Mr. Chairman and Members of the Subcommittee, thank you for allowing me this opportunity to testify about the law enforcement tool "Carnivore" and the Fourth Amendment.  On April 6, 2000, I had the privilege of testifying before you during a hearing on Internet privacy and the Fourth Amendment; I am pleased to continue to participate in the discussion today about "Carnivore" and its role in protecting individual privacy on the Internet from unwarranted governmental intrusion, and about the critical role the Department plays to ensure that the Internet is a safe and secure place.

Privacy and Public Safety

It is beyond dispute that the Fourth Amendment protects the rights of Americans while they work and play on the Internet just as it does in the physical world.  The goal is a long-honored and noble one: to preserve our privacy while protecting the safety of our citizens.  Our founding fathers recognized that in order for our democratic society to remain safe and our liberty intact, law enforcement must have the ability to investigate, apprehend and prosecute people for criminal conduct.  At the same time, however, our founding fathers held in disdain the government’s disregard and abuse of privacy in England.  The founders of this nation adopted the Fourth Amendment to address the tension that can at times arise between privacy and public safety.  Under the Fourth Amendment, the government must demonstrate probable cause before obtaining a warrant for a search, arrest, or other significant intrusion on privacy.

Congress and the courts have also recognized that lesser intrusions on privacy should be permitted under a less exacting threshold.  The Electronic Communications Privacy Act ("ECPA") establishes a three-tier system by which the government can obtain stored information from electronic communication service providers.  In general, the government needs a search warrant to obtain the content of unretrieved communications (like e-mail), a court order to obtain transactional records, and a subpoena to obtain information identifying the subscriber.  See 18 U.S.C. §§ 2701-11.

In addition, in order to obtain source and destination information in real time, the government must obtain a "trap and trace" or "pen register" court order authorizing the recording of such information.  See 18 U.S.C. 3121, et seq.

Because of the privacy values it protects, the wiretap statute, 18 U.S.C. §§ 2510-22, commonly known as Title III, places a higher burden on the real-time interception of oral, wire and electronic communications than the Fourth Amendment requires.  In the absence of a statutory exception, the government needs a court order to wiretap communications.  To obtain such an order, the government must show that normal investigative techniques for obtaining the information have or are likely to fail or are too dangerous, and that any interception will be conducted so as to ensure that the intrusion is minimized.

The safeguards for privacy represented by the Fourth Amendment and statutory restrictions on government access to information do not prevent effective law enforcement.  Instead, they provide boundaries for law enforcement, clarifying what is acceptable evidence gathering and what is not.  At the same time, those who care deeply about protecting individual privacy must also acknowledge that law enforcement has a critical role to play in preserving privacy.  When law enforcement investigates, successfully apprehends and prosecutes a criminal who has stolen a citizen’s personal information from a computer system, for example, law enforcement is undeniably working to protect privacy and deter further privacy violations.  The same is true when law enforcement apprehends a hacker who compromised the financial records of a bank customer.

As we move into the 21st century, we must ensure that the needs of privacy and public safety remain in balance and are appropriately reflected in the new and emerging technologies that are changing the face of communications.  Although the primary mission of the Department of Justice is law enforcement, Attorney General Reno and the entire Department understand and share the legitimate concerns of all Americans with regard to personal privacy.  The Department has been and will remain committed to protecting the privacy rights of individuals.  We look forward to working with Congress and other concerned individuals to address these important matters in the months ahead.

Law Enforcement Tools in Cyberspace:

Although the Fourth Amendment is over two centuries old, the Internet as we know it is still in its infancy.  The huge advances in the past ten years have changed forever the landscape of society, not just in America, but worldwide.  The Internet has resulted in new and exciting ways for people to communicate, transfer information, engage in commerce, and expand their educational opportunities.  These are but a few of the wonderful benefits of this rapidly changing technology.  As has been the case with every major technological advance in our history, however, we are seeing individuals and groups use this technology to commit criminal acts.  As Deputy Attorney General Eric Holder told the Crime Subcommittee of this Committee in February, our vulnerability to computer crime is astonishingly high and threatens not only our financial well-being and our privacy, but also this nation’s critical infrastructure.

