Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Censorship

Vinton Cerf Says Carnivore Source Best Left Closed 186

Posted by timothy from the he-that-is-so-wise-in-the-ways-of-science dept.
ljrittle writes: "Vinton Cerf might be the rubber stamp that the FBI was trying to find. The ACM article says that according to Vinton, Carnivore ``does not pose a threat to innocent computer users' privacy'' and that [we] mere Internet users need not see code." This is nearly as reassuring as the Justice Department's decision to change the name of Carnivore, as pointed out by observant reader Ripped_Edge. Walks like a duck, talks like a duck ...
This discussion has been archived. No new comments can be posted.

Vinton Cerf Says Carnivore Source Best Left Closed More

Vinton Cerf Says Carnivore Source Best Left Closed

Comments Filter:
  • I can see it now, young teenagers are no longer using their xDSL/cable modems to play quake with LPB qualities and run game servers, but instead load up a small server program, about the size of omnihttp (1.4megs) that uses a combination of a pop3/stmp server and an eliza type program and a reader that grabs various nouns and verbs (ak-47, clinton, shoot, attacked, bolivia, nuclear war, ect)off of AP feeds and spits out emails to other Anti-carniVOre Servers (AVOS?), which bounce emails around the net through annonomous proxies in a gnutella-type fashion. Eventually the feds will give up monitoring any emails coming out of those proxies, and people can route their email traffic through the AVOS system. Or somthing.
  • Well, it depends. Frankly, some code is proprietary, and as such, we cannot legally look at it. We still can see what it does, and if we know what language it was written in, we can reverse-engineer it, but there will most likely be differences between that code and the original.

    Also, I can understand, from a security standpoint, that some code may not be made freely available in order to provide greater security for the program that the code is for. I don't necessarily agree with it, but I can understand it.

    Now, given that Carnivore can be accessed from outside secure facilities, it would be a bad idea not to make this as secure as possible. While I don't automatically trust the FBI with what they are doing or where they are going with this whole data collection scheme, I would prefer to see it be as secure as possible, to avoid the possibility that some hacker geek can get into the system easily.

    Finally, I have to agree with a previous article [slashdot.org] and position on Slashdot: Information does not want to be free; people want information to be free. Frankly, until society is free of people who would act irresponsibly with information, I prefer it if not all information is free.

    Kierthos
  • I will intuitively expand your question:

    Without non-government oversite, how do we know that...?

    Agents who violate the law in the name of the law are a problem. But the larger issue is derived from the argument that ISPs would cooperate with legal surveillance, but would baulk at illegal, warrantless operations. The history of cold-war NSA/CIA operations shows that carriers willingly engage in and cooperate with known illegal operations against the people.

    FBI operations at Waco, Texas are a good case in point. Using a modified cellular phone, agents stripped the digital ID number from a cellphone used by David Koresh. This revealed the cellular service provider who allowed an illegal wiretap to be installed at the cell-site. Keep in mind that the cellular provider has to prostitute himself to the FCC to get a license to operate. And the FBI is part of the same government as the FCC. So despite the inner workings of Carnivore, it is the nature of licensees to violate the law for continued operations and profits that we need concern ourselves. Scripturally, the love of money is the root of all evil. This absolute was established some 1700 years before the telegraph.

    More details on FBI/FCC and other government criminal operations in violation of the Communications Act are at Research on Criminal Government. [mindspring.com]

  • I live in Charlottesville. I've been out at all hours. I've even said hello to cops at 3:00 a.m. As long as you're not being loud, walking like you're drunk, or doing anything else terribly rude, they don't do anything. I don't think anyone has ever been brought in on it, either, though they've given a few warnings.

    Welcome, fellow Charlottesvillian! :)

    They bring in a few dozen people a year. You know who they bring in? Black kids. This was the plan, as stated by former Police Chief Wolford (forced out of his job a few years ago) before City Council before the law passed. White kids make up a very small percentage of those snagged. As Wolford said, "those kids from Garrett Square [public housing development] are the troublemakers."

    To be honest, I find that much worse than the constitutionality of it. You raise a good point, which we used in our lawsuit:

    They ordinance has been very carefully constructed so that basically anyone who knows how to say the words "first amendment" can go merrily about their way without harassment. I know this was not the case with the original incarnation of the ordinance proposed, but it is true of the version finally passed.

    That's absolutely the case. Essentially, anybody with enough education (middle-class and up) is OK, but people less educated (poor, lower-class) get snagged. I don't know if you remember, but I printed up and sold (for the cost of printing) hundreds of "I'm Exercising My First Amendment Rights" t-shirts [curfew.org]. Simply wearing this t-shirt exempted kids. I wish I could have given more away to poor kids, but I didn't have the money to do that myself. :)

    I guess it's not too late -- there's still a curfew. I may even have a few of them left...

    -Waldo

    -------------------
  • I love the hypocrisy you see in out government, particularly the law enforcement, sometimes. It's so sad that the FBI isn't satisfied with fair, lawful means of doing their job (which is, mind you, law enforcement, not crime prevention).

    Here's my challenge to the FBI. You trumpet so loudly that the innocent have nothing to hide (an unconstitutional assertion on which to base this system, by the way, since it implies presumption of guilt until innocence is proven). Very well; prove that you really believe this. If Carnivore, or whatever else you may call it, really is such an innocent system, then don't hide it. Let us see the source. After all, if it really only does what you say it will, then there's nothing to worry about, no? And who knows; maybe there are security bugs that you don't see yet; surely you'd want people in positions to help you fix the bugs to see them, wouldn't you?
    ----------
  • The dead white guys that wrote the U.S. Constitution were a gang of revolutionaries with the blood of their opressors on their hands. Don't confuse them with live guys and gals of any shade who suggest that revolution is bad for you.
  • What will your legacy be?

    Hey, as fortune(6) told me this morning when I logged in:
    If all else fails, immortality can always be assured by spectacular error.
    -- John Kenneth Galbraith
  • There is absolutly no reason whatsoever to assume that he had been arrested at all. The fact that he could be has no relivence to the above post.
  • These are all good questions, which I think the FBI should answer. Even so, I don't know that I'd trust their answer without having the code be public, or at least having a group of people whom the computing community trusts look at the code. Something with as serious a consequences as this needs public scrutiny to make sure it is doing what it is supposed to, and only what it is supposed to. It is the latter that I am most concerned with.

  • Mere internet users do not need to see the source. But, I am not a mere internet user, and I doubt that many people who read this are. So I guess that means that we can see the source, by his definition? We should band together and write a letter telling him about us and the contributions we as a community have made, and make it evident that we are NOT 'mere internet users.'



    If you think you know what the hell is going on you're probably full of shit. -- Robert Anton Wilson

  • Indeed.

    While Carnivore itself isn't likely to ruin my life (because I don't use email for anything interesting), the "your crime will be tattooed on your hard drive/TCP logs; all we have to do is read it and lock you up" attitude behind it could.

