Microsoft May Add Eavesdropping To Skype

An anonymous reader writes "The U.S. Patent and Trademark Office published a Microsoft patent application that reaches back to December 2009 and describes 'recording agents' to legally intercept VoIP phone calls. The 'Legal Intercept' patent application is one of Microsoft's more elaborate and detailed patent papers, which is comprehensive enough to make you think twice about the use of VoIP audio and video communications. The document provides Microsoft's idea about the nature, positioning and feature set of recording agents that silently record the communication between two or more parties."

Comments

GNU VoIP

[Anonymous Coward]

It's coming soon...

Re:GNU VoIP

[Hatta]

What ever happened to PGPfone? That's what we need a GNU equivalent for.

Re:GNU VoIP

[GameboyRMH]

SIP/IAX with encryption / through a VPN?

Re:GNU VoIP

[Nimey]

Answered already below:

http://zfoneproject.com/

Re:GNU VoIP

[Anonymous Coward]

Reminder: Don't use variable bitrate codecs.

Re:GNU VoIP

[Kamiza Ikioi]

Give RedPhone a try. Best of all, it's written for Android, aka encrypted calls via a real phone. For added security, route it via Orbot (Tor).

This is why it matters that we can legally root our phones.

Re:GNU VoIP

[jgoshorn]

I've been trying out Jitsi (formerly SIP Communicator) and it seems to be pretty good. I hope to be testing it more in the upcoming months. http://www.jitsi.org/

Re:GNU VoIP

[sgt scrub]

Direct to user voice exists. Why would you use anything else? Well, I guess if your too lazy to download and install the application on your Linux/BSD box.

Re:GNU VoIP

[johanw]

PGPfone? There are still no mobile clients for it.

Re:GNU VoIP

[the_hellspawn]

Yeah that is great and all, but there will be 50 different versions from 100 different people and each version will lack a key feature that the other 49 have. Yet no one will merge them together and have just one superior product created by 100 different people.

Re:GNU VoIP

[rtfa-troll]

RedPhone:
9. Do you make source code available?
[most of our] products are commercially licensed and can be reviewed by commercial customers.

In other words the Chinese and US governments (who have plenty of access to "commercial" customers) can find holes in it, but we little people don't get the same access. No thanks.

Orbot, however, is decisively cool..

Re:GNU VoIP

[Duradin]

Don't you mean GNU/Heard?

Re:GNU VoIP

[Anonymous Coward]

PROTIP: SIP or Jingle over an encrypted channel.
There's shitloads of software supporting those, including pretty much every respectable computer or mobile IM program, physical VoIP phones, Asterisk, etc. And tons of companies offering SIP services and XMPP servers to create an account on. And most of them support tunneling over encrypted channels. Some even require it.

The only reason it isn't used much today, is because of Skype being a douche by not being compatible to standard protocols. (Although a gateway server would be doable.)

If Skype dies tomorrow (OK, to me it's already dead), it would take about a week for people to start switching in masses, and Skype would be forgotten in about a month.

Or, like we say here: And nothing of value was lost.

Re:GNU VoIP

[wye43]

Phone calls through Tor. You feel like waiting 2 minutes between replies?

voip

[Anonymous Coward]

Damn - I just switched over to Ooma.

A market niche opens...

[Freddybear]

Time to start working on an audio stream encryption front end.

Re:A market niche opens...

[NatasRevol]

Just talk in Navajo!

Re:A market niche opens...

[Freddybear]

They had crypto-enabled real-time audio drivers in 1965? Who knew?

But seriously, it could be a potentially lucrative little add-on.

When can I start blaming Microsoft?

[Anonymous Coward]

Skype has been acting a bit annoying lately, and I can't figure out if I can blame M$ yet...

For example, it has popped on top of my other applications for no apparent reason and it has a large ad on the screen when it does. I'm about to uninstall it, but I want to make sure my rage is justified.

Re:When can I start blaming Microsoft?

[cayenne8]

Hey...MS can't let Apple get too far ahead in the ongoing "Big Brother" race.....

Re:When can I start blaming Microsoft?

[GameboyRMH]

Is this on the Linux version? The Linux version has historically been nice and tame compared to the nagware/adware-like Windows version, but I haven't installed the latest update that came out since MS bought them, I'm afraid it will be like the Windows version (which is even bundled with some stupid online game thing now).

Re:When can I start blaming Microsoft?

[Grishnakh]

As far as I can tell, Skype is not yet under the control of Microsoft, so we unfortunately can't blame them for all this evil.

In fact, it's really not like them. MS is a pretty evil company, yes, but mainly to their customers and society in general. I can't say I've ever heard of them screwing over their employees, and in fact everything I've heard is that it's a pretty good place to work, except for the stupid political battles between the divisions (but this doesn't really affect the rank-and-file coders and engineers much).

This kind of crap from Skype is evil beyond which even MS is known for.

Next step, eavesdropping in the audio path

[Animats]

Worse, they'll probably put eavesdropping in the audio path of the PC (where the DRM is now), so that no crypto software on the client end can bypass it.

Re:Next step, eavesdropping in the audio path

[YodasEvilTwin]

Then we'll develop a mic with hardware encryption, or you can just run the audio through another box to be encrypted before running it into your main box.

Re:Next step, eavesdropping in the audio path

[Anonymous Coward]

Yep, you've really got to start worrying when one company owns the hardware, pipes and information.

To think that I thought that it was just Apple, Comcast and Google that we should be afraid of rather than the typical knee-jerk Microsoft bashing that we all have fun with.

Re:Next step, eavesdropping in the audio path

[Anonymous Coward]

The answer is obvious: USB encrypting/decrypting mics and headphones.

Re:Next step, eavesdropping in the audio path

[Dwedit]

Yes, let's encrypt some audio before running it through Lossy Compression, and hope that we can get some recognizable signal afterwards.

Re:Next step, eavesdropping in the audio path

[Microlith]

Microsoft requires all drivers for x64 versions of Vista and W7 pass WHQL and be signed by them. If they decide to enforce eavesdropping in the audio path, they can force hardware vendors to supply it or deny them a signature.

