What is CARNIVORE?
Excerpted from testimony given by Tom Perrine, who was "invited" to testify at the Congressional subcommittee meeting concerning Carnivore.
What is Carnivore?
First of all, what is Carnivore? In technical terms, Carnivore is a high-speed packet "sniffer" with aggressive filtering capabilities. It examines all the data packets passing through a network, and filters out data that does not meet its filtering criteria. In layman's terms, Carnivore is a digital wiretap capable of discarding all information that is not to or from or concerning the subject of the wiretap order.
In fact, other than its fancy, easy to use graphical user interface, and its ability to monitor high-capacity networks, Carnivore is not very different from the various packet sniffer programs available to network managers, system administrators, home computer users and so-called "hackers".
By analogy, if the network is the cellular phone system, packet sniffers are radio scanners, capturing or listening to all data that goes by in the air or on the wire. Also by analogy, Carnivore is a "smarter" scanner, capable of detecting and recording only those phone calls to or from a specific person, or containing certain key words, and not listening to all the other users of the cellular system.
Carnivore's major technical novelty is its apparent aggressive intent to avoid capturing data concerning those that are not the subjects of a wiretap order. It is functionally very similar to software written by Dr. Andrew Gross (of the Kevin Mitnick case) while he was the Principal Investigator of PICS in 1997.
Physically, Carnivore is a personal computer with a network interface, and ZIP or Jaz removable disk drive, running a version of the Microsoft Windows operating system, with the Carnivore software loaded. In order to use Carnivore, it must be physically attached to the network to be monitored. The Carnivore software has a Graphical User Interface (GUI) which presents the user with an easy-to-use way to describe the filters that are to be used in accepting (and recording) or rejecting network data seen by the system. The user interface was designed to be used by a less-technical user, such as an FBI Special Agent in the field. The version of Carnivore I saw, as it was described to me had few provisions for remote access to the gathered data, but did have the capability to be monitored itself from a remote site via telephone. As described to me, this was so that the technical support staff at the ERF could assist with technical problems, and so the assigned Special Agent could determine when the removable media needed to be changed. This remote access method would also allow a remote user to change the filtering criteria from a remote site via a telephone call.
As described to me, all gathered data was written to a ZIP or JAZ removable disk drive, and the data would be physically collected by a Special Agent visiting the site. There are issues involving the collection, storage, custody, and admissibility of digital evidence. I believe that this physical collection of the evidence is a conscious effort to move this "digital" evidence into the realm of physical evidence, which is well understood by and more comfortable to the legal system. Although the system is capable of transmitting some gathered data via the telephone connection, this is impractical given the relative bandwidth of the telephone and the high-speed networks being monitored.
What is Carnivore Not?
Carnivore does not appear (on its face) to be an ECHELON-like "monitoring infrastructure", capable of real-time monitoring of millions of phone calls and network connections. Based on my limited examination of Carnivore, and technical discussions with its developers, it appears to be a tool specifically designed to meet the rigid requirements of a Title III wiretap order. Such an order is supposed to be a narrowly drawn and rigidly interpreted permission from a judge to monitor the electronic activities of a specific person or persons.
Quite frankly, Carnivore appears to be the best available technology to try to implement the limited permissions to monitor granted by a judge. The device is capable of filtering out information concerning those not subject to the wiretap order.
However, Carnivore is just a tool, and its capabilities must be considered in the context of how it could be used, the potential for intentional and unintentional abuse, and the critical need to consider the privacy and constitutional rights of citizens.
add a comment on this article
add a comment on this article