    If you looked at a list of my HTTP requests for the last week or so, you'd find me to have visited sites by/about serial killers and rapists, borderline child pornographers and NAMBLA types, fake-ass 31337 hax0rs, and computer security experts. Now why would I be doing that if I'm not planning to, say, stalk and kill some 13yo hotties by IRCing them up, getting their IPs, cracking their mommies' b0x0rs, hex-dumping their Passport binaries in search of an address, etc.? It looks like that's what I've got in mind, right? Better keep an eye on me.

    The thing is, all I'm doing is trying to learn how these highly specialized "creeps" talkÑtheir speech patterns, jargon, cant, the frequency with which they end their sentences with prepositions, their favored emoticons, etc.Ñso I can write a character who's easily mistaken by readers for today's favorite boogie/bogeymen (hackers and child predators), because he talks the talk. [Is that ironic?]

    Explaining an as-yet-unwritten section of a complex "avant-garde" book to the FBI would not be fun. For all their alleged smarts, they have a hard time with this artsy crap, and all I have now is potentially damning notes and web archives. Not that they'd ask me anyway. They'd just question my neighbors about the lurking predator on the block, ask them what suspicious behavior the skinny [drugs?] Jewish [conspiracy?] guy [penis?] with the shaved head [a Nazi Jew? is he schizophrenic?] down the street has been up toÑthings like being up all night sitting in front of his computer [writing], drinking [coffee], with his hand in his lap [broken right wrist]Ñand let them ruin my life. Certainly been done before.

    Point: FBInet bad, Freenet good. It's not only criminals who think so.

    And VINTCERF's name looks like an acronym for a CIA plot to assassinate Castro [winky smiley].

  • taxpayers have the right to know where the taxes
    that theyre paying is going to. (this is true in
    any democratic government)

    i am not american but i am very concerned, my
    systems are directly connected to an American
    backbone for Internet access. you may ask "so
    what about it". this greatly affect OUR policies
    etc, we might have a very strict privacy policy
    here but when emails are routed through our
    backbones, that policy might go down the drain.

    in the industry peer review is the best procedure
    to find bugs. if crackers want a "crack" at it
    its best that several other persons have checked
    the code, and maybe found some flaws, and have
    corrected it.

    remember, a democratic government "is by the
    people, and for the people". i think this is
    mentioned on the oath the President takes.
    (whatever)

    yorosiku,
    sessya.

    i trust no one.
  • I guess that makes me trustworthy (NOT!)
  • Correct me if I'm wrong, but the man worked at DARPA for 6 years, back when the Internet was a Defense project.

    His opinion may be a little bit biased.

    Just a thought.

  • Trust the low slashdot number (now just 1072 more people to *ahem....*)
  • Vinton Cerf just blew a lifetime of credibility in one ill-considered article. Did he personally review the code? (snicker)

    At this point, even his technical opinions can be considered suspect, I'd wonder what his political agenda was in the context of figuring out what should be taken seriously in anything he says for the rest of his life, assuming I bothered to read what he's got to say.

    The good news... the rest of us can bet against any technical initiatives he's involved in for the rest of his career, with the exception of IPv6 if he has anything to do with that. (however, if he is involved with it, it's our responsibility to check it for ugly surprises, but it would be anyway)

    When I say bet, I mean taking the short side of any stock in any company he's involved in.

  • alot of people aren't aware of this, i know i sure wasn't
  • No SHIT. From the article:

    Cerf, who recently traveled to the FBI's Quantico, Va., campus to review Carnivore, said that scenario would not only raise even more personal privacy issues but also might end up corrupting the evidence. "I have a feeling," he said, "that the ISP geeks would be less familiar with restraints than the FBI gentlemen."

    Fuck me with a chainsaw if that ain't a denouncement of the BOFH and everything it stands for.

    A responsible admin is always less of a BOFH with equipment in the workplace than equipment which they wholly own themselves...but not that much more so. No, Vinton is dismayed at the uncouth, ungentlemanly behavior of system administrators who are accustomed to steamrolling over everything in their path. All well and good, but BOFHness can be used for ill as well as good, we all know that. No, I side with the bastards because it is the proper attitude; it is right and proper to defend oneself from attack. The police have no obligation to protect anyone, and I trust a BOFH future more than any police state.

  • A cop will find someone walking around in a ski mask and bulletproof vest suspicious. The digital equivalent, anonymous encrypted traffic can be viewed just as suspicious.

    Only when it's the exception. If ski masks and bulletproof vests were the latest high fashion items they wouldn't stick out...
  • Your slippery slope argument doesn't hold, because all the other cases you mention (the elderly, blacks, etc.) are all full citizens under the law, unlike minors.

    Minors *are* full citizens -- see Tinker vs. Des Moines [bc.edu]. The ruling stated "First Amendment rights are available...students...Students in school as well as out of school are 'persons' under our Constitution. They are possessed of fundamental rights which the State must respect, just as they themselves must respect their obligations to the State."

    That pretty well settles it for me. Where's James Tyre when you need him? :)

    -Waldo

    -------------------
  • To better know why FBI cannot be trusted with communications intercept software, you need to visit http://wacofacts.home.mindspring.com [mindspring.com] and see how FBI and FCC work together with White House, US Attorneys, Department of Justice and a corrupt House and Senate to cover up their criminal violations of the Communications Act. By the way, Rep. Bill McCollum, one of the chief coverup agents, is running for Senate and must be stopped, unless you want Secret Government. Force the Feds to own up to their still outstanding violations before getting more authority!
  • Compared to the possible harm that the FBI with its weapons and authority COULD cause, but not actually does

    Tell that to the Branch Davidians. The ones who aren't crunchy bits now.

    I'm no militia-man, but the FBI has a lousy record of abusing their power, even when the director isn't a closet transvestite being blackmailed by the mob like J.Edgar Hoover was.

    Do we really think Martin Luther King needed survellance? John Lennon? What people are saying here is yes, we trust them to a point because to some extent all their normal searches etc. happen in meatspace and there is physical evidence or photos of their survellance attempts, for instance of the demonstrators in Philly during the GOP. That's the whole problem - from now on there won't be any record except what's in Carnivore, and we know that'll be whitewashed beforehand if anyone actually gets to the point of trying to subpoena those logs.

    And yes, I'm sure they might have actually stopped some bad people with the system already. The question is do you allow blanket searches on the entire 280M populace to catch 20 drug dealers and 10 pedophiles?
  • "The FBI cannot and does not 'snoop," said Donald Kerr, FBI assistant director. (from the MSNBC article)

    Maybe it's just my distrust of government agencies (especially alphabet ones) after the entire information gathering thing up here in Canada, but does anyone else find this just a little hard to believe?

    Kerr is simply emulating his (ultimate) boss -- it all depends on what the meaning of "snoop" is.

    In their own minds, the COINTELPRO people weren't "snooping"; they were "monitoring a threat to national security" or such such thing.
    /.

  • Who's telling the worst lie? I see a whole LOT of mouths moving!

    Whether or not to believe this report (please don't laugh until I'm done, folks) depends on how much you believe the individual links in the chain (see also 'fuzzy logic'). Fortunately, this chain only has three links:

    1) The Federal Bureau of Investigation: the government agency whose job it is, essentially, to spy on Americans. They do this to go after anyone planning the violent overthrow of the government or especially heinous crimes against the citizens, like mass murder, child pornography, willful drug use, copyright violations, etc.