Re:Next step, eavesdropping in the audio path

[mcavic]

Sounds like a fun project for someone with much more skill than myself.

Re:Next step, eavesdropping in the audio path

[Anonymous Coward]

The real problem with audio is you can listen to an encrypted stream and still discern words. Voice is inherently difficult to encrypt due to harmonics. If you can use speech to text, then text to speech with voice samples sent via side channel (i.e. USB key swapping), then it would be possible to have real encryption as well as a way to talk to someone with very low bandwidth.

The only problem with that is you could end up with this garbage.

Re:Next step, eavesdropping in the audio path

[BuckaBooBob]

Nothing that a Linux install CD wont fix...

Re:Next step, eavesdropping in the audio path

[xkuehn]

I think Dwedit was joking.

Lossy compression of encrypted data would mean little to no data. The other way around works.

Re:Next step, eavesdropping in the audio path

[Anonymous Coward]

That'll ruin compression.

Re:Next step, eavesdropping in the audio path

[lordDallan]

What about the Mac or iOS versions?

Re:Next step, eavesdropping in the audio path

[gl4ss]

that would be the 666th wonder of the world! and they'd need to build a backup internet for just that one reason. why not just bug every room on earth? anyhow, if you want, you could run vpn and http://mumble.sourceforge.net/ to do your crazy chatting. practically if you use any other voip solution than skype they will not have a turn-key solution to listening in. the legal intercept is kind of must have if you want to act as if you're a traditional telco.

Re:Next step, eavesdropping in the audio path

[icebike]

So what?

Also scrambled voice is still close enough to voice to pass thru the codec and be usable and unscrambleable.

Re:Next step, eavesdropping in the audio path

[Anonymous Coward]

Windows allows transparently forcing IPSec on an application, port, IP, or combination.

If you want to talk secretively with someone, just force an IPSec rule on the firewall and it will tunnel to the other side, assuming the other side is configured correctly. It would be easy to test if the packets are properly encrypted as it's an industry standard.

Re:Next step, eavesdropping in the audio path

[icebike]

You can design your encryption such that it does not compress well (or at all), and force the codec to pass it pretty much uncompressed. Codecs do that anyway with bits of speech that don't compress wells. In round bald generalizations, consonant sounds don't compress much compared to vowel sounds, etc.

So worse case, by breaking the speech up into chirps and clicks you chew up more bandwidth.

Not saying MS couldn't detect and block such attempts, but to do so they would have to come right out and outlaw client side encryption on their network rather sneaking around inserting recording agents in the path.

Re:Next step, eavesdropping in the audio path

[dotgain]

Sounds like a fun project for someone with much more skill than myself.

YEP.

Re:Next step, eavesdropping in the audio path

[JSBiff]

Or. . . you run the codec ON the USB dongle before encryption, which also happens on the dongle.

I'll be contacting you for my $500 consulting fee.

*grin*

Re:Next step, eavesdropping in the audio path

[dachshund]

This makes no sense. Harmonics will not leak through a (properly) encrypted digital stream. If your stream is properly encrypted, the only way to recover voice information is via traffic analysis, and that only works if the codec uses a variable bitrate --- easy enough to fix.

Re:Next step, eavesdropping in the audio path

[Anonymous Coward]

Worse, they'll probably put eavesdropping in the audio path of the PC (where the DRM is now), so that no crypto software on the client end can bypass it.

Oh sweet, thanks for the idea!!!

- Stevie B.

Like I always said, "DEVELOPERS, EVDELOPERS, BEAVELOPERS!!!!"

Re:Next step, eavesdropping in the audio path

[mcavic]

Yeah, I see the problem, but I wonder if there's a way around it. I'm thinking some sort of analog encryption where you jumble the audio, rather than encrypting the digital stream. It may be less secure, and much more expensive. But if it's still an audio signal with the right frequency range, the provider can't really block it.

Re:Next step, eavesdropping in the audio path

[mcavic]

I didn't think there was such a thing as chewing up more bandwidth when it comes to VOIP. That is, if I feed it a signal that doesn't compress well, wouldn't it have to degrade the signal in a way that does compress well?

Re:Next step, eavesdropping in the audio path

[gerddie]

I'd prefer the use of a phrase book ;)

Re:Next step, eavesdropping in the audio path

[xkuehn]

It's not less secure, it's essentially useless. I'm afraid that an anagram would not make a good encryption scheme and be rather trivial to break. As in I could do it by hand.

The entire point of encryption is for the relationship between input and output to be highly chaotic. If you encrypt values that are similar, the values you get are not similar. In the same way, if you decrypt values that are similar, the values you get are not similar.

Speaking in terms of numbers: if you encrypted the numbers 5, 6, 7, then the three outputs should usually not be 21, 20, 22 (because they're also close together, which would make the encryption easily broken). If your range is 0-255, you should get something like 111, 75, 121.

Lossy compression and then decompression will change your numbers to something similar. Lets say you compressed 111, 75, 121, and a bunch of other numbers. When you decompress, you get 115, 76, 121 and a bunch of other numbers.

Because of the chaotic relationship between input and output in decryption, this decrypts to, say, 85, 118 and 136 instead of 5, 6 and 7. Because these aren't close to the original values, you can no longer make sense of the data.

The only way that a secure encryption algorithm could be used over lossy compression is (as Icebike said) if you could somehow force the compression algorithm not to compress the encrypted data. Whether that will be possible depends entirely on the compression algorithm.

Re:Next step, eavesdropping in the audio path

[BLKMGK]

Not true. WHQL isn't required for installation - I have signed drivers onboard that aren't WHQL. Getting a signing cert is easy for a manufacturer too.

Add one more

[Anonymous Coward]

To the now rather long list of reasons I need to find a convenient IP-POTS skype alternative.

They really have had a bad few months in terms of user experience.