Many of the crimes that we confront everyday in the physical world are beginning to appear in the online world.  Crimes like threats, extortion, fraud, identity theft, and child pornography are migrating to the Internet.  The Fourth Amendment and laws addressing privacy and public safety serve as a framework for law enforcement to respond to this new forum for criminal activity.  If law enforcement fails properly to respect individual privacy in its investigative techniques, the public’s confidence in government will be eroded, evidence will be suppressed, and criminals will elude successful prosecution.  If law enforcement is too timid in responding to cybercrime, however, we will, in effect, render cyberspace a safe haven for criminals and terrorists to communicate and carry out crime, without fear of authorized government surveillance.  If we fail to make the Internet safe, people’s confidence in using the Internet and e-commerce will decline, endangering the very benefits brought by the Information Age.  Proper balance is the key.

To satisfy our obligations to the public to enforce the laws and preserve the safety, we use the same sorts of investigative techniques and methods online as we do in the physical world, with the same careful attention to the strict constitutional, statutory,  internal and court-ordered boundaries.  Carnivore is simply an investigative tool that is used online only under narrowly defined circumstances, and only when authorized by law, to meet our responsibilities to the public.

To illustrate, law enforcement often needs to find out from whom a drug dealer, for instance, is buying his illegal products, or to whom the drug dealer is selling.  To investigate this, it is helpful to determine who is communicating with the drug dealer.  In the "olden days" of perhaps 10 years ago, the drug dealer would have communicated with his supplier and customers exclusively through use of telephones and pagers.  Law enforcement would obtain an order from a court authorizing the installation of a "trap and trace" and a "pen register" device on the drug dealer’s phone or pager, and either the telephone company or law enforcement would have installed these devices to comply with the court’s order.  Thereafter, the source and destination of his phone calls would have been recorded.  This is information that courts have held is not protected by any reasonable expectation of privacy.  Given the personal nature of this information, however, the law requires government to obtain an order under these circumstances.  In this way, privacy is protected and law enforcement is able to investigate to protect the public.

Now, that same drug dealer may be just as likely to send an e-mail as call his confederates.  When law enforcement uses a "trap and trace" or "pen register" in the online context, however, we have found that, at times, the Internet service provider has been unable or even unwilling to supply this information.  Law enforcement cannot abdicate its responsibility to protect public safety simply because technology has changed.  Rather, the public rightfully expects that law enforcement will continue to be effective as criminal activity migrates to the Internet.  We cannot do this without tools like Carnivore.

When a criminal uses e-mail to send a kidnaping demand, to buy and sell illegal drugs or to distribute child pornography, law enforcement needs to know to whom he is sending messages and from whom he receives them.  To get this information, we obtain a court order, which we serve on the appropriate service provider.  Because of the nature of Internet communications, the addressing information (which does not include the content of the message) is often mixed in with a lot of other non-content data that we have no desire to gather.  If the service provider can comply with the order and provide us with only the addressing information required by court order, it will do so and we will not employ Carnivore.  If, however, the service provider is unwilling or unable to comply with the order, we simply cannot give a criminal a free pass.  It is for that narrow set of circumstances that the FBI designed "Carnivore."

Carnivore is, in essence, a special filtering tool that can gather the information authorized by court order, and only that information.  It permits law enforcement, for example, to gather only the email addresses of those persons with whom the drug dealer is communicating, without allowing any human being, either from law enforcement or the service provider, to view private information outside of the scope of the court’s order.  In other words, Carnivore is a minimization tool that permits law enforcement strictly to comply with court orders, strongly to protect privacy, and effectively to enforce the law to protect the public interest.  In addition, Carnivore creates an audit trail that demonstrates exactly what it is capturing.

As with any other investigative tools, there are many mechanisms we have in place to prevent against possible misuse of Carnivore, and to remedy misuse that has occurred.  The Fourth Amendment, of course, restricts what law enforcement can do with Carnivore, as do the statutory requirements of Title III and the Electronic Communications Privacy Act, and the courts.

For federal Title III applications, the Department of Justice imposes its own guidelines on top of the privacy protections provided by the Constitution, statutes and the courts.  For example, before Carnivore may be used to intercept wire or electronic communications, the requesting investigative agency must obtain approval for the Title III application from the Department of Justice.  Specifically, the Office of Enforcement Operations (OEO) in the Criminal Division of the Department reviews each proposed Title III application to ensure that the interception satisfies the Fourth Amendment requirements, and is in compliance with applicable statutes and regulations.  Even if the proposal clears the OEO, approval must be given by a Deputy Assistant Attorney General.  Although this requirement of high-level review is required by Title III only with regard to proposed intercepts of wire and oral communications, the Department voluntarily imposes the same level of review for proposed interceptions of electronic communications (except digital-display pagers).  Typically, investigative agencies such as the Federal Bureau of Investigation have similar internal requirements, separate and apart from Constitutional, statutory or Department of Justice requirements.