    If they give away their secrets, they lose their effectiveness. People learn how their measures work, and sidestep them in order to get away with things. And in this case, we have to consider their source code one of those secrets.

    However, they want to be trusted. So they want someone to come forth and Bless This Carnivore -- (carnivore? animal? beast? The Beast? Revelations? No wonder they're changing the name! Sorry folks, couldn't help myself, got carried away there) -- so that everyone can feel safe on the Internet.

    So they have two choices:
    1a) Find an expert who can both comprehend the source code, verify that it does what they claim it does, and stay quiet about the details, or
    1b) Lie through their teeth, provide false source code, and/or coerce the scientist of their choice to give it the thumbs up or he'll be shipped off to whatever constitutes Siberia in the United States (probably Nebraska).

    2) Vinton Cerf, First Lemming, stepped forward and was counted, looked over the source code he was handed, and filed his report.

    Even though he may be a suit and a corporate shill, he wants to be trusted too. If he goes along with the government too closely on this, and it is revealed later that Carnivore is indeed Opening Everybody's Mail, then he's just shot whatever credibility he had in the foot. With a Howitzer.

    He also has to agree to the government's terms in order to review the Carnivore Code, and I bet they made him sign "The NDA On Steroids." (Like most non-disclosure agreements, but this one is backed by government lawyers on taxpayer money.) And in this case, it would make sense for the government to do that: this legally binds him from revealing the source code and giving away government secrets.

    Given that he wants to be trusted, I would expect him to scream bloody blue blazes to every media agency in the world if the FBI turned a less-than-glowing report into an endorsement.

    Unless, of course, The NDA On Steroids prevents that. If the government can keep him from talking about the source code, I bet they can keep him from revealing any details in the report too. Including the fact that his copy of the report and the FBI's published copy of the report don't jive.

    If Vinton Cerf has a lawyer, and he read that clause, he'd probably do what I'd do: advise his client that signing that document would shaft him up to the sternum. Or not; that depends how much you trust Cerf's lawyer, but that's another screed. By the way: the NDA, if t exists as such, might be something available through the Freedom of Information Act... someone might want to look that up too.

    So, do you trust Vinton Cerf? He's either:
    2a) A scientist who reviewed the Carnivore code handed to him and honestly reported on it,
    2b) A suit who wouldn't know C++ from FORTH, and handed in a report that makes him look credible. For the moment, never mind the possibility that he was duped by legal wranglings in the NDA. You'll see how that factors in just a moment.

    Do you choose to trust the Vinton Cerf Carnivore report?

    Where:
    P(x) is the probability of a given event between 0 and 1,
    1a=the government is telling the truth,
    1b=the government is lying,
    2a=Vinton Cert knows what he's talking about,
    2b=Vinton Cert doesn't know what he's talking about, and
    t=The report is correct,

    Then:
    P(t)=P(1a)*P(2a).

    It doesn't matter which you trusted less... regardless, I bet you got a low number. So did I.

    Sometimes I wonder if we're a little too cynical. But then I think about what it is we're being cynical about, and I have to wait until the gorge stops churning before I worry about it again.
  • "that [we] mere Internet users need not see code."

    Yeah, we're stupid. we're dumb.

    Is'nt this obstruction of the right to free information?
  • You know what? I don't care any more. This kind of stuff is just ridiculous, and somebody needs to have the guts to make some serious waves, if only for a moment.
  • You forgot one:

    --

  • Under the current administration, we MUST mention "protecting the children".

  • That might be why they didn't take the case -- we don't know. They turn down 99% of cases without explaining why. Too bad -- it would have been a good test case. Not idea, but good. I guess all of these questions are what make the case interesting, and I sure would feel better if the Supreme Court would rule on curfews, or at least cases like them related to youth rights.

    Though curfew cases are usually pushed as first-amendment issues, they really are more about the fourth. It may be years until we get clear guidance on youth rights. Organizations like Peacefire and ASFAR are helping push the envelope, so maybe we'll get something sooner. Who knows?

    -Waldo

    -------------------
  • yes, this is one of such obstructions.

    I personally like the bit about how "lawful web users have nothing to fear", or something to that effect.


    -saintalex



    Observe, reason, and experiment.
  • According to the MSNBC article [msnbc.com] linked above, Carnivore runs only on Windows machines: "Carnivore is a software program that lives on a Windows-compatible computer...Once installed on a computer, it can "sniff" or "filter" all e-mail on a particular network, via a network card." According to that (this can be found in the article under "How Carnivore works"), Carnivore is simply a packet sniffer. Not only that, but it's a packet sniffer that only runs on Windows machines. So, just don't use Windows machines on your network, the FBI obviously can't figure out how to use a Unix packet sniffer, so you've nothing to worry about! ;)

    Really though, I don't see why, if it's just a packet sniffer that offloads the data to removable storage, there's such a hub-bub about it. But, I'm also thinking that, if they would bother to write software that's already out there in abundance, it must do more than just packet sniffing on a network that the computer is on.

    Chris Hagar

  • You can bet your hind quarters that you'd best hope the Charlottesville police never find a legitimate reason to arrest you--cops and lawyers like power, and don't like people who outsmart them, right or wrong.

    That's great. On one hand you say this kid is a jerk for abusing the court system and local cops, on the other you acknowledge the possibility of being railroaded as a personal vendetta by same.

    So, are you an Anonymous Coward or an Anonymous Cop? Let me tell you, if you've never been harassed by cops as a kid you must have missed a bunch of kid-hood. Or maybe you're one of those people who had a kid and completely forgot what it's like to BE one.

    Personally, when I hear curfew I hear Iron Curtain. It's just a means of control and a way to get away with stopping anyone they want. After all, they don't know your age until they've stopped you, right? By then they can sniff around and find some other excuse to harass you if you're the wrong color or economic class.

    I have plenty of respect for cops; I have friends who are cops. But that doesn't prevent their buddies from terrorizing me anytime they want. I've been stopped for doing 2 miles UNDER the speed limit, just because it was quota night, and after all if you're drunk you might drive slowly. Yeah, and if you know a cop car is sitting there with the radar on you might drive slowly too!

    Cop: Why were you driving under the speed limit?
    Me: Because last time I drove OVER the speed limit you gave me a ticket!

    Cop: So why'd you put your brakes on at the top of the hill?
    Me: So I didn't get air going over it!

    Then I was a wise-guy. It's not a far step from there to obstructing a police officer and a night in jail. Just for not "keeping your mouth shut".

    I don't know about you, but I often use my brakes going down a hill. But he had some OTHER idea that I was trying to avoid him or something. By slowing down. Logic is not their strong point and the indivdual's civil rights are often quite beside the point.
  • Indeed it is. It doesn't matter if we need to see it... we have a legal right to see it, for whatever reason.

    I just lost a lot of the respect I had for Vint Cerf...


    -- Fester
  • So, let me see if I get this straight.
    The Federal Government, wants us to allow them to look at our email, but, they lose the email of White House staffers?

