The Economist : Tapping VoIP Presents HUGE Law Enforcement Challenge

Monday, March 10, 2008

…..Around the world, the emergence of voice-over-internet-protocol (VoIP) telephony is forcing authorities and communications firms into both conflict and co-operation.  Their shared problem is a fundamental one that results from the very nature of the internet.  In the old world of telecoms, the path of a call was easy to follow: a continuous analogue or digital connection was established between the two parties, so it was easy for investigators to select a point somewhere along the line (at the telephone exchange nearest to the caller, for example) to tap the call.  On the internet things are very different.  All information, whether e-mails, web pages, music downloads or voice calls, is chopped up into small packets of data and fired off across the network.  The path one packet takes across the sprawling network may be different from the path of the next, and packets may arrive at the destination out of order, or not arrive at all.  If intercepting a traditional phone call is like apprehending a single suspect at his home, eavesdropping on a VoIP call is more like trying to capture all the members of a gang as they cross a busy city in a fleet of separate vehicles.  This technological shift is at the heart of the practical problems faced by law-enforcement officers and communications companies.  In America the law that governs what people in the trade call “lawful intercept” is the Communications Assistance for Law Enforcement Act (CALEA).  It was introduced in 1994 when most internet connections were too slow to be used for voice traffic, and VoIP software was still in its infancy.  CALEA imposed rules on traditional telecoms firms, requiring them to co-operate with wiretap requests…..By 2004 American law enforcement agencies including the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration and the Department of Justice were calling for new powers in response to the emergence of new forms of internet communication, such as VoIP.  They successfully lobbied the Federal Communications Commission, the regulatory body that oversees the implementation of CALEA, to extend the rules to cover internet-access providers.  “Only America’s NSA is thought to have the computing power to unscramble Skype packets.”  The move sparked an outcry from civil-liberties groups, who argued that CALEA was only ever intended to allow wiretapping of traditional telephones.  Internet-access firms also lobbied against the changes, in part because buying interception equipment and establishing the administrative systems to deal with law-enforcement demands would cost them money.  But all these objections were overruled on the grounds that extending CALEA to the internet was a necessary step to fight terrorism.  All broadband-internet and VoIP providers were ordered to comply with the new rules by May 2007.  The European Telecommunications Standards Institute (ETSI), a non-profit industry body, plays a key role in the implementation of lawful intercept in Europe.  Although many national laws include provisions for internet wiretapping, ETSI is currently in the process of establishing the procedures that will allow the CALEA extension to be echoed in Europe.  For internet operators, the biggest gripe with CALEA and similar laws in other countries is that they are told what their lawful-intercept obligations are, but not how to meet them.  For example, CALEA specifies that firms must be able to intercept calls in such a way that suspects cannot tell that they are under surveillance, but it does not say how to do this.

That suspects can be alerted to a traditional wiretap by noise on the line is an old Hollywood cliché, but the problem was in fact solved long ago.  Compliance is much more complicated for internet providers, because when the device on the end of the line is a computer rather than a telephone, any funny business can be detected by measuring the “latency” of the connection—in essence, the time taken for a single packet of data to travel from a local machine to a computer elsewhere on the internet.  Inserting bugging equipment into the chain can increase the latency, and thus reveal to a technically sophisticated suspect that his connection is being tapped.  Under CALEA, it is the internet company’s fault if the investigators’ cover is blown in this way.  As a result, American internet companies have agreed with regulators to leave lawful-intercept equipment permanently in place so that it can be activated on an individual’s connection as required.  The irony is that this may actually reduce the security of the network.  Just as insisting that all door locks should open when a special government key is inserted, building a backdoor into everybody’s connection may actually make it easier for malicious hackers, as well as legitimate investigators, to intercept traffic.  And even with this backdoor, the biggest problem facing eavesdroppers is the sheer volume of data coursing across the internet.  Surveillance of a traditional telephone circuit can be carried out in real time by agents who merely have to switch on a tape recorder to collect evidence, and note down when relevant conversations take place.  The quantity of information that can be recorded by a lawful-intercept operation on the internet, by contrast, is much greater.  A typical two-megabit-per-second broadband connection is theoretically capable of downloading 650 gigabytes of data in a month.  Sorting through such enormous piles of potential evidence for something incriminating is a daunting task, so governments are keen to ensure that the extension of lawful intercept to the internet does not simply result in the indiscriminate hoovering up of masses of data that investigators are then unable to handle.  The trick is deciding when and how to listen—but again, CALEA and its progeny in other countries are little help.  This has prompted telecoms firms and government agencies in both Europe and America to develop their own standards to decide how to target and extract relevant network traffic, and how the resulting data should be formatted and delivered to investigators.  A similar process was necessary for traditional wiretapping, and there is a genuine desire among service providers to make it work on the internet…..

