While attempting to reassure the public that government investigators uphold the privacy of online data, the U.S. Department of Justice offended some protesters by appointing some longtime government employees to the investigative team.
Armed with this information, the American Civil Liberties Union (ACLU) and House Majority Leader Dick Armey (R-Texas) are charging that members of the academic review committee are compromised by their close government connections revealed in an exposed document.
"This Department of Justice proposal has confirmed my fears," Armey said in a statement. "This important issue deserves a truly independent review, not a whitewash."
After a number of other respected academic institutions refused to participate in what they deemed an overly restrictive review process, the Department of Justice on Sept. 26 selected the Illinois Institute of Technology Research Institute (IITRI) to evaluate Carnivore. The review team is supposed to determine if the Carnivore Internet surveillance system violates the privacy of other users of an Internet service provider when the provider is compelled to install the system on its network to conduct court-ordered searches.
But critics have condemned the provision that the DOJ have the final edit on the report and that Carnivore source code not be published. Now the ACLU says the DOJ has also stacked the deck when choosing the supposedly independent search committee.
Members of the IITRI review committee include J. Allen Crider, a senior program analyst at IITRI, who has an interim secret security clearance from the Department of Defense and has worked on contract projects for the FBI, and Steve Mencik, an IITRI science adviser who in 1999 received a top-secret security clearance from the National Security Agency, where he worked as a consultant. Mencik also worked as a consultant for the Internal Revenue Service, as did committee member Mary Ranade, a senior computer scientist at IITRI.
"By selecting people with extensive government ties for what is supposedly an independent review, the executive branch has shown once again that it cannot be trusted with carte blanche authority to conduct searches," ACLU Associate Director Barry Steinhardt said in a statement.
The day after announcing the selection of IITRI, the DOJ posted the institute's proposal in a PDF file that had the names and background information of committee members crossed out. The method used to black out the data was quickly discovered and reversed, and within 24 hours, the missing data was posted in full on the cryptome.org site, including the names, e-mail addresses and phone numbers of committee members.
The Cryptome site, which is run by John Young, has confirmed that digital overwrites in the Carnivore review proposal can be unmasked by copying and pasting the PDF text or by using an Adobe plug-in, such as Pitstop, to remove overwriting.
Kerry M. Rowe, IITRI's senior vice president and manager of its advanced technology group, acknowledged that members of the committee have experience working on government projects and were accustomed to government background checks and nondisclosure agreements, which he characterized as "routine."
Rowe emphasized that the DOJ's power to edit the final report and the past government work done by members of the committee wouldn't compromise a "fair and open review."
"We are professionals," said Rowe. "And we will do a proper and open technical evaluation of this process."