    Their software will intellegently seperate your mail from mine, but in the Whitehouse, their systems couldn't respond properly to an issued subpeona?

    Sure, I trust the. NOT.

  • Vinton Cerf's bio: (Score:4)

    by Captain Pillbug ( 12523 ) on Friday September 08, 2000 @09:09PM (#792709)
    His biographical information can be found here [icann.org]. He's just a suit, albeit with a PhD. Nothing to see, folks; just move along.
  • I don't understand what people think a review of carnivore code will do for them.

    If anyone with half a brain wrote network monitoring software it would be very flexible. You could change a little config file and go from something none invasive to something that grabs everything.

    So, I think it depends more on who is using the software and what methods of oversite exist.
  • Where's the link? Where's the beef? I didn't see anything in the linked article about "mere Internet users need not see code". Without corroboration, this has incredible potential for being misleading and inflammatory.

    Of course, it isn't that far removed from the co creator of the Web saying everyone should have a license to surf the Web [slashdot.org] (yeah, apparently this is not a new opinion for him).

  • Never trust anyone who's /. UID is higher than 666.
  • I agree. I am much less concerned that the FBI botched the job and left a hole open (they are smart guys, after all--if they didn't find it, I won't), I am worried about what it is *designed* to do. I don't want it around, even if it perfectly conforms to the description the FBI already gave.

    I suppose some people are worried that the FBI would leave a secret back-door in there, but I seriously doubt it--they have little to gain from doing so (can get unauthorized data without a warrant... If the FBI wants a warrant, they can get one), but much to loose (someone else could exploit it, the public could discover it and demand Carnivore be shut down, someone in the agency could use it as blackmail, foriegn governments could spy on the US).

  • I suppose that they want something that sounds less threatening then "carnivore"

    How about... Sharing our Feelings

  • The spirit of carnivore is good, the idea that they can target one potential criminal, and read all email pertaining to him in an attempt to arrest him is great. The FBI needs somthing like that.

    The FBI has always relied on covert surveillance. Carnivore is not exactly new or ground-breaking. But one has to wonder at how effective ANY system of this sort would be against technically-adept individuals. How many people who want to evade surveillance would email in plain text? Strong cryptography is frightening to the government precisely because they don't (yet) have a way to stop it. It seems to me that anyone who wished to evade detection could do so -- but I'm no expert in these matters.

    The Freenet [freenetproject.org] mailing lists [sourceforge.net] have interesting discussions on these topics, mainly because Freenet's design goals include anonymity and untraceability.

    The letter though, says only the FBI gets a good look at the code, and they can impliment it anywhere, anytime, on anybody, without any notice.

    I don't think that's strictly speaking true. Mostly, police surveillance in this country requires some strong indication of wrong-doing. The Fourth Amendment provides for protection against "unreasonable searches and seizures." I don't have any specifics regarding Carnivore but I would assume (hope) that monitoring everyone all the time would constitute an unreasonable search or seizure.

    ...it'd be nice to see the government at least attempt to follow with current trends and opensource the carnivore program.

    It is not in the government's best interest to open source it -- even though it may be in ours.

    That was a mistake from the start, their PR department is getting spanked by the public...

    Yes, a PR nightmare, assuming anyone is listening. I haven't seen it on network television lately.

    I'm sure ISP's wouldn't mind adapting the software as a government-provided-spam-blocker, we spend enough money as it is trying spam email cases as it is.

    I don't know about spam-blocker, but as for voluntary ISP participation... It seems unlikely to me that ISP's would volunteer to be the bad guy unless it was in their best interest, ie, to avoid lawsuits or prosecution. Customers certainly wouldn't appreciate it. We get annoyed when our ISP's try to throttle bandwidth, never mind about them volunteering to spy on us and rat us out to the gov't.

  • Seriously, don't give in on the language (Score:5)

    by VValdo ( 10446 ) on Friday September 08, 2000 @10:32PM (#792719)
    Controlling the language often means controlling the argument. If this was called something oblique, half the people wouldn't have cared.

    So for the benefit of the justice department, here are, some suggestions for nicer sounding names and of course names that obfuscate the intended purpose of the device.

    * The Datastream Tickler
    * Electro-Bad Guy Nabberometer
    * The Anti-Evil Communication Filtration Device
    * The eBloodhound safety system
    * The TCP/IP En-Route Packet-Routing Intermediatary Device Monitor Analyzer System
    * The Justice Box
    * The Nothing-To-Worry-About System
    * The Fluffy Bunny Machine
    * The Enigma Trapped In A Riddle Machine
    * The J. Edger Hoover Memorial Email Sniffer

    It would also help if they painted the box red white and blue and put silver stars on it too. Then I'd be less likely to be concerned about potential abuses.

    Thanks

    W

    -------------------
  • Vint Cerf may have helped author the TCP/IP standard, but this really doesn't provide any credentials regarding the ethics of privacy in a free society.

    If I had mod points (and hadn't already commented to this thread), I'd mark that "Insightful".

    This is a classic example of exploiting people with the wrong type of expertise to cast a patina of credibility. It reminds me of the distinguised scientists who endorsed Uri Geller's spoon-bending -- however knowledgeable they may have been in their fields, they were clueless when it came to sleight-of-hand and distraction.
    /.

  • Hrm, I don't take back anything I said. You said he had gotten arrested beacuse he was the plaintiff in a lawsuit. That statement is clearly bassless. If you did know the diffrence, you were ignoring it.

  • cellular service provider who allowed an illegal wiretap to be installed at the cell-site.

    Certainly, corperate oversight won't work since corperations are too easily threatened by the government. It's individuals in the corperations who pose a threat to widespread illegal operations by law enforcement. That comes into play if the FBI has to have the ISP's admins direct a particular users traffic to an otherwise isolated sniffer such as carnivore.

    In that scenerio, surely if the FBI had all traffic, or even a large percentage of traffic diverted, the admins would know it. Sooner or later, one of them would tell the world (possably involving getting drunk at a convention, possably not).

    It's not good enough, but it does at least prevent routine large scale violations.

  • It's so sad that the FBI isn't satisfied with fair, lawful means of doing their job (which is, mind you, law enforcement, not crime prevention).

    Actually, the purpose of the FBI is, as the name indicates, investigation. When there are credible allegations that federal laws have been broken, the FBI serves as the detective.

    Ostensibly, they only investigate evidence that has been cleared by a federal judge. Whether Carnivore really can do that is what the review is meant to determine. Whenever there's private material that belongs to multiple parties (such as a hard disk at an ISP), it's important that some attempt is made to distinguish ownership of various different bits of data.

    I repeat, we don't know if Carnivore does what the Justice Department and FBI say it does. Congress has adopted the right attitude that they should be worried if the FBI says 'Just trust us.'

    However, in Carnivore's defense, if it really does do what it says, i.e., scan From: or To: to weed out all the irrelevant materials that have no bearing on the suspect, isn't that better than having a human scanning the emails?

    Surely a human investigator would be less impartial about his or her task than a bit of software?

    "I was scanning for Joe's drug trafficking, but here's this email I ran across that discusses DeCSS, boss. Ask the judge for a court order, and we can 'find' this tomorrow."

