Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Privacy The Internet United States

FCC Rules VoIP Must Be Tappable 568

pengie2 writes "The FCC has unanimously approved the U.S. Justice Department's bid to expand CALEA to broadband and VoIP networks, according to reports from SecurityFocus and News.com. This means, following a mandatory public comment period, service providers will have to wire their networks for easy law enforcement surveillance, the way phone companies do now. The feds have wanted this for a long time." Ebon Praetor adds a link to Reuters' version, writing "In addition, the FCC has decided that the push-to-talk, or walkie-talkie, functions available on phones from Nextel should also be subject to the same tapping regulations that regular phones are."
This discussion has been archived. No new comments can be posted.

FCC Rules VoIP Must Be Tappable

Comments Filter:
  • by AcquaCow ( 56720 ) * <acquacow@nOspAM.hotmail.com> on Wednesday August 04, 2004 @06:52PM (#9884002) Homepage
    is the FCC getting more permission to sniff my packets...
  • by GoClick ( 775762 ) on Wednesday August 04, 2004 @06:53PM (#9884009)
    I guess me and my terrorist buddies will just have to go back to using encrypted email.
    • by LostCluster ( 625375 ) * on Wednesday August 04, 2004 @06:56PM (#9884043)
      That's good enough for the spooks. See, even if you encrypt the content of your e-mail, you can't encrypt the headers. Sure, "subject" can be filled with nonsense, but the address is good enough to draw a line that says "X said something to Y at this date/time" which is still useful info in an intel puzzle...
      • Do try harder (Score:5, Insightful)

        by GoClick ( 775762 ) on Wednesday August 04, 2004 @07:00PM (#9884090)
        Oh there are plenty of ways to get around that sort of stuff, besides I wouldn't think most terrorists are using one of the big 5 american ISPs atleast not on both ends.

        How about encrypt and encode your messages into images and then post them on places like fark or deviantart? Simple enough. I'm not stupid why would a terrorist be?

        How about our good friends in the government get off their lazy asses and start passing legislations that will make people hate us less not more?
        • by Anonymous Coward on Wednesday August 04, 2004 @07:35PM (#9884409)
          "How about our good friends in the government get off their lazy asses and start passing legislations that will make people hate us less not more?"

          People have been hating us since the beginning. That King George was pretty pissed off. Then there's that whole Hawaii thing. Or the Phillipines. So what makes the present special?
        • Re:Do try harder (Score:5, Insightful)

          by tsm_sf ( 545316 ) on Wednesday August 04, 2004 @08:29PM (#9884888) Journal
          I'm not stupid why would a terrorist be?

          The only quality that a terrorist has in spades is FANATICISM. Did Timmy McVeigh sound all that intelligent to you? Do Bin Laden's broadcasts show an analytical mind? Does the IRA really seem to have it together, organizationally speaking?

          Why then the assumption that they're magnitudes of times more intelligent than the rest of the lusers out there?
          • Re:Do try harder (Score:4, Insightful)

            by moof1138 ( 215921 ) on Wednesday August 04, 2004 @09:26PM (#9885237)
            While I am sure that you would like all terrorists to be idiots, it is pretty clear from the methods of operation of past attacks that terrorist minds can be clever. Sept. 11 had a fair amount of planning and coordination involved. An organization that had resources to get that many members up to speed on how to fly jumbo jets could get members to learn how to effectively use a computer to communicate in clever ways.
        • Re:Do try harder (Score:5, Insightful)

          by NanoGator ( 522640 ) on Wednesday August 04, 2004 @08:36PM (#9884932) Homepage Journal
          "I'm not stupid why would a terrorist be?"

          To be fair, fingerprints are a well known aspect of catching criminals. Despite that, people are still busted because they left fingerprints behind.

          Think about that a bit before going into the "This is easy enouhg to bypass" rationale.
      • by Carnildo ( 712617 ) on Wednesday August 04, 2004 @07:09PM (#9884172) Homepage Journal
        Steganography. Hide your message in an image posted to alt.binaries.pictures.erotica. The feds might be able to figure out that a message was sent, but they won't have a clue who the recipient was.
        • by RealAlaskan ( 576404 ) on Wednesday August 04, 2004 @07:31PM (#9884369) Homepage Journal
          Steganography. Hide your message in an image posted to alt.binaries.pictures.erotica.

          You don't need stegan-what-he-said. The picture can be the message. When the picture on a webpage changes, you carry out your instructions.

          Someone is going to point out that anyone stupid enough to fly a plane into a building might have difficulty with advanced topics like steganography. Someone else is going to say that the NSA can crack it. That's all nonsense: folks have been putting a candle in the window as a signal for as long as there have been candles and windows, and the internet is a far more visible yet far less obvious way to send a signal.

          • by timeOday ( 582209 ) on Wednesday August 04, 2004 @09:02PM (#9885083)
            You don't need stegan-what-he-said. The picture can be the message. When the picture on a webpage changes, you carry out your instructions.
            But your method only communicates one bit (presense or absense of the image). So how do they know what instructions to execute when they see that image? The instructions must be prearranged through some higher bandwidth medium. Ideally, that would be face-to-face communication at a time and place distant from sending the bit. But that is very limiting when you're trying to run a global jihad. You could prearrange a huge catalog of messages, but you'll still be severely limited unless you leverage combinatorics - forming something like an alphabet. But then (whoops!) you're right back to cryptography and the messages might get cracked.

            Your method is indeed hard to defeat, but mostly because it's so severely limited in expressive power.

        • Neither will the recipient.

          This won't suffice as a full method of communication like calling someone up or sending someone an e-mail, because the two parties have to establish when the message is going to be sent, where it will be sent to, and how the recipient will pick up and decode the message. If that was done over a tapped VoIP line the fact that you encrypted and attempted to hide the payload is kind of beside the point.
        • by DavidBrown ( 177261 ) on Wednesday August 04, 2004 @07:59PM (#9884602) Journal
          Forget posting to Usenet, post to /. as an anonymous coward, type something supporting Microsoft and attacking Linux, followed by your terrorist communication. Get modded down to -1, and most people will never see your message anyway.

