Carnivore-like tool released as Open Source 180
Joe Smith writes "NetworkICE released a new Carnivore-like tool that does *everything* FBI said Carnivore is supposed to do." Of course there's no way the FBI will accept this, and the conspiracy theorists will use this as proof that Carnivore is doing more then the FBI is 'fessing up to.
Re:Old.... and sick (Score:1)
Re:Devil's Advocate? (Score:3)
companies using their own technology: they have to make it possible to
do so, but they domn't have to smuggle in any mysterious black box.
The fuss about Carnivore is it breaks with this model, and with no
convincing explanation. You don't need to be paranoid to suspect
there is more to this device than the FBI alleges. (Cringely
suggested it might contain a sabotage device...)
FBI Has No Choice (Score:1)
The whole issue is this: How do internet service providers comply with court orders which require they allow law enforcement agencies to monitor a customer's Internet use? The FBI has offered to install Carnivore for ISPs. ISPs should be free to choose to install an alternative system as long as they can comply with the letter of the court order. This was exactly why Earthlink refused to install Carnivore. They stated that they ALREADY had the necessary equipment to comply with a court order.
As long as it is functionally identical to what the FBI claims that carnivore does, I can't imagine that a court would care. Then again, this is the same court system that made it legal to post instructions on how to build an H-bomb, but illegal to post a song which celebrates a decryption algorithm.
Log escrow (Score:2)
Here's a way of ensuring that wiretap data submitted to a court are accurate and complete. The FBI has no reason to refuse to implement this proposal, unless it intends to change wiretap data or gather data outside the scope granted by a warrant.
Open source monitoring software is installed by the ISP on its own machines. The software is pretty simple - when a wiretap is in progress, this software logs all traffic to and from the user's IP address, encrypting the stream with a symmetric cipher before writing it to a log file. The encrypted stream is also forwarded to the FBI. The key is changed daily. Every day, the previous day's key and a hash of the previous day's traffic are sent to the court which granted the warrant.
In the event of legal proceedings, the ISP's log file is decrypted by the court and given to both the prosecution and the defence. The FBI can ensure that the ISP has been logging all the suspect's traffic because the monitoring software is open source. The public can ensure that the ISP has been logging only the suspect's traffic for the same reason. The suspect's lawyers and the FBI can both ensure that the evidence hasn't been tampered with, and more importantly, the court can determine which party tampered with the evidence, because it has a hash of the original traffic log.
Re:Is Carnivore Irrelevant? (Score:1)
BR.
Re:Feeding the trolls (Score:1)
Re:Devil's Advocate? (Score:1)
I agree, they should have some technology to do network level wiretaps, I don't think Carnivore is that technology. I don't appreciate feeling like big brother is watching over my shoulder. I have nothing to fear, I haven't done anything wrong, but the feeling of being watched makes us all fearful. Carnivore is a trawler, dragnetting the internet for criminal information, it needs to be a scalpel, capable of ONLY picking up the information it's supposed to.
GPS mobile phones (Score:1)
Amen to you.
I do wonder if the GPS feature of our future cell phones will be controlable by the user. I mean, will there be an off/on switch on the bloody thing? If yes, then go for it, I do like the idea of having a GPS to find my way, or when calling for rescue. If I can't control it, then I don't want it and I hope the market will not accept it either. Let's hope this feature is not required "by law" somehow...
Thinking about it, I believe the GPS feature turned on by obligation will not catch on, if only because so many just don't want their affairs to ever be known by their wife or husband. There was some big scandal in france about people being photographed while speeding with their car. The photo is then sent to their house where their conjoint then discover who was on the passenger seat :D
The source is not important (Score:1)
Any network sniffing tool is going to be very configurable. A few changes to the filter config and you go from watching only specific communication to watching all communication.
The oversight of the organizations acting on their net-tap warrants is what is important.
Re:Strawman argument (Score:1)
Then they are in good company. See the
Re:Is Carnivore Irrelevant? (Score:2)
I would be willing to bet that the FBI was suppriesed by the outrage from Carnivore. They already did this sort of thing to all the phones in the US and nobody peeped. I feel that the only reason we are hearing about it is that they made a couple of mistakes that they did not make with CALEA.
So there you have it. It wasn't a small step towards a police state, It was a stumble on the rocks in their general stroll to it. They won't make the same mistake again.
----
crulx
crulx@iaxs.net
---
I have a user id of 3223.
Everything I say should be modded up to a +5.
Dribble - then the real issue... (Score:1)
That aside - This whole trail of replies seems to be stirred up more by an attention seeking (in need of a reality check) person than about the technology or issues in the original article.
My opinion is the government is never going to catch all the bad guys... but being the government I don't blame them for trying to invent new ways to help themselves (they need the help). I don't happen to agree that Carnivore is ethical on a long term basis (specially in the hands of government).
Review (Score:2)
I have been unable to do the headers-only-wiretapping sort of functionality, though I've gotten it to do the log-all-e-mail-coming-from-this-ip functionality.
OTOH, the source code is simple and pretty readable, and it's a really neat idea, so, basically, I encourage everyone who has a home net to download it, poke at it, play with it, patch it, improve it, and sneakily spy on all your own e-mails from your bedroom box to your living room box.
Fun toy, anyway, but it doesn't -really- compete with Carnivore - yet. It's more a proof-of-concept.
(It was, btw, posted to securityfocus several weeks back.)
--Parity
Re:Carnivore is not a bad thing (Score:1)
Re:Devil's Advocate? (Score:1)
Yes, the possible misuse of Carnivore is scary. However, with the appropriate review (not necessarily full-disclosure), it can be a great help.
Not really (Score:1)
Obviously I know what trolling is. I don't think you do. It's meant to be funny or intelligent, not just sick.
Re:Devil's Advocate? (Score:1)
However, if the FBI/whomever knew that a bomb was expected to be placed in location X, by two men that look like (insert description here>), at a certain time, they could stake out the place, attempt to apprehend the men (if appropriate warrants had been issued), and, if after all that, the men pulled out shotguns, the police would be justified in shooting them.
