Re: FBI announcement on email search 'Carnivore'

[Steven M. Bellovin]

In message <[EMAIL PROTECTED]>, Marc Horowitz writes:
>"Steven M. Bellovin" <[EMAIL PROTECTED]> writes:
>
>>> In this situation, everyone's email has to be scanned in order to 
>>> isolate the desired traffic.
>
>I've seen this claim before, and I don't think it's true.  It's like
>saying to wiretap my phone calls, you need to tap an entire fiber, and
>do voiceprint ID to find my calls.  It's much easier and more
>effective only to tap my line.
>
....
>
>In general, I can't see why the FBI needs tools like Carnivore to tap
>email.  The store-and-forward nature of email means there's a place
>you can go to find the email, and the structure of most email systems
>means there's a place which contains only the email for that user.

Right -- but this is a network device.  From the AP wire:

        Marcus Thomas, who heads the FBI's cybertechnology section,
        told the Wall Street Journal that the bureau has about 20
        Carnivore systems, which are PCs with proprietary software.
        He said Carnivore meets current wiretapping laws, but is
        designed to keep up with the Internet.

        ``This is just a specialized sniffer,'' Thomas told the
        Journal, which first reported details about Carnivore.

If the FBI says that it's a sniffer, rather than something that looks
at spool files, I'm not really in a position to argue...