Letter to Reps. Canady and Watt on the FBI Email Surveillance System, "Carnivore"

VIA FAX
Hon. Charles T. Canady, Chairman
Constitution Subcommittee of the
House Judiciary Committee
362 Ford House Office Bldg.
Washington, D.C. 20515-6220

and

Hon. Melvin L. Watt, Ranking Member
Constitution Subcommittee of the
House Judiciary Committee
362 Ford House Office Bldg.
Washington, D.C. 20515-6220

Dear Representatives Canady and Watt:

We are writing to you about the new FBI email surveillance system aptly named “Carnivore,” which gives law enforcement extraordinary power to intercept and analyze huge volumes of email. The Carnivore system gives law enforcement email interception capabilities that were never contemplated when Congress passed the Electronic Communications Privacy Act (ECPA), codified in relevant part at 18 U.S.C. 2510-22 and 18 USC 3121-27. Carnivore raises new legal issues that cry out for Congressional attention if we are to preserve Fourth Amendment rights in the digital age.

The existence of Carnivore first came to light in the April 6 testimony of Attorney Robert Corn-Revere to the Constitution Subcommittee. Its operation was further detailed in a report that appeared in today’s Wall Street Journal (copy attached). According to these reports, the Carnivore system — essentially a computer running specialized software– is attached directly to an Internet Service Provider’s (ISP) network. Carnivore is attached either when law enforcement has a Title III order from a court permitting it to intercept in real time the contents of the electronic communications of a specific individual, or a trap and trace or pen register order allowing to it obtain the “numbers” related to communications from or to a specified target.

But unlike the operation of a traditional a pen register, trap and trace device, or wiretap of a conventional phone line, Carnivore gives the FBI access to all traffic over the ISP’s network, not just the communications to or from a particular target. Carnivore, which is capable of analyzing millions of messages per second, purportedly retains only the messages of the specified target, although this process takes place without scrutiny of either the ISP or a court.

Carnivore permits access to the email of every customer of an ISP and the email of every person who communicates with them. Carnivore is roughly equivalent to a wiretap capable of accessing the contents of the conversations of all of the phone company’s customers, with the “assurance” that the FBI will record only conversations of the specified target. This “trust us, we are the Government” approach is the antithesis of the procedures required under our the wiretapping laws. They authorize limited electronic surveillance of the communications of specified persons, usually conducted by means of specified communications devices. They place on the provider of the communications medium the responsibility to separate the communications of persons authorized to be intercepted from other communications.

Currently, law enforcement is required to “minimize” its interception of non-incriminating communications of a target of a wiretap order. Carnivore is not a minimization tool. Instead, Carnivore maximizes law enforcement access to the communications of non-targets.

In his testimony to your subcommittee Mr. Corn-Revere described the experience of his client, an ISP that was required to install Carnivore when presented with a trap and trace order. He detailed his client’s concerns that a trap and trace order in the context of the Internet revealed information that Congress did not contemplate when it authorized their limited use. In the traditional telephone context, those orders reveal nothing more than the numbers dialed to or from a single telephone line. In the Internet context, these orders and certainly Carnivore, likely involve ascertaining the suspect’s e-mail address, as well as header information that may provide information regarding the content of the communication.

As we have stated previously, the ACLU does not believe that it is clear that the Government can serve an order on an Internet service provider and obtain the e-mail addresses of incoming and outgoing messages for a particular subscriber. Further, it is not clear whether law enforcement agents use or should use authority under the pen register statute to access a variety of data, including Internet Protocol addresses, dialup numbers and e-mail logs. We certainly do not believe that it is clear that law enforcement can install a super trap and trace device that access to such information for all of an ISP’s subscribers.

In light of the new revelations about Carnivore, the ACLU urges the Subcommittee to accelerate its consideration of the application of the 4th Amendment in the digital age. Legislation should make it clear that law enforcement agents may not use devices that allow access to electronic communications involving only persons other than a specified target for which it has a proper order. Such legislation should make clear that a trap and trace order served on an ISP does not authorize access to the contents of any communication – including the subject line of a communication — and that the ISP bears the burden of protecting the privacy of communications to which FBI access has not been granted.

We would be happy to work with the Subcommittee on drafting legislation that protects the privacy rights of Americans.

Sincerely,

Laura W. Murphy
Director, ACLU Washington National Office

Barry Steinhardt
Associate Director, ACLU

Gregory T. Nojeim
Legislative Counsel, ACLU Washington National Office

cc: Members of the Constitution Subcommittee of the House Judiciary Committee