(sarcasm)If all people were dead, there would be no crimes at all. Isn't that the perfect solution?(/sarcasm) And, you'd be surprised how many criminals DO use the net to plan their crimes...
Re:Devil's Advocate? (Score:1)
You seem to have missed some key points in the community's general apprehension about the whole Carnivore mess:
Re:Oh no!--Carnivore wasn't free (Score:2)
They may very well try to use this argument, but it carries no weight. It's the fallacy of "sunk costs"--whether or not they use Carnivore they've already paid for it. Continuing to use an inferior product doesn't regain that value--might as well ditch it and use something better. Especially so if the "something better" has no associated cost.
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
Who give's a damn about Carnivore? (Score:3)
none of this would be necessary .... (Score:2)
Please fuck off (Score:1)
Re:Think of Us... (Score:2)
So as soon as they install the hardware the gov't will be able to read _anyones_ email....
which is why i got Freedom [freedom.net]
Slight/Tolan
Re:Carnivore... (Score:1)
Re:none of this would be necessary .... (Score:2)
/.
Re:Devil's Advocate? (Score:1)
As Post #27 said, its just a new way to do an old thing...
Who cares if it's open source or not? (Score:3)
OK, suppose they do it. Now it's a black box that the FBI guy says is running the open-source version of Carnivore. Great.
Old version: "Trust us, the closed-source version only captures SMTP headers and throws out ones with the wrong From: line"
Open-sourced version: "Trust us, the CARNIVOR.EXE on this box was compiled from the open source version that you geek types wrote."
Hands up, anyone who's sleeping better at night.
Open source has nothing to do with this debate. It all comes down to trust. Do we trust the FBI or not? Regrettably, FBI's track record over the past 50 years has been pretty consistent in demonstrating that they're not worthy of our trust.
In 5 years, I'll no longer dare to make statements like this. Somehow, my political views will evolve to a more mature position, whereby I recognize that FBI has a legal and moral duty to defend me against terrorists, pedophiles, computer programmers, and drug dealers.
I wonder if FBI will have a brain-scanning version of Carnivore in 20 years that'll determine whether my political views really changed over that time, or if I was just duckspeaking in order to stay out of Room 101?
Re:Heh, why email?!? (Score:1)
ugh (Score:1)
Re:A Message from the President (Score:1)
Sincerely,
Bob Jones III
P.S. God [osdn.com] Bless You!
Re:Devil's Advocate? (Score:1)
My question to you all. (Score:2)
How could the FBI perform their wiretaps in a legal manner, without enraging us all about our 'rights'?
How could carnivore-like stuff work without violating our rights? Or should it be wrong altogether?
I do recall someone likening it toa 'trunk-side wiretap'
interesting... (Score:1)
"Openness" (Glasnost?) (Score:2)
Uhhhh.... "Open Source" does not mean "open everything." The companies that produce defense hardware benefit from one of the major selling points of Open Source, in a way. The "many eyes" theory for source code also applies to things like ISO 9001 certification of business practices, etc. Even for non-ISO 9001 companies, anyone working on government contracts is "open source" in the sense that their management, accounting, and manufacturing processes are open to regulatory scrutiny. Even companies not working on government contracts are open to SEC scrutiny, and therefore scrutiny by the public investor as well.
This does not mean that all information traveling through corporate and/or government channels must be freely available. There are perfectly defensible reasons for keeping secrets. Why do you think Open Source advocates are usually also strong cryptography advocates?
Besides, how do you justify encrypting the "1337 DDoS w4r3z" and goat pr0n you have on your ostensibly "Open" system?
Bingo Foo
---
Oh no! (Score:4)
But from a "Promote Open Source/Free Software" POV it's unfortunate because the explanation the FBI is likely to use is "open source can't be trusted". We already know that's false (whether diametrically opposed or orthogonal is a matter of debate), but how imagine Bill Gates quoting Louis Freeh or Janet Reno as saying that "our secrets have to be protected by secret software" or "open source == child molesting terrorists".
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
Re:Think of Us... (Score:1)
What you fail to realize is that we still have *some* freedom left. While the rest of you are just playing puppet roles for your respective "governments."
I personally feel that although the US is not perfect, we have managed to maintain some sense of an individuals independence (even if is is severely limited)
What we need is a global revolution to overthrow all governments so that we can sit down and found a "right and proper" method of ensuring freedoms for all men (and women) and still make sure that the criminal elements and sick bastards get their just desserts.
Perhaps we need to switch to a true democracy, with no representative middlemen. We have the technology now to ensure every single fucker can vote on an issue. Then we'll really know what the majority rule is.
.
Re:Is Carnivore Irrelevant? What in the........... (Score:1)
Re:I see your point... (Score:1)
how about...
"Dastardly Japs Attack Colonially Occupied U.S. Non-State... Congress Declares War after Sneak Attack on US Imperial Holding... FDR: 'We Conquered the Hawaiians First'
Re:Look at it from a different view (Score:1)
To do this you need an intrusive government. They need to be able to see what you are doing, thinking, writing, viewing, etc. in order to determine if you are a "wacko". If you pass some bureaucrat's notion of non-wackoness then you have nothing to worry about. However, if you are a wacko, by someone else's standards, you open yourself up to government surveillance. If, for instance, you own a gun and had been arrested for smoking pot back in college, you may be classified as an armed drug dealer, which poses a significant threat to society.
The fact is that everyone would be forced to live to some bland definition of normal. If you irritate one group than you may be considered a wacko and have your activities curtailed by the all-knowing government. Consider if your activities were subject to the same rules that the FCC dictates to television.
I would rather live in a world where I could do what I want without worrying that someone is watching. I would rather deal with the reality that a car-bomb may blow up at my kid's school than live under the ever watchful eye of big brother. Because as you pointed out, government is made out of people and they are not immune to the trappings of power. The checks and balances you mention should be swift justice for those who break the law not the subjugation of the citizenry to constant surveillance.
