European Crackdown On Skype "Loophole"

angry tapir writes "Suspicious phone conversations on Skype could be targeted for tapping as part of a pan-European crackdown on what law authorities believe is a massive technical loophole in current wiretapping laws, allowing criminals to communicate without fear of being overheard by the police. Eurojust, a European Union agency responsible for coordinating judicial investigations across different jurisdictions, has announced the opening of an investigation involving all 27 countries of the European Union."

Comments

"Allowing Criminals"

[Spazztastic]

Or allowing law abiding citizens to speak with their relatives in hostile countries without worry of big brother listening.

Re:"Allowing Criminals"

[TheRaven64]

And what sensible criminal would use Skype anyway? If you care about potential eavesdroppers, you don't use proprietary encryption, and especially not proprietary encryption over a proprietary protocol that has been shown to be insecure (see the Black Hat paper).

If you want security, run SIP over SRTP, with clients that have undergone third-party security audits.

Re:"Allowing Criminals"

[MoellerPlesset2]

Who's 'big brother' here?
The European governments who want to eavesdrop on suspected criminals after obtaining a court order, or the US and UK governments who are presently listening to everybody in Europe, and have been for quite some time, through ECHELON?

Re:"Allowing Criminals"

[Anonymous Coward]

All of them. If I have multiple older male siblings, I can address them all as "Big brother." The existence of one does not preclude the existence of others.

Re:"Allowing Criminals"

[orzetto]

If criminals knew that much about IT, they would have an IT career, not a criminal one.

Most criminals are at best casual users of computers. While they might hire a whiz kid to encrypt their calls, that is quite rare: hiring someone from outside the criminal environment to encrypt communications opens a much larger security hole than Skype ever could.

You are assuming that the knowledge level common here on Slashdot is common in the real world. It isn't. I remember that Bernardo Provenzano, head of the Sicilian Mafia, used a Caesar cipher using a bible as key to send its orders around, and someone here on Slashdot commenting "what, he does not know of PGP?!?".

Re:"Allowing Criminals"

[mdwh2]

If criminals knew that much about IT, they would have an IT career, not a criminal one.

Unlikely - that argument might work for petty thieves, but not major criminals, especially terrorists whose motivation is often not money in the first place.

Re:"Allowing Criminals"

[morgan_greywolf]

You're kidding right? IF terrorists can learn to fly a jumbo jet, which, mind you, is a very complex beast that requires a lot of training, simulator, and real-world flying time to be able to fly one, or if they can become munitions experts, what's to stop terrorists from becoming IT experts?

Nothing. Nothing at all. Terrorists can take the same classes you took, take the same training you took, and learn as much about IT as you did.

Anyone determined enough to kill a bunch of people in order to achieve notoriety for their cause can learn just about anything if they think it will help them achieve their gol.

Re:"Allowing Criminals"

[tjstork]

It's worse than that, they're hostile countries looking to harm our children

Well, they are. When the head of Iran says that he's going to get the bomb and the USA is as the Great Satan, do you suppose he's just joking around?

Re:"Allowing Criminals"

[thethibs]

Great link.

Provenzano abandoned this code after Giuffre's arrest, and this is when investigators believe he turned to a Biblical code. Since his imprisonment, he has been given a clean copy of the Bible, which he reads every day, annotating and underscoring.

Priceless! If I were stuck in jail, I too would try to find a way to drive my jailors crazy.

Too many loopholes

[mangu]

Suppose they have a way to intercept Skype calls and decrypt everything. How will they know a conversation like "Aunt Emma's cat had seven kittens, three black and four white" actually means "I'm sending seven kilos of heroin, Giuseppe will take three and Giovanni four"?

Re:Too many loopholes

[Anonymous Coward]

That's an issue which applies to any form of intercepted communication not just skype

Re:Too many loopholes

[mangu]

That's an issue which applies to any form of intercepted communication not just skype

Precisely. Intercepting communications is pointless if the target has reason to suspect they are being watched. That's why the US and Britain went to great efforts to disguise the fact that they had broken the German and Japanese encryption systems during WWII.

For instance, when American fighters shot down admiral Yamamoto's plane the US didn't report the fact. They wanted the Japanese to believe that was just a chance encounter, not an action planned from a flight schedule they had known from decrypted Japanese communications.

Re:Too many loopholes

[Chrisq]

Suppose they have a way to intercept Skype calls and decrypt everything. How will they know a conversation like "Aunt Emma's cat had seven kittens, three black and four white" actually means "I'm sending seven kilos of heroin, Giuseppe will take three and Giovanni four"?

because you've just told us - and you are now on the "listen" list

Re:Too many loopholes

[JasterBobaMereel]

Arbitary codes like this and One time pads have been proven (when done correctly) to be absolutely secure, whereas all encryption in theory is insecure (the only exception is quantum encryption)

Skype is a well known protocol, with a know encryption system, and is not secure ....

Re:Too many loopholes

[Asic Eng]

As much as I'm a privacy advocate ... Fact is most criminals are not particularly clever - often they make mind-numbimgly stupid mistakes. One of the tasks which the police has to solve, is to process the stupid criminals quickly, so that they have resources left for the more intelligent ones. Besides, in theory you can avoid any one mistake, but in practice it's impossible to avoid all of them.

