Yes, You Are Being Watched

Doing a Little Digital Eavesdropping

There is a wide range of technologies for eavesdropping on what people send over data networks and even what they do on their own computers. They break down roughly into consumer tools, ones made for companies with IT specialists, government capabilities, and the murky area of methods used by hackers and other rogue agents, according to Erik Laykin, president of consulting company Online Security, in Los Angeles.

Surveillance software is available off the shelf and on the Internet for consumers, such as parents keeping an eye on children's computer activity. Vero Beach, Florida-based SpectorSoft's EBlaster can copy all Web sites visited, keystrokes typed, and e-mail messages sent and received from the computer on which it is running. That information can then be forwarded to someone else's e-mail address, such as that of a parent at work. Programs like this could also be installed surreptitiously, for example on a PC at a competing company, through a virus or other means, according to Gartner's Hunter.

In addition to software for keystroke recording, there is at least one stealthy hardware device that does the same thing. KeyGhost, in Christchurch, New Zealand, sells a small cylindrical device that can be plugged into a keyboard cable and looks like an electrical adapter. It can capture about eight months' worth of keystrokes in flash memory.

Invisible Surveillance

Corporations can do something similar on a larger scale using Raytheon's Silent Runner, a "watered-down" version of a tool originally developed by the U.S. National Security Agency, Online Security's Laykin said. His company is a reseller of the software.

"Once the tool has been placed on a network, the tool is actually invisible to everyone on the network, including the network administrators, and it will capture and view all the data and traffic flowing on that network," Laykin said. Using keywords and rules, Silent Runner can detect improper activity, such as sending e-mail messages with information about a secret new product.

Because it could be dangerous in the wrong hands, Silent Runner is tightly controlled. If Silent Runner is watching you, you probably know it, he said.

"Generally speaking, employers have an obligation to tell employees there's a surveillance program," Laykin said.

Government Tools

However, regulations on private surveillance vary around the world. Meanwhile, little is known about some systems used by governments.

One of the most controversial tools is the U.S. Federal Bureau of Investigation's Carnivore system. Carnivore is a "packet sniffer" that the FBI installs at ISPs to capture traffic associated with a customer under suspicion, according to Smith. Despite fears of agents reading every Internet user's e-mail, the system officially can be used on specific suspects only, Smith said. But some privacy advocates worry that there is too little oversight of agents carrying out a Carnivore probe.

More wide-reaching is Echelon, a system many experts believe has been deployed by governments in the U.S. and Europe to monitor international voice and data traffic over both land lines and satellites. Echelon is used like a net, capturing a large portion of the world's communications so authorities can later sift through it and find what they are looking for, Gartner's Hunter said.

Chinese sources say police in that country have been known to monitor e-mail as well as message board activity at major Chinese portals. If the police find messages with political or other content the government finds objectionable, they may work with the portal operator to try to find those who created the messages.

Dangerous Deliveries

Perhaps the most frightening prospect for surveillance comes from outside the realm of legal tools. A custom "Trojan horse" designed to go into a specific targeted system couldn't even be detected, Laykin said.

"The virus scanners, like McAfee and Norton, will not have a signature for a custom-written virus," he said.

Some advances in technology also have made computer users more vulnerable to unscrupulous electronic surveillance. DSL Internet connections are always on, unlike dial-up accounts, so there may be more opportunity for intrusion. Wireless LANs also open up the possibility of snooping. The encryption system built into the popular IEEE 802.11b wireless LAN standard can be cracked just by examining a brief sample of packets, according to Peter Shipley, a security consultant in Berkeley, California. Shipley said he has intercepted wireless LAN traffic from 20 miles away, with an inexpensive antenna at the top of a hill.

Putting It All Together

As much as you may worry about being watched or having information gathered from you, what may be most scary is what can happen when all that information is pulled together.

Already, data mining systems can analyze 15 terabytes of data in one day, roughly as much information as is gathered by the U.S. national discount chain Wal-Mart Stores in one day, according to Gartner's Hunter. The power of this kind of software is growing, and systems that can analyze 125 terabytes per day are now under development and are likely to be deployed within five years, he said.

Storage and database technology now allows the companies with which you do business to keep more information about you. Civil rights protections may be able to keep government away from that data, but companies face an inherent risk if they keep it, said Lee Tien, senior staff attorney at the Electronic Frontier Foundation, in San Francisco.

"You can't disclose what you don't have, but if you have it, you may be compelled to give it up," Tien said. "Data retention seems to be getting a foothold around the world. We're already seeing undeliberate retention being used for surveillance purposes."

Within Reach

Meanwhile, the Internet does for data transmission and sharing what microprocessors do for data gathering: put it within reach of anyone. It can take a snooper's photo, such as digital pictures that have been taken of women entering family-planning clinics in the U.S., and put that in the hands of any Web surfer, Hunter pointed out.

"We're talking about a world where most human activity is recorded ... and most of what is recorded will be available to anyone who wants it badly enough," Hunter said.

Only in Their Dreams

Some surveillance nightmares will probably just be bad dreams for a long time, according to vendors and analysts in the industry. Among their expectations for the near future:

• Heat-sensitive infrared cameras can't watch you through the walls of your house. They can see you walking down the street day or night, but in your house they can detect the indoor temperature only.
  
  
• Don't lose any sleep over robotic spiders like the ones in the movie Minority Report that detect body heat and breath. Robotics technology is probably a long way from creating tiny creatures that can find their own way around, said Richard Hunter, an analyst at Gartner, in Stamford, Connecticut.
  
  
• Just about anyone can buy a picture taken from space, but they probably couldn't use it to identify you. In pictures from the Ikonos satellite operated by Space Imaging, in Thornton, Colorado, nothing even shows up unless it's about a meter across, according to the company, which typically sells images for uses such as urban and environmental planning. However, military satellites do have a higher resolution.
  
  
• It's unlikely that a clothing store will ever call out an unwelcome greeting to you whenever you walk by. The Tom Cruise character in Minority Report had his face scanned and recognized just when he wanted to be anonymous, running from the police. In reality, turned heads, changing light conditions, and other factors mean that kind of system would have to be reserved for just a handful of avid customers who look right at the camera every time they visit, according to face-recognition experts.