          Unless it's funny. That's why Al Quaida had to stop using it's initial protocol, which consisted of references to Natalie Portman and hot grits being poured into pants.

          The number of question marks in the typical underwear gnomes joke - that's code too, if you know what it means. The frequent use of Admiral Ackbar saying "It's a trap" on www.fark.com - code. "In Soviet Russia..." jokes - not code, but that's just to throw us off.

      • by thedillybar ( 677116 ) on Wednesday August 04, 2004 @07:25PM (#9884315)
        >"X said something to Y at this date/time" which is still useful info in an intel puzzle...

        But clearly not enough for their intel. The feds aren't asking VoIP companies to keep call logs that can be reviewed by subpoena. They're asking for the ability to actually tap the calls. Big difference.

      • by kfg ( 145172 ) on Wednesday August 04, 2004 @07:32PM (#9884377)
        If I were a terrorist interested in using the internet to pass messages the spooks would have a hard time even knowing where to look for it amongst the noise.

        And once they'd found it, and decrypted it, they'd still be left having to crack the code.

        "Honey, could you pick up a chicken on the way home?" might mean "rent a van," "deliver the bomb now," or "Honey, could you pick up a chicken on the way home?"

        The spooks are good, I'll give them that. I'll assume they'll crack my messages. . .given time, so I just won't give them that time.

        KFG
        • "The spooks are good, I'll give them that. I'll assume they'll crack my messages. . .given time, so I just won't give them that time."

          The problem with your logic is that it assumes that this is simple enough that every would-be terrorist would just do it that way.

          a.) Not looking would be painful if somebody managed to get away with it. Just on the off chance that something MIGHT have been found.

          b.) It's simple enough to wipe your fingerprints off a gun or a glass, yet there are people who still don't
      • It's trivial to disguise who you're sending a message to on the Internet. Consider the alt.binaries.warez groups for one of the first examples... you know that X said something, but you have no idea who to. And when you can leave a message just by doing a search on a site that shows "recent searches", you don't really know that "X said something".

        The Internet is full of drop boxes and cutouts and other opportunities to play well-publicised spy shenanigans. And when you consider that a rotten log in a park in Berlin was secure enough to avoid the attention of most of the East German spy apparatus for a couple of months, there's really no chance that any credible level of signals intelligence will find an even modestly competent bad guy.
      • Yeah, traffic analysis can yield intel even if the content is unknown. However, it's also pretty easy to defeat. A simple cron job is all it takes -- all you need to do is send messages of a fixed size (or of random size within a given range) on a regular schedule. If you want to get fancy, you send it to a bunch of decoy addresses as well as the intended recipients.

        If you have real data to send, it gets encrypted and goes out in the next scheduled transmission. If not, you encrypt and send some worth

  • Encryption anyone? (Score:5, Insightful)

    by Anonymous Coward on Wednesday August 04, 2004 @06:53PM (#9884010)
    Encryption should be so much easier with VOIP, since the data is already digital...
    • Sure, but encryption is much easier with e-mail too. Just because it's much easier doesn't mean anyone will implement or use it.

      Why would people start encrypting phone calls when they won't even use PGP? After all, phones haven't been encrypted in the past anyway.

      • Because people started emailing before encryption capability was integrated in "user-level" (i.e., AOL/Outlook level) software. Witness Skype as an example of why VoIP is different.
    • by 0x0d0a ( 568518 ) on Thursday August 05, 2004 @03:11AM (#9886631) Journal
      Whoever thinks that they are going to wiretap all VoIP networks at the FBI is living in dreamland. Let's take a brief look at a quick VoIP system that I'm going to design. I'll even publish the source code, right here on Slashdot. It will take me a few seconds to write:

      # smallvoip.sh
      # VoIP software capable of bypassing FBI wiretap regulations.
      # Warning: use or posession of this software may be a federal crime in the United States of America. Download this software at your own risk.
      # Copyright 2004, 0x0d0a, released under the GPL
      # Usage: smallvoip remote-username remote-ip-address
      # You must have a shell account on the remote machine.
      # Run on each of the two machines involved in the call.
      # Duplex audio support required.
      # TODO: pass through lame or oggenc for better bandwidth usage. This will make the second line slightly longer.
      # LIMITATIONS: only one user per host at once
      # I recommend setting up public-key ssh authentication with this software.

      nc -l -p 7001 >/dev/dsp &

      ssh -R 7000:`hostname`:7001 $1@$2 "cat /dev/dsp|nc localhost 7000"


      Hmm. My high-security, encrypted Internet phone doing VoIP.

      Now, I have to ask the people in charge of Homeland Security: do you really, truly, honestly think that you have *any* hope of keeping anyone from writing such a two-line program? Any *IX user with a bit of experience could write this piece of software. In addition, the fact that it contains voice data is completely undetectable to the outside world, so there is no practical way to "catch" someone using such a system.

      It is true that this is a very simple program, but it can also be very easily extended into a full-blown encrypted voice communication program, without the minor limitations here that make this annoying for day-to-day use. In addition, there are a vast number of extant Internet systems for communicating that cannot be wiretapped by the FBI -- PGP/GPG contains no back doors to allow wiretapping of email communications. Frost (on the Freenet platform) can disguise the very fact that an association exists between two users. These systems are rarely used, but they are also not hard to deploy, and if the FBI insists on forcing conventional voice communication to be breakable, there is little incentive not to use systems such as the one that I have demonstrated here.
  • by Ckwop ( 707653 ) * on Wednesday August 04, 2004 @06:54PM (#9884023) Homepage
    PGP Phone. I don't care if it's law enforcement or not. I want to place a phone call in privacy and frankly I don't trust a huge organisation like the police to use their powers sparingly.

    Encryption is the way gents.

