DOJ Picks School to Review 'Carnivore'

The Justice Department has chosen a Chicago-based research group to evaluate the FBI's Carnivore e-mail surveillance system.

But some prominent computer experts refused to apply for the job, and one said anyone who did so was "prostituting" themselves because the Justice Department would have too much control over the final report.

Along with senior faculty members from the Chicago-Kent College of Law, the IIT Research Institute will review the controversial system, the Justice Department said. (IITRI is affiliated with the Illinois Institute of Technology.)

"We are extremely excited about it," said Kerry Rowe, IITRI's senior vice president for advanced technology, who will oversee the review. "I understand the need for this type of product and I also understand the concern from the public in general, and I look forward to completing the evaluation and moving forwards."

The six-member team — which includes a project manager, technical evaluators, information technologists and administrative support — will begin its review Wednesday at the IITRI lab in Lantham, Md., outside Washington. It is due to be completed in December, when a report will be made available for public comment; an interim draft report will be made available in November.

The Justice Department said the team will review Carnivore's design, function and method of use to make sure it works the way the FBI has said it does: by sorting through all e-mail entering or leaving an Internet Service Provider, like AOL, but only collecting the targeted suspect's e-mail. The IITRI contract will cost an estimated $175,000, the Justice Department said.

Privacy rights advocates have spoken out against what they see as Carnivore's potential for misuse and have sued for the release of the program's source code.

Attorney General Janet Reno's approval of the selection Monday came after a wide search for a university to conduct an independent review. The Justice Department said in a written statement that it received 11 proposals from various organizations, including the University of California, Davis, and the National Software Testing Laboratory.

But many of the nation's top computer scholars refused to review the Carnivore software, claiming the independent, objective review the government claimed to be seeking would be neither independent nor objective.

"If you have a reputation like MIT, you're concerned about sullying it by prostituting yourself by doing such work," said Jeffrey Schiller, a security expert and network manager at the Massachusetts Institute of Technology. He said the fine print in the DOJ's request for proposals placed numerous unacceptable restraints on the process, including giving the department the right to read and edit the report before it is finished.

MIT and the University of San Diego both declined to submit proposals. Schiller said Purdue University had also declined, but officials from Purdue would not comment. Another school, Dartmouth University, declined because it is already doing work for the Justice Department and felt it would be a conflict of interest.

But IITRI's Rowe said he believed the DOJ when it said it wanted an independent and open review of the tool.

"I don't anticipate major edits," he said. "We're gonna be working very closely together [with Justice] throughout the evaluation and I think it's going to be a fair [report]."

Justice Department spokeswoman Chris Watney denied that the chosen review board's final report would be altered before release. The only part that may go unreleased, she said, is the software's source code, which would be the proprietary information of the company that developed it, and which could also help criminals evade Carnivore.

But Schiller said that in selecting IITRI, the Justice Department went with less than the best. "They're not in the top tier, let's put it that way," he said.

IITRI senior vice president Barry Watson said his organization was a natural choice.

"The proposal we submitted was a sound, technical approach for the evaluation needed," he said. "We have an information technology lab that is well suited to do this evaluation."

Another problem with the review, Schiller said, was that the Justice Department gave itself the right to veto any individuals assigned by a university to assist in the review.

But these issues aside, Schiller said, the very idea of a technical review is worthless because it address how the system works, not how it is being used by investigators.

"It's who's controlling the [device] and what are they doing with it," he said. "You're crafting a very invasive and very powerful tool, and with history as a guide, we know those tools get abused."

— Fox News' Bryan Sierra contributed to this report