The FBI's Black Magic?

By David Corn, AlterNet. Posted January 4, 2002.

Knock, knock.

Who's there?

The FBI.

The FBI who?

The FBI who is working on a way to gain remote access to all you type on your computer so we won't have to say 'knock, knock' in the future.

In mid-December, the FBI made a startling announcement that received scant attention. A spokesman for the bureau acknowledged it was developing a controversial Internet spying software -- code-named Magic Lantern -- that supposedly can surreptitiously enter an individual's personal computer, record every keystroke and zap all this data back to the G-men and G-women. Presto, the data-snoops at the bureau would have the target's computer passwords, the texts and addresses of all the emails written by him or her (even those angry emails drafted but never sent), a record of all the Internet traveling he or she did, copies of snail-mail correspondence, the contents of any diary kept, to-do lists, on-line banking information, memos, you-name-it -- anything typed into the computer, even if it were immediately deleted or trashed.

For weeks, rumors of this computer-search software had been buzzing throughout tech circles. In November, MSNBC first reported FBI was developing a computer "virus" that would install "keylogging software" on a suspect's machine. But the bureau would neither confirm nor deny. Several software companies were asked by reporters if they were cooperating with the FBI by rigging their anti-virus detection programs to ignore Magic Lantern. Some firms offered conflicting replies; eventually all said they were not in league with the government. Then finally a FBI official named Paul Bresson publicly confirmed Magic Lantern was no illusion. "It's a workbench project" that has not yet been used, he told Reuters. And that was all he would reveal.

Magic Lantern would not entail a dramatic technological advance. As zdnet.com notes, "several hacking tools, the two most popular being Back Orifice and SubSeven, allow full control over a remote PC infected by the program, including keystroke logging." Still, it is a momentous law enforcement advance.

The software was born out of FBI frustration. In recent years, the electronic eavesdroppers of the bureau have been bedeviled by widely-available encryption programs. If the FBI gets a warrant to intercept the Internet communications of a suspect, it is screwed if that data has been encrypted, for the bureau does not have the resources to crack this sort of code. It would be much easier to obtain the passwords used by a target and with those in hand de-encrypt the information. In at least one known case, the feds, using a search warrant, gained physical access to the computer of an alleged loan shark and gangster who had utilized encryption to scramble information on his hard drive. The bureau planted keystroke-detection technology on the computer, uncovered his password and collected evidence against him. (In court, the FBI adamantly refused to disclose the specifics of its keystroke-snatching technology.) Magic Lantern would replace the need for a black-bag job. Instead of agents breaking into a home or office to attach a keystroke logger, the software would creep in, perhaps via an email that seems to come from a friend, and silently penetrate the computer.

With Magic Lantern, the FBI would move beyond its controversial Carnivore system, which is installed at an Internet service provider, reviews the data stream and picks out email and web visits of specific account holders. Carnivore is like a policeman at a speed trap watching for suspected speeders. Magic Lantern is a cop who sneaks into the backseat of the car of a suspect and, unbeknown to the driver, rides along.

So there's a problem with this? Possibly. Magic Lantern could too easily lead to overly broad searches. Though its grail may be encryption passwords, agents will be able to snag anything typed on a keyboard. (The FBI in the days of old used to love to obtain the discarded typewriter ribbons of suspected criminals or commies. With the ribbons in hand, the bureau could read whatever had been written on the suspect's typewriter.) Viewers of The Sopranos might recall the episodes in which FBI agents wiretapped Tony's home. As is often the case, they were not allowed to record everything that went on in the house. The FBI team could only roll tape when it was clear T. was talking about illicit enterprises. That is because wiretaps are supposed to be narrowly aimed, not used like a Hoover (pun intended). Magic Lantern could end up being much too powerful a snoop.

"Because the tool involves covert installation of software on someone's PC with no physical intervention, it could conceivably allow law enforcement to circumvent wiretapping restrictions,"Alex Salkever writes on Business Week Online. David Sobel, general counsel for the Electronic Privacy Information Center complains, "We don't know what this is capable of." Will this software be open-source? asks Lee Tien, a senior attorney for the Electronic Frontier Foundation. If it is not, the public will not have a clear picture of its capabilites. (Don't bet on the FBI opening such a potent weapon to scrutiny.) The public may not even know when Magic Lantern is up and running, assuming the bureau's high tech wizards succeed. Perhaps it already is. And here's a scary thought: what if Magic Lantern fell into the wrong hands? Or what if the FBI's development and use of a particular software helped or encouraged corporations, individuals, or other governments (say, Beijing) to produce and exploit similar software? Who knows who will be slipping in and out of your computer.

Liked this story? Get top stories in your inbox each week from AlterNet! Sign up now »