eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Their destructive force still terribly fresh, the blasts that leveled the World Trade Center and tore open the Pentagon have shaken the foundation of Americas freedom and expectation of privacy. New efforts to expand law enforcements surveillance powers beyond simple wiretaps are getting overwhelming legislative support in a nation that now considers itself at war.
But civil libertarians, tech industry insiders and even some lawmakers are cautioning that moves to allow more and better eavesdropping amounts to an unacceptable erosion of rights. Like the haunting memories of the events that spawned them, the results of the debate will likely be lasting; history shows that when individual rights are curtailed for the sake of public security at a time of heightened threat, those freedoms are lost forever.
“Theres an immense impulse here to ramrod through changes to police powers,” said Mike Godwin, policy fellow at the Center for Democracy & Technology, in Washington. “Shortcuts in this context are a casualty of terrorism.”
The Senate wasted little time in approving new domestic spying capabilities in the immediate aftermath of the terrorist attacks in New York and Washington. Forgoing the usual deliberation and working late into the night, the Senate earlier this month passed a bill expanding the authority of the government to require ISPs (Internet service providers) to give law enforcement agencies information about e-mail. The Senate provisions, hastily amended to a spending bill, will allow state and federal law enforcement officials more leeway to use Carnivore software and other electronic monitoring technologies. It will also allow U.S. attorneys or Department of Justice officials to order computer wiretapping during an emergency for up to 48 hours without a search warrant. Current laws require a court order for all electronic surveillance.
But even those drastic changes did not go far enough for the FBI and the Justice Department, which have since asked Congress for even greater authority. Specifically, Attorney General John Ashcroft wants the FBI to be able to monitor all of the communications of a person rather than just a single telephone—a request stemming from the widespread use of wireless phones (see story, Page 28). He also wants to be able to obtain a single federal wiretap authorization, rather than being forced to receive authorization from each jurisdiction in which an investigation takes place. Ashcroft had asked that Congress pass the new legislation by the end of last week—even though the lawmakers were on recess in observance of Rosh Hashana until last Thursday.
The FBIs requests for enhanced surveillance powers are not new. The capabilities sought have been debated—and resisted—for a decade or more. Since wireless phones and the Internet became popular means of communication in the early 1990s, the FBI has sought to broaden historic wiretapping powers to cover digital technologies. Privacy activists and the telecommunications industry—responsible for financing much of the implementation of surveillance capabilities—have successfully checked the FBIs demands so far.
But all that changes in time of war. In the midst of a crisis, government faces less resistance to its demands for increased powers, lest resistance be viewed as anti-patriotic, insensitive to victims or unsupportive of the rule of law and justice.
Among the first things federal investigators will likely do with the new surveillance powers will be to expand their use of Carnivore, experts say. The FBI deployed Carnivore, part of a suite of Windows NT/2000-based, packet-sniffing software called Dragonware, in late 1999. Previous generations of the software were known as Omnivore and before that, Etherpeek. It can be used to reconstruct e-mail messages, downloaded files and Web pages visited by a user under investigation and to track a suspects e-mail exchanges with other people. Carnivore today can be set up at an ISP or on a corporate network.
Privacy advocates have long opposed Carnivore, partly because they fear that the technology gives law enforcement access to electronic data beyond the limits of a surveillance subject. Protected personal and corporate data, they fear, would be exposed by default. Last year, the Senate passed similar provisions—dubbed Sneak and Peak—but the initiative died in the House.
Under the new Senate-approved rules, “it is as if they had suddenly gotten the right to get all the information of an e-mail except the content,” Godwin said. “If you are in the position where law enforcement can come in to your business [without a warrant] and demand to put Carnivore on your system, youve lost control.”
ISPs are working with law enforcement to investigate the terrorist attacks, as they do in other crime investigations. America Online Inc., in Dulles, Va., provides information for hundreds of investigations every year, according to Nicholas Graham, spokesman for AOL. As for the expanded surveillance powers outlined in the pending legislation, Graham said it is too early to take a position, but the company does not and will not deploy Carnivore because it has its own methods for providing the information requested by law enforcement.
“Our corporate position is that Carnivore is something weve declined to install on both policy grounds and logistical requirements,” Graham said. “Weve not been asked by law enforcement to adapt Carnivore, and if we were, we would not do so.”