    Simon.
    • by Goobermunch ( 771199 ) on Wednesday August 04, 2004 @07:21PM (#9884283)
      It's not like the FBI has an easy time of obtaining a wire tap. In fact, they've got to jump through a number of complicated hoops in order to get permission to do so.

      Under 18 USCA 2518, the FBI has to apply for a warrant from a court before it can obtain a wire tap. This isn't your ordinary search warrant either. In the criminal justice realm, it's referred to as a "superwarrant."

      There's a limit on how long the government can tap your phone for before it has to go back and re-apply. In addition, they've got to show a) the type of information the tap is going to obtain, and b) that there's no other way to get the kind of information they're looking for, other than a wiretap.

      There are a few caveats for situations involving national security, organized crime, and immanent danger of death or serious injury, but even there, the agency intercepting the wire communications has to apply for a superwarrant within 48 hours of starting the tap.

      Oh, and if they tap you, or try to get a warrant and fail, they've got to let you know within 90 days of ceasing surveilance (or of the denial of the warrant application).

      It's not like the government is running around tapping your phone lines willy-nilly.

      --AC
      • by Trespass ( 225077 ) on Wednesday August 04, 2004 @07:28PM (#9884343) Homepage
        It's not like the government is running around tapping your phone lines willy-nilly.

        Look, I don't want to pander to the tinfoil hat crowd, but I'm old enough (barely) to remember the scandal that COINTELPRO under the Nixon administration caused. Basicly, the FBI was used to spy on and discredit people and organizations that were perceived as enemies of the administration. I'm not convinced things have changed enough to prevent that from happening again. Why make it easy on them?
      • W-R-O-N-G (Score:5, Informative)

        by Safety Cap ( 253500 ) on Wednesday August 04, 2004 @08:00PM (#9884612) Homepage Journal
        USA PATRIOT ACT, section 214-216 [ratical.org] means that the boys in the black sedans don't even need to prove jack in order to tap your arse--all that is required is signoff from a govt. attourney. Oh, and you are prohibited from finding out if they've tapped you (unlike in the olden days) until they haul your yellow self off to one of their reeducation centres.

        Hope you feel safe, 'cause if you gave up all those rights for ... whatever it was you got, then you just got angloed down, mi amigo.

        • Re:W-R-O-N-G (Score:5, Interesting)

          by Wateshay ( 122749 ) <bill@nagel.gmail@com> on Wednesday August 04, 2004 @09:26PM (#9885239) Homepage Journal
          Not to say you're wrong, or that those things aren't in the Patriot Act (which I have some serious concerns about), but I read the sections you linked to, and I don't see what you're saying is in there. Could you point out sections/rules/items, where it says that the government's burden of probable cause for getting a wiretap is lowered (well, ok, it does take away some of the international terror requirements on investigations of non-citizens) or where the requirement to get a judge's signature for a wiretap is removed? I'm not saying it's not there, but I read it and I don't see that. It also seems like the gag rules on telling people about wiretaps are fairly limited in scope, too, and require someone to show a compelling reason to a judge, and provide for annual Congressional oversight of each and every gagged wiretap.

          I've been a fairly vocal critic of the Patriot Act, and have a lot of major concerns about it. I'm having a hard time getting all that worked up about what I read in that link you provided, though. If everything in the Patriot Act is really that tame, I'm going to go so far as to say that my worries were mostly unfounded.

          Of course, I didn't read through the link with fine scrutiny, so I will allow that I may have missed or misread something, but if I did, I'd be very interested to hear what it was.
          • Re:W-R-O-N-G (Score:5, Insightful)

            by WindBourne ( 631190 ) on Wednesday August 04, 2004 @09:58PM (#9885413) Journal
            This is exactly what the patriot act is about. If you think about it, it allows the feds to examine all wired transactions as well as all databases belonging to whoever they want. The interesting part about this, is how many terrorists would be dumb enough to use our systems in the clear. Keep in mind, this was geared towards Al Qaeda. Ronald Reagan approved the CIA training that we gave the Bin Ladin and ilk to take on the USSR in afghanastan. Now, he uses that same education against us. Part of that education teaches that you either
            • use the local system by encoded(encrypted) in a different way.
            • use a different means of communication.
            Al Qaeda has been using human carriers as well as encoding into messages on the internet with switching prearranged e-mail addresses. For all intense purpose, we have no means of tracking them. And the feds know that. Patriot act was not intended to be used against terrorists. Good example is that Ashcroft promised many times prior to pat I that it would only be used against terroists. Then to help push pat II, he made the argument that it had been used against a number of drug pushers, rapists, etc. Ok, so these are bad people. But how soon does it get used against everyday citizens. My guess it about 2.5 years, about 1 month after it was passed.
      • by Yojimbo-San ( 131431 ) on Wednesday August 04, 2004 @08:13PM (#9884746)
        It's not like the FBI has an easy time of obtaining a wire tap.

        But, as the First Circuit Appeals Court have recently ruled, store/forward data is not covered under wiretap regulations, so your example is invalid. See http://yro.slashdot.org/article.pl?sid=04/06/30/20 14242&tid=158&tid=123&tid=95&tid=1 7 [slashdot.org]

        Oh, and if they tap you, or try to get a warrant and fail, they've got to let you know within 90 days of ceasing surveilance (or of the denial of the warrant application).

        Unless it's Patriot-related, in which case you'll never know. And it'll *all* be Patriot-related, won't it?
    • Another issue too. (Score:5, Interesting)

      by einhverfr ( 238914 ) <chris...travers@@@gmail...com> on Wednesday August 04, 2004 @07:55PM (#9884579) Homepage Journal
      We are only talking about centralized networks. This is not likely to pertain to or be enforceable regarding decentralized or private networks. So if my company has a voip tunnel with another company then it all works well.

      Why can't someone and his criminal buddies just set up a SIP-based VOIP channel between them and encrypt the traffic? Seems safer that way....