Re:Add one more

[Anonymous Coward]

It used to be called Gizmo. Then Google bought it and shut it down after pretending to merge Gizmo's features with Google Chat.

Re:Add one more

[GameboyRMH]

Yeah I remember I was going to get a Gizmo account the very day they closed access :-(

Wow ....

[gstoddart]

So, when they install tools for our government to spy on us, it's supposed to be a good thing.

And when they do it to help other governments we don't agree with, it's an enemy to democracy and helping to undermine the ability of peaceful protest.

Love the double standard inherent in this. Maybe we can use the stuff the US is working on to stealthily deploy an internet in places to get around 'oppressive regimes' to prevent wholesale, un-tracked monitoring of our communications.

Oh, right, if you call yourselves the good guys, it's all OK. But, make no mistake about it ... this will help the 'Bad Guys' as much as it will help the 'Good Guys' ... China wants to listen to your VOIP too.

Re:Wow ....

[Sir_Sri]

Sure. But I seriously doubt that governments around the world, including the US, were going to continue to allow such a widely used piece of software circumvent existing law enforcement capabilities. Microsoft is big enough I'm sure they'd *have* to allow wiretapping, just as google is big enough they *have* to try and do something about copyrighted material on youtube. I'd be surprised if skype has been small enough to stay under the radar this long honestly.

When you're small you can get away with it. Ironically, smart criminals use the small stuff which would dodge the rules, but the police wiretap phones and everyone knows you can wiretap phones, so there must be a lot of dumb criminals. And either way, the government writes the rules, and you comply or you don't do business. You may not agree with them, but wiretapping is one of those tools that can be both a gross invasion of privacy, and enormously useful to catch people up to bad stuff, and by virtue of being the government, the government decides who can, and who can't wiretap.

Re:Wow ....

[icebike]

But I seriously doubt that governments around the world, including the US, were going to continue to allow such a widely used piece of software circumvent existing law enforcement capabilities.

Skype has been wire tap-able by national agencies for a long time. You don't see the government bemoaning their in-ability to break skype encryption do you? The reason they aren't bitching about this is because they already broke the encryption (and blamed it on the Chinese) years ago.

Re:Wow ....

[Sir_Sri]

Breaking encryption would be for eavesdropping/intelligence gathering. Wiretapping for law enforcement. Two slightly different problems.

Re:Wow ....

[Anonymous Coward]

I'm sure the germans thought the same thing of their nazi leadership...for awhile at least.

Re:Wow ....

[Alarash]

Not saying it's true or wrong or anything, but the reasoning is that in democracy the laws are voted by the representatives of the people, so it's really the people who chose that it's important that sometimes, under certain circumstances, a lawful intercept is the right thing to do. Now that's the theory before all the real-politik aspect of things.

Think Twice?

[SlayerofGods]

I don't think twice about using my home phone because the police have ability to intercept it.
I don't think twice about using my cell phone because the police have the ability to intercept it.
This is really is one of those situations that if you aren't doing anything illegal don't worry about it and if you do worry about it find another tool.

Re:Think Twice?

[jedidiah]

No. This is a problem.

The Police are supposed to get a warrant before they spy on you. It's a key element of the laws surrounding the situation. There are controls and accountability.

What controls and accountability are here?

This is a corporation abusing you in a way that you should never tolerate from a government.

Re:Think Twice?

[dexomn]

You won't mind me remotely exploiting your systems and downloading personal files from your devices then would you? I mean, no biggie if you're not doing anything wrong. Right?

Re:Think Twice?

[hedwards]

VoIP was that other tool. I'll want more information about this before I become too concerned, but the whole notion that if you aren't doing anything illegal why worry is just complete apologist bullshit.

There's all sorts of legal activities which could ruin ones life if people in general found out. If you're gay and not out, having people listening in to communiques with a boyfriend or girlfriend could definitely ruin ones life.

Re:Think Twice?

[Anonymous Coward]

Your remark is beneath contempt.

Re:Think Twice?

[ChinggisK]

I admittedly didn't RTFA but I don't see anything in the summary that suggests that anyone is planning to use this without a warrant. If MS or the police try to, that's still wiretapping and still illegal; but just developing the technology isn't inherently illegal or worrisome. Granted, that's assuming that the technology won't be abused...

Re:Think Twice?

[gstoddart]

This is really is one of those situations that if you aren't doing anything illegal don't worry about it and if you do worry about it find another tool.

This is the most damaging and poorly thought out sentiments that I hear of late ...

If you're not doing anything wrong, don't worry, citizen. Only the guilty need privacy. Only criminals use encryption. Upstanding people don't have secrets. We have to know everything to prevent thought crimes. We know what's best. Fuck that.

Deciding that we have no expectation of privacy is a dumb idea. Deciding that only people who are doing something shady try to guard their privacy is completely wrong-headed. You start out with fourth amendment rights against unreasonable search and seizure. In theory, there is supposed to be warrants and judicial oversight to keep this in check. Lately, the trend has been to side-step all of that stuff.

There are lots of legitimate reasons why someone would expect to keep some things private ... and taking those away under is a horrible idea.

Why is everybody so damned willing to live in a surveillance society? This makes no friggin' sense to me whatsoever. And every time I hear someone saying that if I'm not a criminal I shouldn't expect privacy I just want to scream at the sheer madness of that statement.

Re:Think Twice?

[jhoegl]

Yes, this is what allowed other governments to attain police state status.
We are heading in that direction.

Re:Think Twice?

[martyros]

The Police are supposed to get a warrant before they spy on you. It's a key element of the laws surrounding the situation. There are controls and accountability. What controls and accountability are here? This is a corporation abusing you in a way that you should never tolerate from a government.

About the same as here? http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy

Re:Think Twice?

[CastrTroy]

On the other hand, this is just technology. Technology isn't evil or good. This technlogy has the ability to be used by evil people, but it also has some good uses. The same technology exists for phone lines, but we don't scream "WHERE'S MY PRIVACY?" because there's a proper legal framework of warrants and whatnot to determine who can spy on your phone calls. If you want the same legal protections for VOIP calls, then don't talk to MS. Talk to your congressman (or member of parliament, or the equivalent in your country) to ensure that this technology will not be misused.