  • Apparently "Linux Today"'s "journalistic" credibility isn't much better than Slashdot's. This "new e-mail sniffing program" is nothing but propaganda for Network ICE's line of security products. As a demonstration of how technically unimportant Carnivore is (crackers have been using mechanisms more sophisticated than the FBI's new toy for years), it makes its point...

    ... but so does tcpdump or any of the myriad free "network intrusion detection" tools being released (snort, sniffit, etc) of late.

    The only interesting aspect of "Altivore" is that it showcases the level of competance in the developers Network ICE hires. Here's a hint, kids, packet header fields are under the control of attackers, and they don't have to be self- consistant. Length fields are unsigned. Negative signed numbers make big-ass unsigned numbers...

    And when the TCP header length can be longer than the entire packet length, maybe the equation "len = header - packetlength" isn't a great idea.

    Its amusing to see a vendor that doesn't seem to know how to sanity check a pointer dereference complain about other vendors taking sequencing "shortcuts". Maybe an interesting "contribution" to the body of GPL software would be actual TCP reassembly code --- but given the sub-Phrack quality of this example, I think the only advantage a competant tech would get out of access to that code is a heads-up warning about the general lack of quality-control at closed, proprietary commercial software houses.

  • Seeing movie that started at 9:30 could easily have gotten me arrested. Seeing John D'earth [johndearth.com] at Miller's on Thursday night could have gotten me arrested. Failing to carry ID could have gotten me arrested.

    Bothering somebody isn't required. Playing loud music isn't required. Simply taking a walk, sitting outside and watching shooting stars, or walking to the 7-11 to get a Slurpee -- all illegal under youth curfew laws.

    There are lots of violations of liberties, and battles against all of them are important. I've chosen youth curfews as a cause. The First Amendment guarantees Americans the right to freely assemble. Curfew laws take that away.

    Your suggestion that this particular battle is "wasted" is offensive, at best. At worst, your belief that my anger is portable, and can simply be carted to some other offensive law, is ludicrous.

    -Waldo

    -------------------

  • The Panopticon (Score:5)

    by daemonc ( 145175 ) on Friday September 08, 2000 @10:47PM (#792738)
    from an essay I wrote a couple of months ago:
    The Panopticon was a prison concept developed in the late 18th century. In the Panopticon prisoners were placed in individual cells arranged in a circle around a central tower. Prisoners could be observed at any time by a gaurd in the tower, but, because the tower had shuttered windows, they did not know when they were being watched or who may be watching.

    Carnivore is the tower, we are all the prisoners.

    We will never be allowed to see how the program works, because it may not be doing anything at all. It is not about catching criminals. The object is to take away the sense of anonymity, so that we know that we can be identified, and to create parnoia that we may watched at any time. The target is not criminals, but the general population. The effect is that it suppresses any radical ideas, creates complacence and conformity.

    I need to go, the Thought Police will be at my door any moment...
  • Never trust someones who's number *IS* 666!

  • Vinton Cerf just blew a lifetime of credibility in one ill-considered article.

    Yep, just becuase he expressed an opinion that differed from your own, he's thrown away all that he's accomplished over his career.

    When I say bet, I mean taking the short side of any stock in any company he's involved in

    Great, go ahead and short a bunch of MCIWorldcom. Post your brokerage statement on the web. It will be amusing to see how much money you lose. If you make money, you can donate it to the FSF or the EFF or one of them folks.
  • You kind of glossed over the point that Mitnick was breaking the law and got what he deserved. If you aren't being an idiot like Mitnick your odds of showing up on the FBIs radar screen are damn close to 0.
  • What I'm worried about are the people who will be invstigated improperly because they're talking about something that snags the filters. You could have a conversation with your friend about lawns and be tagged as a drug kingpin. Throw in an innocent vacation to Mexico and suddenly you get to prove your innocence.

    You can send email to a lot of people on the net that you don't know; that web of contacts is one of the things they're looking for. So I sell race tickets to a guy in California, and he's a bad guy and again, I have to prove my innocence because I'm guilty by association. I agree they need a way to "tap" email to some extent; I just don't agree with the approach. They can get the logs now from the ISPs with a court order.
  • Your own reference:
    • Main Entry:
    • police state
      Function: noun
      Date: 1865
      : a political unit characterized by repressive governmental control of political, economic, and social life usually by an arbitrary exercise of power by police and especially secret police in place of regular operation of administrative and judicial organs of the government according to publicly known legal procedures
    Not necessarily just guys with guns. Reading my email without even telling me what you are doing, when, where, why and how it is happening, is an arbitrary exercise of power by police [FBI] and especially secret police [NSA].

    My point was, that at least the answers to these questions are covered by publicly known legal procedures, when it comes to tapping phones.

    Thank you: your article supports my post :-)

    cheers,
    G

    • What has made OpenBSD so successful is not the many eyes, but rather the FEW GOOD eyes.
    Very good point. But remember that the OpenBSD guys took what was meant to be one of the most secure OSes, and gave it a damn good polish. Also, a lot of their job, was going through outstanding bug reports, that no one had got around to fixing. Would *BSD have been as secure as it was, to give them such a good foundation, without the hundreds more OSS programmers using/working on it for years? Would they have recieved the same quality of information in bug reports, if BSD users did not have the source code? Do you think Windows public beta test are really useful for anything more than guaging public opinion of the product?

    I'm not meaning to dismiss the work done by de Raadt et al, and know that I am not providing empirical facts. But I do not doubt that the coders in the public having the source helped the core development team.

  • I have two laws for you: the FOIA and the Privacy Act. And no, I don't mean you can do a FOIA request on Carnivore's code. What you can do is use the Privacy Act to get a copy of your FBI dossier. Here's what you do:
    • Get investigated by the FBI. This is not as difficult as it sounds, and to judge from the neo-Nazi rumblings coming from the DOJ about the "inherent power" of the government to monitor our communications, it'll probably just get easier as time goes by.

    • Once you have reasonable confidence that the Carnivore parasitizing your ISP's network is following you, begin sending carefully prepared (and perhaps machine-generated) messages to and from a variety of email accounts, some bogus, some belonging to friends and relatives.

    • This being done, wait until you're no longer under investigation by the FBI. (How to accomplish that is left as an exercise to the reader.) Use the Privacy Act to get a copy of your dossier and all the email Carnivore captured. Using this -- if your test data set was well prepared -- you should be able to deduce quite a bit about the behavior of Carnivore.
    Of course, this entails some personal risk, but liberty usually does.

    Alternatively, if you think your local Carnivore is monitoring something it shouldn't, flood it with data and sit outside of your ISP's NOC and see how often the MIBs come to change the tapes.

    Resistance to tyrants is obedience to God.--Thomas Jefferson

    --

  • Okay, so we all know that Al Gore invented the internet [32bitsonline.com], right?

    But did you know that without his help, Vinton Cerf never would have invented TCP/IP?*

    Yeah. I guess I'll vote for Nader, then. :)

    (*Helpful hint for ACs and moderators: read the link!)
    ---
    pb Reply or e-mail; don't vaguely moderate [ncsu.edu].
  • It must be a witch!

    hehe, sorry, couldn't resist...

