Skype: say we are not heard
Intelligence agencies seek full freedom to listen to Internet negotiations.
Among the many advantages that the Internet has revealed to us over the past decade, the development of free telephone calls between users stands out - and a significant reduction in the cost of calls for people who are not even connected to the Internet, since regular calls also began to be partially transmitted over the Internet. For people who work abroad, have friends or relatives in other parts of the world, or simply have to make frequent phone calls, this was great news. However, for the state security services, which previously had the opportunity to listen to telephone conversations through normal lines, this news became the reason for the loss of sleep and rest. The advent of telephony based on the Voice over Internet Protocol (VoIP) has become the cause of new conflicts and new agreements with the special services for Internet providers around the world.
')
The source of their common problems lies in the very nature of the Internet. In the old days of telecommunications, the route of a telephone call could be easily traced: an analog or digital connection was established between the two devices, so it was not too difficult for special services to choose a suitable place on the line (for example, at the telephone exchange nearest to the caller) to listen to the conversation.
On the Internet, the circumstances are completely different. All information, whether it's email, web pages, music files, or phone calls, is packaged in small data packets and then sent over the network. The route by which each packet is transmitted to its destination may differ from the previous one and they may be delivered in a very different order, or even not at all. If listening to a regular phone line can be compared with the arrest of a single suspect who is in his own house, listening to VoIP calls is more like trying to catch all the members of one gang while they are running around a busy city on many separate cars. This technological upheaval was the cause of the problems that faced the special services and companies-providers.
In the United States, the law that controls wiretapping of phone calls is called the Law on Assistance of Telecommunications Companies to Law Enforcement Agencies, or CALEA. It was adopted in 1994, when most Internet connections were too slow to transmit voice traffic, and VoIP software was still in its infancy. CALEA obligated telephone companies to assist in wiretapping requests. In 1995, a similar law followed in European legislation, which has since been widely applied and developed by national governments.
By 2004, US services such as the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration and the Department of Justice demanded strengthening of the legislative base in connection with the emergence of new forms of Internet communications, such as VoIP. They successfully lobbied for the Federal Communications Commission, which oversees the implementation of CALEA, so that the law also applies to Internet service providers.
These innovations have caused a friendly howl in the ranks of human rights groups, who argue that CALEA concerns only the interception of ordinary telephone lines. Internet providers also rose up against these changes, partly due to the fact that they will have to buy new equipment for wiretapping and organize the corresponding administration system with their own money. However, all these protests were rejected on the grounds that the extension of the CALEA rules to the Internet is a necessary step in the fight against terrorism. All broadband Internet access providers and VoIP providers were required to comply with the new rules by May 2007.
The European Telecommunication Standards Institute (ETSI), a non-profit organization, plays a key role in the implementation of legal interception in Europe. Along with the fact that many national laws already include a number of requirements for interception of the Internet, ETSI is currently promoting the European equivalent of innovations in CALEA.
The main problem for Internet operators is that CALEA and similar laws in other countries report only what operators have responsibilities regarding ensuring legal interception, but no one talks about HOW to satisfy these requirements. For example, CALEA announces that providers must be able to intercept calls in such a way that suspects cannot notice that they are being watched, but nothing is said about how to achieve this technically.
Easier said than done
In old Hollywood films, the suspect often realizes that they are listening to his conversation, due to the characteristic noise on the line, however, in fact, this problem was long ago resolved. Internet providers face a much more difficult technical task, because a computer can detect some kind of extraneous interference by measuring the connection “latency” - that is, the time it takes to transfer a packet of data from a local computer to another computer on the Internet. If an eavesdropping device appears in the chain, then it can increase the latency time and the technically savvy suspect will be able to guess that his connection is being monitored. According to CALEA, the Internet company is responsible for the lack of observation.
As a result, American Internet companies agreed with the requirements to install equipment for wiretapping, which will be in constant readiness to wait for the activation team if it is necessary to listen to someone’s conversation. The irony is that this will affect the overall security of the network. If any secret moves for government bodies appear in the system, then not only special services, but also outside thieves, rogues and other hackers will be able to use them.
