Alphabetical Site Index


Internet Censorship

Many people say that the Internet can not be censored, but it can. It is happening now, on a massive scale, for Counterintelligence purposes. It should be of great interest to bloggers and operators of alternative News Web Sites. It is one of the reasons that the Project Media Matrix / David W. Roscoe Web Site is distributed by both the Internet and by disc.

Some Internet Censorship has been well documented, such as:

And some people have produced guides about "HOWTO bypass Internet Censorship" (Live Web Page: here, Cached Web Page: here). But this censorship is minor, and act as distractions from and Covers for, much larger amounts of Internet Censorship which is kept Secret.

Most Internet Censorship is disguised and not noticed. It appears to be something else, such as a malfunctioning Web or E-mail server, a slow Internet, or a random malicious hacker attack. Most people do not realize that this is censorship and they take no action. The few people that would report or investigate such problems as censorship get Individualized Internet Censorship or are controlled in other ways.

Next I describe some Myths About Internet Censorship; how Internet Censorship works both in theory and practice; and Internet Surveillance. I also describe the design of a hypothetical system that I call Carnimore that can do it.

The existence of Internet Censorship is a big reason why we need the Truth Distribution Network (TDN).

[Click on (Back) button now.]

Myths About Internet Censorship

Some people think that Internet Censorship is impossible. They are mistaken.

[Click on (Back) button now.]

E-mail Blocking

This is Internet Censorship of e-mail by intentionally preventing its delivery, or delaying its delivery until the e-mail's content is no longer of value or for other reasons. It seems to happen a lot, and I have seen some of the Proof.

On 2003 Apr 20 I read a report (Live Web Page: here) that stated:

I have personal knowledge of one case. On Sunday 30 Mar 2003 I received a message about an antiwar demonstration in Boston. But I received it more than 24 hours late, and so did everybody else on the recipient list. I believe that this message had been blocked for the following reasons:

So something else blocked the outgoing messages. Maybe Carnimore was programmed to do simple Packet Discarding.

I suspect that the tree falling and the routing problem were Covers for the real problem. And they almost worked.

The following are the e-mail headers from the message that I received. They show where the message was, and when, including the 24 hour delay. Headers near the beginning of the list were the most recently added ones. Times are shown in bold. My comments are shown in [ bracketed bold italic ].

[Click on (Back) button now.]

Web Page Blocking.

This term refers to Internet Censorship that prevents the display of most or all of a Web Page.

In practice most Web Page Blocking is probably done with either Web Page Delaying or Web Page Pausing, with a time period long enough to cause the Web Surfer to give up. Both can be done with Packet Delaying, so Packet movement can be resumed immediately by releasing delayed Packets and allowing them to continue to their destinations.

The simplest way to do Web Page Blocking is with Web Page request Packet Discarding. But Packet Discarding is irrevocable because the Packet is gone. Packet movement can not resume until the next retransmission of a previously discarded Packet.

[Click on (Back) button now.]

Documented Internet Censorship

This section was previously called "Observed Internet Counterintelligence"

[If You Do Not Trust Me Then Read This For Entertainment Purposes Only]

In this section I describe some Internet Censorship methods, the effects of which I have personally observed. I describe them, describe my observations, and theorize about how Carnimore might do them.

Most of the methods listed below are forms of Web censorship. Internet Service Blocking is a harassment method. Individualized Internet Censorship is a way to keep Secret various Internet Counterintelligence activities.

Theoretical Internet Censorship

[This section was previously titled "Theoretical Internet Counterintelligence"]

In this section I describe Internet Censorship methods for which I have no direct evidence. But they are a possible explanation for some Documented Internet Censorship.

Internet Surveillance

[This section was previously called "Internet Intelligence"]

I have no Direct Evidence worth mentioning that Internet Surveillance activities are happening, because it is Intelligence gathering, which if done correctly leaves no traces.

But I believe that extensive Internet Surveillance is happening now, based on Documented Internet Censorship activities that I describe elsewhere.

The logic is simple.

I believe that all Internet activity is being monitored, and probably recorded, including:

Carnimore [click to view]

Individualized Internet Censorship [click to view]

[Click on (Back) button now.]

Project Media Matrix Web Site Hidden Pages.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

As I expected, the Project Media Matrix Web Site was also hidden from Google. The following is a brief history of that hiding.

Other sites containing sensitive information have similar problems. For example, Tony Gosling's site (Live Web Page: here) reports (Live Web Page: here) the delisting and downlisting of his entire site or individual pages by various Search Engines, including Google. He also reports (Live Web Page: here) an e-mail exchange with Google that indicates that some of it's failures are caused by political manipulation.

From these data I conclude that Google's search results are being manipulated:

[Click on (Back) button now.]

Carnimore

Carnimore is the name that I use to refer to the system that is doing the Internet Censorship that the Bad Guys seem to be doing.

The name "Carnimore" is based on the name "Carnivore". It differs by only one letter.

In this section I describe Carnimore, a possible Carnimore Design, what it does, how it does it, and how it is hidden from us.

If you know much about how the Internet works then you should agree that Carnimore could be built. If you believe the evidence then you should agree that Carnimore has already been built. I present the evidence in this Web Site.

[Click on (Back) button now.]

Individualized Internet Censorship

[previously called "Customized Internet Censorship"]

Counterintelligence is less effective if the targets know about it, because they might take countermeasures.

The purpose of Individualized Internet Censorship is to keep Internet Censorship a Secret. It works by treating each Internet user differently based on his ability to detect and respond to Internet Censorship.

Suppose a somebody's Web Page or E-mail publications often contain sensitive information. The Bad Guys want to hide it from as many Web Surfers as possible. But they also want to make it appear to some people to be working fine.

Carnimore can do this. It can give different Internet users different experiences, because every user connected to the Internet has a different IP Address.

I describe how to do Individualized Internet Censorship that hides two types of Web Site problems. For more information see Web Page Delaying With Carnimore and Web Page Pausing With Carnimore.

[Click on (Back) button now.]

Hiding Of A Web Page

The Hiding Of A Web Page is now a Documented Internet Censorship activity. It can be done by intentionally causing an Unavailable Web Page, or by influencing the results from search engines.

The purpose of the Hiding Of A Web Page is Counterintelligence, to keep information on the page Secret. If a Web Page contains information about a Secret subject, then hiding the Web Page will prevent some people learning the information.

Here I explain how it is possible for there to be an Unavailable Web Page, and describe two of the types of Hiding Of A Web Page for which I have seen evidence.

[Click on (Back) button now.]

Unavailable Web Page

Most people that have difficulty viewing a Web Page go view a different page, or do something else. So intentionally creating or faking such problems is an effective method of Internet Censorship by the Hiding Of A Web Page.

I believe that all of the following problems are used for this purpose.

There are several problems that can interfere with viewing a Web Page. Each problem can be either an unintentional malfunction, or an intentional Hiding Of A Web Page.

