CARNIVORE at work

Documents Show FBI Web Surveillance

By D. IAN HOPPER
.c The Associated Press

WASHINGTON (May 4) - The FBI has used Internet eavesdropping tools to track
fugitives, drug dealers, extortionists, computer hackers and suspected
foreign intelligence agents, documents show.

The documents, obtained by The Associated Press under the Freedom of
Information Act, also detail how the FBI scurried last year to prove it
wasn't ''randomly looking at everyone's e-mail'' once its Web surveillance
practices came under attack.

The FBI records show the agency used its controversial Carnivore system 13
times between October 1999 and August 2000 to monitor Internet
communications, and a similar device, Etherpeek, another 11 times.

Carnivore is a set of software programs for monitoring Internet traffic -
e-mails, Web pages, chat room conversations and other signals - going to or
from a suspect under investigation. Etherpeek is a commercially available
network monitoring program that is far less precise in filtering the
information collected.

Civil liberties groups contend that Carnivore can collect too much
information and put ordinary citizens at risk. Some Internet service
providers have raised concerns that since Carnivore's inner workings are
secret, it may damage or slow down their networks while it's capturing
e-mails.

While large portions of the FBI documents are blacked out to protect national
security and investigative secrets, they reveal new details about the
agency's Internet surveillance program.

In January 2000, for example, FBI agents got a wide-ranging order to use a
computer wiretap in a gambling and money laundering investigation. The
wiretap was successful, according to an e-mail to Marcus Thomas, head of the
FBI's cybertechnology lab.

''We got bank accounts, where money was hidden and other information,'' reads
the e-mail from an unknown agent. ''Some of the data sent ... was
instrumental in tying several of the conspirators to the crime. One of the
conspirators is offering to pay ... as part of a plea bargain.''

The following month FBI investigators used Carnivore to catch a fugitive for
the U.S. Marshals Service. The Internet provider involved protested in court,
but was ordered to cooperate.

The 24 instances of Internet surveillance also included four investigations
of computer hacking, three drug probes, one extortion investigation and an
intellectual property case. The nature of the other cases was not disclosed.
The FBI has said that Carnivore has been used in investigations involving
national security and attempted domestic terrorism.

One July 2000 e-mail about Carnivore, with the names of both the author and
recipient deleted, contains the only reference to national security matters:
''We have a pending FISA order there and as soon as we get authority to test
our (software) we will be installing it.''

FISA stands for the Foreign Intelligence Surveillance Act, which enables the
FBI to wiretap foreigners for espionage cases.

E-mails between FBI agents show how determined the bureau was to justify
Carnivore's existence after the disclosure of it last year raised protests
from lawmakers and privacy advocates.

In July, the Tampa, Fla., field office sent an e-mail to other agents,
including Thomas at the FBI lab, offering a slide show explaining how a
militia group used the Internet to communicate.

The group's leader pleaded guilty and was sentenced last year for planning to
break into military facilities to steal explosives and blow up energy
facilities in southeastern states.

''This might be used to show why Carnivore is necessary and essential for law
enforcement to combat terrorism,'' reads the e-mail from an unspecified Tampa
agent.

Thomas replied: ''This kind of information would be very helpful in fighting
the idea that we are randomly looking at everyone's e-mail.''

Also during July, FBI officials found an Internet service provider that was
willing to convince other Internet firms that Carnivore was safe. The
provider's identity was not disclosed.

The provider ''is available to you as an ISP to address/counter any issues
that other ISPs may have in installing Carnivore,'' the e-mail reads, adding
that the company ''is aware of issues that national providers need to address
for wiretapping.''

The FBI 2002 budget request includes more than $13 million for Internet
surveillance, $2.5 million more than this year. Most of the new money would
go for research and development.

In justifying the budget, the FBI cybertechnology lab said the number of
requests for Internet wiretaps from FBI field offices increased by 1,850
percent from 1997 to 1999. The exact number of requests was not disclosed.

AP-NY-05-04-01 1357EDT