Slashdot Mirror
VOIP Tappings Under Scrutiny
dynooomite writes "CNN.com is reporting that Privacy groups have asked an appellate court to overturn an FCC rule that allows for phone-taps on VOIP calls. The privacy groups made their case saying taps would seriously hinder innovation on the web."
If I choose to encrypt my VOIP traffic using some sort of TLS, would such a ruling allow the FCC to force me to give them my encryption key?
Slashdot: Where people pretend to be twice as smart as they really are by behaving like children.
If the taps are on VOIP, what concern is it of the web? Slippery slopes don't count. Or is it possible to tap only VOIP, leaving other traffic alone?
From TFA:
To meet the rule's requirements, Internet call providers would have to rewire networks at great cost, Morris said. In addition, there is fear the rule would stifle development of new technologies by placing more regulatory burdens on innovators.
Can someone explain to me (a) why they would have to rewire these networks and (b) how this would stifle the development of new technology? I must be dense...
I'm not popular enough to be different.
Homer Simpson, The Simpsons
The privacy groups made their case saying taps would seriously hinder innovation on the web.
Can we STOP using that word? This is getting worse than "Synergy"! If you have a point, try to quantify it in a reasonable manner. For example, "Tapping VOIP would drive up costs, thus resulting in slower adoption in an otherwise emerging market."
"Innovation" is nothing more than a weasel word that get bandied about everytime someone wants to argue against something, but has no argument prepared.
So, for the sake of the Children, everything Holy, and the nerves of all of us in the tech industry, please STOP USING THAT WORD as a defense. Thank you, have a nice day.
Javascript + Nintendo DSi = DSiCade
For the very first time.
Where does the school board find them and why do they keep sending them to ME?
Yes, everyone saying people in the EU are less free then those in the USA might please post here, after RTFA. After Posting your humble opinion, you may want to reconsider searching for more information about the wiretapping in Europe.
/. with this topic over and over again with this stupid topic.
Thank you. I would be pleased to see some people to stop spamming
To "sit on a wire" anywhere you should need a probable cause and a warrant.
Anyone without this is simply hacking, which is illegal.
If you "get" pointers add me as a friend (116)!
How do you file a lawsuit on the grounds that it will "seriously hinder innovation on the web"? It is not illegal to have a stupid rule. Maybe someone with more legal knowledge can clarify this for me.
I know my voip is wire tapped. I think CmdrTaco has a loopback on his dupe machine.
That way maybe we can track these dupists ;)
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
What does innovation have to do with it? Aren't our constitutional rights more important than if companies can make money off something?
Please sign petition to restore sanity to our banking system!!!
http://financialpetition.org/
Well, if they had any fucking sense, they'd realise it wasn't possible. You can still (In the SIP/SDP case) send an arbitrary codec description over a call. The actual call is point-to-point.
Even taking into consideration the possibility of codec recognition and denying calls based on a restricted set of codecs, you could just place a "signature signal" at the start of the call - something relatively inaudible to the human ear - that triggers encryption etc. Maybe in the same way as Amateur Radioers have a blip at the start/end of speech.
if you encrypt your traffic and the FCC or some other Govt agency attempts/succeeds in breaking your encryption, could it ("they") be found guilty under the DMCA?
"I'm just here to regulate funkiness."
Aside from being a dupe, this submission is worded horribly. The FCC ruling does not allow VOIP-tapping; that's already allowed under standard warrant laws. The ruling is that VOIP providers should be required to make it just as easy to tap a VOIP call as it is to tap a land or cell call, by hooking into the phone company trunk. Given the wandering nature of internet packets, it would be intrusive, expensive, and possibly infeasible to add to an existing system.
I really fail to see the big deal. They wiretap analog phone lines now. This is just tapping digital lines. Whoopdie do, now they have to be able to send a call's packets to a second place to be listened to. They have control over their routing and should already be able to tell which customer data is coming from. Implimenting something that can sort and redirect seems pretty small. Isn't this part of what carnivore did anyway with all other data from a user?