Unlisted Domain Name

An Unlisted Domain Name can cause an Unavailable Web Page.

In this case the Domain Name of the Web Page can not be translated to the page's IP Address, so there is no way to contact it. This is the Internet equivalent of having the name of a person but not the person's telephone number, and discovering that the person's number is not listed in the telephone directory.

For example, if you try to view a Web Page with a Domain Name of "www.MadeUpWebSite.com" you might receive a message such as this:

Unresponsive Web Server

An Unresponsive Web Server can cause an Unavailable Web Page.

In this case the Domain Name of the Web Page is successfully tranlated to the page's IP Address, but no server at that address responds. This is the Internet equivalent of having and dialing the correct telephone number, but nobody answers.

This is especially suspicious when it happens with some pages but not others on the same server.

Web Page Is Not On The Server

When a requested Web Page Is Not On The Server it causes an Unavailable Web Page.

In this case the Web Page server answers but it can not find a page matching your request. This is the Internet equivalent of dialing the correct telephone number, somebody answers, but when you ask to talk with John you are told that there is no John there.

For example, you request "www.WebSiteName.com/FileName.htm", the Web server for the Domain Name "www.WebSiteName.com" responds, but the server can not find a Web Page associated with the name "FileName.htm". Your Web Browser might display messages such as

If an image file is not on the server then you will see a mostly blank rectangle where a picture should have been.

Slow Web Server

A Slow Web Server. can cause an Unavailable Web Page.

In this case, everything is working, but working slowly. Maybe the Web Site. is temporarily slow because many people are trying to view it at the same time. If you are patient and wait long enough then you will probably see the full Web Page. But if you are impatient and give up then you will not see it.

Slow Internet Service

Slow Internet Service can cause an Unavailable Web Page.

This is when the communication of Packets between you and the Web Site is slow. The problem might be in your ISP, or the ISP that hosts the Web Site, or another ISP somewhere in between.

The effect is similar to the effect of a Slow Web Server, but it probably makes some other Web Sites also appear slow.

[Click on (Back) button now.]

Hiding Web Pages From Web Surfers

Many times I have experienced a malfunctioning Web Page that for practical purposes made it an Unavailable Web Page. Many of these cases were probably the result of unintentional problems, but I am convinced that some were cases of intentional Web Page Blocking. These problems seem to happen more often with Web Pages in, or linked to, Web Sites known for reporting sensitive information.

There are several methods of Hiding Web Pages From Web Surfers. Some are better than others at hiding a page. Some are better than others at not arousing suspicion.

Whether Hiding Web Pages From Web Surfers is successful in a particular case depends on the method used and on the Web Surfer. Web Page Delaying and Web Page Pausing both involve programmable time intervals during which the Web Surfer is forced to wait. If the Web Surfer is patient then the Web Page might not be hidden. Increasing the wait period increases the probability that the Web Page will remain hidden. Complete Web Page Blocking is accomplished by making the wait period infinite, or at least long enough that nobody is willing to wait that long. The Web Page is hidden from everybody, because nobody has that much patience.

Long wait periods hide a Web Page from more people, but arouse more suspicion. Lower wait periods hide the Web Page from fewer people, but arouse less suspicion, because the Web Page behavior can be explained as Slow Internet Service, or a Slow Web Server, and these problems can happen unintentionally.

[Click on (Back) button now.]

Hiding Web Pages From Search Engines

Now I describe how some Poor Search Results from Google, and other evidence, convinced me that there is an active program to hide Web Pages from Search Engines on a large scale. I found no No Suspicious Links that could have artificially raised the ratings of irrelevant sites. Instead I discovered that There Were Hidden Pages that would have contributed to the ratings of relevant pages because they had links to them, but did not because they were hidden.

This is a type of Internet Censorship. I document the pages that I found to be hidden. I also explain how it is possible to do Hiding Web Pages From Search Engines With Carnimore.

Poor Search Results.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

Between the time of my Decision To Work On Project Media Matrix Secretly (I-Edition) and the time The Bad Guys Found Crimson Tablet (I-Edition) I was in hiding. During that period I did no Internet searches for information about the Waco Incident because I assumed that the Bad Guys were monitoring the Internet for that. After that, when I did do some searches, I got some strange search results.

2001 Mar, I used the Google Search Engine to search for Web Pages about the Waco Incident the Waco Holocaust Electronic Museum appeared first in the list of search results (Live Web Page: here, Cached Web Page: here). But in my opinion, the Waco Holocaust Electronic Museum contained very little relevant information.

Because Google has a very good reputation for listing first the Web Pages that contain the most relevant information about a subject, I suspected some type of sabotage. I began to investigate.

No Suspicious Links.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

Google's PageRank(TM) System rates target Web Pages based on the number and ratings of Web Pages that have hypertext links to the target Web Pages. I wondered whether some popular Web Sites might have hidden links to the Waco Holocaust Electronic Museum, thereby artificially increasing its rating and moving it to the top of the search results list.

I used Google's Link Finder to search for such links. I found none that I recognized as popular in the first ten results listed (Live Web Page: here, Cached Web Page: here).

There Were Hidden Pages.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

There is another way to move a page to the top of the search result list. Instead of raising the rating of the target page, it can be done by lowering the ratings of other pages.

In the case of Google it can be done by hiding Web Pages that have links to the target page. The links contribute to the page result ratings calculated by Google's PageRank(TM) System. But if Google can not see a page, then it can not see the links that it contains.

I began looking for Web Pages hidden from Google. I used Google because it was the Search Engine that I normally used and because I could use Google's Page Information System to determine whether Google could see a Web Page. When looking for hidden pages, I followed links on pages in Google's Cache, because these are the links that Google follows when it crawls the Web.

I decided to first look for hidden pages on NewsMax.com because it had articles about the Waco Incident. It had also an entire section about Waco. I found hidden Web Pages almost immediately.

NewsMax.com Hidden Pages.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

A Google search for the URL of the NewsMax.com article titled "New Evidence in Waco Case" (Live Web Page: here, Cached Text Only: here) indicated that the article page was hidden from Google (Live Web Page: here, Cached Web Page: here). Notice that this means that Google had not been able to see the page the last time its Web crawler examined that part of the Web. But I could view the page, and you probably can view it now.

I continued to investigate, looking for more NewsMax.com pages hidden from Google. Here are some of the results.

Notice that the article titled "Bush Outlines Education Plan" (Live Web Page: here) is not hidden. Google's Link Finder confirms that pages that link to the article are visible (Live Web Page: here, Cached Web Page: here).

In summary, it appears that most of NewsMax.com's pages, including articles, archive article lists, and Hot Topic article list, are hidden. But at least some recent articles, recent relative to when Google crawled the Web, are visible.

