Groups Slam FCC on Internet Phone Tap Rule

kamikaze-Tech writes "An Associated Press report posted in the Vonage VoIP Forums discusses the new CALEA regulations that will make it easier for law enforcement to tap Internet phone calls. The article claims that the new law will also make computer systems more vulnerable to hackers, according to some digital privacy and civil liberties groups. While the groups don't want the Internet to be a safe haven for terrorists and criminals, they complain that expanding wiretapping laws to cover Internet calls -- or Voice over Internet Protocol (VoIP) -- will create additional points of attack and security holes that hackers can exploit. VoIP service providers such as Vonage, Skype and Packet 8 have eighteen months to comply with the new law."

Comments

Is Skype accountable to the FCC?

[Anonymous Coward]

Given that Skype's corporate entity isn't located in the States, it would seem that the FCC doesn't have any control over it.

Re:Is Skype accountable to the FCC?

[KitesWorld]

The problem is that if they don't comply, the FCC can issue punitive measures on skype's operations within the U.S.

Re:Is Skype accountable to the FCC?

[aussie_a]

Can't they simply close down their "US" webpages and servers, and re-open them up in a more friendly country, and not ask people if they're from the US or not?

Re:Is Skype accountable to the FCC?

[KitesWorld]

Yeah, but it'd still be a loss of revenues, and arguably profit. Not only would it affect US customers, but other customers (ie, business) would switch to an competing provider that still had a U.S. service. Double-whammy. My guess is that Skype would do something with their U.S. based servers to allow the tapping against calls made to/from/within the US, but without affecting the rest of their service. Of course, this is just speculation.

Re:Is Skype accountable to the FCC?

[dnoyeb]

if they connect to any US numbers, there quality will suck without us servers. Plus most of the numbers connected to will be landlines and you can bet the local phone company will jump with joy when asked to find a way to disconnect the VOIP provider.

Re:Is Skype accountable to the FCC?

[GoodNicsTken]

Exactly!

"VoIP service providers such as Vonage, Skype and Packet 8 have eighteen months to comply with the new law."

Should Say:

VoIP service providers such as Vonage, Packet 8, and have eighteen months to move operations to the caribbean."

The regulation also only applies to VoIP to POTS (standard voice line), and not VoIP to VoIP. It's a way to get the protocol changed now to enable a second stream. Then later they can ease in the VoIP to VoIP taping as well, without drawing too much attention.

This is yet another stupit attempt by LE to create a law to stop terrorists they are supposedly after. The terrorists will easily skirt by using a non US provider. Meanwhile average citizens like you and I using Comcast or another US VoIP provider, will loose a little more freedom.

Re:Is Skype accountable to the FCC?

[DigiShaman]

It doesn't matter. How can FCC demand control when my phone calls go from PC to PC. I don't even make VIOP calls to a standard switched telco system.

Sorry big brother, your fucked. Kill skype, then I will use another voice P2P program! You CANNOT stop me!

Re:Is Skype accountable to the FCC?

[alfrin]

Yes but when you do business with a foriegn county you are obligated to follow any laws they have set.

Re:Is Skype accountable to the FCC?

[Xformer]

From the text of the proposal:

58. We also seek comment on our tentative conclusion that providers of non-managed, or
disintermediated, communications should not be subject to CALEA.166 Non-managed VoIP services, such as peer-to-peer communications and voice enabled Instant Messaging, as currently provided, do not appear to be subject to CALEA for two reasons. First, because they are confined to a limited universe of users solely within the Internet or a private IP-network, they may be more akin to private networks, which Congress expressly excluded from section 103's capability requirements. Therefore, they do not appear to replace a substantial portion of local exchange service; as such they do not appear to fall within the Substantial Replacement Provision. Second, they may be excluded information services under section 103(b)(2)(A) (as discussed above). We seek comment on this issue. Are there other characteristics or distinguishing features that may be used to determine whether a particular class of VoIP service providers is covered under CALEA? One example may be that VoIP service providers are covered under CALEA where their service interconnects to the PSTN.

The bolded portion reflects where Skype themselves say that they are not intended as a replacement for local phone service. Trying to use them for that is silly in most cases, anyway, because in the US you can normally talk to someone a few houses down the street without per-minute charges. Using Skype to connect to your local PSTN in that case would cost $0.02/minute.

If it's found that Skype may fall under the new rules, it's only where it connects to phone networks in the US for incoming and outgoing calls. Wiretap provisions could be done at that point if required, probably by the phone companies providing that connection.

Re:Is Skype accountable to the FCC?

[Phantasmo]

Umm...

From Skype's Terms of Service
8.1
Further, as stated in the Privacy Policy, Skype and/or its local partners may need to provide such data to designated competent authorities upon request, or may need to enter into further activities due to local regulations, for example with regard to the interception of communications, if requested by such authorities.
So, if you're using Skype for the privacy features, dump it and switch to SpeakFreely. Skype CAN wiretap you and never said that it wouldn't.

Re:Is Skype accountable to the FCC?

[TheoMurpse]

As far as I know, there aren't any operations within the US. No matter where you are from, you pay a foreign entity in Euros. Unless you mean that the FCC can issue orders to ISPs to block Skype IP packets. Which is not exactly trivial.

Re:Is Skype accountable to the FCC?

[KitesWorld]

Skype has a division working in silicon valley - they're actually hiring more staff atm. If I were the FCC, that'd be how i get to them.

Re:Is Skype accountable to the FCC?

[Lehk228]

i think you meant to write "would jump with joy to be receiving the massive number of incoming international calls at premium rates moving all of skype outside the US would entail"

It's so much worse..

[Ckwop]

The article claims that the new law will also make computer systems more vulnerable to hackers, according to some digital privacy and civil liberties groups.

Oh it's a whole metric-fuckton worse than that. The problem the FCC, FBI (insert your favourite alphabet agency here) is that they make the assumption that the criminals that will be using VOIP will COMPLY with FCC.

Voice/IP isn't like traditional the traditional telephone system at all. I can't install my own private telephone network with encrypted lines but with V/IP this is fairly easy to achieve. What's worse, what criminal is really going to open up their private P2P telephone so the government can tap them?