    --

  • oh man... you exactly described an idea I thought up a few days ago, and am planning to implement this week. check my site [quadium.net] for details soon... this garbage is getting out of hand, and for once i am deliberately going to step in the FBI's way.

  • Re:Not just see the source (Score:2)

    by Anonymous Coward
    Carnivore in itself is not good or evil, it is simply a tool that can be used to catch a mass-murderer or provide info on all /. users. Society grants powers to law enforcement and trusts them not to abuse them. For the reporting of any abuse of these power, procedures exist. Tens of thousands of law enforcement people carry guns, and we trust them not to turn into psychotic killers. If we had the same reservations about other powers as we had about Carnivore, the FBI would not be allowed to investigate crimes, arrest people, carry weapons, tap phones, perform searches or keep records on criminals. Compared to the possible harm that the FBI with its weapons and authority COULD cause, but not actually does, Carnivore is really not that new.
  • They generally do not aid in stopping crimes and can be called into effect entirely too easily. With just the slightest suspicion of illegal activities, law enforcement can get a warrant to surveil you.

    Also there is a distinct likelyhood of such snooping meaning filling jails with petty criminals and political prisoners. Thus making it appear that a good job of law enforcement is being done. Whilst largly ignoring major league crooks.
    The FBI, under Hoover, did exactly this.
  • OK, so the DoJ makes a phone call and DoD trots out a "well-known Internet designer" to say soothing things like "trust them" and "no one needs to see the code." I don't know whether Cerf worked directly for DARPA, or indirectly by way of DARPA grants. If he worked directly for DoD, then it's very possible that he still does.

    (Many former Federal employees are still on-call as needed; I once met a HS girlfriend's "retired" father at a job fair, behind the CIA recruiting table; a former coworker who was a "retired" SEAL regularly disappeared from work,... for several months.)

    The point is that government "Of the People, By the People, and For the People" is at stake here.

    This is why we have Open Meetings laws (and the Judiciary enforces these when they're flouted). As a parallel, it seems that what we need now are Open Source laws. Strong ones, with teeth.

    Any citizen should be allowed to read the source code of any/every government information system, without barriers, fees, or harrassment. This is simply an extension of existing practices that laws, court decisions, and government rules and regulations must be published for all to see.

    Since government IT systems actually _implement_ regulations, it seems not only fair but even imperative that the public should have access to review the logic actually used by government entities, i.e., the rules coded in their software systems. The IRS quickly comes to mind, here....

    If such laws had been in place several years ago, the California DMV might have thought twice about _selling_ information from their databases of licensed drivers to commercial interests. They got their hands slapped for that one, but not before they'd already done it for quite a while. People had to _infer_ that they were doing that.

    Government source should be open for all to view.

  • Who chose this guy? Oh wait, it's the folks who want Carnivore to get accepted, isn't it.

    Shouldn't the people (and yes it should be people) who examine Carnivore be chosen by the people Carnivore is meant to examine? (no taxation without representation! ;) I know I'd rather have hundreds of Open Sourcers examining it (even under NDA) than one guy chosen by them who used to work for DARPA, and thus obviously has the right attitude to be in the fed.

    I wonder if I can find contact info for whoever's responsible... I doubt it, they're probably hiding like most people behind this sort of thing. (random question: why doesn't work in the preview? Soon I'll know if it works in the comments too, but whether it works or not, it's a bug.)
    ---

  • PFIR Statement (Score:3)

    by puppet10 ( 84610 ) on Saturday September 09, 2000 @07:15AM (#792782)
    And the people at People for internet responsibility think [pfir.org] that opening the source is important but consider far worse problems with the entire carnivore idea.
  • The whole point of the post on slashdot is that Cerf *isn't* qualified to give an endorsement. The Wall Street Journal and other papers are carrying articles about how Cerf says Carnivore is OK. The FBI PR department and the big papers are pushing to the public that Cerf's opinion should somehow matter.

    Did you bother to read the blurb above? It ends with 'This is nearly as reassuring as the Justice Department's decision to change the name of Carnivore...' I mean really, the WSJ headline I mentioned reads 'Web Guru Cerf Defends FBI's Use of Carnivore.' It goes on to claim Cerf is 'widely regarded as the the "father of the internet."'

    Methinks you have misdirected your post against slashdot instead of against the mainstream press...

    Jim

  • It's been a long time since we had the oportunity to have a slashdot interview, and I'd love to ask Mr. Cerf a couple of questions (regarding carnivore, but also some general questions regarding hiswork on TCP/IP and the creation of the Arpanet).

    /.-folks, get us an interview with him, please.

  • I don't see how releasing the source code 'would be bad' if the system is as robust as they claim.

    Maybe the refusal should be considered strong evidence that the system is not as robust as claimed (or that it enguages in activities not yet disclosed.)
  • Well, it depends. Frankly, some code is proprietary, and as such, we cannot legally look at it.

    What the fuck?

    What the hell is wrong with you people? if code is proprietary, then we may not distribute it without a license thats all There is no law anywhere that prohibits anyone from looking at something, (unless that something happens to portray minors in a sexual manner...)

  • carnivore == wiretaps (Score:4)

    by kezgin ( 108761 ) on Friday September 08, 2000 @11:56PM (#792792) Homepage
    Carnivore and it's older cousin, wiretapping, both provide one thing: easier convictions. They provide a means for law enforcement to get a confession without the person even knowing they are condeming themselves. Not only do these methods violate the 4th amendment, but also the 5th, i.e. not providing testimony against yourself. They generally do not aid in stopping crimes and can be called into effect entirely too easily. With just the slightest suspicion of illegal activities, law enforcement can get a warrant to surveil you. Unless this is stopped (and I realize posting here is doing no good), then we are one step closer to have a stronger fake sense of security, and a leap closer to having less privacy.
  • Also, I can understand, from a security standpoint, that some code may not be made freely available in order to provide greater security for the program that the code is for.

    This is simply saying that it uses "security by obscurity". Which isn't a good idea with something which is used for a long time or in a large organisation. Simply because sooner or later the informat will leak anyway.
  • actually, the correct url is:

    http://foad.fbi.gov [fooled.you]

    fyi

    --

  • Re:I don't really care what Vint thinks about this (Score:3)

    by sillysally ( 193936 ) on Saturday September 09, 2000 @12:06AM (#792797)
    without defending the system or taking sides, I believe that the "robustness" claim was about the secure authentication and data transmission (they're probably using ssh :) while the disclosure they wish to avoid is how the "AI" or "grep" that they're using works, what it keys on, vocabularies, etc. because they don't want people to work around it.
  • The government (and their big business friends )got their little feelings hurt due to Kevin, due to such feeling, they gave kevin a royal fucking. Sorry to say, but you step on big business's toe, it steps on you with all 800 pounds.

    I.E. the sort of approach which should be used against big business (or government departments) when they go off the rails...

  • He must be right!! (Score:3)

    by Moridineas ( 213502 ) on Friday September 08, 2000 @09:12PM (#792799) Journal
    Don't forget, this guy is also one of the big defenders of Al Gore's claims to have been instrumental in the development of the Internet. So he's obviously right about this as well!