Re:Carnivore... (Score:1)
I think the whole point is not what paedophiles do to me personally, but to children. Children are innocent to a certain extent, and that is one of the greatest assets a child has. Sick bastards who take that away deserve everything they get, and more.
Re:Heh, why email?!? (Score:1)
Re:ugh (Score:1)
I recommend we rename it cockroach - after the disgusting creature that has existed and persisted, relatively unchanged, for millions of years, despite all mankind's efforts to stomp, poison, burn, and (yes) eat it into nonexistence.
Look at it from a different view (Score:2)
I must be reading your comments wrong, because from what I'm reading you're saying there's no purpose to law enforcement. Here's two questions for you: do you believe corporations should have a watchdog to look over them? How about a watchdog for government?
The populace at large falls prey to the same moral and ethical failings as both corporations and government (probably because they're all made of the same ingredient: people). Just like every branch of the federal government has checks and balances to keep them in line, all aspects of society need to have at least some kind of restraint put on them.
As a resident of Norman, OK, about 15 minutes away from the remains of the Murrah federal building, I'd rather the government intercepted and stopped wackos before, rather than after the fact.
As for governmental agendas, in my experience the agendas of private citizens and corporations tend to be just as petty and just as dangerous.
Sorry, Guys (Score:1)
I look forward to anybody caught using a tool like this without legal authority being flung into the slammer.
What people fear. (Score:2)
Re:Devil's Advocate? (Score:5)
Citizens don't mind that their government agents are able to obtain wiretap warrants on specific people, because the warrants have to come from a particularly high authority and there must be a valid reason for obtaining each and every individual wiretap. The privellege of being able to legally listen in on someone's conversations is balanced against the level of evidence required to be submitted in advance, and also the accountability for your actions if you wiretap for malicious reasons rather than investigating crime.
However, with these new systems, the government agents now have full unguarded access to most but not all of the country's email. There is full anonymity for the agents involved, and there is no accountability. They do not need to give any reasoning to obtain the authority to spy on people, because they've installed near-blanket surveillance on their nation.
Onto the topic of an open-source versus secret carnivore, I'd like to see that there really was a system of authority in operation, ie only the named person's email is captured. As for criminals reading the code to get out of the surveillance, firstly the FBI would be using this to _monitor_ someone, and if it all goes quiet they would investigate why, and if it's via manipulations to get out of the monitored stream, they could trace through that with the ISP and close any hole. Secondly, simply not using email or using an ISP without Carnivore will get you out of trouble, as will end-to-end encrypted IPv6 streams when they hit mainstream, much more effective than reading thorough source code.
Carnivore is the stuff of Orwellian futures, and I just want to see some declaration of accountability to the public here, not demonizing of Internet users as drug dealing terrorist paedophiles.
Run with it! (Score:1)
Terrorist, cocain, pot, doobie, bomb, secret plans, assassinate, DeCSS, libral, Natalie Portman.
Now if EVERYBODY had a sig like that i believe we could render Carnivore and programs like it quite useless.
Re:Oh no! (Score:2)
A similar situation happened with respect to pornography [earthlink.net] during the Nixon administration. A Presidential Commission failed to find any evidence that pornography was actually harmful, and in fact advocated more sex education at an earlier age.
However, due to the public perception that pornography was "bad" and the growing power of anti-pr0n lobby groups, an attempt was made to discredit the report and policy was made as if it didn't exist.
Later, the Regan administration had a similar experience, but the response there was to simply start a second commission to get the "right" answers this time.
Truth has little effect on policy when spin is involved. I trust everyone can see the parallels between these examples and Carnivore, DeCSS and the Napster case.
Re:Why shouldn't we have Carnivore? (Score:2)
You forgot (c) it's bloody difficult for FBI to tap everyone's phone 24/7 and to turn all the conversations into easily-searchable transcripts.
Swap out the 120M removable media from the Carnivore box and replace it with a 100G hard drive next year, and you've got a reasonable shot at being able to record all email at that ISP and dump it into a big-ass database.
Anyone who thinks that the FBI will scan every packet going through routers in the US is living in a paranoid fantasy world.
Anyone who thinks that FBI does not want to dump every packet going through routers in the US is living in a Polyanna fantasy world.
Re:Think of Us... (Score:1)
It really escapes me what part of this experience would have given the Aussies such a high respect for their government -- and the crown, as evidenced by their rejection of the referrendum on becoming a Republic last November. Maybe there is something about the inferiority of the criminal mind...
Re:Devil's Advocate? (Score:1)
And in my opinion, installing equipment with which it is entirely possible to monitor anyone's traffic, with no warrant and no reason, is not just over the border of common sense but over the border of human rights.
And, you'd be surprised how many criminals DO use the net to plan their crimes...
I doubt it. Nevertheless, if we can't stop them without an enormous and fundamental breach of everyone else's rights, then we can't and shouldn't stop them. Like, we could stop criminals that plan crimes by conversing in the middle of public parks, by bugging all the public parks. Should we?
Re:What kind of proof do you want? (Score:1)
perhaps ?
.
Enlighten me (Score:1)
I do know people who were terrorized, so it's more common than you think. He was a high ranking engineer who thought unionizing would be bad for his employee owned company. He recieved a long string of threatening "prank" phone calls that were routed through institutions and untraceble. The pranks included survailence and were unseteling. Example: his son left to go play with his friends. Five minutes later he got a phone call where a teenage boy screamed "Help me! They've got me and they've pulled my pants down." Ha ha, not. They could just as well have done it. Phone taps, Carnivore, nothing would have stoped it short of FBI teams escorting each member of his family like Bill Clinton.
Protection for the home: 357. Gun control = good aim.