      Or better yet-- there are areas where VOIP would be *required by law* to be encrypted, such as between doctors discussing information protected under the HIPAA act.
    • Nice in theory. Think back in early 90's when phil was getting nailed for pgp. The FTC was doing their job and getting ready to put him away for a long time. Then the NSA stepped in and told FTC to do nothing. When FTC balked, they apparently showed them somethings. After a day, all charges were dropped. This is a historical fact.

      Take the above as you will and apply it against what you suggested.

  • by ttyp0 ( 33384 ) on Wednesday August 04, 2004 @06:55PM (#9884025) Homepage
    How do they plan to tap encrypted VOIP traffic? Of course the majority of phone calls won't be encrypted. However, the criminals that would be tapped I assume would use end to end encryption?

    $1.99 web hosting [carbonblock.net]
    • by Aadain2001 ( 684036 ) on Wednesday August 04, 2004 @07:05PM (#9884138) Journal
      Last time I looked into the statistics, the FBI (or was it the CIA?) released some basic statistics about their phone tapping activities (such as how many, reasons for taps (such as drugs), etc) and they listed the number of times they encountered encrypted taps (it wasn't a very high percentage). What shocked me was the line that said the encryption never prevented them from listening to the conversations. So all this talk about encrypted VoIP is probably just a waste of time. Why do you think the NSA finally stopped pressuring the government to classify strong encrypting as a weapon (and thus limited by export laws) around 2000? Do you think it was because they had a change of heart, or that they figured a way to crack pretty much any encryption (PGP included) and no longer worry about losing control? I'm thinking the latter is more likely. So, when VoIP becomes common don't expect PGP et al to protect you from a snooping government. It will probably keep your neighbor from listening, but that's about it.
      • by dmaxwell ( 43234 ) on Wednesday August 04, 2004 @07:37PM (#9884431)
        I seriously doubt the government has some uber-leet technology that lets them crack any encryption. Encryption can do two things and two things only.

        1. Encryption can secure a communications link. Properly used Alice can talk to Bob with reasonable protection from Eve tapping the link halfway between them.

        2. Encryption can secure stored data. Properly used, Alice could protect the files on her keychain should Eve filch it out of her purse.

        Encryption will not:

        1. Secure the ends of a link. If Eve physically installs a keylogger in Alice's keyboard then it doesn't matter what crypto she uses. Come to think of it, the old saw applies: all bets are off if an attacker has physical access to a terminal.

        2. Preclude treachery and incompetence. Law enforcement may have threatened the other end of your link who is letting them see everything in return for light treatment. A while back, NPR ran a story about police officers who took over a kiddy porn website and roped in a pile of customers. Encryption doesn't help if the other end of the conversation isn't who you think it is. Maybe the other side left his passphrase taped under his keyboard. "Rubber-hose cryptanalysis" is what they call it when the police starting leaning on you.

        3. Prevent the government from taking an interest in you. Certain uses of it may even draw their interest. Staying out of view of larger predators is often the best defense.

        4. Conceal the existence of the link. Often the government only needs to prove Alice talked to Bob on 7/24/02 at 3:24p.

        5. Somewhat OT but something else encryption doesn't do: Allow Alice to share data with Bob while simultaneously preventing Bob from divulging it to Eve. Both #1 and #2 apply. Bonus points if you understand what this scenario applies to.

        What this all boils down to is that encryption is largely ineffective against old-fashioned police work. It is also worth noting that Al Queda and others are notorious for using low-tech communications and isolated organizational cells. Don't give those hunting you terminals and only the minimum in physical links to play with. If you're a criminal, try to work alone if possible and keep your mouth shut. If you are a crook or a terrorist, communications are the least of your problems. Your partners in crime and your own mouth are far more dangerous.
  • by ElForesto ( 763160 ) <elforesto&gmail,com> on Wednesday August 04, 2004 @06:55PM (#9884034) Homepage
    You don't know it's VoIP data until you sniff the packets. I guess this means they can monitor any and all data traffic to look for VoIP. And, of course, they aren't going to poke around the non-VoIP packets. *ahem*
  • by temojen ( 678985 ) on Wednesday August 04, 2004 @06:57PM (#9884048) Journal

    Immigration Canada [cic.gc.ca]

    • Canada's Department of Justice is pushing for the same thing: see the Lawful Access Consultation [justice.gc.ca] document about the Canadian government's plans to insure that it can tap your phone, regardless your telephony technology.

      For those of you who don't RTFA, note that the VoIP tapping in question refers to "managed" VoIP, which means VoIP that "touches" the PSTN. Computer-to-computer VoIP calls are not covered by the FCC's decision.
  • by Zan Lynx ( 87672 ) on Wednesday August 04, 2004 @06:58PM (#9884065) Homepage
    What's going to happen as voice service becomes more and more decentralized? What about Skype? AIM? Streaming ogg files over a SSH tunnel or IPsec?

    What about open source VoIP packages? Is anyone who sets one up suddenly a "provider?"
  • by yotaku ( 26455 ) on Wednesday August 04, 2004 @06:58PM (#9884067) Homepage
    Does voice chat over AIM / MSN messanger need to be tappable yet? How long till they go after this.

    Is it illegal to write a small voice chat application with some encryption without a backdoor for the feds?

    I'm sorry but there is no way to stop people from comunicating privately over the internet if they want to. Its a losing battle, thats costing companies that do fine work, such as VoIP far too much money.
    • "Is it illegal to write a small voice chat application with some encryption without a backdoor for the feds?"

      Presumably, if you live in the USA, land of the free, it is or soon will be illegal. Just like it would have been under Saddam Hussein or is under Col. Gaddafi or Dear Leader in North Korea.

      You gotta appreciate the freedom that this sort of thing gives you; if the feds couldn't tap your phones how would they be able to protect you???