  • Not just see the source (Score:4)

    by mind21_98 ( 18647 ) on Friday September 08, 2000 @09:13PM (#792800) Homepage Journal
    We need to get rid of Carnivore period. This is just the Big Brother phenomeon developing right in front of us. It shouldn't be in any form whatsoever. If this is allowed to be used by the FBI it can have devastating consequences. It would turn the Internet from a save haven for people to exchange information to a place where you have to hire a lawyer to make sure the content you're trying to place on a server isn't gonna be considered by the government to be a "threat to national security."

    I will not be sastified until every last Carnivore system is trashed and used for some other purpose.
  • The above poster does make a point though, that while Vint Cerf has done some astoundingly impressive things in his career, his current employment is as "a suit", and his employment has never once been related to privacy or security concerns.

    I'm not attempting to trivialize his accomplishments in the computing field, but honestly I just don't see why his opinion matters in this case.

    And by the way, since when is 12,000 a really low /. number?
    ----------------------------

  • But they can't change the name! (Score:3)

    by Captain Pillbug ( 12523 ) on Friday September 08, 2000 @09:13PM (#792802)
    That would be double-plus-un-clear!
  • developed in the late 18th century

    Prisoners could be observed at any time by a gaurd in the tower, but, because the tower had shuttered windows, they did not know when they were being watched or who may be watching.

    At least, Sheriff Joe Arpaio won't be able to claim a patent for putting his jail in a webcam [crime.com].
    __

  • Re:Vinton Cerf's bio: (Score:2)

    by Anonymous Coward
    Whose opinion are you gonna trust?: Someone who invented TCP/IP? Or someone with a really low /. user#? I thought so.
  • Thanks for the link I'm presonally tired of hearing that particular misquote over and over.
  • I see, so there's nothing wrong with government privacy violations if you're a law-abiding citizen.

    I was a plaintiff in Schleifer vs. City of Charlottesville [curfew.org] -- we sued our city over the youth curfew. What we heard over and over from the lawmakers and judges was "what would a law-abiding kid be doing outside after midnight?" The answer, of course, was "whatever the hell we see fit."

    The innocent need not be concerned with their privacy? That's rich.

    -Wadlo

    -------------------

  • Missing the point (Score:5)

    by sjames ( 1099 ) on Saturday September 09, 2000 @08:07AM (#792813) Homepage Journal

    IMHO, the entire 'examination' is worthless and is designed to distract from the real problem with Carnivore.

    For the sake of arguement, let's say for the sake of argument that unlike every other computer based system in history, it is hacker (and cracker) proof, and always does exactly what it's user wants it to do (no more, no less).

    Further, let's assume that the source is released, and 100,000 respected experts are satisfied that the above is actually true.

    The problem still remains: Without non government oversite, how do we know that the FBI isn't on a giant random fishing expedition? Sure, the warrant says JoeBlow@isp.net but how do we know that the perfectly authenticated FBI guy dodn't set it to scan for '.*@.*' with keyword filters instead? How do we know that the actual units being installed at ISPs have any internal resemblance to the one that was examined? Perhaps it has enough hard drives to actually hold '.*@.*' for several days.

    In short, we don't need a detailed independant examination of Carnivore, We need a detailed independant examination of the FBI and DOJ.

  • I see, so there's nothing wrong with government privacy violations if you're a law-abiding citizen

    Something which is only meaningful to citizens of a state which would never pass laws which are in violation of it's constitution, would never pass laws for purely political reasons, etc.
    However by definition no-one lives in Utopia and even the most supposedly democratic democratic pass the above kinds of laws fairly often. (Indeed the US appears to be especially bad at passing laws due to political lobbying.)
  • Legal interception capabilities are there to catch organised criminals and child pornographers.

    However a big enough criminal organisation (especially if it started as a legitimate business) may well not be caught at all. e.g. Microsoft. Also IIRC at one time the biggest distributer of child pornography was some US law enforcment agency or other.
  • How about this. If every e-mail contained something like a sig, which was maybe a list of words or phrases that triggered snooping you might innundate them with so much information that it would be impossible for them to cope with.

  • Re:Yeah, we're stupid. (Score:5)

    by barracg8 ( 61682 ) on Saturday September 09, 2000 @12:25AM (#792824)
    • Well, it depends. Frankly, some code is proprietary, and as such, we cannot legally look at it.
    I'm not asking for the source code to Windows. The FBI is not a private entity. It is meant to be there to serve the American public, and just saying, "it's our proprietary code, and we don't want to show you," isn't good enough. The American people paid for it. It is the American people's code.

    There are open protocols that the police have to follow if they want to tap your phone. Why? because this is not a police state. I have a right to ask what, when, where and how this may happen. Surely I have equal rights to know what is going on with carnivore. Was that FBI you said, or KGB? I couldn't quite hear.

    • We still can see what it does, and if we know what language it was written in, we can reverse-engineer it, but there will most likely be differences between that code and the original.
    WTF? Are you a troll, or on crack?

    Are you suggesting people try to reverse engineer the carnivore communication protocols? Just how fast do you want a SWAT team on your ass? Please, don't try this at home kids, it would be a bad idea.

    Or do you want to reverse engineer the carnivore program itself? If so, I recommend that an ouija-board will be more useful, than knowledge of what programming language it was written in. How, short of psychic powers, do you intend to calculate what a program that you never get to see running, which is running on a computer that you have no access to, and that you cannot directly communicate with (unless you happen to be a FBI agent), is up to?

    • Also, I can understand, from a security standpoint, that some code may not be made freely available in order to provide greater security for the program that the code is for. I don't necessarily agree with it, but I can understand it.
    Ah - security through obscurity, that old favourite.

    Does the fact that Linux's source code is availably make it inherently more or less secure that Windows NT? Tough one to prove. But I would rather that carnivore was fully security auditted, OpenBSD-style. Many eyes. Shallow bugs.

    Later, you go on to say, "I prefer it if not all information is free," well what if it comes down to this: making information about carnivore free, may make it less likely that your private emails are turned into freely available information. Saying, "I don't either to be free," may not be an option.

    cheers,
    G

  • Um... I don't think anyone here has any high opinion of Cerf's opinion. That's the point. He's not quallified to comment on privacy or on code openness, esp for somehting as important as this.

    I think the FBI wants the general public to think that his opinion matters, which is why it's important that it show up on slashdot.

    Read the headline this way:
    FBI finds 3rd grader who says Carnivore isn't that bad! General public rejoyces that their privacy is safe!

    Better now? :-)

  • I don't really care what Vint thinks about this. (Score:3)

    by g_mcbay ( 201099 ) on Friday September 08, 2000 @09:26PM (#792829)
    Vint Cerf's opinion, like Bob Metcalfe's opinion, means very little to me on a personal basis. Yes, I realize they 'invented' TCP/IP, ethernet, etc. I'm not discounting those achievements.

    I just think its very important that we seperate the technical innovation that some of these folks have been part of with their political or idealogical views.