But even with these holes in the system, the main problem for wiretapping is a huge amount of data that is transmitted over the Internet. Listening to an ordinary phone can be done directly in real time, and for an employee to collect evidence, it is enough to turn on the recording device at the time you start a conversation and simply note when the corresponding dialogues occur. When listening to the Internet would have to record much more serious amounts of information. The usual two megabyte channel is theoretically capable of skipping up to 650 gigabytes of data per month.
Understanding such a gigantic dump of potential evidence is an almost impossible task, and therefore government structures are trying not only to ensure their legitimate access to an inordinate mass of data that cannot be used. The trick is to know WHEN and HOW you need to listen - but CALEA and its followers can do little to help here.
Such circumstances require telecommunications companies and government organizations, both in Europe and the United States, to develop their own standards on how to identify and extract the necessary traffic, as well as the format in which the data should be transmitted to the authorities. A similar process took place with respect to regular telephone wiretapping, and service providers in fact tend to organize similar on the Internet. However, in the US, the relevant CALEA rules were published just a week before the law came into force last year and many companies still do not meet all its requirements.
But even if there are corresponding holes for unauthorized access, and all traffic is intercepted, there will still be another problem: encryption. Not all VoIP calls are encrypted: for example, the popular VoIP provider Vonage does not encrypt its packets when transferring calls over the Internet. Some companies encrypt their VoIP traffic, but most of them (including telecommunications companies and cable operators that provide VoIP services) are subject to CALEA or similar rules and are required to provide the necessary keys for decryption upon request to the authorities.
What about skype?
A striking exception to the picture described is the famous Skype , a VoIP system with 275 million users. This is the so-called "peer-to-peer" system, in which calls are transmitted not through any one server, but directly through the common Internet. Providers' companies technically cannot provide the secret services with the content of the suspect's call, unless it takes control of all possible traffic at all. And even if the investigators are able to track all the Internet connections of the suspect and catch his Skype call, at best they will be able to determine the duration of this call, since each of them is securely encrypted. At the moment, only the US National Security Agency has enough computing power to decrypt Skype packets, but even its listening capabilities are infinitely far from providing all the necessary wiretaps.
FBI requires Skype to develop a special hole in the system in case you need to listen to suspects, but these requirements are in no hurry to meet. Regarding the decryption of calls of suspects, Skype expresses “full readiness to cooperate, but only with authorized representatives”, and since the company is located in Europe, it falls outside the jurisdiction of CALEA.
European representatives are also unhappy that they are not able to listen to Skype calls. In November, the president of the German Federal Police filed a complaint that Skype encryption technology made it impossible for law enforcement officers to intercept conversations. In response to complaints, lawyers recommended infecting the computers of suspects with special viruses that would steal the keys to decrypt Skype.
The “Trojan” program will be stored in the computer’s memory of the suspect, find the keys to decrypt Skype and transfer them to the investigation. The Federal Court of Germany ruled that the information collected in a similar way cannot be used as evidence, but the lawyers reacted by introducing amendments to the law that still make it possible, citing "the significant and outrageous lacunae in our information that appeared as a result technical changes in recent years.
Similar opinions were also expressed in the UK. The director of the State Communications Authority (GCHQ), told members of parliament that Internet communications are “the biggest changes in telecommunications technology since the invention of the telephone. This is a real revolution. ” The entire complexity of the situation was demonstrated by the leadership of MI5, the British security service, which cited a number of evidence not to be disclosed outside the parliament.
Apparently, this conflict between the desire of the authorized bodies to control the negotiations of the criminals and the legitimate desire of citizens to keep private information secret will always exist. Anyway, the evidence from intercepted VoIP calls has not yet been used in court. E-mail messages are often used as evidence, since they are easy to get directly from the sender's or recipient's hard disk, or corporate backups, without any interception at the time of the transfer. But as soon as the intercepted traffic will be used as evidence, it will certainly trigger a new surge in discussions on civil liberties and Internet surveillance.
In the meantime, technology is moving forward. The programmer who developed the popular encryption algorithm with a very high level of “Pretty Good Privacy” protection, Phil Zimerman, is currently working on another free VoIP application called Zfone . The encryption system of this product promises an even higher level of resistance to wiretapping attempts than those that are achieved today. This is good news for anyone who seeks to keep their negotiations secret - no matter what motives.