So suppose the police intercept the conversation example you used. What does it tell them? Well - first they are going to find out that neither of the people involved actually has an aunt emma, or indeed any aunt who owns cats. Alternatively they might be aware that the people involved don't exchange a lot of private information, hence are not close enough to care about the cat of some relative. So they know it's a code and from that they know that something is going to happen. The recipient is a suspected drug dealer, the sender a suspected supplier, so they guess that it's about a drug deal. Possible action: keep a close watch on the recipient of the message - he may receive the drugs soon, or he may establish contact with the persons receiving the drugs.

Even if they can't guess the first thing about the content of the message - intercepting it can still yield information. E.g. it could tell them that the recipient is online now - using the IP address they could identify his location - or they could obtain a voice sample which could be used for identification. They could use the time someone calls to identify their daily routine - if suddenly a call is made at an unusual time (e.g. 2 am for someone who usually sleeps early) then they can guess that something interesting is going on.

Taken to the extreme opposite - if intercepting communications between criminals would never yield results, then wire tapping in all forms would have to be stopped. We could determine whether that's the case by analyzing criminal cases - is wire tapping evidence never introduced, is wire-tapping information never used to guide investigations? If that's not the case, then we shouldn't expect a zero return for skype-interception either.

Communication privacy in freedom

[dyfet]

One does not need to rely on proprietary or otherwise closed source solutions and protocols which may have or can in the future carry backdoors to achieve communication privacy. For the past three years, one could simply apt-get install twinkle with ZRTP support from any Debian repository, which has an open and proven model for peer-to-peer media security and a reference implementation of the ZRTP stack that is part of the GNU Project. More recently, there is SIP Communicator, purely Java based and truly multi-platform, which uses the newer ZRTP4J stack. Existing non-B2BUA based SIP servers like opensips or GNU sipwitch can be used to organize and coordinate scalable secure calling networks. All the tools are there to do verifiable communication privacy in freedom today.

Only Skype?

[tedrlord]

Somebody better tell them about all the other evil loopholes that criminals can use to talk over the internet. They'd better also be able to wiretap Yahoo and Windows Messenger voice, oh, and X-Box chat, and we're going to have to change the RTP protocol to send them a copy of all communications, of course. I'm guessing we'll have to hack all ssh clients to unencrypt VoIP traffic if somebody tries to tunnel it, too.

Or, you know, just get on Skype's case because authorities apparently have no idea what they're doing and seem to believe that Skype is the only way to talk over the internet. I'm sure the criminals appreciate the heads up so they can make sure to use more secure methods.

I don't WORRY about so-called criminals

[TheGratefulNet]

I do worry about my (and everyone's) government.

the governments are ruining our lives, NOT the terrorists OR the criminals!

what an upside down world we live in. I truly don't fear criminals. I truly do fear my own government.

what is a criminal going to do with info he taps from my line? otoh, we can clearly imagine the kind of damage that happens when the governments listen in.

I wonder if we can ever fix this broken world of ours, where we have more to fear from the so-called good guys than the bad guys.

Re:I don't WORRY about so-called criminals

[LVSlushdat]

Everybody pissed and moaned about how bad Bush was.. Just you wait till we've had Comrade Obama and his ilk in Congress for a couple of years.. You aint seen NOTHING yet!! Before one of the many SlashLibs shouts me down as being a Republican, I'll admit that I *was*, for 98% of my life (I'm 58), but in the last couple of years, I've gotten absolutely fed up with the Republican party and am now an Independent.. Which means I'm disenfranchised.. Nobody to vote for.. In any event, I strongly suspect by the time I'm 65 in 2015, this country will finished, only the cleanup of what it once was left to complete.. Of course, perhaps John Titor actually WAS from the future, and the civil war he reports that happened in 2012 really happened, after all he did say we'd start seeing signs of it in 2008-2009... I *used* to have to put on a tight-fitting tinfoil hat when I read the accounts of John, but not so much anymore...

Re:I'm glad we standardized on Skype

[jimicus]

If the defacto standard was opensource, with provably well implemented encryption, then I wouldn't be safe from the criminal hordes.

It could have been. If an opensource project created a product which worked as well as skype I'm sure it could easily have been as popular.

The problem with a plain SIP client is you suddenly find you need a SIP account with a provider - there aren't many truly international SIP providers and they don't all have agreements to allow SIP calls to be carried for free, which adds a lot of complication. And every layer of complication you add to a product will put a lot of people off.

Re:If governments are bad .....

[TheGratefulNet]

my alternative is a complete ban on ALL wire-tapping.

making all electronic communication the equivalent of whispering in a person's ear.

why would one be considered a fundamental human right and yet the other be so easily discarded?

criminals have the right to air, water, food, shelter, clothing. I'd also add 'right to communicate freely' in that list.

once we start whittling down what rights 'certain' people have, you are on the road to societal doom.

I don't believe 'the end justifies the means' and that's ENTIRELY what this wiretapping is all about. we'll VIOLATE your right to communicate in privacy - because there's some 'bad guy in a turban' that we want to stop.

this is insane! the founding fathers would not have given up our freedom to 'ensure' temporary safety and we shouldn't sell our freedoms out, either!

no, I don't agree that police and the gov have any INHERENT right to tap our comms. nothing at all gives them THAT kind of right-stomping ability, no matter WHAT the cause is.

in all situations, humans should have the DIGNITY to communicate and not have to worry about how is stealing their thoughts, ideas or even worse - who is going to MIS-INTERPRET your writings or speech. I'm waiting for the case where someone's fictional writing is intercepted and someone gets into 'big trouble' when the wiretappers refuse to believe that a person's private writing is just that - private. same with phone, net and anything else including email.