Skype Messages Monitored In China

Pickens writes "Human-rights activists have discovered a huge surveillance system in China that monitors and archives Internet text conversations sent by customers of Tom-Skype, a joint venture between a Chinese wireless operator and eBay. Researchers say the system monitors a list of politically charged words that includes words related to the religious group Falun Gong, Taiwan independence, the Chinese Communist Party and also words like democracy, earthquake and milk powder. The encrypted list of words inside the Tom-Skype software blocks the transmission of these words and records personal information about the customers who send the messages. Researchers say their discovery contradicts a public statement made by Skype executives in 2006 that 'full end-to-end security is preserved and there is no compromise of people's privacy.' The Chinese government is not alone in its Internet surveillance efforts. In 2005, The New York Times reported that the National Security Agency was monitoring large volumes of telephone and Internet communications flowing into and out of the United States as part of an eavesdropping program that President Bush approved after the Sept. 11 attacks. 'This is the worst nightmares of the conspiracy theorists around surveillance coming true,' says Ronald J. Deibert, an associate professor of political science at the University of Toronto. 'It's "X-Files" without the aliens.'"

Comments

Where is the insecurity?

[FilterMapReduce]

Maybe I'm missing something, but is this necessarily evidence that the Skype client and transmission are not themselves secure? The third link indicates that TOM-Skype uses TOM-specific client software that does the filtering (which Skype knew about). Isn't it likely that that software is also what's squealing to the monitoring system (which Skype apparently didn't know about) despite the supposed end-to-end security of the actual transmission over the Skype protocol? Is there any evidence that the monitoring is going on during the transmission, rather than this being a case of the TOM software phoning home separately?

I'm not suggesting that the Skype client should be trusted even outside of China—if it's closed-source, it might as well not encrypt anything at all—and this story certainly seems to cast additional doubt on it. But nonetheless, couldn't the foul play here be limited to the "TOM" side of TOM-Skype?