I'm wondering if this could affect other ways that voice communications get transmitted over the internet. Could they force tapping of voice transmissions over IM? How about conversations on Xbox Live? There are many ways other than Skype, Vonage, etc. to communicate with voice over the internet, would this affect all of them?
And yeah, I could go find the original posting to see if someone already answered this, but I'm here now, so...
I stole this sig from a more creative user.
Use open source secure VOIP software, preferably developed outside the US. If it doesn't go through a service provider, and it's encrypted, they won't succeed in tapping it without first hacking one of the endpoints, no matter what outrageous laws the FCC takes upon itself to pass.
I always thought CmdrTaco was just an incarnation of the Cookie Monster, stoned on php. If he starts using voip with cookies then I would worry! You can bet if /. every does become voip enabled someone will want to tap it! Effective cheap and widespread communication through voip is still a long way off thank GOD. Somehow just reading things like /. is enough!
if you encrypt your traffic and the FCC or some other Govt agency attempts/succeeds in breaking your encryption, could it ("they") be found guilty under the DMCA?
Yes, but you would only be allowed to take posession of all the Brittiny Spears mp3s that they have on their hard drives.
HA! I just wasted some of your bandwidth with a frivolous sig!
Articles like this show that the people making laws do not understand what their talking about. It's very easy to encrypt your data (including voice conversations). If the US decides that all VOIP should be tapable/unencrypted, the bad guys can use a service based in a foreign country that doesn't force phone taps. They can then communicate. Or better yet, they can develop their own software to encrypt phone calls and would anyone notice? No way, it would just sounds like static or something. Sorry guys, but there's no way to block people from encrypting stuff and keeping their keys locked safely in their own possession. Unless of course, you make encryption illegal, which would be difficult to do, because the privacy hounds would never let something like that happen.
No Sigs!
Honestly, what's the point of trolling?
because they'd only hear every 10th word out of my mouth. Comcast Cable can't seem to guarantee me enough upload bandwidth to... decent... VoIP... bullsh... back to... fu...ng analog!
All that can be said equally of Linux users.
How about a moderation of -1 pedantic.
OK, so we have innovation , indeed, intuitive, copy protection, boxen, turbo, cyber, and FLOSS,
Got any other words, phrases, or acronyms we should stop using?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
finally boots up. Sorry about that post above, was at work, were to poor to afford anything faster than 28kbs. Anyway, as i was saying.... They can tap my line, as far as I care they can go and tap the damn thing cause they would only hear every 23 words I say. Once again, feel to hack me.
I believe it was US Secretary of State Henry Stimson who said "Gentlemen don't read each other's mail."
How we know is more important than what we know.
Only with a warrant - the RIP laws do NOT involve mandatory key escrow as you seem to imply (history has shown such a requirement is futile and will be ignored by the criminals anyway).
Besides, the same is true in the U.S. - you can be held in contempt of court in most places for obstructing an investigation (using crypto to hinder the case is just another charge they may add on).
Yesterday we had a story about VoIP wiretapping that makes this one feel like a dupe. One of the comments on that story jokingly asked why VoIP users shouldn't have to deal with the same government abuses PSTN telephone users do. It was actually a valid question. They should be dealt with any differently?
Now remember that P2P networks have been fighting hard to gain any legitamacy becuase they are used so much for pirating music and movies. The RIAA/MPAA has been trying to get P2P networks themselves deemed illegal because of this.
Has it occured to anyone the bellco's can play just as stupid a card if VoIP is not tappable. They'll say VoIP is a haven for drug dealers and those plotting against America to communicate and will try to get all VoIP banned the same way recording industry stooges try to P2P banned.
Unless of course, you make encryption illegal, which would be difficult to do, because the privacy hounds would never let something like that happen.
:/
You'd think so, eh?
Unfortunately in the UK the police already have powers to demand that you hand over your keys/passwords to any encrypted data. Under the Regulation of Investigatory Powers bill the UK government can demand that you to hand over your encryption keys to the police.
Laws like these are getting slipped through very easily, with little counter from the opposition parties. With all of the hype around "terror" there is an even stronger drive to give more and more power to the police - the privacy hounds, at least here, are too quiet a voice to halt laws such as RIP when more media-friendly laws such as smoking and fox hunting seem to dominate.
