The "independent" review of Carnivore

In August 2000, the Justice Department responded to widespread criticism of the FBI's Carnivore system by announcing that a major university would be asked to undertake an independent technical review of Carnivore. Critics promptly attacked the scope and credibility of the proposed review process, and contended that the government was merely seeking an academic institution to lend its reputation to the controversial surveillance system.

The Justice Department said that at least nine universities would be contacted as prospective candidates for the review. Early reports said that officials had solicited researchers at MIT, Purdue University, and the UC-San Diego's Supercomputer Center. The DOJ also reportedly approached Dartmouth College and the University of Michigan. (Other likely candidates presumably included universities among the seven institutions named in 1999 by the National Security Agency as Centers of Academic Excellence in Information Assurance Education: James Madison University, George Mason University, Idaho State, Iowa State, Purdue, UC-Davis, and the University of Idaho.)

Nearly all of the most qualified institutions reportedly declined to participate, including MIT, Purdue, Dartmouth, Michigan, and UC-San Diego. Among the objections that were raised: the scope of the review would be limited to issues approved by the government, and would exclude legal issues entirely; all researchers would be required to pass security checks, and the government would have veto power over any changes in the panel; the researchers would not be permitted to release the data that they relied upon; and the Justice Department would have the right to edit the final report. However, an ad hoc group of 13 distinguished security experts calling themselves the "Open Carnivore Group" did offer to undertake the review free of charge; the Justice Department apparently did not take their proposal seriously.

On September 26, 2000, the Justice Department announced that the review would be conducted by a team of researchers from the IIT Research Institute, an organization affiliated with the Illinois Institute of Technology, together with senior faculty members from IIT's Chicago-Kent College of Law.

According to one news report, all of the IIT researchers have either worked on large-scale government projects or currently hold active security clearances, including top secret ratings from the National Security Agency and the Department of Defense. (When the Justice Department posted a copy of IIT's proposal online, it attempted to obscure such information as the researchers' names, telephone numbers, and security clearances -- but in a way that still enabled anyone with minimal technical skills to view the obscured information. The DOJ later removed the document from its web site, but the unaltered version has been mirrored elsewhere on the web.)

The Justice Department acknowledged that some institutions had declined to participate, but said that 11 public and private organizations had submitted bids to undertake the review. The University of California at Davis reportedly was the only other academic organization to submit a proposal; the other nine bids were submitted by private technology firms.

An IIT Research Institute official said that he was unaware of other academic institutions' objections to the review process. One of the Chicago-Kent reviewers said he did not believe that the Justice Department would be able to alter or edit the report (though the DOJ's solicitation [PDF] does provide that DOJ "will determine which parts of the report or associated information must remain confidential").

A Justice Department official said that the IIT team "had the highest technical score and the lowest price," and cited the cost estimate of $175,000 submitted by the IIT researchers.

House Majority Leader Richard K. Armey criticized the IIT review as a "sham," saying that Carnivore "deserves a truly independent review, not a whitewash."

A draft of the report was released in November 2000, and was followed by the final report in December. (Both of versions have been redacted by the Justice Department.) Not surprisingly, the report expressed relatively few concerns about Carnivore.