Alan Goldstein: Eaten up about Carnivore? Use encryption

By Alan Goldstein / The Dallas Morning News With a name like Carnivore, the FBI program that quickly gobbles up and digests huge quantities of electronic-mail messages was bound to attract controversy. Much

Wednesday, August 16th 2000, 12:00 am

By: News On 6

By Alan Goldstein / The Dallas Morning News

With a name like Carnivore, the FBI program that quickly gobbles up and digests huge quantities of electronic-mail messages was bound to attract controversy.

Much of the discussion would be unnecessary if those of us who rely on e-mail for private communications bothered to pay attention to security.

Encryption software exists on the market that can effectively perform the function of putting your e-mail under lock and key, so it can only be opened by the intended recipient. So far, few people have bothered to use encryption.

So what's the big deal about Carnivore?

It's a system for monitoring e-mail traffic through an Internet service provider. Using the program, an FBI agent who connects a computer to the ISP's server can read at least the address of every one of millions of e-mail messages that pass through.

In a way, Carnivore is nothing new. The federal government can already monitor voice calls over the telephone network, as well as suspicious financial activities through the banking system.

Law-enforcement types argue the whole issue will blow over soon enough. They say Carnivore is meant to scare the likes of terrorists, child pornographers and Mafia kingpins, but that the rest of us have nothing to worry about.

"It's not as if it'll pop up all over the place," said Matt Yarbrough, a former federal prosecutor who led the cybercrimes task force in Dallas. He said the government makes it onerous for prosecutors to get surveillance authority, in order to protect privacy.

"A lot of people are using e-mail for bad crimes, from child pornography to drug dealing," said Mr. Yarbrough, now special Internet counsel with Vinson & Elkins. "Drug dealers realize e-mail is a great way to send messages, just as everyone else has."

The FBI says it has used Carnivore only 25 times in the last two years.

Civil libertarians say Carnivore is more like using a giant net to catch a single fish; unrelated parties will get caught. And, they argue, the system is about as constitutional as using a search warrant for a house to bang on the doors throughout a neighborhood.

"I was very surprised to find our government trying to do the same sort of thing they do in China," said Dr. Leon Kappelman, director of the Information Systems Research Center at the University of North Texas in Denton.

"They seem to be saying, 'Trust us. We're Big Brother.' That's obviously not how we operate in this country."

Justice Department officials said last week that they plan to ask a university to study Carnivore to relieve the fears of privacy groups and lawmakers. The university, which hadn't been selected yet, will issue a public report on its findings.

Whichever side you come down on, Carnivore is no match for encryption software, according to the experts.

Though few people use encryption now, demand could mushroom as privacy becomes a bigger concern.

David P. Cook, chairman and chief executive of ZixIt Corp., a Dallas maker of encryption software, says the open nature of the Internet and the growing dependence of businesses on e-mail make the adoption of products such as his ZixMail inevitable.

"We think everyone will figure out that an open network requires you to use secure transmissions," Mr. Cook said. "Why don't people use postcards? You put it in an envelope in the real world, a ZixMail package in the digital world."

ZixIt users don't need to be concerned about Carnivore or any other computer monitoring system, Mr. Cook said. "We look at problems on the Internet as opportunities for solutions," he said.

Barring a major change in computer technology, Mr. Cook said, encryption technology will remain virtually impenetrable. It is based on public keys that are essentially very long numbers with several hundred digits.

ZixMail can be sent to recipients who have the decryption software. In a clever variation, it is also available to anyone else who visits ZixIt's messaging Web portal, SecureDelivery.com.

Although prices haven't been finalized, individual users can select a free option that's supported by advertising.

Why haven't the products taken off faster? "Everything that's new takes a while," Mr. Cook said. He's also hoping for partnerships with other Web portals that would make ZixIt secure delivery a standard option for sending e-mail.

The products have global potential. Though the company is focusing first on the U.S. market, ZixIt has permission to export its technology to most countries of the world. Exceptions include Cuba, Iran, Iraq, North Korea and a few others.

Of course, criminals can use ZixMail technology, too. Mr. Cook said.

"We have legitimate but competing interests between privacy rights and law enforcement initiatives," he said. "Hopefully, the bad guys won't know enough about the Internet to use software like ZixMail, and the good guys will."

Technology editor Alan Goldstein writes about the Internet and electronic commerce for The Dallas Morning News. His e-mail address is agoldstein@dallasnews.com.