Translation from English:
Roman Ravve
Crossposted from worldwebstudio
Among the many advantages that the Internet has revealed to us over the past decade, the development of free telephone calls between users stands out - and a significant reduction in the cost of calls for people who are not even connected to the Internet, since regular calls also began to be partially transmitted over the Internet. For people who work abroad, have friends or relatives in other parts of the world, or simply have to make frequent phone calls, this was great news. However, for the state security services, which previously had the opportunity to listen to telephone conversations through normal lines, this news became the reason for the loss of sleep and rest. The advent of telephony based on the Voice over Internet Protocol (VoIP) has become the cause of new conflicts and new agreements with the special services for Internet providers around the world.
')
The source of their common problems lies in the very nature of the Internet. In the old days of telecommunications, the route of a telephone call could be easily traced: an analog or digital connection was established between the two devices, so it was not too difficult for special services to choose a suitable place on the line (for example, at the telephone exchange nearest to the caller) to listen to the conversation.
On the Internet, the circumstances are completely different. All information, whether it's email, web pages, music files, or phone calls, is packaged in small data packets and then sent over the network. The route by which each packet is transmitted to its destination may differ from the previous one and they may be delivered in a very different order, or even not at all. If listening to a regular phone line can be compared with the arrest of a single suspect who is in his own house, listening to VoIP calls is more like trying to catch all the members of one gang while they are running around a busy city on many separate cars. This technological upheaval was the cause of the problems that faced the special services and companies-providers.
In the United States, the law that controls wiretapping of phone calls is called the Law on Assistance of Telecommunications Companies to Law Enforcement Agencies, or CALEA. It was adopted in 1994, when most Internet connections were too slow to transmit voice traffic, and VoIP software was still in its infancy. CALEA obligated telephone companies to assist in wiretapping requests. In 1995, a similar law followed in European legislation, which has since been widely applied and developed by national governments.
By 2004, US services such as the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration and the Department of Justice demanded strengthening of the legislative base in connection with the emergence of new forms of Internet communications, such as VoIP. They successfully lobbied for the Federal Communications Commission, which oversees the implementation of CALEA, so that the law also applies to Internet service providers.
These innovations have caused a friendly howl in the ranks of human rights groups, who argue that CALEA concerns only the interception of ordinary telephone lines. Internet providers also rose up against these changes, partly due to the fact that they will have to buy new equipment for wiretapping and organize the corresponding administration system with their own money. However, all these protests were rejected on the grounds that the extension of the CALEA rules to the Internet is a necessary step in the fight against terrorism. All broadband Internet access providers and VoIP providers were required to comply with the new rules by May 2007.
The European Telecommunication Standards Institute (ETSI), a non-profit organization, plays a key role in the implementation of legal interception in Europe. Along with the fact that many national laws already include a number of requirements for interception of the Internet, ETSI is currently promoting the European equivalent of innovations in CALEA.
The main problem for Internet operators is that CALEA and similar laws in other countries report only what operators have responsibilities regarding ensuring legal interception, but no one talks about HOW to satisfy these requirements. For example, CALEA announces that providers must be able to intercept calls in such a way that suspects cannot notice that they are being watched, but nothing is said about how to achieve this technically.
Easier said than done
In old Hollywood films, the suspect often realizes that they are listening to his conversation, due to the characteristic noise on the line, however, in fact, this problem was long ago resolved. Internet providers face a much more difficult technical task, because a computer can detect some kind of extraneous interference by measuring the connection “latency” - that is, the time it takes to transfer a packet of data from a local computer to another computer on the Internet. If an eavesdropping device appears in the chain, then it can increase the latency time and the technically savvy suspect will be able to guess that his connection is being monitored. According to CALEA, the Internet company is responsible for the lack of observation.
As a result, American Internet companies agreed with the requirements to install equipment for wiretapping, which will be in constant readiness to wait for the activation team if it is necessary to listen to someone’s conversation. The irony is that this will affect the overall security of the network. If any secret moves for government bodies appear in the system, then not only special services, but also outside thieves, rogues and other hackers will be able to use them.
But even with these holes in the system, the main problem for wiretapping is a huge amount of data that is transmitted over the Internet. Listening to an ordinary phone can be done directly in real time, and for an employee to collect evidence, it is enough to turn on the recording device at the time you start a conversation and simply note when the corresponding dialogues occur. When listening to the Internet would have to record much more serious amounts of information. The usual two megabyte channel is theoretically capable of skipping up to 650 gigabytes of data per month.