Herbivore (Score:1)
'Although we suffer greatly from underfunding in comparison to our counter-parts in other governments, we are very proud of what we have managed to achieve with our new email scanning network codenamed Herbivore', she said. 'The QBasic software runs on DOS 5, and is powered by our latest 286 hardware. We felt that scanning the whole of the UKs email traffic would require the best we could afford here in the UK, so we really went to town. TCP communication is handled by a 33.6k modem as our initial tests with a 14.4k found increasing eCommerce activity to be too much for such a slow connection.'
Details of the actual specification are classified. The reaction from the British public is not yet known, but analysts have been predicting the typical level of apathy.
Please (Score:1)
You're going to have to be more subtle than that. In your effort to persuade people against Carnivore, you're creating an analogy where the FBI checking out your email is like having the government go around killing people because of their clothes. Bzzzzt. It's called a sense of proportion, look into it. Now, I wouldn't have modded you down or anything for it, but it looks like you really suckered some of the other ones into grading you up.
Also, I'm not sure why everyone thinks that pedophiles and terrorists are some masterminds who won't be caught by this. It seems like every week there's a news item about some pedophile who brought his computer in to be fixed and got nabbed when they found all the kiddie porn on his hard drive. I'm a little surprised that nobody ever complains about that here, 'cause it seems as nosy as carnivore to me, since it means that everyone's hard drives are scanned, not just people under suspicion.
Cheers,
Re:how many megs is that (Score:1)
Re:Devil's Advocate? (Score:2)
Good! That's how it's supposed to be. Just because someone accusation was repeated on CNN doesn't make it true. A judge must issue a warrant before things like that are done to prevent abuses. Sure, more criminals would be caught, but at what price? Living safely under the thumb of an oppressive government is worse than living in unsafe freedom.
I still think that a review of Carnivore is a good idea, but if looking at it's algorithms yielded information as to how to thwart it's capabilities, should that kind of information be out in the public?
Crypto? Stego? That's a non issue. People with something to hide WILL hide it, Carnivore is about snooping on peaceable people. A highly organized terrorist group will have access to public key crypto or one time pads. Less importantly, if the program is open sourced, more eyes will be looking at the algorithms, any weaknesses/workarounds can be easily fixed.
Would you be happy if, in the aforementioned scenario where your loved one is in danger, the criminals knew how to thwart the system, rendering the FBI's protection of your family useless?
I think you've jusr brought up a red herreng. Sure, I don't want anything bad to happen to my grandma, but I don't want people's rights trampled because at some point some unknown threat might be dangerous to her. If such a system were to be put into place, would we be able to sue the FBI if they fail to prevent a crime that they should have known about? Of course not! Law enforcement officers have no obligation to protect any one of us.
Re:Devil's Advocate? (Score:2)
invoked with the mandate of tracking devices for mobile phones. In
that case the federal legislation imposes technical capabilities the
mobile phone operators must meet, but how they meet the criteria is
up to them. That I understood is a direct analogue of the wiretap
legislation.
I think the Cringely suggestion is a bit tongue-in-cheek, but it
seems perfectly plausible that there is some switching or spoofing
capability built into these boxes. If so, the capabilities should be
discussed openly. If not, as Cringely put it, why the box?
Re:Why shouldn't we have Carnivore? (Score:3)
FCC Makes Wiretapping Easier for Cops [slashdot.org]
FBI wants to wiretap phones without court order [slashdot.org]
ACLU & EPIC Challenge Wiretapping [slashdot.org]
There was a story last year about hundreds of convinctions in LA that need to be reviewed because defendants were never told that evidence came from illegal wiretaps. The latimes.com article has expired, but here's an archive from the IP list [interesting-people.org].
Not to mention the historic abuses of the FBI against people like Martin Luther King, Jr. King didn't do anything illegal, but the wiretaps did catch him having an affair. An anonymous FBI agent urged King to commit suicide [wwnorton.com] to avoid exposure.
You can't say "it can't happen here". It *did* happen here. Just don't let it happen again.
Traffic Analysis (Score:2)
Encrypting the body of your email message is not sufficient. Traffic analysis (knowing which parties are exchanging mail) can be almost as valuable as extracting message bodies, and is most likely the real purpose of Carnivore.
In order to perform the stated purpose of Carnivore, the software must check the SMTP sender and recipient of every single email crossing your network. Are we honestly going to believe that after logging all of this valuable information, the FBI is simply going to throw it away?
There's precedent to claim that no search warrant is needed to extract the 'envelope information' from every single message.
Re:Why shouldn't we have Carnivore? (Score:2)
It takes time and effort to tap a phone line. It takes time and effort to bug a house. It takes a court order for them as well. Without knowing what makes Carnivore tick we have no guarantee that it's ONLY doing what the FBI says it's doing.
And NO, I don't trust the FBI. FBI agents have destroyed or "lost" evidence, FBI agents have shot unarmed women, anf FBI agents have helped to cover the misdeeds of others. I have no good reason to trust any of them.
LK
University audit (Score:2)
Is Carnivore Irrelevant? (Score:4)
What exactly is the rationale for Carnivore then? It's like wiretapping every phone in America then saying that they'll only turn it on with a court order... you'd never be able to trust them at their word. Why shouldn't the same protections that protect us from unauthorized wiretaps protect our e-mail?
The real purpose behind Carnivore is probably less about catching criminals, and more about government testing the waters. They can get by with an Echelon in other countries because the average American wouldn't care if we spied on France. But, what would be the reaction if Echelon were used for domestic surveillance? (Which only the FBI can legally do?) Carnivore probably isn't going to do much to fight crime, just lead to criminals forging their e-mails, getting multiple Hotmail accounts, and generally making it impossible to accurately trace.
Carnivore as a system is irrelevant. It's real purpose is to see how far the FBI can go in this area, one step more on the slippery slope towards a Big Brother police state. Perhaps the intentions of Carnivore are good, but we all know what the road to hell is paved with...
Want to see more of the DMCA? Vote Gore, the favorite of the MPAA!
Heh, why email?!? (Score:2)
Just my $0.02.