Also, what I want to know is how a patent dating back to 2009, before they even thought of buying Skype all of a sudden means they are going to eavesdrop on our Skype calls. Sounds a little alarmist to me. Just because they have the technology to do something, doesn't mean they are going to integrate it into a product.

Re:Think Twice?

[Anonymous Coward]

The point I understood, and I think/hope the OP was trying to make, is that this patent doesn't make VOIP any less secure than (for instance) a standard cell phone. The fact that technology exists to tap your cell phone doesn't mean that anyone is actually listening, and the fact that Microsoft has patented a way to tap a Skype call doesn't mean that anyone will listen to a Skype call either. I'm actually surprised that people seem to think that routing voice over TCP/IP, one of the least security-aware protocols ever, somehow magically makes it more secure than using dedicated channels.

Yes, "If you're not doing anything wrong than why would you worry" is a stupid way to put it, but I fail to see how this even registers as a blip on someone's security radar. For the paranoid, this is just proof of what they already "knew"--someone is recording everything they ever do. For the not-paranoid, this is just evidence that someone has figured out how to wiretap a VOIP call, which shouldn't surprise anyone.

Re:Think Twice?

[Anonymous Coward]

That's what the legal part of 'Legal Intercept' is; a warrant. Warrantless wiretapping was done by another 3 letter agency and it didn't go over very well with the public (And it was done without Microsoft's help)

Re:Think Twice?

[Anonymous Coward]

Most of the people who claim "Innocent people have nothing to hide" think they THEY are the ones who'll get to decide who's innocent.

They're wrong.

Re:Think Twice?

[Anonymous Coward]

Well, goody two shoes, glad to hear it.

Clap.

Clap.

Clap.

Re:Think Twice?

[mr1911]

Yeah, because your POTS and cell carriers have absolutely no way to listen in on your conversation.

Re:Think Twice?

[Anonymous Coward]

because there's a proper legal framework of warrants and whatnot to determine who can spy on your phone calls.

There used to be. Then the Bush administration threw out the warrant requirement (and of course Mr. "Change" hasn't given up that power).

Re:Think Twice?

[SlayerofGods]

So then why hasn't the country since the government has been out there with alligator clips doing legal intercept since the days of the telegram? It hasn't because there are legal requirements to do so. You have an expectation of privacy... until the judge signs a warrant saying they can intercept your communications.
If you have an issue with them intercepting your Voip then logically you must also be against lawful intercept on POTS and Cell phones. When will be staging the protests rally against those terrible government intrusions?

Re:Think Twice?

[spire3661]

Your post really is one of those situations where you cant see past your own nose.

Re:Think Twice?

[Sloppy]

The reason you don't think twice about those old techs' vulnerabilities, is that after you think once, you realize that its insecurity is inevitable.

VoIP doesn't have to be insecure; it's actually feasible to do it right, because your "terminal" is so outrageously powerful and capable in a way that couldn't be dreamt of on the 1880s.

This is really is one of those situations that if you aren't doing anything illegal don't worry about it

The reason to worry about it, even if you're not doing anything illegal, is that systems that are deliberately designed to be insecure (specifically, insecure to criminals) are likely to be insecure to others, too. If LE is listening, who else? You remember what happened to the Greek government, right?

Designing this stuff to be deliberately insecure is just plain absurd, and we ought to be thinking of it as very strange and very evil, for new tech to not be all that it can be. So yeah, of course I advocate people "find another tool." That applies to everyone, not just people whose adversarial "brother" happens to be the Big one.

Re:Think Twice?

[Yvan256]

Why is everybody so damned willing to live in a surveillance society? This makes no friggin' sense to me whatsoever.

If you think people are mad now, wait until the Facebook generation is in control.

Re:Think Twice?

[ep32g79]

This is really is one of those situations that if you aren't doing anything illegal don't worry about it and if you do worry about it find another tool.

You are arguing a false dichotomy and the third axiom is the expectation of privacy from government intrusion.

Consider this scenario: Your neighbor dies a horrible death at the hands of the most gruesome killer. The police are pressured by the community to bring his killer to justice. In their dragnet, they listen in on your phone call to your mother in which you state to her that:

"My neighbor is dead, died a gruesome death and the police were all over the place.... I never really liked the guy, but it's sad to see him go that way"

They haul you in for questioning and charge you with his murder. What do you think the testimony of the officers will be in court?

Prosecutor: "Officer Jones, was there anything funny about the conversation you heard between the defendant and his mother?"
Officer Jones: "Yes there was, He stated his neighbor died a gruesome death, but the newspaper had not reported that yet"
Prosecutor: "Was there anything else peculiar about the conversation?"
Officer Jones: "Ohh yea, he said he never liked the guy."

Open and shut, do not pass go, do not collect $200. Point being, even the most innocuous of conversations can be taken out of context and used against you and it doesn't even have to be due to malice on the part of the recollecting party.

Re:Think Twice?

[icebike]

No. This is a problem.

The Police are supposed to get a warrant before they spy on you. It's a key element of the laws surrounding the situation. There are controls and accountability.

What controls and accountability are here?

This is a corporation abusing you in a way that you should never tolerate from a government.

How is it any different than with a telephone company who can listen in on any call for "quality assurance"? Or who can put a back room in to route all traffic thru the NSA?

This capability has existed on EVERY common carrier since the invention of the reel-to-reel recorder. Warrants allow police to listen. But the company always had the ability to do so warrant or no warrant.

Your protection from the carrier is that your call is buried in so much other traffic that there are not enough people and not enough interest to even bother.

You can make yourself interesting either to the company or the police. But you really have to go out of your way to do so.

Re:Think Twice?

[shadowfaxcrx]

I feel it should be pointed out that thanks to the Patriot act and other examples of Shredding the Constitution in the Name of Safety from Terrists, the government does not need a warrant to spy on you anymore. All they have to do is say they're spying on you to make sure you're not a terrorist, or talking to any terrorists.