So the measure has absolutely no effect on our ability to catch criminals. Instead we subject the communication of ordinary law abiding citizens to the possibility of them having their perfectly legitimate conversations compromised, be it by a l33t|st or corupt police officers alike.

Simon.

Re:It's so much worse..

[MattWhitworth]

Agreed. If you've got something big to plan, you don't use an unsecured public medium (criminals and terrrorists have learnt that it's possible to track down your position from a mobile phone call. A Chechen leader was assasinated in this way, and it's how the Madrid bombers were traced).

How does the FCC think it will be able to tap an 128-bit RSA-encrypted private protocol? It can't, and the overwhelming majority of phone taps will be of law-abiding citizens. But that's the way the world works. Just look at DRM

In short, terrorists/criminals/enemies of the state aren't stupid.

Re:It's so much worse..

[Motherfucking Shit]

Oh it's a whole metric-fuckton worse than that. The problem the FCC, FBI (insert your favourite alphabet agency here) is that they make the assumption that the criminals that will be using VOIP will COMPLY with FCC.

And it gets worse yet. Essentially, all "anti-terrorism," "anti-drug," etc. laws are useless for the purpose for which they're supposedly enacted. Terrorists, drug dealers, and other criminals are, by their very nature, breaking the law. Making their tangential activities (like communicating, meeting, transferring funds...) illegal isn't going to stop them!

In short, attempts to legislate terrorism out of existance are doomed from the start and should be suspect. You can damned well bet that lawmakers are smart enough to know that these laws aren't going to do anything to stop the Bogeyman of the day. They're being passed as "feel good" measures at best, and as attempts to control the law-abiding population at worse.

Making it illegal to carry cigarette lighters onto airplanes doesn't stop a terrorist; a terrorist would find a way to bring an incendiary onboard anyway. Making it illegal to have an untappable VoIP connection doesn't stop a terrorist, either; a terrorist would just setup stunnel or pgpFone end-to-end and chat away.

Sigh. Someday, the United States Congress will be comprised of people who grew up understanding technology...

Re:It's so much worse..

[Anonymous Coward]

whole metric-fuckton

This is why I love slashdot while it's still night-time in America. The quality of the profanity is so much higher when left to the Brits.

Re:It's so much worse..

[andreMA]

Someday, the United States Congress will be comprised of people who grew up understanding technology

Don't bet the farm on that.

Re:It's so much worse..

[badfish99]

If you've got something big to plan, you plainly *do* use an unsecured public medium. You admit yourself that a Chechen leader was assassinated this way, and it's how the Madrid bombers were traced.
Most criminals aren't IT experts. If they were all that clever, they would have regular well-paid jobs and wouldn't need to turn to a life of crime.

Re:It's so much worse..

[jtwJGuevara]

And if by the time the reach office they will be already be behind the current state of technology and will still not be making fully informed decisions regarding that technology.

Re:It's so much worse..

[Bloke down the pub]

If you've got something big to plan, you plainly *do* use an unsecured public medium. You admit yourself that a Chechen leader was assassinated this way, and it's how the Madrid bombers were traced.

That's not a case of they *do*. It's a case of they *did*. The others, assuming they aren't stupid, have probably wised up by now.

Most criminals aren't IT experts. If they were all that clever, they would have regular well-paid jobs and wouldn't need to turn to a life of crime.

Did the directors of Enron need to turn to crime? What about Nick Leeson? And IIRC, OBL has a degree in engineering. How's the "criminal = poor and stupid" theory now?

Re:It's so much worse..

[Threni]

> The problem the FCC, FBI (insert your favourite alphabet agency here) is that
> they make the assumption that the criminals that will be using VOIP will COMPLY
> with FCC.

No, they're relying on the fact that if you have the ability to wiretap data conveyed by companies which provide internet access but not ordinary phone calls then you can keep tabs on criminals who are using VOIP using that company.

> So the measure has absolutely no effect on our ability to catch criminals.

Wrong - every last byte the criminals transmit will be grabbable by the FBI for analysis.

Furthermore, there is absolutely no chance whatsoever that this will be defeated in the long run. The police/FBI *will* legally be able to monitor all communication, it's really as simple as that, as there is no public will to allow people to communicate free from such observation.

Re:It's so much worse..

[dnoyeb]

But you kind of proved the other point with your examples don't you think?

We keep saying that real criminals wouldn't do this, but somehow they seem to keep doing it. So I suppose we can catch the stupid criminals, and the ones we want to frame.

Re:It's so much worse..

[g2devi]

> they make the assumption that the criminals that
> will be using VOIP will COMPLY with FCC

I'm confused. Don't all criminals obey the law?

Re:It's so much worse..

[telecsan]

Right, but you want to force them to at least build their own p2p network. Yeah, it doesn't catch the big guys, but imagine if having a secure line, free from tapping by the FCC/FBI/whatever was as easy as calling up Vonage/Skype? Every 2 bit criminal and their mother would have 'secure' lines.

Re:It's so much worse..

[Breakfast Pants]

"The others, assuming they aren't stupid, have probably wised up by now." Assuming they "aren't stupid" is a pretty big assumption for people willing to explode themselves. Hell for those not willing to explode themselves you have the even more recent example of one of the (second event) London bombers being caught in Italy because of... you guessed it: his cellphone.

Re:It's so much worse..

[kilodelta]

Not to mention that in large part, mainstream VoIP is nothing but a last mile technology. The call still lands on a public switch near you.

In my case I use Vonage. They make the IP connection to PaeTec's switch in my city and from there the call hits the PSTN. I used that very scenario to push the local PUC into forcing Verizon to port my number faster because it was in fact a regulated to regulate port.

I've confirmed all of my suspicions with both Vonage, PaeTec and Verizon folks that I know and sure enough I got it right.

Law enforcement has had the ability to silently tap lines since the advent of digital switching. I recall when a new #5 ESS was installed in a local community a friend gave us a private tour of the facility. You could sit at the console, bring up a phone number and listen in.
>
From that I can estimate that it is trivial for the ALGA (Acronym Loving Government Agencies) to listen in on your line. In most cases it takes nothing more in the case of VoIP than finding the wire you pulled from the NID and tapping onto that. The more elegant solution is to mirror your conversations to a line hooked into the local PD. Better yet, record it.

