effect: "Those who would give up liberty for safety deserve neither liberty nor safety."? The fourth and fifth amendments are not there to harbor criminals. They are there to protect the wrongly accused. And just because you claim legitimacy does not mean that you will never be accused. Go ahead and let them sniff? Given enough time and wide enough scope, the FBI could have brought charges against Mother Teresa.
Rather than a court order allow a switch to be thrown, I would prefer a larger price in time and money to install such a system to deter wanton use of this if it can even do what it claims. Remember, it's not how private something really is in the US, but how much privacy you expect that determines what kind of warrant is needed.
PerES Encryption
They want to run this software, but yet they have not done a systematic search for any bugs or security holes? What the hell is the FBI thinking? "We want to spy on your insecure software with our really insecure software... And hope no one else joins us in spying on you..."
"What can a thoughtful man hope for mankind on Earth, given the experience of the past million years? Nothing." -Bokonon
"One such approach is to publish the Carnivore source code for public review. Although an extraordinary step, we urge the DoJ to consider it seriously. "
I wonder how many people at the department of justice would actually seriously concider that? Wouldn't if be funny to run across the source-code with a GPL-like license which happens to read "And now that you've read this, we'll have to kill you." For National Security reasons of course.
---
"Of course, that's just my opinion. I could be wrong." --Dennis Miller
But the inner workings are not something the public need to know about. It only opens the avenues of criticism [b]y the technically inept.
The logic of this statement completely escapes me. How would the details of the inner workings lead to criticism by the technically inept? If you display the technical diagrams of the newest Ford engine in, say, NY Times, do you expect this to generate technically inept criticism, or would an article in the automotive section on the same topic and without much technical detail generate this type of criticism?
We already know the equivalent of the article without much technical detail about Carnivore: it is a packet sniffer, with filtering capabilities, it runs on NT, there is little or no security. The "technically ept" can conclude based on this information that this tool will be relatively easy to misuse (or abuse), and that without the details (i.e. the source code) there is a good chance that adding Carnivore to your internal network may cause technical problems in addition to any of the issues discussed in the meta-review.
I wonder how exactly does an agency such as FBI select a contracter who writes their software. This contracter has to be trusted and than the independent reviewer has to be trusted as well. If I wanted to wiretap into FBI wiretap what do I have to do? From the reviewer it looks like the way Carnivore is written and tested does not qualify to be an FBI wiretapping software. The software tracks more than it is allowed (all network packets), it uses PCAnywhere to administer the configuration and the software! All we need now is a bug in the PCAnywhere software. Carnivore will slow down the traffic that it monitors and it probably will not be able to scale. If I was working for let's say some 'other' agency and I was interested in wiretapping the wiretappers and I had enough power, how difficult would it be for me to put everything in the right place for the FBI to take the bait. Get a certain company to do the contract, get someone inside the company to grab all the source code then screw with the independent reviewer (requires money but not impossible).
We'll keep backup of all your email and all the files you've ever sent over the net for your convinience and for our security.
You can't handle the truth.