  • Comment removed (Score:5, Informative)

    by account_deleted ( 4530225 ) on Wednesday August 04, 2004 @07:00PM (#9884084)
    Comment removed based on user account deletion
    • Aren't you assuming that all calls will be VOIP > POTS? What about VOIP > VOIP? There may be no switch. And if they decide to tap your ISP? What do they do when you have an encrypted tunnel to another location ( VOIP > Tunnel....Tunnel > Abu Dhabi > VOIP > POTS )? They won't even be able to tell that you're using VOIP at all.
      • by The Vulture ( 248871 ) on Wednesday August 04, 2004 @08:52PM (#9885021) Homepage
        I can't speak for how this would work over DSL, but I can tell you how this will work over cable modems. Note: I haven't read the PacketCable spec in a few weeks, so my memory might be a bit hazy.

        If you happen to get a cable modem with an MTA (Multimedia Terminal Adapter) built-in (which would serve as your VoIP box), then your ISP will configure two streams for you, one for data, one for voice. (This is where using cable modems for VoIP is truly superior, I think, in that you have a dedicated stream that is prioritized, rather than trying to use the priority bits in the IP headers, which although I may be wrong, is how I understand that regular VoIP is done).

        The dedicated stream for your voice goes through a centralized server, which if the police get a warrant, etc., will log every packet, as well as who the call was made to, and for how long. Clearly CableLabs was planning for this requirement even before it became official.

        More information here [packetcable.com] (PDF file, PacketCable Electronic Surveillance Specification).

        -- Joe
    • by wfberg ( 24378 ) on Wednesday August 04, 2004 @08:08PM (#9884690)
      In Europe there's tapping legislation that forces each and every provider of a "public network" to provide tapping capabilities. That means that tapping might occur at any hop along the way that is in the EU, be it the DSL or dialup connection (btw, that also ends up in a traditional, yet modernized, CO), the DSL provider, your ISP, their backbone, etc. etc.

      Probably the CO where the DSL line is hooked up to is the preferential point-of-tapping, since that way you also catch packets that might go astray (e.g. spoofed packets).

      Tapping software is advanced enough (and why shouldn't it be) to filter out and reconstruct VOIP streams.

      It's unlikely that the authority to tap is used sparingly (i.e. used only on one end of the conversation). For example, in The Netherlands a warrant to tap a line extends not to just one phone line, but any one that calls that phone line can get tapped as well, regardless of suspicion (so, if you call Don Vito, and his line is tapped, your line will now also be tapped, just to see if you'll call any other mobsters).

      This of course results in masses of data (much of it duplicated) that the police would have to sort through - that is truly a growth market. Write software for it and become rich.

      Also, ISPs are increasingly willing to supply data without a subpoena or warrant.

      Using codes and stegonagraphy won't always be much help. For example, a Dutch blackmailer was arrested when he looked at a car-ad that contained coded information about the drop-off point of the money he'd demanded. Turned out that the ad was only clicked on about 3 times (he should have picked a more popular model), so placing an ad wasn't really that "broadcast" as he'd thought. Also, the anonymous proxy service that he paid for ratted him (or at least his credit-card number) out immediately.

      The bottom line is that the internet is FAR from a safe haven for terrorists, or even common criminals. Actual real life terrorists are far more likely to use 50 year old spying techniques that still work well (like deap-drop boxes, placing ads in papers, etc.).

      Of course, the more people come to realise this, the less useful all these measures become; to get a bit political, the potential for abuse is enormous. The EU is considering making it mandatory for ALL communications (of ALL citizens/companies, no due cause) to be stored for seven years, "just in case".

      Just think what a political/economical opponent could do with seven years' worth of your most intimate communications (while terrorists are happily communicating using WWII spying techniques). A bit more than that Nixon dude could ever have achieved with those pesky tapes.
  • No problem here :) (Score:3, Informative)

    by Duncan3 ( 10537 ) on Wednesday August 04, 2004 @07:00PM (#9884087) Homepage
    Voice Encryption Tools [google.com]

    I still like PGPfone tho... for pure historical reasons.
  • by SPYvSPY ( 166790 ) on Wednesday August 04, 2004 @07:00PM (#9884089) Homepage
    Listen, there's no question that bad people are going to exploit digital technologies to tragic ends. (If you have a shred of doubt about it, read this [newyorker.com]excellent article on how terrorists use the Internet to develop more and more insane ideologies and strategies.)


    Nevertheless, we also have a compelling public interest in keeping Big Brother from using the backdoor to enforce stuff that goes beyond keeping the peace and encroaches on our fundamental (and hard earned!) liberties.


    The bottom line is that blocking all law enforcement access to these technologies is going to cost people their lives, but letting the pigs sniff around where they don't belong is going to ruin everyone's life. This is just another balancing act in the giant circus we call a democratic society.

    So, rather than moaning about one side of this argument or another, doesn't it make sense to focus on getting just the right sweet spot in between?

    • by Tackhead ( 54550 ) on Wednesday August 04, 2004 @07:25PM (#9884314)
      > The bottom line is that blocking all law enforcement access to these technologies is going to cost people their lives, but letting the pigs sniff around where they don't belong is going to ruin everyone's life. This is just another balancing act in the giant circus we call a democratic society.
      >
      > So, rather than moaning about one side of this argument or another, doesn't it make sense to focus on getting just the right sweet spot in between?

      There is no sweet spot.

      Technology levels the playing field. Technology is an equalizer. A little over a century ago, "God made all men. Sam Colt made them equal." Today, most democracies and representative republics, even the US, have gun control.

      If you and I can encrypt our conversations using a microphone, a computer, some Free client-side software, and some TCP/IP packets, then so can the bad guys. We're all potential providers of VOIP service. ("When outlaws have strong crypto, all crypto ends up outlawed!" :)

      In an age where technology equalizes citizen adn terrorist, there's no balancing act to be had: Choose - security or liberty - because you can't have both.

      So we bring out Ben Franklin - fine. But it's been three years. The people have spoken, and made it pretty clear that they neither want nor deserve either liberty or security.