Carnivore should not be a surprise to anyone (Score:3)
What makes Carnivore different is:
Email has always been insecure. If you're really concerned about the mail that leaves your workstation, learn to use PGP [pgp.com], and get all your friends to use PGP. Suddenly, you won't care nearly as much about who's reading your email because it's all encrypted.
Re:Oh no!--Carnivore wasn't free (Score:2)
They may very well try to use this argument, but it carries no weight. It's the fallacy of "sunk costs"--whether or not they use Carnivore they've already paid for it. Continuing to use an inferior product doesn't regain that value--might as well ditch it and use something better. Especially so if the "something better" has no associated cost. I beg to differ - it carries plenty of weight. Rather than having to hire specialists to pore over the OS Carnivore alternative and fix any holes or weaknesses that they find, they can, at no cost, simply use the version that they paid for.
I also don't understand how an alternative that is different in only one respect (open sourced) and supposedly has the exact same functionality is superior to the closed source version. To me, a well-designed program is a well-designed program, whether it was designed in total secrecy or GPLed.
Link to source (Score:2)
Abuse of Privacy in the name of Prevention (Score:2)
Of course the FBI is saying that they'll use the system for monitoring of current investigations, but they have also stated that they would use it for crime prevention. I repeat, prevention. They are willing to sacrifice our privacy in the name of "preventing" future crimes which have yet to happen.
Does anyone see the problem here? The FBI is presenting us a black, cloudy future filled with terrorists and super-criminals using emails for evil purposes, and we, as responsible citizens, should forgo our privacy to help prevent this sordid future scenario the FBI is presenting us.
It's much like an insurance salesman selling disability insurance. He's going to scare the hell out of you about a future possible disability in order to get your money. Even though, statistically, disabililty insurance taken as a whole over the entire population, is rarely needed.
I, for one, am willing to forgo the FBI's Carnivore insurance policy. I'm not willing to pay the premiums.
EMUSE.NET [emuse.net]
Re:Devil's Advocate? (Score:2)
Absolutely, without question. Up to the point where you commit a crime. Once you've commited a crime, and the authorities have evidence of a crime, you should be prosecuted.
Currently, planning a crime and discusing the details with others is a crime. Specifically, it's conspiracy to commit a crime, and you can be prosecuted for conspiracy.
"If the FBI got wind that a crime ring was planning to kidnap, rape, and exploit YOUR wife/son/daughter/sister/brother/etc. by planning the dispicable act entirely through e-mail, would you not want to have some means to protect your loved ones?"
I would wonder how the FBI 'got wind' that something was happening. I would hope that they had done so legally. I would expect them to prosecute everyone involved for conspiracy to commit whatever crime, which is why it would be important to me that they had used legal means to find out about the conspiracy in the first place.
It's worth noticing here that the FBI doesn't have any obligation to protect us, and the police don't either. Instead, they have an obligation to catch criminals after a crime has been commited.
As for having the means to protect myself and my loved ones, I would like to be able to go get a gun or whatever I might feel I need, without waiting for X days, at a moments notice. I certainly wouldn't expect the FBI to protect me, because that isn't their job.
Placing a wiretap or a Carnivore device might help the FBI gain information, but it certainly wouldn't help protect me or my loved ones.
What would be more likely to happen is that the FBI would choose to place my loved ones in danger by failing to pursue a conviction for conspiracy in the hopes that they might wait and catch you in the act of commiting a more serious crime.
In the meantime, if I also happened to find out that you were planning something, I would quite likely be unable to go get a gun without waiting for government approval. I might also be required by the FBI to remain in the danger zone, taking no actinos that might let you know that the FBI had some clue what you were up to. It is quite likely I would be unable to pack everything up and leave.
"The FBI would still need to obtain the appropriate warrants to place the tap device on the criminal's ISP (BTW - these orders are time sensitive - the [whatever]ivore device can only be on the system for a specific period of time), and collect the information required to perform their mission."
More to the point, they would be required to do so if they wanted to be certain that any information they obtained would be admissable in a court of law.
If they decided that it was more important to have the information quickly than to be able to use that information in a court of law, they might ignore the requirement.
For example, they might ignore this requirement if they thought they could get away with the crime, and thought that they could build a 'strong enough' case without that specific information.
Or perhaps you'd like me to believe that the FBI never commits a crime.
"OTOH, if the criminals were solely using the telephone to plot, would you have a different view or expectation as to their capture?"
No. All of my answers would be exactly the same. Perfect consistancy. The technology doesn't matter.
"I'm not saying that the FBI (or any governmental agency, for that matter) should have unrestricted access to our personal lives - that is CLEARLY a breach of the law. "
Clear to us, now. What of the things the government is currently doing which people fifty years ago believed were CLEARLY a breach of the law. If the government starts doing this now, I predict that this clear line will move.
"I still think that a review of Carnivore is a good idea, but if looking at it's algorithms yielded information as to how to thwart it's capabilities, should that kind of information be out in the public?"
Absolutely. Otherwise the system is flawed and only certain people, such as former FBI agents and friends, have that information and the public doesn't. This gets back to security through obscurity. Frankly, I'd rather have a system with known flaws than a system with flaws known only to people who had worked with the FBI. In the first case the system might get fixed. In the second case, someone might abuse the system when they wanted some information that they couldn't justify getting a court order for.
"Would you be happy if, in the aforementioned scenario where your loved one is in danger, the criminals knew how to thwart the system, rendering the FBI's protection of your family useless?"
Again, the FBI doesn't protect us. My family wouldn't be any worse off than if the system didn't exist at all.
That question depends on the assumption that the only way for you to know about a problem is if it is publicly disclosed. This assumption is false. It is also possible that you might know how to thwart the system in some way which isn't publicly known. In such a case, a public review might have revealed the flaw and allowed time to fix it, where a hidden system let it linger.
"Just some thoughts... I'm not fully a proponent of government, but I think that there are some things best left out of the public eye."
