August 09, 2001, 2:58 PM — A federal court ordered the U.S. Department of Justice (DOJ) on Tuesday to reveal technology used to track the computer keystrokes of a suspect, in a case observers say has an impact on privacy in this era of IT surveillance.
In May of 1999, agents from the U.S. Federal Bureau of Investigation (FBI) snuck into the New Jersey office of Nicodemo S. Scarfo Jr., according to court records. They went not to tap his phone but to plant a device to track the tap of his fingers on his keyboard, recording the keystrokes to glean the password for an encrypted file, according to the records. The DOJ, working with the FBI, is charging Scarfo with racketeering, illegal gambling and loan sharking as a member of what they call a Mafia crime family.
When agents raided the computer system earlier, they discovered a file named "factors" which was protected with PGP (pretty good privacy) encryption, according to the records. Suspecting the file contained records of gambling debts to support their loan sharking investigation but unable to crack the encryption, agents installed the key logger to get the password as he typed. The cracked file became key evidence in their case.
What the court doesn't know is how the key logger system works. The government said national security prevents it from disclosing its methods but U.S. District Court Judge Nicholas H. Politan wants a better explanation. Politan called the printout of FBI's computer keystroke log "gobbledygook" and ordered the government on Tuesday to explain the technology used in the keystroke logger within the next 10 days.
The case has broad implications in the escalating debate about technology and privacy in the U.S. The government asserts that revealing the technology used to learn Scarfo's PGP password would endanger the lives of U.S. agents and hurt ongoing investigations of foreign intelligence agents. But a software designer says it's unlikely that a keystroke logging program itself contains especially sensitive technology.
"It's not rocket science ... I sure hope our tax dollars didn't go to their top scientists to spend all their time developing a keystroke logger," said Richard Eaton, president of WinWhatWhere Inc., a software company that makes keystroke logging tools. "They said the methodology is the security issue ... it could be the way the data is transmitted out of the system. I don't know if it was e-mailed out of there or what."
Court records describe the key logger system as "software, firmware, and/or hardware." Lawyers on both sides are under a court order not to speak publically about the case.
The warrant given to the FBI to secretly install the key logging system and learn Scarfo's PGP password specifically prohibited monitoring of Scarfo's Internet traffic. Internet communications are legally similar to phone conversations, and require a warrant for a wire tap, which must meet a higher burden of justification.
Politan's ruling may shape the boundaries for legal guidelines for IT surveillance technology, especially the government's use of emerging surveillance technology like the FBI's e-mail monitoring system, formerly known as Carnivore.
"In some ways the law hasn't kept pace with the effect of intrusive technology," said David Sobel, general counsel for the Electronic Privacy Information Center non-profit advocacy group in Washington. "In some cases, law enforcement is exploiting the gap between the development of new technology and its evaluation by the court."
The case troubles him, he said, because of the FBI's desire to keep the technology secret. "The government is making the case that they can install sophisticated technology on computers and make a national security claim," to keep it secret, he said. If it became a routinely accepted argument for preventing its disclosure to defendants in court, "it would radically alter our concept of due process and the rights of criminal defendants."
The FBI, in Washington, D.C., can be reached at +1-202-324-3000 or at http://www.fbi.gov.
Court documentation regarding the Scarfo case is available at http://www.epic.org.
