Home > Privacy and Government > Government Threats to Privacy > Surveillance > Carnivore

Carnivore

"Carnivore" is a specialized computer developed by the FBI and equipped with software that can scan Internet traffic at extremely high speed. It attaches to the systems of Internet service providers (ISPs) and can be used either legitimately, to observe Internet use that is subject to a valid search warrant, or illegitimately to observe the behavior of everyone using a particular ISP.

When it first came to light, Carnivore appeared to be used only to scan e-mail traffic. It appears, however, that current or planned versions of Carnivore can reconstruct Web pages viewed by the subject of surveillance and capture voice-over-Web communications.

The major concern with Carnivore is that there are few ways to ensure that government investigators will use it only for legitimate purposes and within legitimate bounds. The FBI has taken halting steps to reassure Congress and the public that Carnivore will not invade citizens' privacy, but the most respected independent institutions have been unwilling to assist the FBI.

If it is to be used at all, the Carnivore system should be made subject to strict controls and independent monitoring. At this point, neither of these conditions exist.

ISPs should not be conscripted as the deputies of law enforcement agents. This places the costs of investigations on ISPs and Internet users rather than the public fisc, and it may cause consumers to distrust and resent their ISPs. Consumers should educate themselves by asking their ISPs the following questions:

1. Has the FBI ever asked to install Carnivore (or EtherPeek, or any similar system)?
2. Has Carnivore (or a similar system) ever been installed on their facilities?
3. Is Carnivore (or a similar system) now installed on their facilities?
4. If yes to 1. or 2., what was the ISP's response? Did the ISP offer to obtain the information under court order so that Carnivore would not be necessary? Did the ISP retain counsel to fight such a broad search in the courts, and appeal it to the highest level?
5. If yes to 2. or 3., what steps did the ISP take to assure that the privacy of its users would be protected? Did the ISP gain access to Carnivore's source code to verify FBI claims? Did the ISP check the information FBI obtained from the Carnivore machine, either remotely or through physical collection on recordable media?
6. If yes to 2. or 3., is the ISP aware of any other capabilities FBI might have installed?
7. If FBI or any other government agency gains or attempts to gain access to all user traffic information on the ISP, will the ISP inform its users? Under what circumstances would the ISP inform its users of unwarranted monitoring by investigators?