Snoopware: New Technologies, Laws Threaten Privacy

They say the first casualty of war is truth. In the digital age, however, the initial victim may be the right to privacy for many Americans--criminals and innocent suspects alike.

Last November, the FBI acknowledged the existence of Magic Lantern, a Trojan horse program it is developing that will render encryption useless on a suspect's computer by logging the user's keystrokes. Coupled with laws that Congress passed following September 11th, Magic Lantern will give the agency unprecedented access to digital communications.

But is the government using the fight against terrorism as an excuse to gain long-sought surveillance powers, or is it merely trying to keep pace with tech-savvy criminals?

Genie in a Bottle

Magic Lantern reportedly will allow an agent to plant a keystroke logger in a specific computer by using a virus-like program. Once activated, the logger will capture words and numbers as a subject types them (before encryption kicks in), and will transmit them back to the agent.

Privacy advocates say the as-yet-undeployed program is the government's attempt to obviate a bid (so far unsuccessful) to collect master keys from encryption software vendors, which would have let officers unscramble a suspect's data.

"The government wants to be able to get into people's computers--that's the surveillance agenda," says Jim Dempsey, deputy director of the Center for Democracy and Technology. "Any capability that lets them [the government] do that, they will seek." The FBI says it needs such tools to combat criminals. "In many ways law enforcement is playing catch-up," says FBI spokesperson Paul Bresson.

"It's no secret that criminals and terrorists are exploiting technology to further crime. The FBI is not asking for any more than to continue to have the ability to conduct lawful intercepts of criminals and terrorists," Bresson argues.

Dempsey says the program goes too far, however. More than just getting into your data, he says, it lets the FBI get "into your brain." "The program would not only capture messages you sent, it would capture messages that you wrote but never sent--things that perhaps you thought were a bad idea and [deleted]. This is the government using the Internet to get into people's houses and into their minds."

Knock, Knock

At issue is the fundamental right the Fourth Amendment grants citizens to prior notice when the government conducts a search and seizure.

"In order for the government to seize your diary or read your letters, they have to knock on your door with a search warrant," Dempsey explains. "But [this tool] would allow them to seize these without notice."

Most privacy advocates say it's not the technology that worries them, but the lack of judicial oversight in its use. Jennifer Granick, director of Stanford Law School's Center for Internet and Society, says she doesn't object to the FBI's using such tools, but she says she worries about misuse.

"Advances in technology may require new law enforcement techniques," Granick notes. "These tools, if properly used within the system of checks and balances, may work, and then we can embrace them." But, Granick says, the same privacy protections that apply everywhere else should also apply in the digital world.

The Patriot Act, passed by Congress in October 2001, weakens those protections in two major ways, says the Center for Democracy's Dempsey.

The Act lets law enforcement agencies conduct surveillance under looser rules previously applicable only to foreign intelligence cases, he says. It also broadens law enforcement's ability to intercept Internet transactional data such as e-mail addresses.

And while the act aims to assist in "terrorist" investigations, its surveillance provisions are not limited to that area, according to Dempsey. Critics say they're also concerned that talk likening hackers to terrorists could lead to investigations of innocent PC owners when hackers surreptitiously commandeer their PCs to launch Internet attacks against government sites.

Appeasing Critics

To allay such concerns, Barry Steinhardt, associate director of the American Civil Liberties Union, wants the FBI to open Magic Lantern--and any other similar program it creates--to congressional and independent review prior to its deployment. "We still don't know whether Carnivore has been used in the way it's suppose to be used," he says.

Carnivore, a controversial tool the FBI uses to collect e-mail passing through the servers of Internet service providers, is supposed to pick up only e-mail messages relevant to an investigation (see January's Consumer Watch for more information). But critics say that there is little oversight to ensure that the FBI uses the tool appropriately.

And Dempsey says that a keystroke logger--with its unlimited access possibilities--offers even more opportunity for abuse by over-eager law enforcement officials.

Still, the primary concern of most critics is the legislative carte blanche that the Patriot Act seems to give the FBI for conducting its investigations.

Though there has been talk on the Senate Judiciary Committee about "fixing" the Patriot Act, the ACLU's Steinhardt says we'll probably have to wait some 18 months to see how the Act plays out in court cases before there will be any movement to change it.

In the meantime, he says, "People should contact members of Congress to get them to take their oversight responsibilities seriously."