We're living in a police state but the police are by and large clueless.

Re:It's so much worse..

[OverkillTASF]

Interesting... Once again, we have a parallel to gun control here. I would assume from the conversation that all parent posts to this would also agree that just as this tangential law won't stop a criminal from communicating, nor will a given gun-ban stop a criminal from obtaining and using an illegal firearm. If you outlaw encrypted VOIP, only criminals will have encrypted VOIP. And the rest of us are screwed.

Re:It's so much worse..

[GoldAnt]

Theres so much data flying around on the internet, all they need to do is grab some severless p2p phone program like picophone, punch in their mateys IP through an encrypted tunnel, and voila. The FBI may be able to grab every last piece of stinkin data, but it won't know that crap from the rest of it on the internet. They can easily put it on a common port, like 80 or 21 and make it even more confused... ;)

Re:It's so much worse..

[Thalagyrt]

If it's using ssl, putting it on 443 or 22 would make it a bit less suspicious :P

Re:It's so much worse..

[GoldAnt]

not very practical(possible?) to monitor everything.

Re:It's so much worse..

[HD Webdev]

Don't bet the farm on that.

Very true. It's not like most families that raise 'Political' children try to also teach them technology.

Those children are shown how to use human resources to use people and technology.

Being a politician mostly involves high skills in using other people to accomplish tasks and do the 'understanding' for the politician. That is pretty much the opposite of learning how to understand technology themselves.

Re:It's so much worse..

[Anarke_Incarnate]

Gun control plainly does not work. Criminals still have them. Most gun crimes are not comitted by people who would have obtained guns legally anyhow. I have no problem with minor inconveniences like a backround and mental health check, but making people wait 60+ days (yes, the law says 30, they don't care, cuz they are unmotivated bastards in gov't jobs) for a gun is ludicrous. You cannot stop people from doing bad things by passing laws. All you do is make those who would do them legally more put out. You stop a tiny portion of the illegal activity, criminalize a greater portion of formerly law abiding citizenry and waste massive resources to do so.

Re:It's so much worse..

[robertjw]

They'll take my encrypted VOIP when they pry it from my cold dead hands.

Re:It's so much worse..

[badfish99]

The directors of Enron? They were management. There's no way they would have known how to use secure encryption.

Re:It's so much worse..

[Misanthropy]

Exactly, if someone is trying to prevent interception of their communications they will just use a different medium.

An anonymous proxy, a couple yahoo email accounts, and gpg; and you've got a pretty good system right there.

Re:It's so much worse..

[DavidTC]

So we'll just Darwin out all the stupid terrorists and assassins.

Sounds like a plan to me. A fucking stupid one.

People are always going to have untappable means of communication. Untappable because they actually cannot be tapped (Strong encryption, people carrying messages by hand.) or just that no one can find out where they are. (Calls between two disposible cell phones, message drops.)

Tapping phones works fine for catching normal criminals. That's because if you know who a criminal is, you can just follow him around anyway until he commits a crime. While criminals are caught using phone taps, very few of them are discovered using phone taps, and in fact that makes no sense. At best, they merely 'spread' one known suspect onto five known guilty parties. Which is good, but doesn't work if we don'thave one suspect to start with.

And we don't know who are planning 'big plans', and we don't know what they're planning. Yes, sometimes we get very lucky and randomly intercept a big plan while doing a tap for some other reason, but that is not a 'success' of a phone tap, it is arguable a 'failure', because we were tapping converstations that weren't relevant to what we were looking for.

Re:It's so much worse..

[DavidTC]

Well, gun control does have minor success at keeping gun away from people, even criminals. So the parallel is clear, in that they both make things slightly harder to get. (Although, in all cases, 'harder to get things' are much less harder to get for serious criminals than for normal people who just want to break that specific law.)

However, this minor success is outweighed by the fact that having guns in the hands of random people noticably decreases random assaults.

So, really, gun control has less going for it than 'phone control'. At least criminals, knowing I lack an untappable phone, aren't more likely to target me.

Unless, of course, they start tapping my phone themselves, but that's a whole nother problem.

Re:It's so much worse..

[DavidTC]

Most of them do, but if they don't, we can just arrest them, so it's okay.

Re:It's so much worse..

[DavidTC]

That's why I don't get what this is talking about.

They specifically say this law isn't about tapping calls that do not use the phone system. Although why 'the internet' is a private system and 'the phone system' is a public system is slightly confusing to me. I certainly don't have the ability to use the phone system however I want, and it appears to be owned by private companies.

Anyway, logically, all calls that do not use the internet solely use the telephone system, and thus go through a switch. Probably more than one.

Now, granted, it might be had to track to which call was which, so I can see the FBI and whatnot requiring more information from VoIP carriers, along the lines of 'every time number X makes a landline call, tell us what switch you've connected to'.

But trying to tap the net data is just idiotic when they have perfectly good methods of taping calls on the phone network, and all calls the interact with the phone network have to, duh, cross the phone network.

The only reason to add the ability to tap the net data is because, later on, they want to add the ability to tap net-to-net calls.

Re:It's so much worse..

[ultranova]

Sigh. Someday, the United States Congress will be comprised of people who grew up understanding technology...

Um, didn't you already answer to this when you said "You can damned well bet that lawmakers are smart enough to know that these laws aren't going to do anything to stop the Bogeyman of the day. They're being passed as "feel good" measures at best, and as attempts to control the law-abiding population at worse." If your congress will get better technical know-how, they will simply become better at bullshitting and oppressing their subjects.

Or to put it another way: Never attribute to stupidity that which can be adequately explained by malice.

Re:It's so much worse..

[SpaceLifeForm]

Listening in via the 5ESS switch is a 'feature'. Literally a BRCS (Business and Residential Custom Service) feature. It's just not well documented, and in fact, is not normally taught to switch techs. But, it's just a variant of 3WC (Three Way Calling).

As to VOIP tap-ins, well, the government would rather you use VOIP since it's much easier to collect.

Re:It's so much worse..

[JoshWurzel]

Yeah because Orin Hatch will NEVER FREAKING DIE! ;)

Re:It's so much worse..