      And if the job of a representative is to respond to his constituents' wishes as best as he can, then our reps are doing a pretty good job of it: Deny liberties to all, and protect the security of those whom they can protect. (Namely themselves and their future lobbyist careers. But it's better to see that secure than nothing secure. :)

    • by bckrispi ( 725257 ) on Wednesday August 04, 2004 @07:47PM (#9884504)
      Nevertheless, we also have a compelling public interest in keeping Big Brother from using the backdoor to enforce stuff that goes beyond keeping the peace and encroaches on our fundamental (and hard earned!) liberties.

      The issue isn't the fact that the FCC has mandated that a back door be installed to monitor VoIP traffic, but how the government uses this. If a law enforcement agent has probable cause and can get a legal warrant to tap someones VoIP communication, I'm all for it. My concern is the kind of "warrantless" searches that legislation like the Patriot act provides. If the power is used in accordance with the Constitution, it is protection; if not, it's tyranny.

  • by LostCluster ( 625375 ) * on Wednesday August 04, 2004 @07:02PM (#9884115)
    This keeps coming up here on /. whenever the FCC talks about "VoIP". They're not talking about all computer-to-computer peer-to-peer realtime audio connects, they're talking about VoIP services that result in a network of people you can "dial" that more or less resemble a phone network. It's those that they're regulating and basically putting on the same playing field as existing phone services.
  • by reallocate ( 142797 ) on Wednesday August 04, 2004 @07:11PM (#9884197)
    I know this will upset the /. gang, but I have no problem with the FBI being able to monitor conversation between criminals.

    As the cliche goes, if you're not a criminal, you have nothing to worry about. If you're paranoid, I'd guess you shut up anytime a cop comes within hearing distance.

    Do we have a right to privacy? Sure. Do we have a right to keep criminal conversations private? No. Is this subject to abuse? Sure. Will we be abused by criminals who conspire in private? Of course.

    Given the choice between giving criminals the freedom to conspire in private or the ability of the FBI to wiretap criminals, I've no problem opting for the former.

    In any case, the net is a public place. Nothing there is private.
    • by Catamaran ( 106796 ) on Wednesday August 04, 2004 @07:30PM (#9884359)
      As the cliche goes, if you're not a criminal, you have nothing to worry about. If you're paranoid, I'd guess you shut up anytime a cop comes within hearing distance.

      It's not paranoia. These days people are being arrested [thenation.com] for carrying anti-Bush signs.

    • by johne_ganz ( 750500 ) on Wednesday August 04, 2004 @09:26PM (#9885233)
      I know this will upset the /. gang,

      Possibly. But since you seem to acknowledge that a given population has a contrary view point, do they have a valid reason?

      but I have no problem with the FBI being able to monitor conversation between criminals.

      Sure. I'd venture that on a pure principle level, most people don't.

      The problems usually begin with what "criminal" means. The ones who write the law have a pretty good idea of how they want the law to be used, and at the start everyone thinks it's a super idea. "Criminal" is written pretty broadly, trying to cover "the bad guys".

      As the cliche goes, if you're not a criminal, you have nothing to worry about. If you're paranoid, I'd guess you shut up anytime a cop comes within hearing distance.

      Later on, however, the enforcers would really like to make use of this provision because it's pretty potent. So the definition of "the bad guys" shifts a little through any number of legitimate means, such as changing the scope of what a criminal is to adding new crimes that fall under the original scope.

      Then, a set of events takes place and all of the sudden it's really bad to be a "terrorist". And a terrorist is sort of loosely defined, but definitely someone who is against "the state" and what it represents, using any and all means at their disposal, including disinformation and propaganda.

      Do we have a right to privacy? Sure. Do we have a right to keep criminal conversations private? No. Is this subject to abuse? Sure. Will we be abused by criminals who conspire in private? Of course.

      What's a "criminal conversation"? Because history assures us with countless examples that those who make the decision on what a "criminal conversation" is rarely do it with YOUR best interests in mind.

      Is discussing with other like minded individuals your displeasure with the current George W. Bush administration and planning activities to educate the public on the facts and what they can do to kick him out of office a "criminal conversation"?

      Want an example? The PATRIOT act, which did away with such minor things like habeous corpus (considered by many to be the cornerstone of our justice system and made no one above the law, one of the fundamental checks and balances ) and passed to deal with "extraordinary threat" in these "extraordinary times"..... being used for a copyright case. [slashdot.org] Legislation that bypasses most of the fundamental US Constitutional rights would NEVER be applied to anything frivolous.

      Given the choice between giving criminals the freedom to conspire in private or the ability of the FBI to wiretap criminals, I've no problem opting for the former.

      This is the beauty of the whole thing right here. Trivial means in the form of encryption exist that totally negate any benefit law enforcement would gain from such legislation. Most likely, these days, all the necessary tools exist on your computer right now (openssl).

      The only people that this would be of assistance against are... well, idiots. Since you know you're going to be discussing things of particular interest to law enforcement, and they have the means to intercept it, it's in your interest to encrypt your communications. So, from a practical sense, the only information you're going to get out of this is that two people spoke to each other which is useless in court.

      So... now what? We now have a system in place that's capable of catching none but the most utterly incompetent criminals and can be abused by the government against law abiding citizens.

      I know! Let's outlaw encryption. That'll learn 'em.

      In any case, the net is a public place. Nothing there is private.

      This seems to be particularly specious reasoning. By the same token I can say that the entire planet is a public place, ther

  • Get used to it (Score:5, Interesting)

    by juggledean ( 792527 ) on Wednesday August 04, 2004 @07:13PM (#9884222) Homepage Journal

    The police will get a warrant with your name on it and take it to your ISP and tell them to tap your VoIP traffic. Your ISP will recognize it the same way your receivers client recognizes it. If it's encrypted the police will know you are using encryption. If your worth enough to them, they'll crack it.

    They've had it all along for the landlines, there's no reason to think they'd change their mind at this juncture.