Jason Catlett, president of privacy advocate Junkbusters Corp., in Green Brook, N.J., said hes concerned with protecting consumer information and is wary of hasty requests for new surveillance tactics. “Theres a lot more push for no questions asked surveillance by the government,” Catlett said. “Decisions made under trying circumstances are usually not the best.”
ISPs in the United Kingdom have already been asked to collect and retain data on customers for possible government investigations, according to Catlett. “I would expect ISPs here to come under increasing pressure to undertake potentially onerous data collection and retention,” he said.
Stan Laufer, network administrator at Californias San Jose State University, said that forcing all ISPs and corporate and university networks to install Carnivore would be an “extreme measure. I always assumed the government was trying to collect that data anyway,” Laufer said. “I see the need to limit the extent to which its used. To force everyone to deploy [Carnivore] on a global basis so the government can use it at their convenience— no, thats ludicrous.”
Some enterprises, however, do not object to the enhanced electronic monitoring. Scott Forsythe, system administrator at Toast .net, an ISP in Toledo, Ohio, supports increased surveillance as a counter-terrorism measure. Forsythe said he would not object to increased security at Toast .net, including Carnivore.
“Theyve got to do what theyve got to do to make the country more secure,” he said. “I think people have to understand whats going on out there. Im all for taking 3 hours to get through airports and banning knives on the plane if it prevents attacks.”
In the realm of wireless telephone calls, it is unclear how much information could be obtained without a proper search warrant under the pending legislation. It is possible that location information could be obtained with no more than an attorney certification, CDTs Godwin said.
At press time, there were no assurances that the House of Representatives will grant the issue of expanded police powers any more deliberation than the Senate did in the wake of the attacks. However, some privacy activists saw hope in that the House narrowed the original provisions granting the president authority to order an armed response to the Sept. 11 tragedies. According to several sources on Capitol Hill, many members anticipated efforts to rein in the provisions passed by the Senate and sought by the DOJ.
“This is certainly a time to guard against people trying to rush through unwise legislation,” said an aide to Rep. Ron Paul, R-Texas, who has a long record of opposing expanded federal law enforcement authority. “But its going to be very hard to make the privacy arguments now. Privacy will suffer.”
There are two ways that the type of expansive powers sought by the DOJ and passed by the Senate could address the goal of fighting terrorism without treading so heavily on individual privacy, sources said. First, the use of new powers could be restricted exclusively to terrorist investigations. Second, the new powers could be established for a specified period.
“There are members [who] want to limit the proposals to this particular case or time period,” said a well-placed Hill staffer. “This way, we do not in any way impede the investigation and, at the same time, do not impede on personal liberties.”
“No ones going to have a problem with [surveillance of an individual rather than a telephone] in the context of finding Osama bin Laden,” said an aide to Rep. Edward Markey, D-Mass. “The congressman has said that it is important that in the search for the bad guys, we do not harm the good guys.”
In the wake of the Sept. 11 devastation, privacy activists and civil liberties groups face added pressures. In the past, threats to national security were considered largely external, but todays threat resides within U.S. borders, taking advantage of the very freedoms it seeks to destroy. The alleged terrorists lived among us, and, according to the government, some of their associates probably still do, profiting from U.S. liberties to plot and execute their attack.
Privacy activists say they will be less opposed to expanded surveillance capabilities if law enforcement could demonstrate that the expanded powers will result in increased safety. What they fear most is the loss of liberties without a commensurate improvement in public security. They point to past increased security measures growing out of a crisis, which were made permanent but failed to prevent disasters.
For example, in response to the explosion of TWA Flight 800 in 1996, the Federal Aviation Administration established rules on passenger profiling. Civil liberties advocates opposed the regulations, largely on the grounds that they would not be effective in promoting airline safety. “Theyre targeting the wrong people,” said Lisa Dean, vice president for technology policy at the Coalition for Constitutional Liberties, in Washington. “Theyre random searches, and theyre not based on human intelligence. Theyre based on a database.”
Unless lawmakers take the unprecedented step of including expiration dates on expanded police powers, the new rules are almost certain to be used as the foundation for future expansions.
“Our experience has been that these things operate on the ratchet system,” CDTs Godwin said. “You ratchet it up a notch, and you never go back.”