If you can provide an example, I'd be glad to hear it. The only one I can think of is information about military tactics (note that I don't include military strategy). Can you think of another?
Re:Devil's Advocate? (Score:2)
Go ahead. Surprise me. Give me an exact number. Give me a ball park number. Tell me where you got the number. Support your claim.
I think you'd be surprised how many criminals DON't use the net to plan their crimes...
Re:Strawman argument (Score:2)
Just how much freedom are you willing to give up? And just how much security are we buying with it? Was the country really more secure when Hoover was trying to stop the Civil Rights movement?
> After all if a law was passed requiring people with red hair to register on a national database, of course it would be people with red hair who would complain.
Are you saying that you wouldn't protest if they rounded up the red heads?
First they came for the Jews
And I did not speak out -
Because I was not a Jew.
Then they came for the communists
And I did not speak out -
Because I was not a communist.
Then they came for the trade unionists
And I did not speak out -
Because I was not a trade unionist.
Then they came for me -
And there was no-one left
To speak out for me.
Pastor Niemöller, 1938
Re:Traffic Analysis (Score:2)
That is, it could do so if they had enough surveilance at enough of the points. And it could do so even if the headers are encrypted.
Beating traffic analysis requires padding to the same length, introducing delays, and having lots of traffic.
Re:Is Carnivore Irrelevant? (Score:2)
Shut the fuck up troll.
Re:Why shouldn't we have Carnivore? (Score:2)
There is a primary difference which you overlooked. The available methods of automatically scanning ascii text are vastly better than the available methods of automatically scanning human speech.
One part of the concern is that this means it is physically possible for the FBI to scan ALL internet communications, while it hasn't been possible for them to scan ALL human speech.
The concern is that they may try to implement a system which allows them to do exactly that. We haven't worried that they may try to implement a system which scans ALL human speech, because it's been believed that it isn't possible. We are worried that they may try to implement a system which scans ALL internet communication, because it is clearly possible.
"Anyone who thinks that the FBI will scan every packet going through routers in the US is living in a paranoid fantasy world."
Anyone who believes that the FBI would never violate a single law is living in a nieve fantasy world.
It doesn't matter if they actually reach the point of scanning all the traffic. One point is that if the ever scan any traffic they shouldn't have, that's a problem. That's a problem that also faces wiretapping, but with Carnivore, the concern is that it's gotten vastly easier for them to violate the law, and vastly harder for anyone to find out about it or prove it.
"Either you trust the FBI or you don't, but stop being hypocritical in what you complain about."
I don't trust them, but I don't think I'm hypocritical either. I think it should be possible for us to catch them when they do wrong. For me, Carnivore is a problem because it makes it more likely that they will be able to get away with something, and I believe that in turn makes it more likely that they will try.
Re:Carnivore and Napster debates (Score:2)
/.
Re:Devil's Advocate? (Score:5)
A. The governent has the ability to catch all the paedophiles, terrorists and so on by means of black boxes which read all their email. Since the boxes are black, you have to take it on Government say-so that they operate legally and only under warrant. The government therefore has the capability to silently upgrade the box to spy at any time on the private communication of all its law-abiding citizens, and send the men in balaclavas round to fetch anyone that seems subversive. Meanwhile all terrorists and paedophiles with two brain cells to rub together are not using the internet to discuss their evil plans.
B. The black box is not in place, or an open solution is used instead, and a few people use the internet to plan crimes.
I would suggest that under the US constitution option B is the only viable one. Ditto the European Human Rights laws. And personally I would certainly prefer option B.
To put it a different way: If a relative of yours was blown up after two men in trench coats planted a bomb, and this could have been prevented had all policemen had orders to shoot on sight all people wearing trench coats, would this have been the right thing to do? Sometimes we have to choose the lesser of two evils.
Big Brother has gone open-source (Score:2)
Note to the Los Alamos lab: open-sourcing missile systems would be a bad idea.
only follow this link if you want to get really ticked off [ridiculopathy.com]
Re:Why shouldn't we have Carnivore? (Score:2)
It's not that I don't trust the FBI... Well, actually, I don't. But that's because I don't trust the US government in the form of the elected officials or governmental agencies, as they have proven, time and time again that they cannot be trusted, either to keep their promises, or to not cover up 'incidents' that would make them look bad.
Of course, that doesn't make them that different from any 'normal' person on the planet.
And, having said that, there isn't a country on the planet I would rather live in...
NecroPuppy
---
A true patriot is one who tries to improve his country.
Re:Oh no!--Carnivore wasn't free (Score:4)
That argument doesn't hold water, because the furor over Carnivore stems not from the fact that it might have flaws or weaknesses, but that nobody quite knows what Carnivore's capabilities are. Are you absolutely sure it's just tapping email? Or maybe there's built-in packet sniffing, as well. Perhaps it maintains its own duplicate cache of every web page you access.
Or, since Carnivore is a black box, perhaps it scans *every* email or web page request and does some fancy pattern matching on it. Under the auspices of looking at Joe Blow's email, the FBI has a tool in which to look for whatever they want: people downloading kiddie porn, people building bombs, people passing military secrets... which they have NO RIGHT to look for beyond look at Joe Blow's email.
Nobody's bitching about Carnivore because it might have a flaw. The big stink is the fact the FBI won't give any more information on Carnivore than sound bites, and people are justifiably worried that Carnivore might do more than just tap one persons emails.
I also don't understand how an alternative that is different in only one respect (open sourced) and supposedly has the exact same functionality is superior to the closed source version. To me, a well-designed program is a well-designed program, whether it was designed in total secrecy or GPLed.
It's not about the design. If this were simply about security flaws you'd be correct.
This is about the capability of software you know nothing about. An open version allows an ISP to make 100% sure that all it does is tap email. With the FBI's black box, you have to take your chances.
Open source, in this instance, provides a much greater level of security and comfort than proprietary software.
