Pubdate: Sat, 15 Sep 2000 Source: Chronicle of Higher Education, The (US) Copyright: 2000 by The Chronicle of Higher Education Contact: http://chronicle.com/ Author: ANDREA L. FOSTER UNIVERSITIES REJECT OPPORTUNITY TO SCREEN INTERNET-WIRETAPPING SYSTEM Several prominent universities have rejected the U.S. Justice Department's appeal to universities to test an electronic eavesdropping device known as Carnivore. Researchers from four universities have complained that the department has too much control over the review, and their public comments have prompted a fifth university to ignore the department's request. The Federal Bureau of Investigation uses Carnivore to intercept the electronic mail of criminal suspects, but critics have said that it could devour too much information, intruding on the privacy of innocent people. They also have said that, because only the F.B.I. knows how Carnivore works, there is no way to check that the agency is using it legally. Initially the Justice Department said it would select a reviewer from a pool of universities contacted by the department. But the department later opened the review to nonacademic institutions, and moved back the date for announcing the selected reviewer from September 15 to September 25, saying the vetting process was taking longer than expected. But interviews with officials at several major universities suggest that the Justice Department may have been caught off guard by the negative response to its request for a reviewer. Computer-security experts at the Massachusetts Institute of Technology, the University of Michigan, and the University of California at San Diego said they have concluded that the department is really interested in improving Carnivore's public image rather than receiving an unbiased analysis of the system. "They want to borrow a university's reputation," said Jeffrey I. Schiller, network manager at M.I.T. "Their definition of an independent review is a definition I hadn't been familiar with." Mr. Schiller said he objects that the Justice Department would have veto power over members of the review team and could severely limit the scope of the study. He also said that researchers would not be able to freely discuss their findings. Tom Perrine, manager of security technologies at the San Diego Supercomputer Center, a research unit of the University of California at San Diego, said none of the 13 security experts in a group called Open Carnivore were interested in reviewing the surveillance system. They include representatives from the University of California at Berkeley and AT&T. "We were pretty surprised," Mr. Perrine said of the proposal. "We thought it would be much more open and independent." He said the department wants the reviewer to analyze only the technical aspects of Carnivore and not the more-complex legal issues it raises. Noting that there is a long history of case law on telephone wiretapping, he asked: How does this apply to electronic surveillance? And does Carnivore present a greater threat than does telephone tapping to the Fourth Amendment prohibition on unreasonable searches and seizure? "No one in our group believes that there's widespread abuse," Mr. Perrine said of the F.B.I.'s use of Carnivore. "Most of us have had to deal with law enforcement. But with a secret process, there's a potential for abuse. We want to know what legal safeguards there are. But we can't even ask." Mr. Perrine said Purdue University also was not interested in reviewing Carnivore. In a message recorded on his telephone answering machine, Eugene H. Spafford, director of the Center for Education and Research in Information Assurance and Security at Purdue, said he would not comment on Carnivore. Peter Honeyman, director of the center for information technology at the University of Michigan, said he agreed with Mr. Perrine that the Justice Department was misguided in seeking only a technical review of Carnivore. But he said Congress and the administration, not academics, should address the legal issues. He has not applied to review Carnivore. "Scholarship and scientific integrity are not the characteristics that the Justice Department is looking for," Mr. Honeyman said. "They're looking for political support. I run a research lab." David A. Wagner, assistant professor of electrical engineering and computer science at the University of California at Berkeley, said the Justice Department's conditions for the review were too restrictive and not compatible with scientific review. The department retains authority to edit the report, imposes restrictions that would not allow the findings to be verified, and also requires a nondisclosure agreement, said Mr. Wagner. For example, the department's request for a proposal reads, "The contractor shall revise the draft report as necessary in light of technical comments received from the department or the public." Responding to the criticism, Chris Watney, a Justice Department spokeswoman, said, "We have repeatedly made clear that we want an independent team to produce a thorough report. We will provide full access and cooperation to do that." Computer experts at other universities, such as Harvard and Yale, say it was unlikely that any researchers at their institutions had applied to review Carnivore. "People I respect who have read the request for a proposal have expressed serious reservations about it," said Daniel A. Updegrove, director of information technology services at Yale. "That does not lead me to go door to door in our computer-science department encouraging researchers to submit a proposal." He said he had read the remarks of computer security experts at M.I.T. and Purdue, who, he said, are among the top in their field. Paul C. Martin, a physics professor and dean of information technology at Harvard, heard from colleagues that computer security experts were faulting the Justice Department's request for a proposal. Neither he nor three other technology officials at Harvard said they were aware of any Harvard researcher applying to test out Carnivore. Also turning aside the opportunity to review Carnivore is Dartmouth College. Lewis M. Duncan, dean of the college's Thayer School of Engineering, said Dartmouth would have liked to test out the surveillance system and felt qualified to do it. But it decided not to apply because the National Institute of Justice, an arm of the Justice Department, has provided $15-million in start-up money to the college's Institute for Security Technology Studies, and that would raise an issue of conflicting interests, he said. The deadline for applications to review Carnivore was September 6. The Justice Department's Ms. Watney declined to reveal how many applications the department had received or from which institutions. However, she revealed that Attorney General Janet Reno wanted to change the name of Carnivore to something less ominous sounding. Meanwhile, Richard K. Armey, majority leader of the House of Representatives and a Texas Republican, was considering attaching to an annual spending bill a measure that would prohibit the F.B.I. from continuing to use Carnivore. "We have people on the left and the right saying that this is a problem," said the congressman's spokesman, Richard P. Diamond. "You can't just gloss over it." - --- MAP posted-by: Keith Brilhart