Understanding such a gigantic dump of potential evidence is an almost impossible task, and therefore government structures are trying not only to ensure their legitimate access to an inordinate mass of data that cannot be used. The trick is to know WHEN and HOW you need to listen - but CALEA and its followers can do little to help here.
Such circumstances require telecommunications companies and government organizations, both in Europe and the United States, to develop their own standards on how to identify and extract the necessary traffic, as well as the format in which the data should be transmitted to the authorities. A similar process took place with respect to regular telephone wiretapping, and service providers in fact tend to organize similar on the Internet. However, in the US, the relevant CALEA rules were published just a week before the law came into force last year and many companies still do not meet all its requirements.But even if there are corresponding holes for unauthorized access, and all traffic is intercepted, there will still be another problem: encryption. Not all VoIP calls are encrypted: for example, the popular VoIP provider Vonage does not encrypt its packets when transferring calls over the Internet. Some companies encrypt their VoIP traffic, but most of them (including telecommunications companies and cable operators that provide VoIP services) are subject to CALEA or similar rules and are required to provide the necessary keys for decryption upon request to the authorities.
What about skype?
A striking exception to the picture described is the famous Skype , a VoIP system with 275 million users. This is the so-called "peer-to-peer" system, in which calls are transmitted not through any one server, but directly through the common Internet. Providers' companies technically cannot provide the secret services with the content of the suspect's call, unless it takes control of all possible traffic at all. And even if the investigators are able to track all the Internet connections of the suspect and catch his Skype call, at best they will be able to determine the duration of this call, since each of them is securely encrypted. At the moment, only the US National Security Agency has enough computing power to decrypt Skype packets, but even its listening capabilities are infinitely far from providing all the necessary wiretaps.
FBI requires Skype to develop a special hole in the system in case you need to listen to suspects, but these requirements are in no hurry to meet. Regarding the decryption of calls of suspects, Skype expresses “full readiness to cooperate, but only with authorized representatives”, and since the company is located in Europe, it falls outside the jurisdiction of CALEA.
European representatives are also unhappy that they are not able to listen to Skype calls. In November, the president of the German Federal Police filed a complaint that Skype encryption technology made it impossible for law enforcement officers to intercept conversations. In response to complaints, lawyers recommended infecting the computers of suspects with special viruses that would steal the keys to decrypt Skype.
The “Trojan” program will be stored in the computer’s memory of the suspect, find the keys to decrypt Skype and transfer them to the investigation. The Federal Court of Germany ruled that the information collected in a similar way cannot be used as evidence, but the lawyers reacted by introducing amendments to the law that still make it possible, citing "the significant and outrageous lacunae in our information that appeared as a result technical changes in recent years.
Similar opinions were also expressed in the UK. The director of the State Communications Authority (GCHQ), told members of parliament that Internet communications are “the biggest changes in telecommunications technology since the invention of the telephone. This is a real revolution. ” The entire complexity of the situation was demonstrated by the leadership of MI5, the British security service, which cited a number of evidence not to be disclosed outside the parliament.
Apparently, this conflict between the desire of the authorized bodies to control the negotiations of the criminals and the legitimate desire of citizens to keep private information secret will always exist. Anyway, the evidence from intercepted VoIP calls has not yet been used in court. E-mail messages are often used as evidence, since they are easy to get directly from the sender's or recipient's hard disk, or corporate backups, without any interception at the time of the transfer. But as soon as the intercepted traffic will be used as evidence, it will certainly trigger a new surge in discussions on civil liberties and Internet surveillance.
In the meantime, technology is moving forward. The programmer who developed the popular encryption algorithm with a very high level of “Pretty Good Privacy” protection, Phil Zimerman, is currently working on another free VoIP application called Zfone . The encryption system of this product promises an even higher level of resistance to wiretapping attempts than those that are achieved today. This is good news for anyone who seeks to keep their negotiations secret - no matter what motives.
Translation from English:
Roman Ravve
Crossposted from worldwebstudio
Source: https://habr.com/ru/post/31568/
All Articles