--
Re:A Message from the President (Score:2)
I don't know whether the post was made for kicks and giggles, or for some other reason, but in the end, there =are= a disturbingly large number of "Christians" who preach hate, prejudice, paranoia and emotional/physical violence.
If "sides" exist, and I had to choose which "side" guided the writer of the post, I'd say the guy with the pitchfork is a more likely suspect.
Re:Oh no! (Score:3)
This is going to be difficult considering the President's Information Technology Advisory Committee published a report (Covering letter) [ccic.gov] recommending the use of open source for high-end computers, and suggesting government-funded development(IIRC)
Re:Think of Us... (Score:2)
I won't completely disagree with you but please don't go for a perfect democracy where everyone can vote on every issue.
The problem with this is that the only people who would bother to vote after the first few weeks are the people who actually care about changing things. This breaks down to a subset of people who have a particular personality, so such a system would ultimately give control to these people.
Most people couldn't care less about most issues, but many people take a stand on things they know little or nothing about. Usually this stand comes from being manipulated by annoying people with loud voices who know how to mix key patriotic manipulative words into sentances to hit irrationally on large blocks of population.
People have voted away "true" freedom in nearly every democratic country in the world, in favour of having a government to "protect" them from things they don't have time to understand. How long do you think it would take for people to do it again?
It's easy to vote to allocate money to helping the homeless. It's not easy to organise how this is done. It's easy to vote to replace the people who were responsible for organizing something. It's not easy to appoint someone who has a hope in hell of doing any better.
The central problem with democracy is the side of it that is nothing more than two wolves and a sheep voting on what's for dinner.
===
Re:Sorry, Guys (Score:2)
Geez -- don't do that without a C&C warning.
(wipes the coffee off monitor; gives thanks that the cat doesn't like to sit on laps)
has a role in monitoring criminal communications. Some random hacker who threw together a program does not.
An ISP can have whatever policies it likes, so long as it does not deceive its customers. (Obviously, an ISP with a known policy of contempt for privacy isn't going to attract many customers.)
In any case, you've missed the fundamental point -- the FBI can no longer claim that its secret black box serves any legitimate need which cannot be better met by ISPs using this software to perform legally authorized monitoring. If, as some of us suspect, the FBI's agenda includes illegal monitoring (once the black boxen are in place, who's to know?), they'll have to go back to the drawing board.
/.
Your epistemology is lacking. (Score:2)
So long as the innards of Carnivore are not open to the public, the FBI could easily track anything they want to. Given this, the following scenario becomes not only possible but likely:
- FBI becomes interested in person X, for political or other non-criminal reasons.
- FBI agent takes out a pseudo-account in the name of Y on person X's ISP, begins exchanging "suspicious" traffic.
- FBI "notices" Y's traffic, asks for a mail-header warrant to see if there is cause for a criminal investigation.
- FBI installs Carnivore on person X's ISP, allegedly to watch Y. However, the Carnivore system is also set to capture all traffic pertaining to X.
Now prove to me that that can't happen. Given our police agencies' record of using illegal wiretaps, try making a case that it isn't inevitable. You have two chances of making your case, slim and none.--
Build a man a fire, and he's warm for a day.
Not exactly a conspiracy yet... (Score:3)
While the FBI refuses to comment on specific products, spokeswoman Chris Watney confirmed that the information is all the bureau is interested in. How they get it, as long as it's legal and complete, doesn't matter, she said.
So it appears to me that the FBI has no problem with ISP's using this software. At least that's the way I interpret it. If this is so, then there's no problem here that I can see. Yes, carnivore may have done more than this software does, but the FBI is backed into a hole, and since they claim that they only need specific information, which this software provides, then we win this battle.
For you conspiracy buffs out there, this may change in the future when they come out with "Carnivore ME" that has enhanced features that they claim are proprietary and can't legally be reverse engineered in the U.S. thanks to stupid laws passed like the DMCA and such.
how is this proof of something? (Score:2)
sig:
Re:Devil's Advocate? (Score:4)
A better analogy which captures more of what the FBI is doing would be: "Suppose some terrorist group was using the US postal service to plot its plans." Unencrypted e-mail is like a post card, encrypted e-mail is like a letter inside of an envelope.
While e-mail is faster than snail mail, it lacks the immediate feedback of a phone conversation; in addition it leaves an audit trail that any terrorist organization would be fools to leave.
I would think that something like ICQ would be a better choice for clandestine plotting than e-mail.
Another way of handling communication would be through https and some secure forms to a .com site; your 'order' could be "Bomb the UN building at 3:OO PM".
In any case the whole "We've got to read your mail" paranoia on the part of the FBI is mostly unnecessary; traffic analysis alone will give them the vast majority of the information they need to have on any terrorist organization.
Besides, sending an e-mail message like "You da bomb" gets you looked at by Echelon anyway.
The FBI just wants Carnivore because it is full of petty snoopy people who like to read other peoples mail. Since 99.9999% of all email is of the innocent variety, they have to read an awful lot of innocuous stuff to find the sort of criminal communications that they claim are "flooding the Internet".
Anyone who is seriously worried that their daughter is going to be kidnapped and raped by political terrorists also needs to be worried about being electrocuted by a lightning strike in a dust storm; since the two events are roughly equal in probability.
The broadcast media and newspapers have a hidden agenda; both of these groups are terrified of the potential competition that the Internet can be for them - so they want the Internet as crippled as they can make it. That is the real motivating reason for all of the stories of "slavering pedophile boogie men who are going to turn your rosy cheeked 8 year old into a porn - ho".
If you want to see how ridiculous all of these stories are remember that the Internet is just a medium of communication like the air or the US Mail is. Substitute "Air" or "Postal Service" for Internet and the absurdity of the stories is apparent:
"A Pedophile was arrested today. Authorities said that he 'talked' to a little girl on her way to school. The FBI renewed its demand before congress to get parabolic microphones and laser snooping devices on every street corner so that they could listen in to all conversations to prevent that sort of crime from happening."