[Bloke down the pub]

Assuming they "aren't stupid" is a pretty big assumption for people willing to explode themselves.

Right. Because the heads of terrorist organisations (you know, where the brains are) always lead by example, lead from the front.

Re:It's so much worse..

[Breakfast Pants]

I'm glad (as it is quite telling) that you didn't address my second point at all.

Re:It's so much worse..

[Bloke down the pub]

You didn't make a second point. But as you don't know the difference between the head of an organisation and the pawns at the bottom, I suppose it's expecting too much that you'd be able to count.

Why should the Feds get their own backdoor?

[mikeophile]

If they want to tap VoIP, they should have to hack it like everyone else.

Re:Why should the Feds get their own backdoor?

[Bimo_Dude]

I have nothing to hide, but what I do is NONE OF THEIR FUCKING BUSINESS.

Period.

Re:Why should the Feds get their own backdoor?

[TheSloth2001ca]

I have done nothing wrong but I still want to maintain my privacy. I hope you are never in a position to make these kinds of decisions

Re:Why should the Feds get their own backdoor?

[g2devi]

Agreed. The whole "If you have nothing to hide, you don't need to worry" argument forgets one thing, there's a big difference between private and secret.

What you do in the bathroom isn't a secret, but it is private.

What 99% of people do 99.9999% of the time isn't secret. The bulk of it is predictable. As Pinky and the Brain put it, "What are you doing to do tomorrow? The same thing we always do (Take over the World)." But a lot of what we do is private. (Console a loved one. Talk to friends about personal matters. Work out the details of our next business or invention.....)

Nearly everything of value we do starts off as private. You wouldn't even exist if it weren't for a private act between your parents. In a true democracy, the fact that you vote isn't a secret, but what you vote is private (and anonymous).

It really is none of their business.

Re:Why should the Feds get their own backdoor?

[SillyNickName4me]

why do they need to screw with our hardware installing global backdoors for hackers and viruses alike!

Because even the feds still have some trouble doing realtime decryption of aes without some help of a backdoor?

Re:Why should the Feds get their own backdoor?

[SillyNickName4me]

Im sorry but how is that relavent to them tapping VoIP?

Skype uses AES for encrypting conversations so if you want to tap such a conversation you supposedly have to decrypt it.

Re:Why should the Feds get their own backdoor?

[SillyNickName4me]

I could think of 2 thinks...
1. get notified about the session key being used so you don't have to brute force it
2. get an unencrypted copy of the data

Either way, life gets a lot easier.

Re:Why should the Feds get their own backdoor?

[Vampyre_Macavity]

Hear hear!

It's not about stupid criminals or stupid government agencies, it's about the being able to have this conversation:

Government: What have you got to hide?

Me: Nothing, now fuck off until you have a fucking good reason to spy on me, capisce?

Cyberstalkers...

[Travoltus]

Isn't that the same CALEA law that also forces router/NIC makers to install FBI backdoors (which can also be compromised by hackers)?

I see a big market soon for do-it-yourself NICs and PC routers...

Re:Cyberstalkers...

[thegoogler]

actually, more like a huge market for used NIC's/routers

gentlemen, start your ebay

Sounds fine to me

[domipheus]

I don't mind phone tapping at all - as long is there is cause for it's need. However as stated in another posting it is kinda stupid, as if people want to communicate over the net for dodgy dealings, they are certainly not going to use one of the mainstream (or indeed, any) VOIP provider.

If only the UK was able to procecute criminals based on phone tapping, currently it's not allowed (hears gasps of shock).

Re:Sounds fine to me

[Threni]

> If only the UK was able to procecute criminals based on phone tapping,
> currently it's not allowed (hears gasps of shock).

That's a misleading statement. The police use phone taps all the time as a tool to see who's talking to who, and what they're saying. Then they mount surveillance, arrest people, get them to grass people up or work out the best time to catch people. What you're probably referring to is that you can't use a transcript or tape of a phone call in court as evidence. Usually, however, this isn't needed.

Re:Sounds fine to me

[domipheus]

Thats exactly what I meant, thanks for clearing it up :)

Re:Sounds fine to me

[Junior J. Junior III]

The standard operating procedure for this will be: Tap first, invent a need later. If no need can be invented, deny the tap. If people start investigating your tapping, tap them as they are obviously threats to government authority.

Legal consequences?

[soma_0806]

I can't help but wonder what will happen when someone uses one of these "mandated" security weak points to impair service from one of the larger providers, like Vonage. If the government was warned that it would be a likely outcome of their new law, are they liable for the damages?

Even worse, sniffable (tapable, whatever) by the government means sniffable by a lot of far more clever black-hats. Who is liable for the damages incurred by identity theft? Or are we just never supposed to order anything over the phone again?

I guess 18 months from now it's back to the cell phone only existance for me....

Re:Legal consequences?

[macaulay805]

I guess 18 months from now it's back to the cell phone only existance for me....

Please correct me if I am wrong, but I believe all of the major cell phone providers utilize a voip network anyways ...

here is the link to the FCC anouncement

[brajesh]

The announcemnt came last week. its a .pdf

This is not as bad as 911 requirements

[arivanov]

This is not as bad as it seems.

As far as Vonage or Packet8 are concerned they will have easier time implementing this then incumbents. It is dead easy to do this with SIP. All that is necessary is to make the SIP server reply with a different voice endpoint to all SIP invites from persons who are under surveilance. As a result the "snooping" equipment is separate and does not encumber primary network infrastructure.

As far as Skype is concerned I could not care less. It will be dead by that time. Same as Kazaa - supernode to freeload ratio will drop beyond the point where the network is sustainable.

Or what?

[el_womble]

Dear Skype, We, the FCC, require you, a British company, to comply with American laws. If you don't we'll... say Ni! in your general direction. Your Friends The FCC Seriously, they're already giving away free phone calls, and free software from a foriegn country, using foreign servers. The best the FCC can hope for is that they put a line on their download page: Dear American, please don't download our software cause it will upset the FCC and the Feds. Failure to comply will mean that those in charge will think you are a terrorist. You don't want people to think your a terrosit do you? Vonage... well they're pretending to be a phone company, so they might have some luck.

Re:Or what?

[severed]

Or they could do what they did with the IndyMedia Servers hosted in the UK...

