|
|
|
|
You may have heard about Carnivore, a controversial program developed by the U.S. Federal Bureau of Investigation (FBI) to give the agency access to the online/e-mail activities of suspected criminals. For many, it is eerily reminiscent of George Orwell's book "1984." Although Carnivore was abandoned by the FBI in favor of commercially available eavesdropping software by January 2005, the program that once promised to renew the FBI's specific influence in the world of computer-communications monitoring is nonetheless intriguing in its structure and application. While information about the first version has never been disclosed, many believe that it was actually a readily available commercial program called Etherpeek. In 1997, the FBI deployed the second generation program, Omnivore. According to information released by the FBI, Omnivore was designed to look through e-mail traffic travelling over a specific Internet service provider (ISP) and capture the e-mail from a targeted source, saving it to a tape-backup drive or printing it in real-time.
Omnivore was retired in late 1999 in favor of a more comprehensive system, the DragonWare Suite, which allowed the FBI to reconstruct e-mail messages, downloaded files or even Web pages. But we do know that Carnivore was basically a packet sniffer, a technology that is quite common and has been around for a while. Essentially, a packet sniffer is a program that can see all of the information passing over the network it is connected to. As data streams back and forth on the network, the program looks at, or "sniffs," each packet. Normally, a computer only looks at packets addressed to it and ignores the rest of the traffic on the network. When a packet sniffer is set up on a computer, the sniffer's network interface is set to promiscuous mode. This means that it is looking at everything that comes through. The amount of traffic largely depends on the location of the computer in the network.
A client system out on an isolated branch of the network sees only a small segment of the network traffic, while the main domain server sees almost all of it. The program stores the copies in memory or on a hard drive, depending on the program's configuration. These copies can then be analyzed carefully for specific information or patterns. When you connect to the Internet, you are joining a network maintained by your ISP. The ISP's network communicates with other networks maintained by other ISPs to form the foundation of the Internet. In fact, many ISPs use packet sniffers as diagnostic tools. Also, a lot of ISPs maintain copies of data, such as e-mail, as part of their back-up systems. Carnivore and its sister programs were a controversial step forward for the FBI, but they were not new technology. A court grants the request for a full content-wiretap of e-mail traffic only and issues an order.
The other type of wiretap is a trap-and-trace, which means that the FBI can only capture the destination information, such as the e-mail account of a message being sent out or the Web-site address that the suspect is visiting. A reverse form of trap-and-trace, called pen-register, tracks where e-mail to the suspect is coming from or where visits to a suspect's Web site originate. The FBI contacts the suspect's ISP and requests a copy of the back-up files of the suspect's activity. The FBI sets up a Carnivore computer at the ISP to monitor the suspect's activity. The FBI configures the Carnivore software with the IP address of the suspect so that Carnivore will only capture packets from this particular location. It ignores all other packets. Carnivore copies all of the packets from the suspect's system without impeding the flow of the network traffic. Once the copies are made, they go through a filter that only keeps the e-mail packets.
|
|