CALEA requires that the tap be undetectable, and able to set up effectively by flipping a virtual switch. Since RTP in VoIP can be point-to-point (i.e. untappable), and since tapping by routing a call through a proxy that could record the packets would be detectable (given a network sniffer), VoIP providers would have to route ALL calls through proxies just in case they might have to tap them. Realize they already had the power to ask for a subpoena for a tap, but that VoIP providers didn't have to engineer their network to make it easy and quick (or possible). Now they will have to. And it includes all the universities, who say it may cost them 5-10 BILLION dollars to comply.
This means added delay to all calls (lower quality), and extra expense for the VoIP companies (proxies and/or Session Border Controllers for all calls, and the associated bandwidth. For students, increased tuition (and not a small amount). Plus, part of why you don't want this done ever is that the easier it is technically to do, the more temptation there is to use this ability. Slippery slope and all that. The FBI/NSA/etc already tried to force OnStar to let them turn on the mic's in cars remotely as bugging devices; the judge stopped them because it would have disabled or otherwise interfered with safety features in OnStar (reporting of airbag deployments, etc).
Yes, you can make direct SIP/RTP calls without going through a VoIP provider. However, the FCC ruled that all 200Kbps and above broadband suppliers were ALSO required to comply with CALEA and make it possible for them to tap (all) traffic easily.
Can you say, huge blinking arrow saying "Hack this box"? Talk about a tempting target for malicious people, not to mention espionage.
As for encryption in a direct SIP call - it's hard (though not totally impossible) to avoid a possible MiTM attack in that case, unless you have communicated with that destination before, and cached their credentials, and it was before the MiTM attack was put in place. And if they realize you are in that situation (where you could detect MiTM due to credentials), then all they have to do is find some way to subvert/kill/etc one of the two endpoints. (Product recall, software update, cleaning lady knocked it over "by mistake", etc.) If you're using encryption via a VoIP provider, then who's verifying these certs you're accepting? Even if you did cache credentials, that only helps if they don't have a copy of the private cert subpoenaed from whomever provided it.
Didn't the FCC just recently win the Brand-X case in the Supreme Court arguing that broadband was an information service and not a telecommunications service, therefore broadband providers were not considered common carriers and under no obligation to "open up" their lines to competitors?
Doesn't it seem at least on the surface, if not directly, contradictory for this agency to have any discussion regarding wiretapping as far as VOIP goes? Doesn't wiretapping only happen on communication services? Doesn't the 'IP' part of VOIP primarily use broadband?
If these two events are contradictory in nature, how can they possibly co-exist without everyone drawing the conclusion that FCC functions, at least in part, to create rules allowing large (or perhaps simply first-to-market) broadband providers to maintain an unfair advantage over smaller or late-comer competitors?
Is this evidence of the belief that fair competition does not exist in the United States? That you can only have as much justice and fairness as you can buy, bribe, and lobby for?
Unless I'm completely misinformed...which may be the case so I'll apologize now...but plesase don't let that stop you from hurling your flames of vitriolic righteousness.
I'm sorry, but your opinion seems to be wrong.
Yes they did - at least they did for me - they're on the same front page as I write this.
That's some pretty dismal editing :(
If you don't pray in my school, I won't think in your church.
Under the New Zealand Telecommunications Act, all telcos in NZ are required to have "interception capability" for all communications going through their networks, so as to assist law enforcement agencies who present a valid warrant. Other countries have similar laws. Does the US have any similar laws on its books? And for a product like VoIP, which is very easy to use internationally, will there be governments in other countries demanding VoIP providers provision similar capabilities within their products?
In an npr story about this, it was mentioned that the FBI - the actual source of this FCC rule - really wants to be able to do this wiretapping remotely. So rather than needing to physically go to a site and install equipment and or software, collect data, then come back for it later, the FBI tech can just go [click][click] in his remote wiretapping console and now they're wiretapping. And if its not remote, you basically need to have your IT guy available 24/7 with keys to your building. That's one thing for a big university, its another world for your average small town library. They barely have enough money as it is!
Some observations:I thought you made a good point.
"I'm just here to regulate funkiness."