If the investigative agency and the Department of Justice approve a federal Title III request, it still must, of course, be approved by the proper court.  The court will evaluate the application under the Fourth Amendment and using the familiar standards of Title III.  By statute, for example, the application to the court must show, through sworn affidavit, why the intercept is necessary as opposed to other less-intrusive investigative techniques.  The application must also provide additional detail, including whether there have been previous interceptions of communications of the target, the identity of the target (if known), the nature and location of the communications facilities, and a description of the type of communications sought and the offenses to which the communications relate.  By statute and internal Department regulation, the interception may last no longer than 30 days without an extension by the court.

Courts also often impose their own requirements.  For example, many federal courts require that the investigators provide periodic reports setting forth information such as the number of communications intercepted, steps taken to minimize irrelevant traffic, and whether the interceptions have been fruitful.  The court may, of course terminate the interception at any time.

The remedies for violating Title III or ECPA by improperly intercepting electronic communications can include criminal sanctions, civil suit, and for law enforcement agents, adverse employment action.  For violations of the Fourth Amendment, of course, the remedy of suppression is also available.

Carnivore itself also contains self-regulating features.  For example, because of its sophisticated passive filtering features, it automates the process of minimization without intrusive monitoring by investigators, and simply disregards packets of information that do not satisfy the criteria in the court’s authorization.  Indeed, one of the most powerful privacy-protecting features of Carnivore is its ability to ignore information that is outside the scope of the court-ordered authority.  For later verification, it also logs the filter settings.  In addition, as a practical matter, Carnivore is not deployed except with close cooperation with the appropriate system provider.  In any event, the FBI does not use Carnivore in every instance in which the court orders a Title III electronic communication intercept.  Indeed, I understand that the Bureau uses Carnivore only in those instances when the service provider is unable to comply with the court order using its own equipment, or when the provider asks the FBI to use Bureau equipment.

As I testified in April, we face three major categories of challenges in trying to keep the Internet a safe and secure place for our citizens.  These are:

1. Technical challenges that hamper law enforcement’s ability to locate and prosecute criminals that operate online;

2. Certain substantive and procedural laws that have not kept pace with the changing technology, creating significant legal challenges to effective investigation and prosecution of crime in cyberspace; and

3. Resource needs that must be addressed to ensure that law enforcement can keep pace with changing technology and has the ability to hire and train people to fight cybercrime.

In nearly every online case, tracking the online criminal requires law enforcement to attempt to trace the "electronic trail" from the victim back to the perpetrator.  In effect, this "electronic trail" is the fingerprint of the twenty-first century – only much harder to find and not as permanent as its more traditional predecessor.  In the physical world, a criminal and his victim are generally in the same location.  But cybercriminals do not have to physically visit the crime scene.  Instead they cloak their illegal activity by weaving communications through a series of anonymous remailers, by creating forged e-mail headers with powerful point and click tools readily downloadable from hacker websites, by using a "free-trial" account or two, or by "wiping clean" the logging records that would be evidence of their activity.

In some cases, the criminal may not even be in the same country as the victim. The global nature of the Internet, while one of the greatest assets of the Internet to law-abiding citizens, allows criminals to conduct their illegal activity from across the globe.  In these cases, the need to respond quickly and track the criminal is increasingly complicated and often frustrated by the fact that the activity takes place throughout different countries.  With more than 190 countries connected to the Internet, it is easy to understand the coordination challenges that face law enforcement.  Furthermore, in these cases, time is of the essence and the victim may not even realize they have been victimized until the criminal has long since signed-off.  Clearly, the technical challenges for law enforcement are real and profound.

This fact was made clear in the findings and conclusions reached in the recently released report of the President’s Working Group on Unlawful Conduct on the Internet, entitled, "The Electronic Frontier: The Challenge of Unlawful Conduct Involving the Use of the Internet."  This extensive report highlights in detail the significant challenges facing law enforcement in cyberspace.  As the report states, the needs and challenges confronting law enforcement, "are neither trivial nor theoretical."   The Report outlines a three-pronged approach for responding to unlawful activity on the Internet:

1. Conduct on the Internet should be treated in the same manner as similar conduct offline, in a technology neutral manner.