"You can never tell who is plotting crimes by using the air to talk to each other, so we need to have the ability to snoop on all conversations. Besides, if you aren't doing anything wrong how could you object? Warrants, we don't need no steenking warrants; this is an emergency, all civil rights need to be suspended for the duration."
Carnivore is not a bad thing (Score:2)
Altivore - The Site (Score:5)
Re:Traffic Analysis (Score:2)
One method of preventing knowing who is sending to who is an anonymizing store/forward message gateway - where messages would be held until there are a sufficient number of receipt hosts and then forwarded all at once to their destinations, padding the message sizes so they all are the same size, etc... But even with something like that they'll be able to track (with enough perseverance) sender and receiver unless you have many many users.
Think of Us... (Score:4)
If the Australian Government passed a bill approving a carnivore-like system to be used in Australia, you wouldn't hear too many complaints from the public. ASIO (equiv to CIA) has the power to intercept and read your e-mail if they suspect you of engaging in criminal activities. No guidelines are given to what constitutes 'suspicion', it's completely arbitrary and at the discretion of the agent involved.
--
Daniel Zeaiter
daniel@academytiles.com.au
http://www.academytiles.com.au
ICQ: 16889511
Devil's Advocate? (Score:3)
The FBI has retained the right to perform legal wiretaps on telephones (old-school communications device) for years. They have specific guidelines that they must follow in order to set them, including a signed order from a judge.
Today, we obviously rely more on e-mail (new-school communications device). Does this give us a license to use this new device for whatever crimimal acts we want? If I want to plot a kidnapping/assination/kiddie porn ring (NOTE: I don't...), should I have the unrestricted freedom to make all of my plans online? If the FBI got wind that a crime ring was planning to kidnap, rape, and exploit YOUR wife/son/daughter/sister/brother/etc. by planning the dispicable act entirely through e-mail, would you not want to have some means to protect your loved ones? The FBI would still need to obtain the appropriate warrants to place the tap device on the criminal's ISP (BTW - these orders are time sensitive - the [whatever]ivore device can only be on the system for a specific period of time), and collect the information required to perform their mission.
OTOH, if the criminals were solely using the telephone to plot, would you have a different view or expectation as to their capture?
I'm not saying that the FBI (or any governmental agency, for that matter) should have unrestricted access to our personal lives - that is CLEARLY a breach of the law. However, the intelligence oversight in this country is EXTREMELY restrictive, and is designed to protect U.S. citizens. In fact, the U.S. cannot collect information on its citizens abroad, and cannot collect information on non-citizens while they are within the borders of the US. So if Usama Bin Laden crosses the border at Niagara Falls, NY (lax border, for the most part), the FBI/CIA/whomever CANNOT place a wiretap on his hotel phone without a legal warrant to do so.
I still think that a review of Carnivore is a good idea, but if looking at it's algorithms yielded information as to how to thwart it's capabilities, should that kind of information be out in the public? Would you be happy if, in the aforementioned scenario where your loved one is in danger, the criminals knew how to thwart the system, rendering the FBI's protection of your family useless?
Just some thoughts... I'm not fully a proponent of government, but I think that there are some things best left out of the public eye.
Why shouldn't we have Carnivore? (Score:3)
What I don't understand about all of the fuss over Carnivore I've read on sites like /. is that essentially it isn't any different from already existing methods of surveillance like phone tapping. If you don't trust the FBI to use Carnivore properly, then you shouldn't trust them to use other methods legally either. But there's no outcry over phone tapping because a) it's already here, and b) it's not affecting the Internet.
Really, the only reason that Carnivore wasn't built into the net when it was first created was that nobody in law enforcement ever thought it would come to what it has? The original ARPAnet was mainly used by academics in America - who would have ever thought that it would eventually be used by terrorist organisations in the Middle East to coordinate with cells in New York?
The astounding growth of the net both in America and abroad caught agencies off guard, and they're not moving to recitify the problem in whatever way they can. This is not an invasion of privacy, it's a sensible precaution to be used when it is required. Anyone who thinks that the FBI will scan every packet going through routers in the US is living in a paranoid fantasy world.
Carnivore isn't a "new danger to liberty", it's a new medium for an old technique. Either you trust the FBI or you don't, but stop being hypocritical in what you complain about.
Re:There's nothing new there... (Score:2)
Aha! So open source *is* less secure... (Score:2)
The reason people were so pissed about the FBI's Carnivore is because we have no way of knowing what it really does.
At least with an open-source version, we know what the system's capabilities are.
So basically what you're saying is that you want an open-source version because it's easier to hack? That certainly seems to be what you're implying - you want to know it's capabilities which makes it easier to plan a defence for...
So much for the vaunted "open source is more secure" mantra...
Re:Oh no!--Carnivore wasn't free (Score:2)
It has nothing to do with the GPL in this case. What this is about is being able to SEE what this software REALLY does. The FBI has declined to allow the source to be inspected to ensure it only does what they say it does. They have rejected FOIA requests, and a federal judge has sided with them on the issue. Which really does beg the question: If all this thing is really doing is filtering all email looking for items related to a subject the FBI has the LEGAL AUTHORITY to be wiretapping (i.e. court ordered) then WHY is it too sensitive to show the public?
Personally, I side with the ACLU on this one: This thing must be stopped, and stopped NOW before it is used to circumvent the 4th ammendmant.
Re:Is Carnivore Irrelevant? (Score:4)
Yeah, because Bush is fighting for your rights! He won't make any concessions to the MPAA and the RIAA, no siree. He's a man o' the people.
Re:Link to source (Score:2)
sig:
Let's read 'the prince' again (Score:2)
When you have the means to extend your power, you are morally required to do it!
It seems our governments are once again trying everything they can to protect us. Too bad they don't have the means to read our thoughts or to watch our every moves, it would be so much easier to track criminals, terrorists and pedophiles!
(me being sarcastic)Watch the watchers (Score:2)