DOJ sets rules for Carnivore wiretap investigation

The Justice Department today came a step closer to opening the FBI's secretive Carnivore Internet wiretap technology, presenting guidelines for a promised review of the system.

The DOJ posted a document on its Web site outlining rules for universities that are interested in bidding on a contract to conduct a limited study of the system. Carnivore has stirred up considerable controversy among privacy advocates, who want an accounting of the full scope of its snooping capabilities.

The FBI says it is using the Carnivore system to monitor email by suspected criminals under investigation. In July, officials said they had used Carnivore 25 times, including 16 times this year. The FBI has not disclosed detailed information about those cases, which have not yet gone to trial.

Privacy advocates are concerned that the wiretaps will capture email from people who are not criminal suspects. Earlier this month, the Electronic Privacy Information Center (EPIC) accused the FBI of failing to provide adequate details of the system.

Responding to criticism, the DOJ agreed to conduct a review of the technology, which it decided to commission to a university.

"The primary goal of this procurement is to select an offer that is capable of delivering an independent, objective, impartial and thorough technical review of the Carnivore system within the time frames specified," the document stated. (See the complete executive summary of the request for bids.)

Initially, the DOJ will commission the study to a university and then review the results. The DOJ document outlined four key questions that its review will answer:

• Will the Carnivore system deliver the FBI "all the information" it is entitled to under a given court order? Will the system give the FBI only this information?

• Could the Carnivore system cause Internet service providers to face impairment or security risks?

• Could the Carnivore system accidentally obtain messages beyond those it aims to achieve, "whether intentional or unintentional?"

• Are the protections built into the Carnivore system, including both audit and operational functions, commensurate with the level of the risks, if any were identified in the three questions listed above?

Universities must submit proposals by Sept. 6; the contract will be awarded Sept. 25. The review will be due Nov. 17 and followed by a public comment period. The final draft will be issued Dec. 8.

The report will be available to the public for comment, except for portions that the DOJ believes compromise the security and integrity of the FBI's system.