Re:Or what?

[Ironsides]

Dear Skype, We, the FCC, require you, a British company, to comply with American laws. If you don't we'll...

Get a court injunction preventing you from doing any and all business in the US and it's territories.

well they're pretending to be a phone company, so they might have some luck.

If they're going to be a phone company, they have to follow all the phone company regulations.

Re:Or what?

[Peyna]

Dear Skype, We, the FCC, require you, a British company, to comply with American laws.

It doesn't matter where your company is, you're very intentionally doing business with US Citizens. You've subjected yourself to US Jurisdiction. If you don't like it, don't do business here.

Re:Or what?

[el_womble]

They're not exactly doing business in the US, so much as letting US citizens import their software freely. If the US can figure out a way of imposing an import restriction on internet traffic for a particular item of software, they wouldn't need to have the wire tapping restriction, they could just block all the packets marked "terrorist".

Now clearly IANAL, but the only thing the FCC can do is prevent the wholesale of phone minutes and numbers to foreign companies, forcing companies like Skype to set up US holdings, bringing them under FCC control. But what would that prove? The only thing that the FCC could possibly hope to control are calls that use the existing US POTS system (Skype In / Out) in that case they can monitor those as soon as the call hits the copper wire, which they can do already.

There is nothing the FCC or Feds can do about PC-2-PC comunication. Nothing. If thats voice data, video, bomb designs, or plain text they are helpless. What can they do? They could put a packet sniffer on a suspects DSL line, and guess at the software they're using and try and decrypt the messages. If they want to do that they can go after the DSL and cable providers who they already have by the balls. Even if they put a backdoor in the software, whats to stop Joe Terrorist from using a firewall or similar to block the backdoor, or to modify the inevitable OpenSkype so that it avoids the wiretaps and closes the backdoor?

Clearly the Feds have the right to do whatever they like to protect their citizens - in their country. This is a stupid action that shows a complete missunderstanding of both the internet and software.

Re:Or what?

[agraupe]

If the US (the country that most often seems to come up in this sort of thing) doesn't like something in its country, it should stop it at the border. The US has become drunk with power, to the point where it extrodites foreign citizens for commiting crimes on foreign soil, if they have so much as a relation to the US. For example, this story. This has to end at some point before the US rules the world.

Re:Or what?

[sirdude]

Since when is Skype a British company? It is based in Luxembourg and has offices in Tallinn (Estonia) and London. It's founders are a Swede and a Dane.

Re:Or what?

[Peyna]

From the story you cite:

Benson says Emery has sold $3 million worth of seeds - mostly to the U.S.

You sell stuff to people in the U.S. you're subject to jurisdiction in the U.S. regarding those sales.

Also, the raid on the guys home was authorized by a Canadian judge and carried by Canadian authorities.

Re:Or what?

[agraupe]

If the US doesn't want these things in their country, then they are free to stop them at the border and arrest the people who ordered them. My guess is there was some sort of warning along the lines of "this may be illegal in your jurisdiction", so I fail to see how Emery is responsible. Furthermore, I think it's disgraceful that the Canadian authorities responded to arm-twisting by the Americans on this case.

Re:Or what?

[DavidTC]

Skype, unlike Vonage, isn't trying to be a phone company.

Re:Or what?

[DavidTC]

Why the hell should people in Canada have to comply with US law?

If the law in Canada says it's legal for him to sell pot seeds, then it's legal for him to sell pot seeds. If the law in Canada says it's legal for him to ship them to US addresses, then it's legal for him to ship them to US addresses. Responsibly on keeping things from being shipped into the country the government doesn't like is the responsiblity of the receiving government.

The only way they got him is that it technically isn't legal to sell pot seeds in Canada. It's just there's no local support of arresting people on drug related charges, especially not merely selling pot seeds, in Canada, and juries always fail to convict. It's dead letter law.

However, based on the fact it was technically illegal, the US is trying to get him extradited. (You can only extradite people for something if the same thing is illegal in the country you're being extradited from.)

This, incidentally, isn't because he's selling pot seeds. As long as the police turn a blind eye to it, anyone and everyone can sell pot seeds to Americans. It's because he's the leader of the Canadaian drug legalization party, and is very good at what he's doing.

Luckily, it sounds like he might get a jury trial locally on whether or not he should be extradited.

If you want an analogy of what's going on, it would be like Saudi Arabia asserting that someone from the US brought some alcohol there, and drank it, and sold it to some friends, then managed to escape.

As selling alcohol is illegal without a license in the US, he should be extradited back to Saudi Arabia to stand trial for selling alcohol. Which completely ignoring the large disaparity in enforcement and penalties. Here, we don't bust people for splitting the cost of a six pack with the friends, even if it is technically illegal. No jury would convict.

But let's say this person had been upsetting a lot of people with his political party. So the US say, 'Sure thing' and rounds him up to ship to Saudi Arabia, to convict him for something that has much harsher penalties than here, and he wouldn't be convicted of anyway.

You can see why the Canadians are annoyed.

Yes! We got those pesky terrorists at last!

[mrRay720]

I mean, they'll never find a way around this, right?

All I can say is thank god that the technology doesn't exist to communicate over voice outside of the phone and VoIP channels.

You know, if anyone ever figures out how to do direct PC-to-PC voice service, or if an IM service such as Yahoo ever include voice in their client, we'll all be doomed!

Wait a minute... they could be emailing each other right now! They could be talking to each other on IRC right now, or in a chat room, or through Yahoo messenger, or through MSN messenger, or through....

Yikes. I never realised how much danger we are all in. SOMEONE BLOW UP THE INTERNET NOW!!!!!!1!!!1oneone

calea is for telecom.but FCC just reclassified net

[plasmacutter]

The FCC just reclassified broadband as an "information service".

Calea is supposed to apply to telecom.

I sense some cognitive dissonance here, or maybe a simple hyppocritical abuse of power?

BTW.. calea is not a new law, and the rule itself is not a "law" it's a regulation. There are subtle differences.

Of course...

[poptones]

If they don't comply the gestapo will just pressure Visa and MC to deny them accounts on the basis of "aiding the terrorists" - and if they devise some means of getting around it then uncle fed will just rapture their corporate officers to Syria or someplace where they can await prosecution on "money laundering" charges.