WorldNetDaily Hidden Pages.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

NewsMax.com is not the only Web Site for which there is evidence of Hiding Web Pages From Search Engines. I did a similar investigation of WorldNetDaily looking for pages hidden from Google. I did not spend as much time, because WorldNetDaily has fewer links pages, and I was tired. But here is a summary of the results.

In summary, it appears that WorldNetDaily news articles are hidden, but advertisement articles are not.

Incorrect Page Cross References

Some search engines can do cross reference searches. Causing them to fail is another way to do the Hiding Of A Web Page or pages.

On 2004/08/03 I learned about Copyscape (Live Web Page: here), a search engine that can find Web Pages that contain text that has been copied from one of your pages. So I tried it. It did not behave correctly.

I noticed that Copyscape was "Powered by GoogleAlert". I decided to test Google's cross reference search.

I concluded that this function was being crudely faked, possibly with a Censoring Proxy Web Server.

Project Media Matrix Web Site Hidden Pages [click to view]

Google bilderberg.org Incident [click to view]

No robots.txt File.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

Web masters can request that Search Engines ignore parts of their Web Sites by putting a file named robots.txt on their site. This could explain why some Web Pages can not be seen by the Web crawler robot of a Search Engine.

But there was no robots.txt file on NewsMax.com because http://www.newsmax.com/robots.txt returned:

There was also no robots.txt file on WorldNetDaily.

Hiding Web Pages From Search Engines With Carnimore

Here is one way Carnimore could be used to do Hiding Web Pages From Search Engines. If the procedure above is followed then links to the Web Pages that are supposed to be hidden will appear to be broken. The Search Engine will not be able to read and index the hidden Web Pages. People will not be able to find information on these Web Pages using the Search Engine.

[Click on (Back) button now.]

Advertisement Blocking.

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

Advertisement Blocking is the causing of a missing advertisement on a Web Page. The remainder of the Web Page is not affected. It is also now a Documented Internet Censorship activity.

Most Web Surfers will not notice a missing advertisement. And if they did notice it then they probably would not report it. The few people that would be interested in the fact that an advertisement is missing could be given Individualized Internet Censorship to hide the fact.

On October 9 2000 I was viewing the Web Page at http://www.dreamagic.com/bruce/gandw94.html and I discovered that part of the page near the bottom was missing. For a long time the status line at the bottom of my Web Browser indicated that it was not finished loading the page. It was stuck on something. I pressed the key to terminate the load and suddenly the remainder of the page appeared, most of it anyway.

At the bottom had appeared a row of pictures of books by third party political candidates: Harry Browne, Ralph Nader, Patrick Buchanan, and Jesse Ventura. At the left end of the row if images was a graphic symbol indicating that another image of a book could not be loaded by the browser. I clicked on it and it took me to the page for Harry's other book "How I Found Freedom in an Unfree World" at http://www.amazon.com/exec/obidos/ASIN/0965603679/thedreammachine/ at Amazon.com. So the missing picture was acting as an advertisement for Harry Browne's book. What was strange was that the picture of the book was missing from the Amazon.com page also! The Web Browser seemed to be waiting for it to load, the same as what happened to the image on the dreamagic.com site.

I reloaded both pages and each time the book pictures were missing again. All other pictures on the pages seemed to load immediately.

On the Amazon.com page I clicked on a link labeled "See larger photo" and that worked. After that the smaller image of the book was visible also.

I examined the HTML source code of both of the Web Pages, but I saw no reason why these particular pictures would not be loaded and the other pictures would be loaded. For example, the picture of Ralph Nader's book with a URL of http://www.dreamagic.com/bruce/naderbook.gif loaded.

I changed the file name in the URL to xxxx.gif, creating http://www.dreamagic.com/bruce/xxxx.gif . But when I tried to load that I got a page containing nothing but:

I assumed that it was because there was no such file as xxxx.gif on the Web Site. If the file brownebook.gif, the picture that would not load, was missing from the Web Site then it should have resulted in a similar message. But the link http://www.dreamagic.com/bruce/brownebook.gif caused the browser to display in its status bar: for a long time, without loading the picture. In a few cases I waited several minutes, but the picture never loaded. Something weird was happening with this file, but this file only. Internet problems can sometimes cause slowing downloading, or complete download failures. But because of the repeatability and selectivity of the problem, I concluded that it was the result of intentional interference.

The problem continued for several hours, but ended after I had exchanged some E-mail about it with some people.

I exchanged e-mail with the dreamagic.com Web master. The e-mail that I received said that he had no idea what might have been causing the failure. The picture loaded for him. Also the e-mail said that I should not have been able to view any of the pictures because he copied the files to the ISP of his Web Site a few minutes before receiving my first e-mail message about it. I think that he might have been confusing two different messages. I had sent another message on a different subject several hours earlier, before I tried to view the page at http://www.dreamagic.com/bruce/gandw94.html . In my final e-mail message to him, I asked him whether he had confused my first two messages, but I did not receive a reply.

Advertisement Blocking can be done with Carnimore. The method is almost identical to the method for Web Page Delaying With Carnimore. The differences are:

[Click on (Back) button now.]

Web Page Pausing.

Web Page Pausing is a common Web Surfing problem. It is a Documented Internet Censorship method that can be used for Hiding Web Pages From Web Surfers.

When the Web Surfer clicks on a link to a Web Page, it begins to be transfered and displayed, but pauses. How much the user sees before the pause varies.

After the pause time, the transfering and displaying of the Web Page resumes, unless the user has given up and clicked on his Back Button. In that case the sensitive information is not seen and for practical purposes has been blocked. If a page was not loading then how many seconds would you wait before going elsewhere?

Below I describe some real examples and explain how it is possible to do Web Page Pausing With Carnimore.

Web Page Pausing Of CarlaHowell.org

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

On the morning of October 25 2000 I received an E-mail message with a link to an Excite News article. It was titled "Sen. Edward Kennedy Nixes Debates" and was about his refusal to debate his opponents in the year 2000 Senate race. When I tried recently to view the article it was not available, but it was originally at http://news.excite.com/news/ap/001024/23/kennedy-no-debate .

At the end of the article were links to the campaign Web Sites of the three candidates. They were:

After reading the article I tried to view each of the campaign Web Sites. The Democrat Kennedy and Republican Robinson sites loaded quickly. The Libertarian Howell site did not. Loading of the Howell Web Site began immediately, but then paused for many seconds. I viewed each site four times over three days, with the following results. The Kennedy and Robinson sites always loaded quickly and without pausing. The Howell site always paused. I did not view these sites at any other times during this period. A couple of days later when I checked the Howell site again I saw no pausing.

A Slow Web Server can cause a Web Site to be displayed slowly. But I do not think that a Slow Web Server caused the pausing. Except for the pauses at the beginning, the Howell site was fast. When I reloaded the site it was fast. And when a Web Site is slow because it is very busy, the entire loading process is slow, not a bit at the beginning only. Also, notice that on October 26 at 2:17 AM, a time when Internet traffic is usually light, and few people would be viewing the site because most of them would be in bed, the download pause lasted 9 seconds.

