Privacy and the Carnivore

1
Privacy and the Carnivore

• GySgt Richard Tackett

2
Online Privacy

• Let's take a quick multiple-choice test. What
  can a private company do with personal
  information that it receives about you over the
  Internet? You get to choose one potential answer
  (a) It must keep the information secret (b) It
  may, only under certain circumstances, release
  the information to anyone who asks for it or (c)
  The company can do whatever it wants with your
  personal information.

3
Answer

• There are virtually no limits to what a company
  can do with personal information that it has
  obtained about you. Your name, address, telephone
  number, social security number, height, weight --
  practically anything that a company can get its
  hands on in the normal course of business-- can
  be doled out for money, services or anything else
  that might benefit them.

4

• Up until a few months ago, a handful of states
  were even willing to sell drivers' license photos
  to the highest bidder. If it weren't for an
  overwhelming surge of consumer outrage, Florida,
  South Carolina and Colorado all would have sold
  over 22 million drivers' license photos to a
  private company in New Hampshire. Surprisingly,
  only a few states actually have laws preventing
  this from happening.

5

• There are currently no laws that govern how or
  when your personal information may be
  disseminated. For the most part the industry is
  left to regulate itself. This notion of self
  regulation is starting to catch on. Currently
  there are two companies that are leading the
  pack. TRUSTe and BBBOnline provide privacy seals
  to websites that are the equivalent to UL
  Listed emblem that you see on electrical
  appliances. This seal means that the web site is
  a privacy friendly site. There are 1500
  companies that have been allowed to display these
  seals.

6
Carnivore

• In order to combat the problem of organized
  crime and information terrorism, the FBI has
  developed a program that allows law enforcement
  officials to obtain e-mail wiretaps when
  criminal activity is suspected. This troubles
  many. Carnivore is a high-speed packet sniffer
  program developed by the FBIs Engineering
  Research Facility to conduct electronic
  surveillance of e-mail and Internet
  communications. Carnivore is installed at an
  Internet Service Providers (ISPs) facility to
  monitor selected transmissions

7
How does it work?

• The program works as such First, the FBI
  obtains a specific search order targeted to
  certain e-mail addresses or individuals. Then,
  the FBI and ISP identify an access point at the
  ISP that contains all traffic from the suspect.
  The FBI then connects a one-way tapping device at
  this access point, which produces an exact copy
  of all data at the access point. This copied
  data is then compared against a predetermined
  filter. Only data that is authorized for capture
  by court order passes through the filter and is
  stored on permanent storage

8
Is it legal?

• At the heart of the controversy surrounding the
  use of tools like Carnivore is a Fourth Amendment
  issue debated far before the inception of the
  Internet When does the gathering or monitoring
  of information and private conversations by law
  enforcement become an unreasonable search and
  seizure?

9

• Questions?