  • by HotNeedleOfInquiry ( 598897 ) on Wednesday August 04, 2004 @07:17PM (#9884251)
    If I were to set up a VPN link between 2 sites and and added VoIP phones on each end? Or used sound cards, for that matter? Seems like all they will be able to monitor is conversations through the big-name services, not anyone with the ability to buy and configure a pair of $50 routers with VPN.
  • Criminal Privacy (Score:5, Insightful)

    by ComputerInsultant ( 722520 ) on Wednesday August 04, 2004 @07:17PM (#9884256)
    If you criminalize privacy, only criminals will have privacy.
  • by OldHawk777 ( 19923 ) * <oldhawk777&gmail,com> on Wednesday August 04, 2004 @07:19PM (#9884276) Journal
    Why zero-value ... well when you are using a dedicated (real/virtual) circuit/channel, then wire tapping is no/little problem. However, encrypted virtual channel VoIP may not be easily tapped, and (I suspect) there are a few ways to very the path/packet. So, if you don't/can't tap the access/origination circuit and/or the destination termination, then .... VoIP in a sort of encrypt-jumping and path-hopping algorithm may be a little tough to tap.
    >
    Then again there is always PGP encrypted P2P ... pick your path through 37 points/jumps and you use radio-protocol (the Rogere-Wilco-Out stuff) for the time delay problem.
    >
    Controlling Technology is like fucking without a condom ... you might catch something horrible or there is a pregnant pause ... in technology innovation.
    >
    I am sure this will help monitor the common law abiding citizens. Just like Gun-Control keeps guns away from criminals and their organizations.
    >
    Then again maybe the above ain't no problem to tap. We should all always know that we are being monitored for the good of the nation and blessings of god.
    >
    OldHawk777
  • by Lord Kano ( 13027 ) on Wednesday August 04, 2004 @07:24PM (#9884310) Homepage Journal
    Just think, if you're a terrorist and you know thay any communication that you make is subject to tapping what would you do about it?

    You'd probably find a way to make your call blend in. I mean speaking in code.

    Take this example.

    "I just talked to mom. She said that she might need surgery on her colon. You should give her a call."

    Sounds harmless, but what if it means

    "I just talked to [the boss]. She[or he] said that [the time might be right to strike the power plant in city X]. You should [prepare and wait for the go signal]."

    LK
    • The problem with a code like that is that it presumes that a secure communication (the information on the code itself) has already occurred, that the code has not been captured or compromised, and that the message you want to convey is within the scope of the code already exchanged.

      People have used codes in that way for thousands of years, and they still have the same weaknesses.

      It's much more powerful and effective to send a message encrypted with good asymmetric key cryptography.
      • "It's much more powerful and effective to send a message encrypted with good asymmetric key cryptography."

        which stands out like a dogs balls.

        steganography and platen codes are about the only way to convey information innocuously.

        About the only way for encrypted data to be transmitted innocuously is if it would be innocuous to transfer large amounts of 'static' (or noise or very large random numbers). But somehow I doubt that any covert listener would fail to notice, and be suspicious of such data transfe
  • No need to worry (Score:3, Interesting)

    by bigHairyDog ( 686475 ) on Wednesday August 04, 2004 @07:25PM (#9884313)

    You can use VoIP with IPSec to secure your phone calls, as long as both sides have the right software installed. The IPSec encryption algorithms are up to you, so if you want to use Elliptic curve cryptography [openssl.org] (as donated to OpenSSl by Sun), you can.

  • In a word.. (Score:3, Insightful)

    by JPriest ( 547211 ) on Wednesday August 04, 2004 @07:25PM (#9884317) Homepage
    Duh.

    The feds have access to existing phone lines, they have access to internet traffic, why shouldn't they also have access to VoIP traffic?

    Eventually VoIP will be like email, with the option to use PGP or another form of encryption at both ends.

  • by freelunch ( 258011 ) on Wednesday August 04, 2004 @07:27PM (#9884338)
    I recently experienced some serious drop-out problems with my VoicePulse VOIP service.. So I decided to take some packet dumps and see what I could determine with ethereal.

    Well, the protocol analysis was excellent. And, sure enough, the dump of the data produced an audio file easily played with XMMS. I was shocked at how easy this was (and once again at how good ethereal is). I no longer have any illusions of privacy due to the 'obscurity' or complexity of the protocols.

    So, next time your VOIP provider plays dumb over drop outs, give them a protocol analysis and an audio record of the problem.
  • by Saeger ( 456549 ) <farrellj@g m a il.com> on Wednesday August 04, 2004 @07:28PM (#9884345) Homepage
  • by villoks ( 27306 ) on Wednesday August 04, 2004 @07:31PM (#9884371) Homepage Journal
    Tame.

    EU is currenly planning 1-3 year mandatory data retention for all Internet traffic data. The process is right now at the member states' goverments (E.g. the Finnish goverment just decided to support the initiative but the parliament has to still agree..) So for all Europeans, contacting your MP would be a very good idea..

    More info here:
    Statewatch - EU and Data retention [statewatch.org]

    V.
  • I don't get it. (Score:3, Interesting)

    by pclminion ( 145572 ) on Wednesday August 04, 2004 @07:33PM (#9884389)
    They can already tap your "regular" phone and you don't seem enraged by that... What's so different about VoIP?

    Or are you saying the government should not be able to collect evidence in criminal investigations, even with a warrant?

    • Re:I don't get it. (Score:3, Interesting)

      by argent ( 18001 )
      If they have to be able to tap my VOIP phone, then I can't be allowed to have the source to the software for my VOIP phone, otherwise I could modify it so as to be untappable. If I can't have the source to my VOIP phone, then there can't be any open source VOIP phones. If there can't be any open source VOIP phones, then the VOIP protocol has to be protected. Not only that, but ALL VOIP protocols must be protected. Which means a free open source VOIP program becomes an illegal program, even if it doesn't int
  • Cue Orwell (Score:3, Insightful)

    by whovian ( 107062 ) on Wednesday August 04, 2004 @07:36PM (#9884415)
    Found this essay on RFID implants and the tracking of people. Excerpt borrowed without permission from Bill Hammack [engineerguy.com]:

    But it isn't Orwell's Big Brother Police Force and their in-your-face technology that menaces us. Since World War Two we've moved step-by-step toward a system where a police state need no longer be brutal, or openly inquisitorial, or even omnipresent in public consciousness. Police have instead moved in the direction of anticipating and forestalling crime. So, the trend is toward tracking every citizen throughout his or her life - geographically, commercially, and biologically.