The pattern of pausing behavior of the Carla Howell Web Site causes me to think that it is an example of the intentional Hiding Of A Web Page. The purpose seems to have been to cause impatient Web Surfers to not see the Howell campaign Web Site, but see the Web Sites of the establishment opponents.

Web Page Pausing Of My Internet Service

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

There have been several incidents in which I have been unable to surf the Web. Some of the incidents I believe were malfunctions of my ISP. But I believe that at least three of them were intentional interference, specifically Web Page Pausing Of My Internet Service.

The behavior was similar to that in the Web Page Pausing Of CarlaHowell.org. One difference was that instead of being the pausing of a single Web Site, every Web Site that I tried to view paused. Each site seemed to begin to load and be displayed, but within a split second it stopped.

Another difference was that instead of resuming after a few seconds, it never resumed. It was as if my Internet connection had suddenly stopped working. If I tried to view a different Web Site then for a split second things would work again. A small bit of the new page would display, for example the window might be blanked with the background color, but then it would stop. For practical purposes the site was blocked.

One of the things that made me think that the pausing was not a malfunction of the upstream connection of the ISP to which I was connected, was the fact that my E-mail continued to work. I was able to check my e-mail boxes on three different ISPs, including two others to which I was not directly connected, without problems.

Another thing that made me think that the pausing was not a malfunction of the upstream connection of my ISP was my discovery that I was also apparently getting Individualized Internet Censorship. Two of the incidents happened after I put my Web Site on the Internet. Though every other Web Site that I tried would not load, my Web Site did. You might think that this is easilly explained by a malfunction of the upstream link to the Internet from my ISP. If my Web Site had been local to the ISP with which I was trying to view Web Sites then I would agree with you. But my Web Site is on my old ISP UltraNet to which I have only dial-up capability. I was viewing the Web using a DSL connection, originally a Flashcom account, and later EarthLink. So my Web Site was not local. So why was I able to view only my Web Site? I think the reason was Individualized Internet Censorship.

I suspected that the Bad Guys were probably sabotaging my Web Site in some way because of the sensitive information that it contains. But to prevent me from knowing about the sabotage they gave me Individualized Internet Censorship. But later, when they did the Web Page Pausing Of My Internet Service, they did not turn off the Individualized Internet Censorship. Apparently it affected the Web Page Pausing Of My Internet Service also, so it spoiled their try to similate a general malfunction.

Web Page Pausing With Carnimore

Here is one way Carnimore could be used to do Web Page Pausing.

The following assumes that Web Page Pausing should be done for anybody that tries to view particular target Web Page, except that a small number of Web Surfers will receive Individualized Internet Censorship, and that this target information has been entered into the Carnimore Target Database in the Carnimore Base Unit.

Notice that Web Page Pausing is fail safe with respect to failures in either the Carnimore Base Unit or the Carnimore Channel. If either fails then Packets will flow freely and arouse no suspicion.

[Click on (Back) button now.]

Web Page Delaying

Web Page Delaying is a Documented Internet Censorship method that does Hiding Web Pages From Web Surfers.

When the Web Surfer clicks on a link to a Web Page that is delayed, nothing happens at first. Unlike Web Page Pausing, in which the page begins to display but quickly stops, and maybe resumes later, with Web Page Delaying nothing is displayed at first. If the Web Surfer waits long enough then the Web Page might eventually be displayed. Sometimes clicking on the link again helps.

Many times I have clicked on a Web Page link and seen nothing happen. In most cases I had no easy way to determine if I was seeing Web Page Delaying or only an unintentional malfunction. But in a few cases I concluded that Web Page Blocking Of My Web Site was being done using Web Page Delaying.

Web Page Blocking Of My Web Site

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

My Web Site is actually two Web Sites in one. One is my personal page David W. Roscoe, The other is Project Media Matrix. Here is what happened one day when I tried to view it.

The only difference between their Internet URLs was in the file name at the ends. It appeared that a particular file, pmm.htm, was being blocked.

I experienced this same Web Page Delaying using several different Internet connections.

I no longer experience this unexplained Web Page Delaying regardless of from where I surf. I assume it is because the Bad Guys have given the Internet connections that I used special Individualized Internet Censorship.

But I assume that most other first time viewers of the site will have problems viewing it, and this will continue regardless of where it moves on the Internet.

Web Page Delaying With Carnimore

Here is one way Carnimore could be used to do Web Page Delaying.

The following assumes that Web Page Delaying should be done for anybody that tries to view particular target Web Page, except that a small number of Web Surfers will receive Individualized Internet Censorship, and that this target information has been entered into the Carnimore Target Database in the Carnimore Base Unit.

First:

If we wanted to do unlimited Web Page Delaying of the entire Web Site for everybody that tried to view anything on it, then nothing else would need to be done. But if we want the delays to be temporary, delay only some of the Web Pages on the Web Site, or do Individualized Internet Censorship, then we must do some other things.

Notice that doing Web Page Delaying this way is not fail safe with respect to failures in either the Carnimore Base Unit or the Carnimore Channel. If either fails then the request Packet and the display of the associated Web Page are delayed indefinitely. Suspicions might be aroused.

[Click on (Back) button now.]

Internet Service Blocking

Your Internet Service has probably failed before. It has happened to most people at least once. In most cases an Internet Service failure is an innocent malfunction.

But there are Counterintelligence reasons why the Bad Guys would use Carnimore to intentionally cause a failure of somebody's Internet Service. It makes getting news from the Internet difficult. It can make work difficult if the work involves the Internet. If the Bad Guys believe that some of that work is harming them then they would want to slow the work.

I believe that I have been a victim of Internet Service Blocking. My Internet Service Blocking is now an example of Documented Internet Censorship activity.

My Internet Service Blocking

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

After the Web Page Pausing Of My Internet Service, I had few problems with my Internet Service for a while. Then a new problem began.

Earlier, during the Web Page Pausing Of My Internet Service, I had noticed the strange combination of some parts of my Internet Service working and other parts not working. And I had documented it in this Web Site. So the Bad Guys knew that I understood what they had done. They apparently decided to be more careful and make their next action less obvious.

One day my Internet Service began to malfunction in a completely new way. Sometimes it worked fine. At other times nothing worked. I could not access any of my E-mail servers. I could not view any Web Sites. I could access nothing on the Internet. It was as if somebody was throwing a switch, and turning my Internet Service on and off every few minutes. But if they were throwing a switch, then it was not a physical switch, because the LAN LNK indicator light on my DSL modem remained on.

As with previous problems with my Internet Service, My Internet Service Blocking stopped when I acted to increase the publicity for the Project Media Matrix Web Site.

Internet Service Blocking With Carnimore

Internet Service Blocking is easy to do with Carnimore, assuming it is for an individual.