You don't fuck with the world police...

And what makes you think

[guruevi]

that they didn't do this already in other closed-source programs? It is known that Microsoft Windows has them...

Re:And what makes you think

[Spad]

Well yes, but to be fair to Microsoft they weren't intentional backdoors.

Rephrased for proper effect

[Anonymous Coward]

"If you've got nothing to hide then you shouldn't have any objection to select government agencies/individuals listening to your conversations."

If you're making fun of that line, you've got to go a little further; the way you state it is exactly the way the serious supporters of surveillance state it.

E.g.:

If you've got nothing to hide then you shouldn't have any objection to select government agencies/individuals listening to what you whisper in your lover's ear. On the other hand, if you're a member of Al Queda, I could see why you might have a problem with this idea.

If you've got nothing to hide then you shouldn't have any objection to select government agencies/individuals placing cameras in your shower. On the other hand, if you're a member of Al Queda, I could see why you might have a problem with this idea.

If you've got nothing to hide then you shouldn't have any objection to select government agencies/individuals reading your thoughts. On the other hand, if you're a member of Al Queda, I could see why you might have a problem with this idea.

Re:Rephrased for proper effect

[Adult film producer]

"If you're making fun of that line, you've got to go a little further; the way you state it is exactly the way the serious supporters of surveillance state it."

Ya, I was just goofing around.. didn't think the mods would go so crazy about it :-)

Re:Rephrased for proper effect

[aussie_a]

If you've got nothing to hide then you shouldn't have any objection to select government agencies/individuals listening to what you whisper in your lover's ear. On the other hand, if you're a member of Al Queda, I could see why you might have a problem with this idea.

I don't think the Al Queda will be whispering terrorist plans into their lover's ears. So why should they care?

If you've got nothing to hide then you shouldn't have any objection to select government agencies/individuals placing cameras in your shower. On the other hand, if you're a member of Al Queda, I could see why you might have a problem with this idea.

Are you implying that all Al Queda have small dicks?

Re: Someone blow up the internet

[Tune]

Your point is so true. Of course providing a wiretap service through VoIP is a waste of money. Actually, it is more likely to provide malicious hackers with private info of the good guys, than it is going to help intelligence catch the bad guys. (For example, eavedropping random phone conversations is relatively easy access to credit card numbers.) Meanwhile, terrorists could use onion routing/tor networks to communicate virtually untraceble.

The only way to tap on *every* conversation is to kindly ask *everyone* to install the spyware on *every* computer and never turn it off. Did I say "ask kindly"? Make than "mandate".

Now what do we need for the population to accept that? Call it fear, uncertainty and doubt. Stories about pirates. Stories about violence. Stories about war and terrorism.

Hello Nineteen Eighty-Four.

--
Technological progress has merely provided us with more efficient means for going backwards -- Aldous Huxley

It's obvious what will happen

[ajs318]

Some hacker will graft PGP-style encryption onto SIP. You will simply send your public key in the headers -- it's called Session Initiation Protocol for a reason don'tcha know -- and the far end will encrypt against it. If anybody is listening in, they won't be able to decrypt it. Even better, you wait for sometime after the information has lost its value and publish the private key. Now nobody can even prove you really were the intended recipient.

All the tools required to do this are already available as open source, so it will be an interesting exercise for somebody.

And it will have the beneficial side-effect of killing off SKYPE. Another closed protocol bites the dust, good riddance.

Re:It's obvious what will happen

[hotdiggitydawg]

erm... man-in-the-middle? You'd probably want to exchange keys before the session, preferably by some other (secure) means...

Re:It's obvious what will happen

[brandorf]

If the man in the middle manages to get both public keys, he still can't decrypt either side of the conversation. You need the private keys for that. That's how public key encryption like PGP works. The public key allows you to encrypt a message that can only be decrypted by the private key.

Re:It's obvious what will happen

[hashinclude]

I do believe the parent meant man-in-the-middle INTERCEPT rather than SNIFF.

If Alice and Bob are trying to communicate securely, and need to exchange keys, Alice can't simply send the key to Bob, cos Trudy can intercept it, and send out a DIFFERENT key to Bob, who is then replying to Trudy not Alice. Unless Bob knows that the key he received was indeed sent by Alice, the whole system just went out the door.

Re:It's obvious what will happen

[EllisDees]

Of course nobody would ever be able to figure out that they were talking to Trudy instead of Alice becuause of her suddenly strange voice...

Re:It's obvious what will happen

[Sloppy]

People have been working on that for years, trying to build up a solid infrastructure network for newbie leaves to tag onto. Join in.

I have plenty to hide

[Lifewish]

Business dealings; issues with my imperfectly-secured web apps; that incident recently in a pole-dancing club where... um, forget that last one OK?

Re: Someone blow up the internet

[mrRay720]

The sad thing is that I genuinely believe that a headline of "Pedohphiles use phones. We need to tap your phone to stop pedophiles." Would easily get 20% of people agreeing.

I guess that the general population just get what they deserve, and the rest of us have to suffer along with them.

US Only Skype Version

[Foddrick]

Could skype make a version that is only available in the US and is tappable ? There's no reason when I call here from Australia to some other Non-US country that the us feds should be listening to me. For years we've had NONUS sections in debian etc... This shouldn't be any different ?

Re:US Only Skype Version

[plasmacutter]

just out of curiosity, what is the difference between the us and non us debian? also, how would one search on the internet for a "non-us" debian?

Re:US Only Skype Version

[ldspartan]

It used to be crypto, due to the US' classification of crypto as an armament and preventing its export. These laws went away a year or so ago, and now there's no more non-US debian.

--
Phil

"Safe haven for criminals"

[Drew Curtis]

I personally do want the internet to be a safe haven for criminals. Think of all of the people you know. How many of them are not criminals?

Re:UK...

[aussie_a]

If I was in the UK I'd be calling someone up just to say "bomb" and "Bush" in the same sentence. If they want to mark me as a terrorist, they can go right ahead. I'll protect me freedoms and liberties, and they won't be able to scare me that easily.

Thankfully nothing like that would ever happen in Australia. We haven't invented the telephone yet.