    This began soon after World War Two with records of fingerprints, extensive paper dossiers on citizens, and then computer punch cards to sort through files. It evolved into the electronic databases and biological profiling we have today. These new chips are just a way to quietly add a page to an electronic dossier.

    Still, the potential for abuse is enormous. In the future, perhaps, when someone approaches a sales desk their credit info would be displayed automatically for the sales staff. Or, the state could track the public movements of everyone. As a result people would be less likely to do public activities, to engage, for example, in protests that offend powerful interests.


    Good criminals and terrorists, as do spammers, will try to stay one step ahead of the countermeasures.
  • by Gelfman ( 802827 ) on Wednesday August 04, 2004 @08:02PM (#9884638)
    ...what will happen when major telcos start employing quantum cryptography...

    Ashcroft: All telecommunications are belong to us - intercept...intercept!
    Techie: But Johnny, you canna change the laws of physics
    Ashcroft (non-musically): Let the eeeeeagle soar!
    Techie: But...
    Ashcroft (in the style of Homer making a point): I said let ... the ... eeeeeagle ... soar!
  • by Proudrooster ( 580120 ) on Wednesday August 04, 2004 @08:08PM (#9884686) Homepage
    To summarize the past 48 hours of news:
    • The government should be able to secretly listen into all your voice communication and can do so via the Patriot Act.
    • The FCC will allow you to share freely available digtal TV shows with up to 9 friends with a TiVo as long as the shows are encrypted and use a cumbersome key system.
    • Fair Use copying of copyrighted DVD's is illegal.
    • Munich stopped deployed Linux because of "Patent Concerns"
    • The NTSB want's "black boxes" in all cars.
    • Your employer owns all your thoughts.
    • All the Euro countries and Australia are caving-in, errr, I mean harmonizing to screwed up US copyright and patent laws.
    • Microsoft is getting on the Patent train. (Just as ESR predicted)
    • Even with all this fussing and fighting over technology, the best anyone could do in the Darpa Grand Challenge (2004) was to get an unmanned vehicle to travel 7 miles through the desert before crashing or catching fire.

    Is anyone else out there starting to get angry? How long until the Deparment of Homeland Security implants RFID chips in our necks? How long until employees are forced to get their employer's logo tattooed on their face after changing their last name and waiving all of their human rights in the employment contract.

    Geeez..... what kind of America are we living in?

    America, previously land of the free, now home of the Corporate controlled puppet government run by lawyers with the best healthcare taxpayer money can buy.
  • by Positive Charge ( 592093 ) on Wednesday August 04, 2004 @08:16PM (#9884778) Homepage

    Frankly this wire tapping business has gone on long enough.

    Any time a person picks up a phone to call someone, there is a subtle change in his thinking if he thinks he might be surreptitiously monitored. There are certain things you just don't say.

    How is this different from meeting with someone on the street, perhaps to organize some political effort? If you think you may be overheard, it changes what you say.

    (Thinking from a two hundred year old perspective,) the difference is that on the street, you can see who is listening. You know what is being said.

    Secret wire taps by a third party subvert the entire process that granting the political freedom of assembly was intended to protect. If I want to speak to someone on the phone, law enforcement should be absolutely limited to compromising that other party in order to get in on the conversation. If there is a second party on the phone, I should get a little flashing light informing me that there is another listener.

    I would just switch to Skype [skype.com], except I have no idea how secure their encryption is either.

    I wrote a really bitchy blog entry about this a while back right here [blogspot.com], if you care.

  • by macz ( 797860 ) on Wednesday August 04, 2004 @09:22PM (#9885210)
    Isn't the FCC appointed by the executive branch along with the bulk of the secretary level people at the DOJ? So the Executive branch is asking the Excutive branch to give the Executive branch the power to tap our phones... and the Executive branch unanimously approved it's own actions... The legislation that comes out of this will look seriously inbred... for good reason.
  • Immunity for None (Score:5, Insightful)

    by CristalShandaLear ( 762536 ) on Wednesday August 04, 2004 @10:41PM (#9885604) Homepage Journal
    I wonder how many slashdotters are black?

    Black people have always known that our rights are revokable. It seems to me that only when it starts happening to white people that small things like "civil liberties" get to be a problem.

    I expect this post to be marked troll or flamebait at best, but it's truly not meant to be that way. It's just the way I see the world because my husband doesn't even tell me how many times he gets pulled over by the police anymore. It's a routine occurence, not worth notice anymore.

    Our church group is decidedly anti-Bush. I think most black folks are, despite the photo-op pics you'll see everywhere. Anyway, we had police officers taping our services now again because our preacher speaks out against the corrupt politics in our city and nation.

    There is no need to protest because no one in authority cares and is probably behind it anyway. We simply did the next best thing and got a local cable station to air our services. No more police, they can just set the VCR now.

    I see young men get harrassed by the police and their pockets turned out because their skin is dark. I know better than to go to the movies with a large purse or maybe even a purse at all on a crowded weekend day, because no matter how large the white woman's purse in front of me, mine will be the one to be searched.

    As far as I can see, white people for too long have thought they were immune from this type of thing. It's probably not even the slashdot crowd. It's be the parents and the grandparents of the slashdot crowd.

    I saw a post earlier here that asked, who will begin the revolution? I think it will begin right here.
  • by Cranky_92109 ( 414726 ) on Wednesday August 04, 2004 @10:43PM (#9885621)
    Do we really need legislation about tapping push-to-talk phones? I mean, if you really want to know what they're saying, just stand next to the jerk using push-to-talk. Or even in the next room.

    (Is it just me or do people using push-to-talk speak even LOUDER than when using the phone non Star Trek stylie?)

Suggest you just sit there and wait till life gets easier.

Working...