If this is done then no Packets will be able to get to or from the target Internet user's computer. The user will, for practical purposes, be cut off from the Internet.

As with all Carnimore Counterintelligence functions, Internet Service Blocking With Carnimore can be switched on and off at will, either by manual commands from a human agent, or by a computer program. I assume that it was a computer program in the case of My Internet Service Blocking, because my Internet Service switched on and off every few minutes for several days.

[Click on (Back) button now.]

Web Page Substitution.

Web Page Substitution is a way to do Internet Censorship in which the content of a Web Page is replaced with different content. I am calling this a Documented Internet Censorship activity because there is strong evidence for Web Page Substitution for Search Engines and Web Surfers.

There is nothing wrong with doing this to one's own Web Page. For example, the owner of a News Web Site might change the content of the home page many times per day as new news stories develop. The problem is when someone other than the owner of a Web Site, or someone authorized by the owner, changes the content of the site.

Here are some ways that Web Page Substitution might be used for Internet Censorship. The method used probably depends on the ability of the page's owner to analyse and react to the problem.

Google's Cache Age Data

[If You Do Not Trust Me Then Read This Section For Entertainment Purposes Only]

The following are observations that cause me to believe that Web Page Substitution is happening.

Many News Web Sites display two types of dates. Each article usually includes the date on which it was published, usually near the beginning of the article. But there is often today's date somewhere on each page, usually near the top.

The following data shows:

The difference is the age of the page in the cache.

I did not check Google's Cache every day during these periods. But I did check at least twice, on the first day and the last, and probably some other days in between.

Google's Cache Age Data March 19 to May 3 2001 Analysed

What puzzled me in the beginning of the data was the long period of time between the today's date from the copy of the page in Google's Cache and the date I viewed it. The time difference was as long as 2 months or longer. This means that a Google search was returning old information, the Web as it existed more than the 2 months ago.

2 months seemed excessive to me. Here is my reasoning. Assuming that there is no interference with Google.

But from March 19 to May 3 2001 the time difference could be higher than 2 months, and never less than 1 month. Why? There was an innocent explanation and a sinister explanation. Sometime between May 3 and May 7 2001, things changed.

Google's Cache Age Data May 7 to Aug 1 2001 Analysed

Sometime between May 3 and May 7 2001, things changed. The time difference, the age of pages in Google's Cache, had become smaller. It could now be less than 1 month, and no longer became greater than two months. Things seemed to be getting better. Why? Again there is an innocent explanation and a sinister explanation.

Sometime between Aug 1 and Aug 22 things changed again.

Google's Cache Age Data Aug 22 To Sep 6 2001 Analysed

Sometime between Aug 1 and Aug 22 things changed again.

I had not checked the dates on the News Web Sites in Google's Cache since Aug 1 2001. I thought that I had plenty of time before the next update of Google's Cache. But when I checked the dates on Aug 22 2001, I discovered that the cache had already been updated. What was stranger was that, according to the dates on the pages in the cache, the page in it was only 1 day old, which is something I have never seen before on these pages.

On Sep 06 2001 the data was 0 days old. That is very fresh data.

Why? Again there is an innocent explanation and a sinister explanation.

Google's Cache Age Data Sep 12 And After Analysed

Sometime between Sep 6 and Sep 12 things changed again. Unless Google is testing different types of search indexes on their users without telling them, the change is Proof of Web Page Substitution.

The change is that the dates on the cached pages for NewsMax.com and WorldNetDaily had become OLDER. They had both become more than a month old. Cached pages are never supposed become older. Supposedly each time Google's Cache is updated, it is updated with NEWER data, approximately one month newer, because Google's Cache is updated monthly. There is no reason for the dates on either of these Web Sites to become older.

On the other hand, the date on the CNN.com cached page did not get older. It continued the pattern of before Sep 12. The page in the cache was no more than a day old.

Therefore, different Web Sites seem to be getting different treatments. The cached data for the pages of the News Web Sites of alternative media is old. The cached data for the pages of the mainstream CNN.com is no more than a day old. This puts the News Web Sites of alternative media at an unfair disadvantage.

Note that Attack On America 2001 Sep 11 happened immediately before this period.

Sometime between Sep 17 and Sep 22 things changed again. All three News Web Sites resumed the pattern of before Sep 12. The pages in the cache were no more than a day old.

Google's Explanation Of The Strange Cache Dates

On 2002 Jan 10 I sent an E-mail message to Google asking about why the Google's Cached copies of a NewsMax.com page seemed to be only one day old. Here is the message. 
  Date: Thu, 10 Jan 2002 22:43:51 -0500
  To: help@google.com
  ...
  Subject: daily crawler?
  ...

  Hello Google.


  I am confused about your crawler.  

  I thought that Google crawled the Web every 28 days.
  But according to 3 requests to Google's cache over the past 3 nights for
  http://www.newsmax.com/archives.shtml , the crawler is running daily.
  This page at this URL includes the current day,
  so the date on the page in the cache should indicate the day
  on which the page was crawled.

  Here is my data.  The file names are local to my computer.

    + google85.htm = http://www.google.com/search?q=cache:hDjC1XKBkpsC:www.newsmax.com/archives.shtml+&hl=en&start=1
      This is G o o g l e's cache of http://www.newsmax.com/archives.shtml.
      Date on page is: January 07, 2002 , which is one day old..
      Compare with google86.htm .

    + google86.htm = http://www.google.com/search?q=cache:hDjC1XKBkpsC:www.newsmax.com/archives.shtml+&hl=en&start=1
      This is G o o g l e's cache of http://www.newsmax.com/archives.shtml.
      Date on page is: January 08, 2002, which is one day old..
      Compare with google85.htm and google89.htm .

    + google89.htm = http://www.google.com/search?q=cache:hDjC1XKBkpsC:www.newsmax.com/archives.shtml+&hl=en&start=1
      This is G o o g l e's cache of http://www.newsmax.com/archives.shtml.
      Date in page: January 09, 2002, which is one day old.
      Compare with google86.htm.


  I have noticed this on a few other pages also.

  Is Google crawling some Web pages daily?
  If so then what is the criteria for choosing those pages,
  and where is it documented on your site?

  Or is somebody spoofing your site for some pages?


  Dave.
I immediately received the following reply. 
  Date: Thu, 10 Jan 2002 19:56:02 -0800
  ...
  From: Google Help Autoresponder 
  Subject: Re: daily crawler?
  Reply-To: help@google.com

  Thanks for writing to Google.

  We read all of the email we receive and try to send personal responses
  to each message.

  This note is just to let you know that we've received your letter,
  and you'll hear from us soon.  We appreciate your taking the time to
  contact us.

  Keep on Googlin',
  The Google Team
But I received nothing after that.

So on 2002 Jan 18 I sent another copy of my question. Again I immediately received an autoresponder reply. But as of 2002 Mar 05, I have not received any further response.

