Subject: Re: Email Privacy eating software

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 14 Jul 2000 09:23:29 -0400

In message <[email-masked]>, Doug Isenberg writes
:
>         From today's Wall Street Journal 
>(http://interactive.wsj.com/articles/SB963523417716552926.htm):
>
>One of the nation's largest Internet-service providers, Earthlink Inc., has 
>refused to install a new Federal Bureau of Investigation electronic 
>surveillance device on its network, saying technical adjustments required 
>to use the device caused disruptions for customers.
>
>The FBI has used Carnivore, as the surveillance device is called, in a 
>number of criminal investigations. But EarthLink is the first ISP to offer 
>a public account of an actual experience with Carnivore. The FBI has 
>claimed that Carnivore won't interfere with an ISP's operations....

One can draw some interesting conclusions from that article, though 
firm technical details from the FBI would be welcome.

First -- the box was placed at the remote access servers, and is -- 
according to the article -- capable of monitoring email and other 
network traffic.  Earthlink claims that the box was incompatible with 
the software version of the server they were running, and says that 
they had to downgrade to an older, buggy version, which crashed, 
causing a denial of service.  The FBI, in turn, says that their box is 
purely passive, so it can't affect the net.

My suspicion is that the box wants to monitor traffic based on IP 
address, and not just email headers.  To do that, it needs to know 
when the suspect has dialed in, and what his/her IP address is.  That, 
in turn, would likely require monitoring of the RADIUS traffic, which 
(if it were different from release to release) might have forced the 
downgrade.

		--Steve Bellovin

---

From: Steven Cotton <[email-masked]>
Date: Fri, 14 Jul 2000 16:13:35 +0200 (CEST)

On Fri, 14 Jul 2000, Steven M. Bellovin wrote:

> That, in turn, would likely require monitoring of the RADIUS traffic,
> which (if it were different from release to release) might have forced
> the downgrade.

RADIUS logfiles provide lots of interesting information. They'll know your
dial-up habits, phone number, length of time connected etc. The FBI should
just start their own ISP.

-- 
steven

---

From: Tim Salo <[email-masked]>
Date: Fri, 14 Jul 2000 10:04:35 -0500 (CDT)

> Date: Fri, 14 Jul 2000 16:13:35 +0200 (CEST)
> From: Steven Cotton <[email-masked]>
> Subject: Re: Email Privacy eating software 
> 

How do you know "they" (whoever "they" might be) haven't?

-tjs

---

From: Steven Cotton <[email-masked]>
Date: Fri, 14 Jul 2000 17:40:59 +0200 (CEST)

> How do you know "they" (whoever "they" might be) haven't?

Ooh, the paranoia :)

-- 
steven

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 14 Jul 2000 18:43:29 +0200

> How do you know "they" (whoever "they" might be) haven't?

Because they don't know how.  And we know that they don't know how because
they are still setting up stupid things like Carnivore.

---

From: [email-masked]
Date: Fri, 14 Jul 2000 13:23:38 -0400

> they are still setting up stupid things like Carnivore.

It has long been a well-known fact that to excel in slapstick comedy requires
incredible agility, strength, and flexibility....

-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech