Slashdot Mirror
FBI Carnivore Screwup Destroys E-Mail Evidence
An Anonymous Coward writes: "The FBI apparently used Carivore in an attempt to collect information on Osama bin Laden't network. Unfortunately they screwed up and collected information on "non-covered targets" (*ahem*, isn't this the sort of thing we weren't supposed to worry about...). Then the FBI tech was "so upset" that he destroyed ALL of the collected email, not only the information that was not covered by the warrant. Here is the SF Gate Story and EPIC's press release."
Here's the original FBI memo: http://www.epic.org/privacy/carnivore/fisa.html
www.time.com/time/covers/1101020603/memo.html
you've got to read it to believe it.
I was forced to work for this pervert for a few months . Everyone knew he was bad news, even before he entered a guilty plea for possession of child pornography including photos of infants.
Why are we letting pedophiles write software to catch criminals?
This guy is NO GENIUS! After all, he thought there really were young girls in an IRC chat room called "Dads & Daughters Sex" and he got caught!
Patrick was supposed to be an Internet Expert, yet he didn't even PGP his kiddie porn!
The Walt Disney Company lost $1Billion dollars investing in Patrick Naughton's company (his college roommate and best friend still works for Disney!). Now the FBI lost hard-earned evidence investing in Naughton's technology.
-Disney paid the price for Naughton's stupidity.
The FBI paid the price for Naughton's stupidity.
And THE AMERICAN PUBLIC did, too! By standing still while "pretty boy" Patrick was able to plea bargain by writing crappy software for the FBI, he got out of jail sooner and he's free to endanger more young girls, maybe even your son or daughter!
--
Ask the Ya-Hoot Oracle Anything!
Shameless plug: Jabberjab has made three posts including the one above.... Here are the other two:
#1 Sometimes these movies just don't turn out. Why not make a movie based on website? Can you imagine what a movie about Slashdot or NerdTreeHouse [nerdtreehouse.com] would look like? I want movies based on websites! Are you with me?
#2 Java is certainly not going anywhere. Java is the very thing that allows some companies to be in business. For example, NerdTreeHouse [nerdtreehouse.com] is a company that uses 90% Linux and 10% BSD to power the entire company. Basically, they provide gaming servers to highschool and college kids. Without Java, the company won't be around.
At least as of last year, Carnivore/DCS-1000 ran on NT 4.0 (not sure which service pack). Yeah, the poster prbably would be a little embarassed if s/he discovered Carnivore was deployed on Linux, but the poster need not worry. Most people arround here know that Carnivore runson NT 4. That's part of a lot of people's concerns. I'd feel much better if my government used more robust means to collect evidence. If someone cracks a Carnivore box, it comes with nice GUI tools to facilitate blackmail and information theft.
The FBI comes in with the box and hooks it up to the same LAN as the mail server to be monitored. I think it sniffs traffic instead of passing all of the traffic in one NIC and out another.
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
Your hard drive also does not consist of a clean room with technicians in a bunny suit (think intel) taking apart your hard drive to read the data on the drive =)
As a member of the IITRI team that evaluated the Carnivore system, I'd like to point out that the dates of these memos indicate that the mistakes happened while using an earlier version of Carnivore than the one that we evaluated. I'm not trying to downplay the dangers of a device like Carnivore, but simply to point out that the FBI was aware of problems with their device, and was making modifications to it. One of the caveats of the independent review was that our review would only apply to a specific version of Carnivore, as we could not possibly know how changes made after we reviewed it would fix problems, or possibly introduce new ones. The version of the system we reviewed was not baselined until just before the review began.
As a recap of our report, we pointed out that the accuracy of Carnivore collection was highly dependent on the correct setup of the filtering rules. We also pointed out that it was quite easy to make a mistake setting up those rules which would cause an over collection. The memos which were released do not indicate whether the overcollection was due to a filter setup mistake or some other bug that may have existed in a version prior to the one that we tested.
As stated earlier, I am not trying to defend Carnivore, but you must put these documents into context with the time period in which they were produced.