But I did find some 2002 Feb 01 reports related to my question. On Slashdot I found a report titled "Google Prefers DRAM to Hard Disks" (Live Web Page: here) that referenced a CNN.com report titled "Three minutes with Google's Eric Schmidt" (Live Web Page: here). From the article:

but more to the point The daily indexing about which Schmidt talked might be the cause of the strange cache dates that I reported. But that does not explain why I never received a response to my e-mail.

And it raises other questions, such as:

[Click on (Back) button now.]

Censoring Proxy Web Server

A Censoring Proxy Web Server is a possible use of a Carnimore Base Unit for censoring the Web.

A Censoring Proxy Web Server works by responding to Web request Packets redirected to it by Carnimore Field Units. It acts similar to a regular Web server. But there are significant differences.

How the Censoring Proxy Web Server responds depends on the identity of the particular Web Page being requested, and the identity of the requester. The censorship type to be applied to that combination comes from the Carnimore Target Database. Here are some examples.

In theory a Censoring Proxy Web Server could also filter and modify the requests to, and the results from, search engines.

There is no direct evidence of a Censoring Proxy Web Server. So it is only a Theoretical Internet Censorship method. But Hiding Web Pages From Search Engines and Web Page Substitution, both of which are Documented Internet Censorship activities, could be implemented with a Censoring Proxy Web Server.

[Click on (Back) button now.]

Carnivore

Carnivore is a real FBI Surveillance system. The FBI claims that Carnivore is a Surveillance system that it uses to monitor the E-mail and possibly other Internet communications, but only of criminal suspects, and only after obtaining a search warrant.

Many people suspect that Carnivore can be used to do much more. I suspect that Carnivore is part of, or is a Cover for, a larger system that I call Carnimore.

To learn more about Carnivore, including things that the FBI might not tell you, and technically how Carnivore works, see the following.

Carnimore Design

Physically Carnimore probably consists of two types of computers that I call the Carnimore Base Unit and the Carnimore Field Unit. Networks of these units work together in various Intelligence and Counterintelligence activities. Their activities are controlled by the Carnimore Target Database and the state of the IP Address Tracker. They communicate with each other through Carnimore Channels.

Hiding Of Carnimore

The Carnimore Base Units are located behind locked doors, probably at sites controlled by an Intelligence agency. They are hidden by the usual internal secrecy protocols used to hide Secret projects. For example, the agency employees that deal with the Carnimore Base Units probably signed secrecy agreements saying that they will never reveal what they know about the units without permission.

Hiding the Carnimore Field Units is more complicated because they are located in the field. It is not practical for all the people that see a Carnimore Field Unit to agree to keep it Secret. So many Carnimore Field Units probably operate under Cover as something else. Fortunately the simplicity of the Carnimore Field Unit's function means that it needs only a small amount of computer resources, mainly memory, which makes it easy to hide under Cover as something else. Exactly how a unit is hidden depends on its type.

Below I describe three different types of Carnimore Field Unit Cover, how the Hiding Of Carnimore Traffic Effects can be done, the role of the Filter Expiration Time, and Individualized Internet Censorship.

[Click on (Back) button now.]

Stop Carnivore Web Site

The Stop Carnivore Web Site contained much information about Carnivore, Internet privacy, and related issues. As their name suggests, they have their own agenda, but I trust what they say much more than the FBI.

But it appears that the Live Web Page of their site, which was http://stopcarnivore.org/, has been taken down, for reasons unknown. To view an archived copy of the site, see the (Live Web Page: here, or the Cached Web Page: here). [ For some strange reason, the Stop Carnivor logo file sclogo2.gif wouldn't display when part of my Web site. ]

Altivore

Altivore is a nongovernment Carnivore replacement that was made available by Network ICE. Their Web Page (Live Web Page at http://www.networkice.com/altivore/, Cached Text Only: here), read:

Network ICE made Altivore available as source code in the C computer programming language (Live Web Page at http://www.networkice.com/altivore/altivore.c, Cached Web Page here.

If you are a technical person who understands computers and the Internet, then it will help you understand how Carnivore and Carnimore work.

[Click on (Back) button now.]

Carnimore Base Unit

The Carnimore Base Units are located behind locked doors, probably at sites controlled by an Intelligence agency. The Carnimore Base Units contain most of the complexity of the Carnimore system. Each unit accepts commands from the Bad Guys or their agents and does those commands with the help of Carnimore Field Units.

The functions of the Carnimore Base Unit are limited only by their size and programming. Multiple Carnimore Base Units are probably networked together and cooperating on some functions. Here are some of the functions they might do:

For more information, see:

Carnimore Field Unit

The Carnimore Field Unit is much simpler than the Carnimore Base Unit, but there are many more of them. Each Carnimore Field Unit can perform a few simple functions, but the functions can be applied and combined in many different ways, based on commands that it receives from controlling Carnimore Base Units.

The main function of the Carnimore Field Unit is to filter Internet Packets. It examines each Internet Packet that enters it and performs an action on each Packet before the Packet departs toward its destination. This filtering is controlled by the Carnimore Filter Control Table.

Carnimore Target Database

Another important part of the Carnimore Design is the Carnimore Target Database. It controls what Carnimore does. It contains a list of all the targets, such as Web Sites and Internet users, against which Carnimore has been commanded to do Intelligence And Counterintelligence functions. It also contains the type of function to do against each.

The Carnimore Target Database changes in response to the following.

IP Address Tracker

Most of the telephone network deals with telephone numbers. But people like to deal with names, not numbers. That is why there are telephone books and directory assistance, to help when we do not remember the numbers.

Similarly most of the Internet deals with numerical IP Addresses. Fortunately the Internet is a little more advanced than the telephone network because we hardly ever need to deal with numerical IP Addresses. Instead we can work with our alphabetic Internet login names and Web Site Domain Names such as "yahoo.com".

But Internet IP Addresses can change much more often than telephone numbers. You probably have a different IP Address every time you connect to the Internet. For Carnivore or Carnimore to be able to do its work on the Internet it must know whenever the IP Addresses of its targets change. This is the job of an IP Address Tracker.

An IP Address Tracker maintains a database that associates Internet user login names and Web Page Domain Names with their changing IP Addresses. In Carnimore the database is probably stored in Carnimore Base Units. It might be considered an automaticly updated part of the Carnimore Target Database.

If you want to see a simple IP Address Tracker then see the RADIUS processor in the Altivore source code. RADIUS is a common protocol used for Internet login with dial-up modems. If a Carnimore Field Unit at an ISP is on the same network as the modems receiving incoming calls then it could be commanded to do Packet Copying of all RADIUS Packets and send them to a Carnimore Base Unit where the user's IP Address could be tracked and recorded.

