Universities unwilling to review FBI's 'Carnivore' system

Agency's restrictions seen as overbearing

By Richard Stenger
CNN.com Writer

(CNN) -- Academic institutions will likely pass up the chance to audit the federal government's Internet monitoring system, citing strict controls that would prevent an independent review, researchers said Wednesday.

Known as "Carnivore," the FBI's e-mail monitoring system has drawn fire from electronic freedom activists who see it as an excessive intrusion on individual privacy.

The Justice Department approached teams of researchers at major universities to make sure that the controversial eavesdropping technology does not violate civil rights.

INTERACTIVE See how Carnivore gathers data for the FBI     ALSO Senate panel examines FBI Internet surveillance system

But a daunting list of requirements and restrictions for the review seems to have prompted numerous university research teams to forego the opportunity to take a peek at the secretive Carnivore code.

"Basically (the federal government) can edit the report, omit sections of the report and decide never to release it," said Jeffrey Schiller, a computer security expert at the Massachusetts Institute of Technology who was contacted to participate in the review.

The contract would allow the government to veto researchers from the review and possibly pursue criminal charges against researchers who disclose sensitive information.

Tom Perrine, a computer specialist affiliated with the University of California, San Diego, said such stipulations discourage academics from taking part.

Like MIT and UCSD, researchers at Dartmouth College, the University of Michigan and Purdue University rebuffed informal or formal requests from the Justice Department, given the tight controls, Perrine said.

"They came to the exact conclusion that we did, that this would not constitute an independent review," Perrine said.

Nevertheless, the assistant attorney general said he did not expect a complete no-show from potential bidders.

"We have received multiple queries from universities so I would be shocked if that were the case," Stephen Colgate said Wednesday, just hours before a 5 p.m. EDT deadline to submit proposals.

Responding to academic critics, Colgate said that the bid application includes standard contract language and that limits on publishing concern only the code itself.

"All we're asking about is the source code. All we're trying to protect is the tool from very smart hackers," he said.

Colgate said he would not know who the bidders were until Thursday morning.

Several Internet security specialists suggested corporations that often perform government work could bid on the contract.

"Various beltway bandits might be interested," said David Sobel of the Electronic Privacy Information Center, referring to major information technology corporations based in Washington, D.C., that perform defense department and related contracting work.

"That's not an independent review. That's work for hire," Perrine said.

Carnivore would work as a "black box" attached to the core of ISP networks. Based on a court order, the FBI would use it to monitor and retrieve e-mail messages of criminal suspects.

The FBI and the Justice Department maintain that strict oversight by federal courts would prevent abuses of the system. The pledge has failed to assure electronic privacy activists that only legitimate uses would take place.

U.S. Justice Department releases criteria for 'Carnivore' review
August 25, 2000
FBI to release Carnivore documents, but schedule draws fire
August 17, 2000
FBI says Carnivore will not devour privacy
July 21, 2000
Critics bash U.S. plan for surveillance standards
July 21, 2000
ACLU: Block FBI e-snoops
July 17, 2000

U.S. Department of Justice
Federal Bureau of Investigation
Electronic Privacy Information Center
American Civil Liberties Union

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.