FRAMINGHAM (07/19/2000) - Privacy advocates yesterday said they are deeply disappointed with a White House proposal intended to strengthen legal requirements for Internet surveillance by law enforcement agencies.
They said the announcement did little to temper alarm over recent revelations about the U.S. Federal Bureau of Investigation's Carnivore surveillance system, which has the ability to monitor all of an Internet service provider's network traffic.
"They didn't address Carnivore. They addressed everything but Carnivore, and in my mind, it really was a camouflage to cover the mess that is Carnivore," said Barry Steinhardt, associate director of the American Civil Liberties Union (ACLU). "The problem with Carnivore is that it is a black box with all of the service's private traffic flowing through it, and the FBI has unlimited power.
Tweaking some of the standards is not going to solve the problem."
Both the ACLU and the Electronic Privacy Information Center (EPIC), filed a Freedom of Information request last week for all records, sources and object code related to Carnivore.
EPIC also rejected the White House action as an attempt to circumvent concern about the system.
"Why wasn't some moratorium on Carnivore announced?" asked David Sobel, EPIC's general counsel. "How can the administration on one hand say they are trying to improve online privacy and also, at the same time, approve the use of technology that appears to be inherently invasive?"
Administration officials didn't return phone calls seeking comment.
A House subcommittee will hold a hearing next week on the Carnivore system, and Attorney General Janet Reno said she will review whether Carnivore complies with constitutional privacy guarantees. The legislative proposals will be sent to the Senate Judiciary Committee, which has a variety of Internet surveillance and privacy bills under review.
The White House initiative was intended to create a standard for unifying inconsistent laws governing the surveillance of telephone, cable and Internet communications. The legislation would apply telephone-wiretapping standards, which require law-enforcement agents to show that they have probable cause of a crime, to obtain a court order for scanning the content of a suspect's e-mail.
It would also give federal magistrates authority to review requests for "pen registers" or "trap and trace orders." In the past, these requests produced lists of telephone numbers of people who have called the suspect. But they can now be applied to the collection of e-mail or IP addresses now available to investigators with just a subpoena.
"It's time to update and harmonize our existing laws to give all forms of technology the same legislative protections as our telephone conversations," said John D. Podesta, White House chief of staff, in a speech at the National Press Club. "Our proposed legislation would harmonize the legal standards that apply to law enforcement's access to e-mails, telephone calls and cable services."
Critics say surveillance standards could backfire But privacy watchdogs say these attempts to update wiretapping standards could backfire and harm privacy protections. They say investigators seeking e-mail from suspects using cable modems are frustrated by the Cable Act of 1984, which sets tougher restrictions for monitoring computers with cable connections.
Sobel says law enforcement is attempting to lower standards for surveillance of cable modems by arguing that the act applies only to subscribers' services rendered, such as television programming, and not to actual communications.
Sobel noted that applying existing wiretap laws could also erode the rights of suspects. Currently, he said, the legal requirements for law enforcement to access e-mail stored for more than 180 days on remote servers states that the owners of that communication must be notified. Some Internet service providers, such as America Online Inc., continue to store e-mail messages long after they have been deleted by the users. But notice of such surveillance could disappear if the data is subject to court orders under current wiretap laws, which don't require informing the target of the investigation.
"Everyone involved really needs to look at the proposal and debate what makes sense," said Sobel. "We need to look closely at all of these issues and understand what the impact would be on these servers."
Meanwhile, EarthLink Inc., an Atlanta-based Internet service provider with 3.5 million subscribers, reached an agreement with the FBI that permitted the service provider to deliver information requested in a court order instead of having the FBI install Carnivore on its network. The company had argued that the Carnivore system would monitor the traffic of subscribers who weren't suspected of a crime, but it was overruled by a federal magistrate who ordered EarthLink to install the system. The company declined further comment on the agreement.
But Sobel said Internet service providers appear to be hiding behind these court orders. He said they should instead speak out against Carnivore, take their concerns to a judge as EarthLink did and share information on working out agreements with the FBI.