2. We must recognize that the needs and challenges of law enforcement posed by the Internet are substantial,  including our need for resources, up-to date investigative tools and enhanced multi-jurisdictional cooperation.

3. Finally, we need to foster continued support for private sector leadership in developing tools and methods to help Internet users to prevent and minimize the risks of unlawful conduct online.

Despite the type of difficulties outlined in the Unlawful Conduct Report and discussed today, the Justice Department and law enforcement across this nation are committed to continuing to work together and with their counterparts in other countries to develop and implement investigative strategies to successfully track, apprehend, and prosecute individuals who conduct criminal activity on the Internet.  In so doing, the same privacy standards that apply in the physical world remain effective online.

Mr. Chairman, the Department of Justice has taken a proactive leadership role in making cyberspace safer for all Americans. The cornerstone of our cybercrime prosecutor program is the Criminal Division’s Computer Crime and Intellectual Property Section, known as CCIPS.  CCIPS was founded in 1991 as the Computer Crime Unit, and became a Section in 1996.  CCIPS has grown from five attorneys in 1996 to nineteen today, and we need more to keep pace with the demand for their expertise.  The attorneys in CCIPS work closely on computer crime cases with Assistant United States Attorneys known as "Computer and Telecommunications Coordinators," or CTC’s, in U.S. Attorney’s Offices around the nation.  Each CTC receives special training and equipment and serves as the district’s expert on computer crime cases.  CCIPS and the CTC’s work together in prosecuting cases, spearheading training for local, state and federal law enforcement, working with international counterparts to address difficult international challenges, and providing legal and technical instruction to assist in the protection of this nation’s critical infrastructures.  We are very proud of the work these people do and we will continue to work diligently to help stop criminals from victimizing people online.

I also note that public education is an important component of the Attorney General’s strategy on combating computer crime.  As she often notes, the same children who recognize that it is wrong to steal a neighbor’s mail or shoplift do not seem to understand that it is equally wrong to steal a neighbor’s e-mail or copy a proprietary software or music file without paying for it.  To remedy this problem, the Department of Justice, together with the Information Technology Association of America (ITAA), has embarked upon a national campaign to educate and raise awareness of computer responsibility and to provide resources to empower concerned citizens.    The "Cybercitizen Awareness Program" seeks to engage children, young adults, and others on the basics of critical information protection and security and on the limits of acceptable online behavior.  The objectives of the program are to give children an understanding of cyberspace benefits and responsibilities, an awareness of consequences resulting from the misuse of the medium and an understanding of the personal dangers that exist on the Internet and techniques to avoid being harmed.

Finally, Mr. Chairman, the Subcommittee may be aware that the Administration will soon be transmitting to Congress a legislative proposal addressing various issues relating to cyber-security.  I  know that the focus of today's hearing is the Carnivore program, and this is not the time to undertake any detailed discussion of the Administration's proposal.  I would, however, like to mention two points that relate directly to today's discussion.  First, the Administration supports raising the statutory standards for intercepting the content of electronic communications so they are the same as those for intercepting telephone calls:  high-level approval, use only in cases involving certain predicate offenses that are specified by statute, and statutory suppression of evidence derived from improper intercepts.  Second, the Administration supports requiring federal judges to confirm that the appropriate statutory predicates have been satisfied before issuing a pen register or trap-and-trace order.  Those changes would apply to the use of Carnivore – and would, in important respects, simply confirm by statute the policies and procedures already followed by the Department of Justice.  Beyond those specific points, I will simply note here that the Administration supports a balanced updating of laws to enhance protection of both privacy and public safety, and that the forthcoming proposal will contain important provisions whose enactment would be most helpful in the ongoing fight against cyber-crime.

Conclusion:

Mr. Chairman, I want to thank you again for this opportunity to testify today about our efforts to fight crime on the Internet while preserving the rights conferred by the Fourth Amendment and statute.  Ultimately, the decision as to the appropriate parameters of law enforcement activity lies squarely within the Constitution and the elected representatives of the people, the Congress.  The need to protect the privacy of the American people,  not just from the government but also from criminals,  is a paramount consideration, not just in the context of the Internet, but in general.  The Department of Justice stands ready to work with this Subcommittee and others to achieve the proper balance between the important need for protecting privacy and the need to respond to the growing threat of crime in cyberspace.

Mr. Chairman, that concludes my prepared statement.  I would be pleased to attempt to answer any questions that you may have at this time.