X

U.S. keeps PC surveillance under wraps

The U.S. government for a third time is seeking to cloak a report that would reveal surveillance techniques used to obtain computer passwords and indict an alleged mobster.

Stefanie Olsen Staff writer, CNET News
Stefanie Olsen covers technology and science.
Stefanie Olsen
3 min read
The U.S. government for a third time is seeking to cloak a report that would reveal surveillance techniques used to obtain computer passwords and indict an alleged mobster.

The government, in the case United States of America v. Nicodemo S. Scarfo, has refused to disclose information about the covert installation of a key logger system. By capturing the keystrokes made on a computer, this technology can be used to discover encrypted passwords.

The motion responded to a mandate from Judge Nicholas Politan in a Newark, N.J., court to produce a report "detailing how the key logger device functions" by Aug. 31.

The move is the latest salvo in a two-year case that could have broad implications on public privacy and the government's tactics of monitoring computer use in federal investigations.

"With so much record keeping now done on computers, the government investigation of that information and its techniques are obviously critical," said David Sobel, general counsel for the Electronic Privacy Information Center (EPIC) in Washington. "The challenge is to make sure these new techniques are used in a constitutional way."

Sobel has advised defense lawyers in the case. All lawyers in the case are under a gag order.

Public concern has been escalating regarding the government's use of technology to track criminals. The FBI's DCS1000 surveillance system, originally known as Carnivore, caused widespread fear about the government's capacity to spy into private communications. The system allows law enforcement to intercept electronic transmissions such as e-mail.

Facial monitoring devices installed by federal investigators in Tampa, Fla., and at the Super Bowl also sparked fears about a Big Brother government.

As a result, lawmakers are taking action. Last month, a bill passed in the House requiring federal law-enforcement officials to be more forthright when answering questions about electronic surveillance systems.

The Scarfo case, which began in January 1999, involves how the government obtained a secret pass code set by Scarfo, who is awaiting trial on charges of allegedly running gambling operations for the Gambino crime family. Scarfo is the son of jailed mob boss "Little Nicky" Scarfo.

The pass code unlocked an encrypted document stored on Nicodemo S. Scarfo's personal computer. Investigators believed decoding the file could reveal criminal evidence.

To capture the pass code, investigators secured a search warrant for Scarfo's office and obtained a copy of his hard drive. However, they could not crack a file locked by PGP (Pretty Good Privacy) software. Investigators gained approval to secretly install a device allowing them to capture the pass code. The technology used, however, is information the government vehemently wants to protect.

The new motion, filed Thursday, asks that the information remain classified and that the government be allowed to submit an "unclassified summary" of the technology. The government asked for protection under the Classified Information Procedures Act, preventing disclosure for reasons of national security. It has refused to disclose this information twice before, arguing it is privileged.

The defense wants information on the monitoring system to form its legal arguments. If the technology was capable of capturing the suspect's online activity, it would be equivalent to a wiretap. The defense could then show that investigators only had a traditional search warrant and weren't authorized for a wiretap.

Furthermore, the defense hopes to show that investigators didn't comply with legal requirements for accessing online activity, which are more stringent than those required for a standard search warrant.

Investigators have disavowed any intention to capture online activity.

EPIC's Sobel said that even if the device didn't capture online activity, it could violate the Fourth Amendment because it likely took in data outside of the intended purpose. Investigators only had authorization to obtain a password, but in the course of securing the code they most likely were privy to all of Scarfo's computer activity. The Fourth Amendment prohibits a general search.

"There's potentially a very serious Fourth Amendment issue if this device was capturing everything" Scarfo did on his computer, Sobel said.