Aren't There Commercial Products to Snoop This?

[Evil W1zard]

Correct me if I'm wrong but aren't there simple commercial products like Niksun Netdetector that can simply reconstruct VOIP traffic from an Ethereal dump collected by simply by snooping the wire? Is this calling for new technology to collect the traffic or is this saying we want the magic black boxes at every provider to provide an instant tap anytime/anywhere...

Re:Aren't There Commercial Products to Snoop This?

[pavera]

Yes there are. And besides all major softswitches already fully support CALEA (Silantro, Broadsoft, etc).

Time for Open Source

[pwiebe]

It's time for a decentralized Open Source solution, with open standards. Let's let the FCC try to impose wire tapping requirements on this.

Re:Time for Open Source

[KitesWorld]

Didn't they revoke the common carrier status for ISP's?

With that in mind, the FCC could just force ISP's to block any non-compliant solutions that crop up, regardless of wether they are closed or open sourced.

Re:Time for Open Source

[pwiebe]

I think it's like trying to block anything else, there will be ways around it.

Can you imagine if ISPs were told to block P2P traffic or web sites that advocated violence? This has been tried before many times, in many different countries.

There will always be people who figure out a way to code around it, or other international sites that act as proxies.

Re:Skype security

[ajs318]

Any closed-source cryptography is not at all secure.

Idiots

[pavera]

Sometimes I'm happy that the ACLU et al are looking out for me, sometimes they pick the wrong fight. This is exactly one of them. Oh, packet 8 and vonage have 18 months to allow wire tapping? Guess what guys, they already have it. Vonage uses Silantro, its had calea support for at least the last 3 years. Broadworks (the Broadsoft softswitch) has calea as well. The large softswitch vendors all already support it, I think Asterisk even might (although I'm not sure). These things aren't going to make the "Internet more vulnerable to hackers".

Has the ACLU setup CALEA on these systems? I highly doubt it, but I have. At least with broadsoft it is a trivial matter to keep the softswitch entirely firewalled off the internet that unless someone finds a buffer overflow in the sip protocol or rtp protocol that the system is using there is no opportunity for a hacker to get in.

Furthermore, the system supporting CALEA doesn't increase the risk.. IE if someone hacks the SIP protocol stack on a softswitch and takes control of it, well who cares if the box supports CALEA they just got access to all the phonecalls going through that box.

Do you really thing that up til now the FBI et al has had no power to wire tap a VoIP phone? That more than 5 million people in the US are totally able to break whatever law they want (wire fraud, telemarketing scams, plan bank robberies, etc) notice I didn't mention terrorism, just because they have Vonage? Right.

Re:Skype security

[Lifewish]

Any closed-source cryptography is not at all secure.

Correction: any cryptography that relies on being closed-source is not at all secure. A commercial implementation of RSA can be just as secure as an open-source version, modulo the risk of dumb programmer errors.

Mod Parent Way Up

[handy_vandal]

It's time for a decentralized Open Source solution, with open standards. Let's let the FCC try to impose wire tapping requirements on this.

Right on!

-kgj

Re:Skype security

[ajs318]

A commercial implementation of RSA can be just as secure as an open-source version, modulo the risk of dumb programmer errors

Not necessarily. It could have all manner of nasties in it. How do you know it isn't sending your plaintext to the company's headquarters, at the same time as generating the correct cyphertext?

The only way to verify the integrity of any software -- especially, but not just security software -- is to read and understand the source code. Software vendors know this too, so if they won't show you the source code they are as good as admitting that their software is insecure.

Re:Skype security

[SillyNickName4me]

From a Skype VoIP FAQ:

  How does Skype protect my privacy?
Skype is encrypted end-to-end because it uses the public Internet to transport your voice calls and text messages and sometimes these calls are routed through other peers. Skype encryption ensures that no other party can eavesdrop on your call or read your instant messages.
Skype uses the Advanced Encryption Standard (AES, also known as Rijndael) which is used by U.S. Government organizations to protect sensitive information. Skype uses 256-bit encryption, which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1024 bit RSA to negotiate symmetric AES keys. User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates.

So.. it seems they are using 256 bit AES for encryption.

I don't know about this user public key part.. seeing how I don't have to carry around a private key and can just login from anywhere with my username/password, that key seems to not be used for identifying users.

Bullshit

[nuggz]

The problems with terrorists is their antisocial behaviour. I'll admit the US has done some things (dumb and/or repeatedly) to piss off a lot of people.

Terrorism and war has existed for as long as society. It exists in the US, outside the US, before the US existed and will continue to exist long after the US ceases to.

Occasionally some group will blame a certain action of another group for their behaviour.

But the following excuses are just excuses and don't in themselves always justify the reaction.
Their brother/daddy/government/religion/geopolitical group beat up my daddy/governmentreligion/geopolitical group.

The Devil/Bible/Koran/Cereal box/talking monkey made me do it.

They weren't listening to me, so I'll just keep making more noise until they do. As appropriate in politics as a toddlers temper tantrums.

Re:Feed the troll

[cbiltcliffe]

I've followed about 4 or 5 links to see exactly what verse they're referring to with comments, and every one they've twisted to make it say what they want it to say, then said "See?! The Bible can't be right, because it says to !!"

Genesis 24:2-3,9 : Grope sexual organs of one swearing oaths
Read the text. Putting a hand under a thigh is hardly "groping sexual organs". Putting it on top of the thigh would be closer to what they describe it as. Besides, I think this was a cultural thing. Nowadays we shake hands on a deal, they would do this. It's probably rooted in something like holding the person there until the deal is done, and they've sworn their promise to you.

Genesis 25:1-6 : Keeping mistresses is not adultery.
Again, read the text. Nowhere does it say that keeping mistresses is not adultery. It says Abraham had them. It doesn't say whether this was a good or bad thing. It does show that Abraham was human, and subject to the same character flaws as we are.

Genesis 39:7-14 : Woman tries to rape man.
So? What's the point? Have you never seen a demanding woman who happens to want sex? She wanted to have sex with him, and he didn't want to. As geeks, I know this is hard for us to understand, but there are aggressive women out there, who pursue men in this way.