Similar tracking could be done with other login protocols, such as PPPoE (PPP Over Ethernet) used with DSL and cable TV modems, though technically PPPoE is an Ethernet protocol, not IP.

In the cases in which there are no Carnimore Field Units at an ISP, the IP Address Tracker information could be collected in another way. You might know that the ESS (Electronic Switching System) at the telephone company allows 3-way and conference calls on demand. This technology allows the telephone company and other knowledgable third parties to tap any telephone line on an ESS system. If the Bad Guys have the same control over the telephone network that they appear to have over the Internet then it would be a simple matter to silently tap the beginning of every telephone call to any telephone line known to be connected to a modem, or at least the lines of ISPs that can not be monitored by Carnimore Field Units. Each tap would connect the line to a Bad Guys' receive-only monitoring modem long enough to learn the user's new IP Address and send the information to a Carnimore Base Unit. It would require little hardware because the tapping modem could disconnect after a few seconds when the Internet connection is complete, and be available to tap the beginning of new call.

Carnimore Channel

An important part of the Carnimore Design is the Carnimore Channel. Carnimore Base Units need to communicate with each other and with Carnimore Field Units. They communicate through what I call Carnimore Channels.

A Carnimore Channel might be an overt regular Internet TCP connection. But because Carnimore Field Units are in the field, and are supposed to be a Secret, a Carnimore Channel might be a more covert channel and use a special protocol.

Packets moving through the channel might be disguised. For example, they might be disguised as FTP data Packets, or other types that would not arouse suspicion.

Packets moving through the channel might be made to appear to be coming from, and going to, completely different places. Each Router Carnimore Field Unit along the channel path could be commanded to recognize these special channel Packets and change the IP headers enough to make the packets appear different, but not enough to divert them from the next leg of the path to their destination.

It is probable that the data in the Carnimore Channel Packets would be encrypted with a simple but fast encryption algorithm, only enough to hide the data from casual observers.

[Click on (Back) button now.]

Carnimore Filter Control Table

An important part of the Carnimore Design is the Carnimore Filter Control Table. It controls how the Carnimore Field Unit filters Packets that try to pass through it. The contents of the table are are based on the contents of the Carnimore Target Database, and are changed by commands that come through Carnimore Channels from Carnimore Base Units.

Each entry in the Carnimore Filter Control Table consists of the following parts.

Entries in the Carnimore Filter Control Table can be added, deleted, or replaced by commands from Carnimore Base Units.

Carnimore Packet Selection Criteria

Each Carnimore Filter Control Table entry in the Carnimore Field Unit would specify values for the Carnimore Packet Selection Criteria. Zero or more of the selection criteria might be wild-cards, or don't-cares, meaning that any value in the Internet Packet matches the selection criteria. If a Packet does not match the criteria in any table entry then the Packet is ignored by the Carnimore Field Unit. The Packet passes through as if the Carnimore Field Unit were not there.

Here is a list of some possible Carnimore Packet Selection Criteria. It would be easy to add others, and probably there are others.

Carnimore Packet Action

When an Internet Packet entering a Carnimore Field Unit matches the Carnimore Packet Selection Criteria in its control table, the specified Carnimore Packet Action is done. Here are some possible actions.

Notice that only the action of Packet Copying is a Surveillance or Intelligence gathering action. All other actions are Counterintelligence actions meant to change the packet flow.

Notice also that some Carnimore Packet Actions can be combined. Packet Copying can be combined with most other actions. Packet Redirecting can be considered a combination of Packet Copying with Packet Discarding.

Filter Expiration Time

In the Carnimore Field Unit, each Carnimore Filter Control Table entry has a Filter Expiration Time. This is the time at which the Carnimore Filter Control Table entry is deleted, unless the entry is replaced with another entry with a later Filter Expiration Time.

The main reason for having a Filter Expiration Time is to help with the Hiding Of Carnimore. Using Filter Expiration Times is an easy way to make Carnimore Counterintelligence activities fail safe.

Some Carnimore Counterintelligence activities work by turning Carnimore Packet Actions, specifically Packet Discarding and Packet Delaying, on and off. An example of this is Web Page Delaying With Carnimore.

Carnimore Packet Actions are turned on and off by commands that add, replace, or delete Carnimore Filter Control Table entries. The commands come from a Carnimore Base Unit. If either the Carnimore Base Unit sending the commands, or the Carnimore Channel through which the commands are received, fails then a Carnimore Packet Action might not be turned off. If this happens then some Packets will be blocked until the failure is resolved. If it is a long time then suspicions might be aroused and the Carnimore Field Unit discovered.

This problem can be avoided by doing two things.

[Click on (Back) button now.]

Packet Copying

In this Carnimore Packet Action one Packet becomes two. One copy of the Packet continues to its intended destination. Another Packet, a copy of the first, is sent to a Carnimore Base Unit for other processing, such as storage in a surveylance database. It might not be an exact copy. It might be only part of the Packet, for example, the header.

The Packet goes to the Carnimore Base Unit through a Carnimore Channel.

This Carnimore Packet Action could be used for real time expanded Carnivore-like Intelligence gathering. But it could also be used in conjunction with various Counterintelligence functions. It all depends on what the Carnimore Base Unit does when it receives the Packet.

Packet Discarding

In this Carnimore Packet Action the Packet goes in but it never comes out. The intended receiver does not receive it.

This Carnimore Packet Action could be used for the Hiding Of A Web Page and Advertisement Blocking.

Packet Throttling

In this Carnimore Packet Action Packets that match the Carnimore Packet Selection Criteria are slowed down in some way to reduce the average transmission speed relative to what it would have been without interference. A specified average speed is in the Carnimore Filter Control Table entry with this action. Throttling can be done either by delaying Packet forwarding or simply discarding some Packets and forcing retransmission.

This Carnimore Packet Action could be used to make a Web Site, or a user's Internet Service, appear to be slow.

Packet Delaying

In this Carnimore Packet Action the Packet is held in the Carnimore Field Unit a while before being sent on its way. The delay can be specified either as a delay relative to the time each Packet arrives or as an absolute future time. The delay could be a very long time and have the effect of blocking.

This Carnimore Packet Action could be used for many different types of Internet Censorship.

If a Carnimore Filter Control Table entry that specifies Packet Delaying is deleted or replaced with one that does not specify Packet Delaying, then any Packets being held by the entry will be released and sent on their way.

Packet Redirecting

In this Carnimore Packet Action instead of being sent toward its intended destination, the Packet is sent to a Carnimore Base Unit. The Packet disappears, at least temporarily, as if discarded.

The Packet goes to a Carnimore Base Unit through a Carnimore Channel.

In theory this could be used for many things, depending on what the Carnimore Base Unit does with the Packet when it receives it. It is a way of letting a Carnimore Base Unit decide how to handle a Packet in the cases where the processing is complicated or would require excessive resources in a Carnimore Field Unit.

