Carnivore substitute keeps Feds honest
The NetWitness package can separate data to ensure strict, minimal compliance with a pen register or trap and trace order, and later associate the original content if a search warrant or a wiretap warrant is issued, Forensics Explorers General Manager Mark Longworth told The Register.
Because Carnivore is capable of capturing far more data than a pen register or trap and trace order is meant to make available, an ISP may well prefer to install its own kit rather than trust Carnivore operators to stick to the letter of the law.