Re:Think Twice?

[icebike]

If you're gay and not out, having people listening in to communiques with a boyfriend or girlfriend could definitely ruin ones life.

Or perhaps improve it? Just sayin....

But even in a purely normal situation, such as searching for a new job, if you do such on your current employer's time and dime using your current employer's internet connection to skype potential jobs at (perhaps) competitors, you are likely to find yourself unemployed before you land the new job.

Do it at home, and you are probably safe. Even if Microsoft HAD the capability why would they care to tap you?

The fact that they can, and skype always could, and the phone company always could, and that your ISP can record every bit and byte out of your modem with or without a warrant seems never to have been an issue.

People understand that use of facilities owned by others always presented a risk.

Nothing new to see here folks. Move along please...

Re:Think Twice?

[icebike]

This is really is one of those situations that if you aren't doing anything illegal don't worry about it and if you do worry about it find another tool.

This is the most damaging and poorly thought out sentiments that I hear of late ...

If you're not doing anything wrong, don't worry, citizen. Only the guilty need privacy. Only criminals use encryption. Upstanding people don't have secrets. We have to know everything to prevent thought crimes. We know what's best. Fuck that

Fix that with your VOTE.

Don't expect a private company like Microsoft to stonewall a warrant for you.

This is entirely YOUR fault. You elected these bastards. Year after year you voted your self interest. The bill has come due.

Re:Think Twice?

[icebike]

Yes, this is what allowed other governments to attain police state status.

We are heading in that direction.

We've long since arrived.

In the face of an outright revolt as is happening in Syria today, is there anyone here who does not believe any western government wouldn't do the exact same thing as Syria is doing?

Re:Think Twice?

[An ominous Cow art]

No, he said "The Police".

Re:Think Twice?

[Anonymous Coward]

I admittedly didn't RTFA but I don't see anything in the summary that suggests that anyone is planning to use this without a warrant.

If you RTFA what you get to is this:

A request to monitor a selected VoIP entity is sent by the requestor to the call server. For example, the intercept requestor may request that the call server record communications for the VoIP entity.

And that's all I can find about how the process gets started. There's nothing about the system checking the signature of a request against a list of judges' public keys, or contacting court servers to check for the existence of a warrant. Ergo, they are designing a system which does not require warrants.

Re:Think Twice?

[MonsterTrimble]

While I agree that we need protection from government intrusion, your example doesn't make sense. At most it partially explains motive while ignoring means and opportunity.

1) As the victim's neighbor you would have already been questioned by police if you saw anything, etc. and would already be on their 'people of interest' list if anything seemed weird or you didn't have an alibi.
2) The call to your mom states a widely-known fact along with a personal opinion of the neighbor. No real insider knowledge of the crime.
3) The other neighbors and the victim's family and friends would be questioned as well and if there were any issues between you and the victim they would most likely know.

Again, I agree with your statement, but the example doesn't work. Frankly if you're in court it's for far more than your phone call.

Re:Think Twice?

[ep32g79]

At most it partially explains motive while ignoring means and opportunity.

Perhaps not. But the example is to highlight that any conversation, even those which are considered to be the most innocent, will never ever be exculpatory.

Re:Think Twice?

[Tom]

Actually, I do think twice, but I've decided that the alternatives are too troublesome and don't justify the small risk.

Because, quite honestly, the "if you don't do anything illegal" line makes a faulty assumption: Namely that the police and justice system are perfect. They aren't. There are police officers who will make a copy of your porn collection or your intimate conversation with your girlfriend. There are prosecutors who will make your life difficult even though you didn't do anything illegal - because sometimes it takes several courts and many years to figure out if this borderline case was, or wasn't.

Maybe instead of the "evil bit" we should propose a "good guy flag" that you and I can use so the police doesn't waste time and precious resources on going after us. ,-)

Re:Think Twice?

[Anonymous Coward]

When people say that I always aak them if they lock the door when they go to the toilet

Patent Exclusivity

[jpvlsmv]

Oh good. So Microsoft can use this patent to prevent anyone from eavesdropping on VIOP calls.

I'm _SO_ sure that's why they want it.

--Joe

What A Bullshit Story

[Anonymous Coward]

There isn't a shred of evidence that this will be added to Skype. Just because they filed a patent application, doesn't mean anything. Companies file for patents all the time, and is no indication that something will ever be deployed.

Bottom line, this whole headline and story is just pure speculation, and hype. In short, FUD. Slashdot and CmdrTaco should be ashamed for the yellow journalism.

Re:What A Bullshit Story

[Hatta]

Alternatively, there isn't a shred of evidence that Skype doesn't already have this capability. If you have something sensitive to communicate, you have to assume that they do.

Thank the patent office!

[the_raptor]

Now only Microsoft products will be able to have this feature! Other developers can just tell the police that adding intercept technology to their VOIP product would be a patent violation.

Re:Thank the patent office!

[CastrTroy]

But if a law was passed stating all VOIP services operating in the USA had to have this technology, you might be forced to license the technology, of not offer your services in the United States. You might think they can't do that, but I can't see why not. You would either have to license the patent from MS, develop your own technology for doing the same that didn't infringe on the patent (entirely possible, depending on patent), or just bow out, and not offer your services. I'm sure that there's been other technologies that have been mandated for use by the government but that have had patents against them. Something off the top of my head that might fall under this would be something like airbags, which probably was patented, and is now mandate in all new vehicles, although I'm not sure if the two ever overlapped. Same goes for things like safety helmets. You can't argue that you don't want to pay for proper DOT or SNELL certification so therefore you're allowed to sell your helmets without proper certification. You either get the certification or you don't sell them. (or you label them as not approved, and nobody buys them because they aren't safe).

Re:Thank the patent office!

[Dachannien]

They did it with Macrovision, after all.

Re:Thank the patent office!