Packet Redirecting could be used for

Packet Changing

In this Carnimore Packet Action the Packet that comes out is different from the one that went in.

Any part of a Packet could be changed, including the headers. It might be necessary to recalculate a checksum after the change is made.

There are many possible uses of this Carnimore Packet Action. For example:

[Click on (Back) button now.]

Carnimore Field Unit Cover

Hiding Carnimore Field Units is an important part of the Hiding Of Carnimore.

Hiding Carnimore Field Units is more complicated than hiding Carnimore Base Units, because Carnimore Field Units are in the field. It is not practical for all the people that see a Carnimore Field Unit to agree to keep it Secret. So many Carnimore Field Units probably operate under Cover.

Fortunately the simplicity of the Carnimore Field Unit's function means that it needs only a small amount of computer resources, mainly memory, which makes it easy to hide under Cover as something else. Exactly how a unit is hidden depends on its type. Below I describe three different types of Cover for the Carnimore Field Unit.

[Click on (Back) button now.]

Other Carnimore Field Unit Functions

The main function of the Carnimore Field Unit is to filter Packets being sent and received by Internet users and take actions when they satisfy criteria in the Carnimore Filter Control Table. But there are other things for which a Carnimore Field Unit could be used.

Another possible function of a Carnimore Field Unit is to be a conduit of Bad Guys' Packets used in a malicious attack such as a denial of service (DoS) attack or a SPAM attack. The reason for using the Carnimore Field Unit for this is to disguise the origin of the attack.

Any computer connected to the Internet can be used as a source of these types of attacks. And there are ways to make difficult the tracing of the source of an attack. But using a Carnimore Field Unit can make this tracing much more difficult.

The Carnimore Field Unit could be used to launch a disguised attack. The Packets used in the attack would be sent through the Carnimore Channel that connects the Carnimore Field Unit to the Carnimore Base Unit, which is the actual origin of the attack. IP Addresses in the Packet headers would be faked to indicate that the attacks came from different computers, or nonexistant computers.

[Click on (Back) button now.]

Carnivore Carnimore Field Unit

Carnivore Carnimore Field Units are Carnimore Field Units that operate under Cover as Carnivore computers. Carnivore computers are located inside locked cages at ISPs. The computers contains software for both the Carnivore function and the Carnimore Field Unit function.

Only authorized FBI agents have physical access to the unit, mostly to collect the data that the computer as Carnivore has collected about the criminal suspect. The agents might or might not know that the computer is a Carnimore Field Unit also.

The ISP employees probably would not know. They would think that the computer is simply a Carnivore unit. When being used simultaniosly as a Carnimore Field Unit it will probably use little additional network bandwidth, a small fraction of whatever bandwidth is used by regular Internet traffic. So if the ISP employees do not do a precise analysis of the flow of Packets going in and coming out of the computer then they will not see evidence of filtering function.

Router Carnimore Field Unit

Router Carnimore Field Units are Carnimore Field Units that operate under Cover as Internet Router computers. Each computer contains software for the normal Internet routing functions and software for the Carnimore Field Unit functions.

Some Routers might be more useful as under Cover Carnimore Field Units than others. For example, the Routers at points known as Network Access Points (NAPs), Exchange Points (EPs), and ISP peer-to-peer connections, could filter Packets that move from one ISP to another. The Routers on major Internet backbones could filter Packets traveling long distances.

But Carnimore Field Unit functions are simple. If they are used correctly then they consume few resources, and can be easy to hide. It is possible that most Internet Routers are Router Carnimore Field Units.

Most of the employees of the ISP that uses the Routers probably would not know that their Routers contain Carnimore functions. If there were any employee Bad Guys there, then the number would probably be small.

It seems more probable that the persons that put, or allowed to be put, Carnimore functions into the Router computers, are employees of companies that manufacture the Routers. The number of companies that manufacture Internet Routers is much smaller than the number of companies that use them, and would be much easier to infiltrate to get a desired level of Internet Censorship.

How could the Carnimore Field Unit functionality be put into Routers and hidden? Here are some possibilities.

Whoever the people responsible for the placement of Carnimore functions into Router computers are, they are probably employees of both a private company and the Intelligence agency managing the Carnimore network for the Bad Guys. The private company might be a front company for the Intelligence agency. Remember that the Internet, known in its early days as ARPANET, was developed by the military.

Dedicated Carnimore Field Unit

The Dedicated Carnimore Field Unit is installed in a filtering hard tap of an Internet communications path carrying the traffic of great interest. For example, it might be in a path leaving the country, or in the Internet Service connection of a very sensitive target individual or organization.

The Dedicated Carnimore Field Unit and its tap are hidden physically. The unit might be located in an residence or office located near the target. The residence or office is the Cover.

Within the residence or office the same security procedures would apply as those for Carnimore Base Units. Only employees of the Intelligence agency managing the Carnimore network see the Dedicated Carnimore Field Unit.

Hiding Of Carnimore Traffic Effects

When a Carnimore Field Unit is active it changes the flow of Internet Packets passing through it. The change could reveal the presence of the unit, especially if the change causes an overload and noticeably slows regular traffic. Is this a problem? If it is then can it be solved?

Hiding the Packet traffic is not an issue with the Dedicated Carnimore Field Unit because agents of the Intelligence agency managing the Carnimore network have complete control of the Dedicated Carnimore Field Unit and the connections to it. But the Carnivore Carnimore Field Unit and Router Carnimore Field Unit are installed at commercial ISPs, and employees there have access to them.

If the ISP company employees do not do a precise analysis of the Packets going in and coming out of a computer Secretly acting as a Carnimore Field Unit, then they will not see evidence of anything unusual. This is true because a Carnimore Field Unit can be very useful without generating a large amount of additional Packet traffic.

Suppose a Carnimore Field Unit is used for the Intelligence gathering function of monitoring all Web browsing activity. The Carnimore Field Unit would be commanded to do Packet Copying for only the Web Page request Packets sent to Web servers, not the bigger and more numerous Web Page response Packets returned. The monitoring would add a relatively small amount of Packet traffic. The additional traffic would probably not be noticed.

Suppose a Carnimore Field Unit is used for the Intelligence gathering function of monitoring all e-mail that passed through the unit. The traffic generated by doing this would be more difficult to hide because the Carnimore Field Unit would be commanded to do Packet Copying for every Packet of every e-mail message. The Carnimore Base Unit does the message reassembly, keyword searching, archiving, and other functions, after the Packets arrive there.

A function such as full e-mail monitoring would generate a lot of additional Packet traffic, but there are ways to hide it.

Notice that some Carnimore Field Unit Counterintelligence functions, such as connection throttling and blocking, Advertisement Blocking, Web Page Pausing, and Web Page Delaying actually reduce Packet traffic. To some extent these functions will counteract the Packet traffic increase caused by other functions and reduce the need to hide it.

[Click on (Back) button now.]

Alphabetical Site Index