Australian VoIP service providers must keep interception channels open for law enforcement following a legislative review which IT Minister Helen Coonan has endorsed.
Recognizing the disruptive nature of VoIP technology, the federal government undertook a review late last year to assess whether changes need to be made to the Telecommunications Act to facilitate wiretapping by law enforcement.
The review, which is currently before the minister, has recommended keeping VoIP channels open and is in line with similar moves in the US where the government has amended the Communications Assistance for Law Enforcement Act (CALEA) to extend regulation to VoIP services.
A spokesperson for Senator Coonan said the government is supporting recommendations in the report, which is entitled Examination of Policy and Regulation Relating to VoIP Services, to keep interception channels open.
However, industry analysts and even vendors argue that opening permanent interception channels for law enforcement inadvertently exposes user privacy to hackers and places too much trust in third-party companies, contracted to relay information to legal bodies.
Even Internet founder Vinton Cerf and former National Security Agency encryption scientist Clinton Brooks have warned that keeping channels open will introduce new cybersecurity problems and will require a massive re-engineering of the Internet.
The uproar is a prime example of technology versus legislation. Governments around the world are wrestling with the impact of VoIP on telecomms regulation.
Not surprisingly, Australia is following the US lead by mandating that interception channels are kept open for law enforcement to undertake wiretapping.
Tracking VoIP calls is more difficult than tracking calls on the traditional telephone network because providers have little control over how their calls are routed across the Internet.
It raises serious, cross-jurisdictional problems for law enforcement, not to mention privacy problems and the fact that VoIP calls will open the Internet to new vulnerabilities.
VoIP technology is changing the communications regulatory framework but also raising serious privacy concerns. VoIP wiretapping requires law enforcement to have access to both customer data from the VoIP providers and real-time tracking of calls routed across the Internet.
Sun Microsystems chief security officer Whitfield Diffie said such a move would open the Internet to new vulnerabilities.
"You find yourself with a technologically very, very complicated problem," he said, adding that such a system could be built but it would require a substantial R&D effort to reduce vulnerabilities.
"It would be difficult to apply the US Federal Communications Commission (FCC) ruling to VoIP calls worldwide; these things do not respect borders."
If wiretapping rulings are enforced, Internet founder Vint Cerf said all kinds of Internet applications would be monitored.
"I don't see any way to constrain or restrict the target of the intercept to simply voice, because, in fact, every application would have to be effectively treated in the same fashion. There's no way to tell what the bits mean in the packets that are flowing."
Local telecommunications analyst Paul Budde said the Australian VoIP regulation is unsustainable as the Telecommunications Act applies to simplistic PSTN networks.
"Ultimately, the [VoIP] regulations are created by politicians who are trying to rubber-stamp PSTN laws on complex VoIP infrastructure," he said.
"All it will do is cause a political ruckus between politicians who cannot back down, and the providers who are faced with reality."
Because VoIP operates on different protocols, it is only possible to tap connections routed through a PTSN switch.
Budde says this leaves other VoIP channels regulation-free.
"Peer-to-peer networks are impossible to wiretap because they operate independent of a PSTN... they function completely over the Internet, have no main server and are even encrypted," he said.
Peer-to-peer provider Skype says the multiple paths that peer-to-peer communication can take, makes tapping exceedingly difficult and the encryption used is almost indecipherable since users are not required to keep decoding keys.
"Skype uses an advanced encryption standard which is also used by US government organizations to protect sensitive information. Skype uses 256-bit encryption [256-bit AES], which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message," a spokesperson said.
According to the US National Institute of Science and Technology, "It would take a computer using present-day technology approximately 149 thousand-billion (149 trillion) years to crack a 128-bit AES key... AES has the potential to remain secure well beyond 20 years."
But it goes even further; other real-time applications include instant messaging and multi-player online gaming, which also fall under wiretapping laws.
Nemertes Research president Johna Till Johnson said designing a system open for lawful wiretapping will always expose it to malicious security threats.
"Any time you architect a system to be wiretapped by X, it can be wiretapped by Y", she said.
But hardest hit are Internet services providers. The cost of becoming wiretap-enabled is a burden providers must wear; a situation Freshtel CEO Michael Carew says will cause smaller players to go bust.
"You will find a lot of small VoIP businesses that want to get into the marketplace will lose out when regulations demand they [implement wiretapping capabilities]. They will have to tear apart their entire infrastructure and simply won't be able to afford it," he says.
And what about users? Third-party surveillance requires VoIP calls to be piped from ISPs, where the data is analyzed and extracted by court order.
The danger, according to privacy advocates the Electronic Frontiers Foundation, is not only in the piping of information, but in trusting third-parties with sensitive information.
"The transaction leaves personal data potentially vulnerable when it travels from the service provider's network to [the third-party]. It also places the personal data of people [in their] hands without customer consent," an EFF spokesperson said.
Even a report by the US Department of Justice Inspector General admits enforcing CALEA with ISPs is a costly exercise.
"A VoIP provider will pay about $US100,000 to a trusted third-party to develop its CALEA solution," the report said.
"In addition, the party will charge a monthly fee of $US14,000 to $15,000 and $2000 for each intercept. These amounts do not include the cost of labour for writing code into the software to accommodate the CALEA solution. [Telephone company] officials were concerned that the government would mandate that every new feature would have to be CALEA-compliant prior to being offered to the public."
Codifying bad ideas into law
by Johna Till JohnsonEarlier this year, news broke that unnamed bad guys had been wiretapping the Vodafone cellular network in Greece from just before the Athens Olympics in August 2004 until March 2005.
Targets reportedly included Greek Premier Costas Caramanlis, the mayor of Athens and senior state security officials -- along with senior military officers, human rights activists, journalists, Arab businessmen and the US Embassy.
The leak was ultimately traced to software installed in the switches to enable the lawful intercept of traffic, which had been hijacked by rogue programmers. That's right: Ericsson put wiretapping software in its switches to comply with legal requirements -- and the bad guys used it in decidedly illegal ways. What a surprise.
As you might expect, plenty of finger-pointing has ensued. Vodafone blames Ericsson, saying it had no idea the switches contained wiretapping software -- a claim adamantly denied by Ericsson's Greek CEO, Bill Zikou, who maintains that Ericsson provided all relevant details about the switches' capabilities to Vodafone management and says the responsibility to protect subscribers was with Vodafone.
And everybody blames the Greek government for failing to expose and remediate the situation in a timely fashion. Disturbingly, nobody seems quite sure of the culprits' identities, let alone their motives (though the selection of targets seems to clearly imply political aims). In one of the funnier moments during the whole episode, the Greek government initially denied the possibility the culprits could be Greek, on the theory that Greek geeks lack the technical knowledge necessary to pull off such a sophisticated hack -- surely news to the many world-class computer scientists and engineers who hail from Hellas.
So here's the thing: as I noted previously, law enforcement agents need the tools to do their jobs. But building "tapability" into networks isn't the way to make that happen. Whether you're more concerned about unauthorized government intrusion or attacks by criminally minded geeks (and history suggests you should fear both), embedding tapability into the network is a bad idea.
Too bad we've codified this particular bad idea into our law.
Johna Til Johnson is president and senior founding partner at Nemertes Research, an independent technology research firm.