The FBI has all but abandoned its custom-built Carnivore Internet surveillance technology, almost a week after the Electronic Frontier Foundation filed Freedom of Information Act papers demanding the Justice Department answer to whether it's been using the Patriot Act to spy on ordinary, non-suspect American Netizens.
Kicking Carnivore to the proverbial curb doesn't exactly mean the FBI has given up on eavesdropping, however – the bureau has reportedly changed to undesignated commercial software to prowl computer traffic during specified investigations, while coming more and more to ask Internet service providers to lay wiretaps on customers for the government and reimbursing the ISPs for the costs.
According to a pair of annual reports sent to Capitol Hill covering fiscal 2002 and 2003, the FBI ran only five Internet taps in the former and eight in the latter, and none of them used Carnivore, or DCS-1000 as it is also known. The FBI had reported previously that they used the program 25 times from 1998 through 2000.
Carnivore's disclosure in mid-2000 provoked a Freedom of Information Act filing by the Electronic Privacy Information Center seeking public release of all Carnivore-related FBI records, including source codes, technical details, and legal analyses which discussed privacy implications of the program. EPIC also obtained the two annual Capitol Hill reports under the FOIA last week.
The Justice Department reportedly stonewalled the requests and the EPIC sued in federal court to get the information, with a federal judge ordering the bureau to report to the court by August 16, 2000 and identify the volume of material at issue and the bureau schedule for releasing it. After a couple of years' worth of haggling in federal court, the FBI finally released the requested Carnivore documents in May 2002 under a court order.
EPIC representatives were unavailable for comment before this story went to press.
FBI spokesman Paul Bresson told reporters the bureau moved away from Carnivore/DCS-1000 to commercial software because the latter was less costly and had better ability now to copy e-mail and other communications of targeted accounts without affecting other subscribers. "We see the value in the commercially available software," Beeson was quoted as saying. "We're using it more now and we're asking the Internet service providers that have the capabilities to collect data in compliance with court orders."
The EFF is challenging Section 216 of the Patriot Act, which broadened federal authority to use pen registers or trap-and-trace devices – known as pen-traps, and collecting information about dialed telephone numbers without recording conversations – on Internet communications, where the line between content and non-content is "a lot blurrier" than on telephone calls, as the EFF put it.