[Anonymous Coward]

I'm pretty sure that law would be struck down. I remember seeing a story on /. a few years ago about a handsaw manufacturer being sued for not including a patented safety feature, and IIRC that was denied on the basis that you couldn't force somebody to license a patent.

Re:Thank the patent office!

[starfishsystems]

It's already been done. It's called CALEA and its present form, covering digital communications and VOIP, came into force on May 14, 2007.

Re:Thank the patent office!

[Anonymous Coward]

But if a law was passed stating all VOIP services operating in the USA had to have this technology

IF?

http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act

And it *also* implements intercept

[OeLeWaPpErKe]

So yes, it implements intercept. Obviously. Just try to sell a VOIP PBX to an operator without intercept.

I would be amazed if skype didn't implement intercept yet.

Re:And it *also* implements intercept

[GameboyRMH]

I would be amazed if skype didn't implement intercept yet.

This. Anyone who assumed in the first place that a service accessed with a closed-source app with a secret encryption scheme going through a bunch of servers you don't control was secure is an idiot.

Re:And it *also* implements intercept

[memyselfandeye]

No kidding? From the comments you'd think this patent wasn't a method for one or more parties to record their video conversation, but some Orwellian upload to big-brother.Microsoft-1984.server. Ground Control to Major Tom... it's not eavesdropping if I'm 1/2 of the conversation.

Re:And it *also* implements intercept

[GooberToo]

There is no need for amazement. Its already been covered they allow for it. I honestly don't see what the news here is. Microsoft creates yet another patent on something which is not only commonly done every day, but mandated by governments around the world.

Next on slashdot - people move and technology helps them do so.

Re:And it *also* implements intercept

[NatasRevol]

it's not eavesdropping if I'm 1/2 of the conversation.

That depends very much on the local laws.

Re:And it *also* implements intercept

[Yo Grark]

True. In Canada, only one side needs to know about and authorize the taping of a conversation.

BUT a third-party taping is obviously a HUGE nono.

A few years ago a friend of mine went through a bitter divorce and recorded everything his (now ex) wife was saying on the phone since she kept changing her tune when in front of arbitrators.

When the tapes came out, she spouted up and down about how illegal it was and it would never be used in courts etc. After a 10 minute recess with her lawyers the contested issues were resolved in short order.

It's made me VERY careful about what I say to who on ANY phone.

Under the "Cases considering the one party consent exception" section, http://www.legaltree.ca/node/908

Yo Grark

Re:And it *also* implements intercept

[hairyfeet]

Citation please? because from what I understand as long as you are recording yourself and aren't trying to hide that fact you are legally in the clear, otherwise all those "This call may be recorded for quality assurance" messages would be announcing they are breaking the law.

As for TFA looking at TFA (I know, but I got bored) it seems to be more along the lines of letting grandma record her video calls of her kids and vice versa than some new wiretap schema, which BTW CALEA means that ALL have to allow the police to access it with a warrant.

As someone who has buried his sister and grandma in the past 5 years I see the ability to record conversations as a GOOD thing. With so many of us spread out having recordings of them, even talking about trivial things, would be nice when they shuffle off this mortal coil. Nobody lives forever and you'd be surprised what a comfort having recordings of a loved one that has passed can be.

Re:And it *also* implements intercept

[icebike]

True, as one of the parties you have the right to record (in most jurisdictions), but the patent wasn't about client side recording.

This isn't about the availability of user-side recording, which I believe is already in Skype clients.

TFA says:

The patent does not mention an eavesdropping module that is integrated into the client software. However, it describes recording agents that can be placed in a multitude of devices, including routers. There is also the note of a recording agent software that represents “a software module that logically and/or physically sits between the call server and the network.” According to Microsoft, the agent will have access “to each communication sent to and from the call server,” which clearly refers to the general infrastructure of a VoIP service and network.

So two levels of intercept are explained here, one that might live an a router (potentially any router in the path) and the second runs on the server. Since the server in skype could be any one of the supernodes Microsoft can start silently record any calls to or from any party instantly upon presentation of a warrant. (To cast them in the least evil light).

The much hyped end to end encryption of skype is thereby gutted. (It had already been cracked years ago according to some reports).

Re:And it *also* implements intercept

[memyselfandeye]

Eavesdropping does not equate recording, I can listen to someone's private conversation without recording it, and it's still eavesdropping. Likewise, it's not eavesdropping if I listen to a conversation I'm apart of, regardless of recording it or not. Now it may be illegal to record a conversation I'm a part of with or without notification depending on local laws, however in either case, this patent has nothing to do with the summary and link that says, in not so many words, "Microsoft filed for a patent that allows them to eavesdrop and record private conversations of Skype users. The Internet is DOOMED and we should all watch out for the Feds because I hear the helicopter's buzzing overhead. Where's my open source tin foil hat, I need to apt-get update!"

POTS/VOIP PBXs have always supported call recording. It's up to the user to use it legally, but they do not, and will not, upload recorded phone calls to the AT&T master server. Neither is Microsoft going to upload recorded Skype calls to themselves, or the FBI, or Taco Bell.

  Correct me if I've misinterpreted the summary and following comments.

Re:And it *also* implements intercept

[shadowfaxcrx]

It depends on the state. "One party consent" states work as you described. "Two party consent" states require that BOTH (or all, if more than 2) ends of the conversation be aware that there is a recording being made. That's why any time you call a business they have the recording at the start that says the call may be recorded - to cover themselves for people who live in two-party states.

Re:And it *also* implements intercept

[starfishsystems]

Indeed. CALEA, as applied to digital communications, came into force in May 2007. At that point, all US network providers were required to file a report of comprehensive intercept capability or face a $10,000/day fine from the FCC. For this to be achievable, network devices with this capability had to be widely available well ahead of the deadline, and indeed they were. That in itself looks like prior art to me.

You'll notice that RFC 3924 has a section dedicated to VOIP. It was published in October 2004. You'll also notice that while this RFC discusses decryption of intercepted traffic, there is not even a mention in the Microsoft patent.