Even with the backdoors in place and rules agreed on how and when traffic should be intercepted, there is another problem: encryption.  Not all VoIP calls are encrypted: Vonage, a popular VoIP provider, does not encrypt the packets of data that carry its calls across the internet.  Some companies do encrypt their VoIP traffic, but most of them (including telecoms firms and cable operators that offer VoIP services) are subject to CALEA or equivalent rules, so they must provide law-enforcement agencies with the necessary decryption keys if asked to do so.  The glaring exception to all this is Skype, the world’s most popular VoIP system, with over 275m users.  It is a “peer-to-peer” system in which calls are routed entirely over the public internet.  The firm cannot provide investigators with access to suspects’ calls, since it does not handle any of the traffic itself.  And even if investigators intercept a Skype call by tapping a suspect’s internet connection, its strong encryption means they are likely to be able to determine only the time and the duration of the call.  Only America’s National Security Agency is thought to have the raw computing power required to unscramble Skype packets, and its intelligence-gathering efforts are far removed from day-to-day law enforcement and the collection of evidence for prosecutions.  The FBI has been pressing Skype to build a special backdoor into its software for lawful-intercept purposes, but so far it is thought not to have complied.  Skype’s cryptic position on lawful intercept is that it “co-operates fully with all lawful requests from relevant authorities”, but since it is based in Europe it is not subject to the recent extension to CALEA.  European authorities are also frustrated at their inability to tap Skype calls.  In November the president of Germany’s federal police complained that the encryption technology used by Skype makes it impossible for his officers to listen in on conversations.  In response, legislators have proposed using a technique favoured by cyber-criminals to grab Skype decryption-keys directly from suspects’ computers.  This would involve covertly installing “Trojan” software on a suspect’s machine that could retrieve Skype keys and pass them back to investigators.  A German federal court has ruled that data gathered in this way would be inadmissible as evidence, but legislators responded by drafting a change in the law that would allow it, citing “a serious and scandalous hole in our information that has arisen through technical changes in recent years”.  Similar concerns have been expressed in Britain.  In his submission as part of an annual assessment of the effectiveness of the British security services, the director of GCHQ, the government’s communications headquarters, told members of parliament that internet communication represented “the biggest change in telecoms technology since the invention of the telephone.  It is a complete revolution.”  The difficulty of the task was underlined by the evidence from the head of MI5, Britain’s domestic intelligence service, though his full comments are censored in the public version of the report.  As with other internet technologies and real-world rules, the authorities will probably always be behind in their bid to eavesdrop on criminals, and the legitimate desire for privacy and security will continue to come into conflict with the needs of law enforcement.  So far, evidence from intercepted VoIP calls has not been used in court; e-mails are often presented as evidence, but they are easily retrieved direct from the hard disks of the sender or receiver, or from corporate back-up tapes, rather than being intercepted in transit.  But once intercepted traffic is presented as evidence, it is sure to reignite the debate over civil liberties and internet wiretapping.  Meanwhile, the technology continues to evolve.  Phil Zimmerman, the programmer who developed “Pretty Good Privacy”, a popular and highly secure encryption algorithm, is now working on a free VoIP product called Zfone.  Its scrambling system promises to be even more opaque to wiretaps than existing encryption techniques.  That will be good for anyone who wishes to keep their communications secret—whatever their motives.  But it will be more bad news for any investigators trying to listen in.

Reference :

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: