July 18, 2000
Proposal Offers Surveillance Rules for the Internet
White House Tries to Balance Rights of Computer Users and Law Enforcement
By STEPHEN LABATON with MATT RICHTEL
ASHINGTON, July 17 -- The
White House said today that it would
propose legislation to set legal requirements for surveillance in cyberspace by law enforcement authorities similar in some ways to
those for telephone wiretaps.
Privacy advocates and civil liberties groups welcomed some aspects
of the proposal but said they remained alarmed about a new F.B.I.
computer system that searches and
intercepts private e-mail and can
easily capture communications of
people not suspected of crimes.
The legislative proposal was made
as the administration also announced today that it had eased export controls on encryption technology, making it significantly easier
for American companies to sell software products to the European
Union and eight other trading partners that can be used to keep computer data and communications secure.
Both the electronic surveillance
proposal and the export control
changes are part of a broader policy
outlined in a speech today by John D.
Podesta, the White House chief of
staff. He said the policy tries to balance the privacy rights of computer
users against the needs of law enforcement to be able to monitor digital communications.
Congress and federal regulators
have done little work in the area,
even as the world has quickly come
to rely heavily on communications
through cyberspace. More than 1.4
billion e-mail messages change
hands every day.
The administration's legislative
proposal on electronic surveillance
tries to fix the inconsistent patchwork of laws that apply different
standards to telephone, cable and
other technologies with a single
standard for those systems and the
Internet. Prospects for the proposal
in Congress are uncertain.
Until now, law enforcement agencies have been able to monitor electronic communication with only
modest court supervision.
The proposed legislation would require that the same standards that
apply to the interception of the content of telephone calls apply to the
interception of e-mail messages. Specifically, it would require law enforcement agents to demonstrate
that they have probable cause of a
crime to obtain a court order seeking
the contents of a suspect's e-mail
messages.
The proposal would also give federal magistrates greater authority to
review requests by law enforcement
authorities for so-called pen registers -- lists of the phone numbers
called from a particular location and
the time of the calls. The magistrates
now have no authority to question the
request for such lists, which are frequently used by the authorities.
In the context of the Internet, existing laws are ambiguous about
what standards apply for different
kinds of surveillance. Many limitations imposed on law enforcement in
the context of telephone wiretaps --
like the requirement that such taps
be approved at the highest level of
the Justice Department -- do not
appear to apply to e-mail surveillance.
Moreover, the Cable Act of 1984
sets a far harder burden for government agents to satisfy when trying to
monitor computers using cable modems than when monitoring telephones. That has proved troublesome for law enforcement authorities as more Americans begin to use
high-speed Internet service through
cable networks. The Cable Act also
requires that the target of the surveillance be given notice and an opportunity to challenge the request.
"It's time to update and harmonize our existing laws to give all
forms of technology the same legislative protections as our telephone
conversations," Mr. Podesta said in
a speech at the National Press Club.
"Our proposed legislation would harmonize the legal standards that apply to law enforcement's access to e-mails, telephone calls and cable
services."
White House officials said today
that they hoped the proposal would
break a logjam in Congress where a
variety of different measures have
been introduced dealing with electronic surveillance. The administration's proposal adopts some elements of both Democratic and Republican bills.
But Congressional aides said there
was too little time left in the legislative session and that the matter
would in all likelihood remain unresolved until after the next term begins, in 2001.
Administration officials said the
proposal would apply to communications that either begin or end in the
United States. It would not apply to e-mail messages transmitted entirely
outside the country.
Privacy and civil liberties groups
criticized the administration's proposal because it would continue to
permit the government to use a new
surveillance system that the groups
say may be used far more broadly
than older technologies, enabling federal agents to monitor an unlimited
amount of innocent communications,
including those of people who are not
targets of criminal investigations.
The system, used by the Federal
Bureau of Investigation, is called
Carnivore, so named, agents say, because it is able to quickly get the
"meat" in huge quantities of e-mail
messages, so-called instant messaging and other communications between computers.
Carnivore is housed in a small
black box and consists of hardware
and software that trolls for information after being connected to the network of an Internet service provider.
Once installed, it has the ability to
monitor all of the e-mail on a network, from the list of what mail is
sent to the actual content of the communications.
Marcus C. Thomas, section chief of
the Cyber Technology Section of the
F.B.I., said the technology was developed 18 months ago by F.B.I. engineers and has been used fewer than
25 times. Mr. Thomas said that Carnivore had potentially broad capabilities and that he understood the concerns of privacy groups.
"It can do a ton of things," he said.
"That's why it's illegal to do so without a clear order from the court."
He said that most Internet service
providers had cooperated with requests to use Carnivore.
Privacy groups and some Internet
service providers have been deeply
critical of the use of Carnivore because, once installed on a network, it
permits the government to take
whatever information it wants.
Moreover, the government has not
said what it does with the extraneous
material it gathers that is not relevant to the particular surveillance.
The issue does not often arise today with the monitoring of telephone
conversations because when a law
enforcement authority wants to see a
list of telephone calls made by a
suspect, the agent gets an order from
a magistrate, presents the order to a
telephone company, and the company then turns over the list.
In at least one instance, an Internet company did not cooperate so
readily with the government. In December, federal marshals approached the company with a court
order permitting them to deploy a
device to register time, date and
source information involving e-mail
messages sent to and from a specified account.
| |
|
Trying to establish a
single standard for
different
technologies.
| |
| |
Concerned the device would
record broader information, the
company countered with a compromise: it would provide the government with the requested information
about e-mail senders and recipients,
according to Robert Corn-Revere, a
lawyer for the company, in recent
Congressional testimony. The company was later identified as EarthLink, a service provider with 3.5 million subscribers.
Mr. Corn-Revere said the government initially accepted the compromise but later became dissatisfied
and wished to use its own device.
EarthLink objected but was overruled by a a federal court, which
ordered the device deployed.
Other Internet companies have
also been critical of Carnivore.
William L. Schrader, chairman
and chief executive of PSINet, a major commercial Internet service provider, said that the system gave the
F.B.I. the ability to monitor e-mail
messages of every person on a given
network. He said he would refuse to
permit the government to use the
technology at PSINet unless agents
could prove that it could only sift out
the traffic from a given individual
that is the target of a court order.
"I object to American citizens and
any citizens of the world always being subject to someone monitoring
their e-mail," said Mr. Schrader,
whose company serves about 100,000
businesses and more than 10 million
users. "I believe it's unconstitutional
and I'll wait for the Supreme Court to
force me to do it."
Civil liberties groups, meanwhile,
said that today's policy announcement was an inadequate response to
the growing controversy over the
deployment of Carnivore.
"Today's speech was camouflage
to cover the mess that is Carnivore,"
said Barry Steinhardt, an associate
director of the American Civil Liberties Union. "In light of the public and
Congressional criticism of Carnivore, we had hoped and expected far
more from an administration that
likes to tout its sensitivity to privacy
rights. Rather than glossing over
Carnivore, Podesta should have announced that the administration was
suspending its use."
| |
|
Concern that the
proposals allow
federal agents too
much leeway. | |
| |
Facing growing concerns about
Carnivore, Attorney General Janet
Reno said on Thursday that she
would review whether the system
was being used in a manner consistent with privacy rights in the Constitution and in federal law. A subcommittee of the House is set to hold a
hearing next week on the system.
While the civil liberties and privacy groups applauded giving judges
greater discretion to review certain
kinds of requests for surveillance,
they were critical of other aspects of
the proposal.
Marc Rotenberg, director of the
Electronic Privacy Information Center, a research organization that
studies privacy issues and technology, criticized the administration for
lowering the standards for surveillance of cable modems rather than
raising the standards for telephone
surveillance.
"The Cable Act provides for one of
the best privacy protections in the
United States," Mr. Rotenberg said.
"The question is whether to harmonize up or harmonize down. Our view
is this harmonizes down."
But administration officials said
the Cable Act never contemplated
that there would be broad use of
cable modems for e-mail traffic and
that the standards used for obtaining
warrants for telephone surveillance
should also apply to digital communications through cable networks.
NET PRIVACY