Re:And it *also* implements intercept

[Urban Garlic]

Well, turnabout being fair play, how's this:

Microsoft (and many others) use copyright law to control my right to run their software, because, they assert, in order to get the software from the distribution medium into my computer where it can be run, I must make a copy of the software, and the legal mechanism whereby they exert their control is by specifying, by their copyright, the conditions under which I may make this copy.

I assert, on the same basis, that the nature of digital media are such that any technically feasible eavesdropping process involves making a copy of some portion of the stream, and transforming that copy into human-listenable or human-readable form. There is nothing in the law that says that the obligations of the recording-maker are reduced if the lifetime of the recording is brief, or if their intent is somehow benign. Just as a copy is a copy, a recording is a recording, and so any "digital eavesdropper" must, by virtue of the recording made as part of the eavesdropping process, obey the restrictions and obligations incumbent on any other overt or covert recording-maker.

I'm dreaming, obviously, but it would be nice to see that particular legal knife cut both ways, or none.

Re:And it *also* implements intercept

[memyselfandeye]

I'm confused. And I hate the law. What I'm really saying is, Microsoft is not patenting an "intercept any Skype session and copy to Microsoft servers" They are patenting an "intercept your Skype session and copy it to your server(router, device, exec)." The summary, OT, and comments are all confused by the 'interception' patent speak and keep alluding to the notion that this is some big brother thing. The only way the FBI, TSA, or Post Office will ever see these recorded calls is if they get a warrant to search your servers AND you happened to have enabled the recording feature, should that be implemented in Skype. There is no secret squirrel eavesdropping going on here.

Now, whether it's legal to record your phone call or Skype session in your State is one thing. But other than writing the software, Microsoft has nothing to do with it. In other words, this is not some mechanism to circumvent encryption, to prevent privacy, or to record every single Skype session that is ever made in the whole world in order to find dissidents who are afraid of giant rats.. It's simply a method to intercept a session already established between two, or more, parties and silently route it in order to record the session, instead of some hackish solution to divert every call to a black-box (video capture window, dedicated capture server, tuner card) that must be manually toggled via managers or users, and also waste resources.

This is just the Skype equivalent of hitting *1 on your work phone to record a conversation, or recording a phone call for 'quality assurance purposes'... and last time I checked that doesn't get uploaded to Ma Bell for guys in white lab coats to analyze. In other words, this is not a patent to circumvent Skype's SSL encryption. It is not a patent for unanimous wiretapping. Nor is it a patent to disable features that we have all come to love and enjoy. I'm not saying Microsoft wont kill off Skype by doing something stupid, but this isn't it. In fact, I'd love to be able to record conversations between myself and colleagues with the push a button. I use it a lot to pass 'visual' data such as white-boarding and other experiments, and would love to look back at those without having to open a video capture card and hope the system doesn't crash.

Re:And it *also* implements intercept

[memyselfandeye]

That is what the article states, but after reading the actual patent I disagree. The application explicitly states it is a router on the network of one of the session's end. That is just one of the methods, which is required to enforce your patent should someone come out with an appliance/router, for example, that records Skype sessions.

And I'd love to record Skype video, but I've never been able to figure out how. If it is supported in the client, I'm a idiot. And I have never trusted the Skype security, and legally can not for classified work, but it is dang useful for my work.

Re:And it *also* implements intercept

[icebike]

That is just one of the methods, which is required to enforce your patent should someone come out with an appliance/router, for example, that records Skype sessions.

On the other hand, we've all seen patent claims against software that allegedly infringes only small portions of specific claims even when other claims are not even remotely challenged.

Every patent attorney seems to suggest this is impossible and yet nearly every week we see new court cases that indicate they are cherrypicking specific claims within ancient patents and applying them to something totally different.

Re:And it *also* implements intercept

[sixsixtysix]

^^this

Re:And it *also* implements intercept

[innerweb]

and last time I checked that doesn't get uploaded to Ma Bell for guys in white lab coats to analyze

When was the last time you checked? Not too long ago there was this seeming ruckus about them doing just such a thing. All in the name of national security. Given, they were probably convinced to do this, but none the less, they still did. They got busted, and were given immunity. Now, I can not tell you to who, for what or how often they did this, however I can tell you it happened. It was in the news, people were named, excuses were given and the government gave them a get off free pass.

I trust AT&T far more than Microsoft, and that is saying a lot, because I really despise AT&T (Ameritech) legal and business practices. Will Microsoft do anything illegal or *wrong* with this technology. Well, I can not tell you, but I can draw parallels. Ever wonder why investments are based on past performance, or criminal records are all about past performance? Well, past actions are a pretty good indicator of future actions.

Re:And it *also* implements intercept

[Roachie]

OMG, thats it! Play Metallica in the background of all your conversations.

"Hey Lars, guess what Microsoft is doing?!?!?"

Time to switch to Zfone

[Beautyon]

Zfone is a new secure VoIP phone software product which lets you make encrypted phone calls over the Internet. Its principal designer is Phil Zimmermann, the creator of PGP, the most widely used email encryption software in the world. Zfone uses a new protocol called ZRTP, which has a better architecture than the other approaches to secure VoIP.

* Doesn't depend on signaling protocols, PKI, or any servers at all. Key negotiations are purely peer-to-peer through the media stream
* Interoperates with any SIP/RTP phone, auto-detects if encryption is supported by other endpoint
* Available as a "plugin" for existing soft VoIP clients, effectively converting them into secure phones
* Available as an SDK for developers to integrate into their VoIP applications
* IETF has published the protocol spec as RFC 6189, and source code is published

[...]

http://zfoneproject.com/

Re:Time to switch to Zfone

[Anonymous Coward]

> * Interoperates with any SIP/RTP phone

Well, "many", not "any".

http://zfoneproject.com/getstarted.html

Zfone has been tested with these VoIP clients: X-Lite, Gizmo (audio, no video yet), XMeeting, Google Talk VoIP client (but only when Google Talk is using RTP), Yahoo Messenger's VoIP client (for audio), Magic Jack, and SJphone. Zfone will encrypt audio and video for Apple iChat calls on Mac OS X (Leopard). Zfone has been tested with these VoIP service providers: Free World Dialup, iptel.org, and SIPphone. It does not work with Skype.