    From Article: Cerf also said that it would be a bad idea to force the FBI to reveal Carnivore's source code, as many of the system's critics have requested

    Bad? Bad how? Does anyone have any other links that might have direct quotes? I don't see how releasing the source code 'would be bad' if the system is as robust as they claim.

    Why not release the source code of the system? I mean, if it is really well designed and the authentication is so robust, what do they have to fear from full disclosure?

    From Article: Carnivore's detractors had suggested that hackers may be able to gain access into the system.

    Actually, for me the issue is more about the FBI themselves abusing this system than some future threat of a hacker takeover of it...

  • I wish I could moderate you up: (Score:5, Insightful).

    --

  • Re:Not just see the source (Score:3)

    by sparrowjk ( 214769 ) on Friday September 08, 2000 @09:29PM (#792831)

    Citizens are willing give up a certain right to privacy in order to be protected. However, things like Freenet are attempts to thwart Carnivore-like systems. It is unlikely that the Government will ever voluntarily give up what it considers to be its fundamental and unimpeachable right to conduct surveillance.

    As far as Vinton Cerf goes: he worked for DARPA. He was a government employee. While I don't mean to imply that this somehow makes him untrustworthy, it does say something about his endorsement. I don't think it could be called an "independent endorsement" by any stretch.

    I'd be interested to know what reasons he gives for not recommending open source. I suppose the only reasons that could really be justified are for "security" reasons. The government is all about secrecy -- why should they (or Cerf) say anything else now?

  • Has anyone actually seen the code? I mean does this software just pull packets of relays? Then if you encrypt your email via Kerberos or the like could they still pull it and crack it? I run my own SMTP and POP server so does this mean that I by some wacky juristriction am in violation of the law if I do not comply to their standards? Not to mention that this is internation traffic we are dealing with, due to Intelligence Oversight Laws, and the inherent domestic only role of the FBI, wouldn't this then be under the juristiction of the CIA?

    I have two cans and some string if I talk over it then do I have to allow the FBI to tap it?

  • Different Interpretations? (Score:3)

    by Anonymous Coward on Friday September 08, 2000 @09:31PM (#792833)
    msNBC.com's article [msnbc.com] tells a differnet story:

    Vint Cerf, an Internet founding father who was selected to serve as an unbiased technical adviser on the Senate panel, was even harsher in his assessment of the suggestion that Carnivore be put in the hands of ISPs. The proposal "strikes me as alarming, quite frankly," he said.

  • Why do you have expectations on Cerf's opinion? (Score:5)

    by Ars-Fartsica ( 166957 ) on Friday September 08, 2000 @09:38PM (#792835)
    Vint Cerf may have helped author the TCP/IP standard, but this really doesn't provide any credentials regarding the ethics of privacy in a free society.

    This isn't a rip on him - its a rip on slashdot for expecting him to say something momentous.

    Its amusing how the readership of this site hangs on the words of Linus, Alan, ESR, Larry Wall, etc.

    Make up your own mind folks, forget the celebrity worship.

  • The spirit of carnivore is good, the idea that they can target one potential criminal, and read all email pertaining to him in an attempt to arrest him is great. The FBI needs somthing like that. The letter though, says only the FBI gets a good look at the code, and they can impliment it anywhere, anytime, on anybody, without any notice. I'm sure people speaking out against carnivore are on their list of people to watch, if nothing more than to test out carnivore. Which brings up the subject; is this carnivore version 2.0? How long have they been testing this program on the general public without informing us about the program? On the flip side, yes, everyone is fairly aware that the FBI and whatnot agencies have always been able to efficently monitor the people they want, but for them to blatently pointing out "yes, we're quite capable of reading all of your email, and yes we're not letting you see what kind of technology we're using, and we're going to keep it that way.". That was a mistake from the start, their PR department is getting spanked by the public, at the very least they could have predicted a reaction even half of this, and they probably could have released a basic skeletal (or even fake) version of carnivore? Either way, we're a government of the people, by the people; if the people are beginning to opensource many new software projects, it'd be nice to see the government at least attempt to follow with current trends and opensource the carnivore program. I'm sure ISP's wouldn't mind adapting the software as a government-provided-spam-blocker, we spend enough money as it is trying spam email cases as it is.

    comments?

  • I'm relatively new to this whole internet thing, but i'm wondering how this guy get's called "father of the internet", or at least which people see him as such...
    I've been brought up under the impression that Jon Postel, RW Stevens, and CmdrTaco made up the 3 men who concieved the internet (the baby)...
  • Technically, it should be Omnivore -- as it looks at *all* email. (If it was truly targeted at only one email address, then Carnivore would make more sense.).
  • From what everyone hints at, all it does is that if it sees a mail packet go through the ISP's routers[*], it looks at the mail message until it has FROM: and TO: (and possibly other relay headers), then if needed, it grabs the rest of the email for storage.

    Which means that using the standard email protocols, you can encrypt the message itself to your heart's content, but you're still sending delievry information in the clear, which means Carnivore will still pick it up. It's akin to being able to look at envelopes that are spitted out through the post office system, and plucking out the ones that have the address you are interested in. But in the case of email, it's generally a bit worse as most text is sent in the clear. (And no, I don't think that encryption for everyone is the answer -- it should not have to come to this, is the point).

    [*] I suspect it has to be on routers (the last point before the packet is sent to the internet backbone) as opposed to on the mail server as 1) many ISPs have multiple mail servers, and 2) any person smart enough with a home box can easily bypass their ISP's mailserver if they don't rely on that email address, including either using their own box or a 'friendly' open relay box for smtp processing.

  • Yes, I understand the whole privacy argument - but really, if I follow everything correctly, all this software does is allow the government to do what any reasonably intelligent geek on your local network has been able to do all along - packet sniff. Correct? If you really want privacy, don't whine about the government having access to your e-mail - encrypt it. They can sniff my e-mail all they want, they're still not getting anything from it.
  • I think that most web traffic could be considered "useless data" from the FBI's perspective. There's no reason to clog the pipes with random bits when you've got gigs worth of porn and mp3's zinging every which way all the time.

    What the FBI would be interested in (presumably) is threats to national security, terrorists, virus writers, etc... (Yes, virus writers... the gov't doesn't take kindly to "malicious" code, be it for shutting down computer systems or decrypting DVD's...) For anything you personally consider sensitive and don't want the FBI peeking in on, you always have recourse to strong cryptography, though of course there are no perfect solutions.

  • FBI's past history of benevolence (Score:5)

    by phutureboy ( 70690 ) on Friday September 08, 2000 @09:53PM (#792859)

    If you wanna get a better idea on what kind of intelligence info the FBI gathers, and the type of people it gathers it on, peep the FBI's Freedom of Information act site:

    http://foia.fbi.gov/ [fbi.gov]

    The site has reams of declassified FBI files on famous people like John Lennon, Lucille Ball, Jackie Robinson, Charles Lindbergh, Elvis Presley, John Steinbeck. They're all in PDF format, but at least that way you get to see the nifty black marks over the parts they didn't declassify.



    --

Slashdot Top Deals

Anyone can make an omelet with eggs. The trick is to make one with none.

Close