Genesis 47:29 : Joseph ordered to "feel-up" his father.
Jacob didn't want to be buried in Egypt, which was a foreign land. He wanted to be buried at home. So he made his son swear that his body would be taken and buried with his ancestors, using the customary "handshake" of the time. Nowhere does it say "Jacob order Joseph to stroke his dick and promise to take him out of Egypt."

Exodus 12:29 : God kills all first-born babies in Egypt
Egypt at the time was an extremely sinful nation in God's eyes. Children were being brought up in slavery, sex orgies were common, and people were beheaded, stoned or worse, just for saying "No" to the emperor. (Kinda makes Bush Jr. look good, doesn't it?) Assuming that the whole heaven/hell thing is accurate, children brought up in this culture would have no chance of a life in heaven after death. By taking them young, God brought them out of their corrupt environment, and at least some of them wouldn't have been sent to hell. He also probably caught the attention of the people of Egypt, as nothing else had worked so far.

According to Christians, (real ones, not Bush) God wants nothing more than for every human to repent of sin and take forgiveness and, by extension, life after death in heaven. What happens to you on earth is pretty much immaterial in the infinite scheme of things. Nowhere does God say that people in the bible are "exemplary for modern conduct", as that page says. They're human. They're supposed to be human. They're supposed to have all the same stupid problems we do, because we're supposed to learn how they overcame them, rather than striving to be like a perfect, unreachable ideal.

I won't claim to be an expert on the bible. I'm not. There are undoubtedly some references on that page that would stump me, had I looked at all of them, rather than just the few that I did.
That's why I work on computers for a living, rather than preach. I don't want to be an expert on the bible. (It does contain some very good lessons to all of us, though.)

But the fact that I (a non-biblical expert) could pick a few random links, and couterargue every single one of them, shows that maybe the page author doesn't completely know what they're talking about, and isn't taking a few things like cultural difference into account.

All this attention on VOIP is interesting

[Dark Warrior]

You know, I can't think of a fundamental difference between VOIP traffic and any other IP traffic.

I get the feeling that back door would be useful for more than tapping VOIP.

Some of these laws have a purpose

[franzel]

It's not about stopping them. It's about arresting and convicting them.

The tangential activities that you describe, e.g. communicating, meeting, transferring funds, etc. are the means by which federal officers arrest and convict mobsters/drug dealers/terrorists/etc.

It's very rare to get a conviction on a mobster via a direct mob activity. Instead, the feds use money laundering or tax evasion laws to deal with the mob people so that they can at least do time for _something_. And if they do it multiple times, then they get slapped with RICO and do _real_ time.

franzel

On the other hand there are dumb criminals

[Beryllium Sphere(tm)]

>absolutely no effect on our ability to catch criminals

Criminals smart enough to do things we consider obvious will escape capture by CALEA. No question there.

If most criminals were smart, then we'd catch even fewer of them than we do now. The whole system is geared toward finding and prosecuting dumb criminals.

PGP?

[Lawrence_Bird]

Wouldn't the solution be to use phones implementing a PGP or
similar solution with the key input by the enduser? Of course
that would cost money and be opposed by the government, but
you would think the market could provide such equipment for
those who feel they need/want it

Re:Feed the troll

[stinerman]

Dude, take it easy. It was just a joke.

I hope you didn't take to long to write all that ...

Re:Skype security

[Luke-Jr]

Not that I disagree with you in general, but... software doesn't need to be verifyably secure to be secure in fact...

I hope Vonage stands up to this...

[bergeron76]

I really hope one of those companies tells the Fed to take a hike. If they try to prosecute, they can take it all the way to the Supreme Court and hopefully get some justice there.

hilarious

[poptones]

You really think this is a troll?

Obviously you are not a webmaster...

Phil Zimmerman to the rescue ( VOIP / PGP )

[nehumanuscrede]

Seems Phil has seen this one coming and has already started working on it :)

Check out the article here: http://www.wired.com/news/technology/0,1282,68306, 00.html

Re:Phil Zimmerman to the rescue ( VOIP / PGP )

[quarkscat]

Zimmerman has a good idea, but I would like to see an open source H/W & S/W project to make public key streaming encryption an availanle option for ALL PHONES.

That being said, I hope that Zimmerman does not wind up being classified as a Dubya regime "person of interest", (or worse).

Sure you can

[complexmath]

Voice/IP isn't like traditional the traditional telephone system at all. I can't install my own private telephone network with encrypted lines but with V/IP this is fairly easy to achieve.
It's always been easy to achieve, provided you had a computer at each end. Remember PGPFone?

Typical VoIP call and the real problems with VoIP

[Frank T. Lofaro Jr.]

A: Hel-----lo, its its me, Alice.
B: Huh?
A: Its me me AlAlice *hiss*.
B: I can't ear you ------ ery ell!
A: Well, least at my c-call free is is is.
B: all me on on a land land line, pease!

and you can't depend on it for 911 if your power is out, and even if it isn't, they can't find you, and packet duplication, reordering, lossage, etc will just make it work badly.

Also, when I call a friend with that VoIP monstrosity, sometimes the call gets null routed to an operator because their is not a needed switch translation, sometimes it fails to forward to his cell when he is out and goes to voice mail (but if I call his cell he answers it in one ring), and sometimes I'd be talking to him and hear the VoIP voice mail on the line at the same time.

The Feds listening into to VoIP is the LEAST of your problems.

I can't imagine any criminal wanting to use it.

Re:Skype security

[ajs318]

software doesn't need to be verifyably secure to be secure in fact

No, I agree: software can be secure without you knowing about it. Software can even be secure by accident. But software does need to be verifiably secure in the mind of the user to be secure in the mind of the user. Even if it is secure in fact, if the user does not know that it is secure then they have a good reason not to use it.

If I myself as a user of software have any doubts about the security of that software, then the only way I can allay -- or confirm -- those doubts is by thoroughly examining the source code of the software. Which is why I insist only to use software where the author will agree to show me the source code; if the author refuses then I must assume they have something to hide.

Which Internet Phone companies support this?

[albertgj]

I can't believe Internet Phone companies support tis thing - it's not logical - look at what Free Internet Phone Calls http://calls.forcents.com/ wrote about this in their news section.

Doesn't make any sense does it?