Re:Time to switch to Zfone

[rtfa-troll]

It seems that Twinkle even supports ZRTP and is compatible with Zphone but the instructions I found to set it up are the perfect example of why Skype is so successful (compare with install / create account / it works... )

Re:Time to switch to Zfone

[dkf]

Does it require both ends to be not behind significant firewalls? The good feature of Skype for the majority of users was its ability to get connections past a majority of firewalls without network admins having to do lots of work. (I know of one place that has trouble, and that's because the admins there block just about everything and use a horrible firewall for everything else, so placing safety as more important than the ability to work. I don't know if any of them are actually called Mordac...) Having to massively expose your computer to the internet just so you can make calls is not the world's finest option when it comes to total system security, given that snoops most certainly aren't the only class of threat out there.

Big surprise

[next_ghost]

Jojin and HedgeHog from Bugemos.com made a comic strip about this 2 weeks ago. And it's not their first comic strip prophecy which turned out to be true.

technology and free choice between good and evil

[h1q]

If a privacy technology is insufficient to protect pedophiles and terrorists, then it is insufficiently strong enough for me.

The quality of the technology should transcend the user's choice between good and evil, as the allegation of evil is often done by those who know it well.

Does this surprise anyone ?

[mbone]

Really, I am curious. Does this surprise anyone ?

Re:Does this surprise anyone ?

[The Great Pretender]

Hasn't Google voice been doing this for a while? Otherwise how do they manage to do their voice to text?

Re:Does this surprise anyone ?

[hairlesshobo]

Unfortunately, this does not surprise me at all. It's kinda scary to see the lack of privacy that people in general have nowadays, but it has been a long time coming. I am a huge fan of electronics in general, but unfortunately in my opinion the line has been crossed in many ways with regards to privacy. This is just another example of how one or more corporations are able to monitor people whenever they please. I am not only referring to this this article about the possibility of Skype being recorded, but I am talking about trusting our data in other people's hands. Just like the idea of the "cloud." Enough ranting for me. I guess privacy is the expensive price most people have to pay for the sake of convenience. It truly is a shame.

Re:Does this surprise anyone ?

[Anonymous Coward]

I would be surprised if Skipe was _not_ required to make there systems compatible with (local) government automatic phone taping systems, just like any other network provider.

Re:Does this surprise anyone ?

[Tasha26]

I think the joke "what's a good Skype alternative" seems pretty real now.

Re:Does this surprise anyone ?

[Anonymous Coward]

Badly, I might add.

Re:Does this surprise anyone ?

[AHuxley]

The US has had a long history of bringing in tech, from aspects of radio, jets, rockets ect.
Now they have most of the worlds VOIP servers and staff within reach of the US legal system.
The only shock is the price, and that MS had all the tech - someone wanted Skype in the US.
What was hinted when the sale was first mentioned ie US crypto and legal wiretaps issues seems to be the reason that fits.
Skype must have been a few extra steps for US SIGINT and now thats fixed.

Re:Does this surprise anyone ?

[cjb658]

GV does not, and has never claimed to, encrypt calls.

...if you aren't doing anything illegal...

[Anonymous Coward]

That argument has been debunked long ago.

The problem is that if any organization has access to it, then the most corrupt or infiltrated agent has access to it.

Any specific information about a person that cause them to be distinguished from the rest can be used against them, if not through due process, then by sport.

If you don't believe me, publish your contact details here.

Whether you have anything to hide in particular is irrelevant.

why use skype when...

[Anonymous Coward]

Why use skype when there are VOIP applications that use standards, are built with open source so can be verified by others, support encryption, and are not controlled by a single large company?

Um why "add" something that's already there?

[Anonymous Coward]

Either I'm getting this horribly wrong or it has been common knowledge that lawful interception capability has been in Skype for ages. It's what made our police (in Germany) stop whining about not being able to catch Terrorist using Skype (something to that tune is also mentioned in Skypes wikipedia article btw. for what it's worth).

Also with Skypes architecture being as it is I'm wondering who could ever think Skype isn't able to intercept any phone call on a whim. Even without access to the data stream endpoints (which in the case of lawful interception isn't a problem) they can easily influence negotiation to make the talk go over a Skype controlled relay. I have yet to see any evidence to the fact that they do not have the capability to recover the keys used to encrypt the calls or influence route negotiation.

Hell they could outright patch a targets Skype to do whatever they want...

Unless you want US and potentially other countries listening in on your calls you better not use Skype. Microsoft buying Skype didn't change one bit about that fact.

you can't encrypt it before.

[goombah99]

The problem with audio stream encryption is that it will be before the compression codec. When you feed uncompressed but encrypted audio into the skype codec expecting voice it either wont' be able to compress it enough to send, or very bad things will happen to the signal and it probably can't be decrypted. If you try compressing it first, then you are still screwed when you try to decrypt it.

In the 80's when CB radio took off people tried building encryptors for that but it pissed the feds off and they got shut down.

Re:you can't encrypt it before.

[GameboyRMH]

Or instead of adding this Rube Goldberg contraption on top of Skype, just use any free and open VoIP protocol that already supports encryption. There are plenty to choose from.

Re:you can't encrypt it before.

[Anonymous Coward]

1) Design the encryption so that the encrypted stream is also compressible (ie "sounds like human speech"). I'm not saying it's easy. Just saying it should be possible.
2) The point would kind of be to piss off the feds, wouldn't it?

Re:you can't encrypt it before.

[icebike]

The problem with audio stream encryption is that it will be before the compression codec.

Why wouldn't it be possible to encrypt AFTER the codec. Bits is bits, No?

Also CB radio by law was never authorized to send encrypted messages. It was always illegal just as it is illegal for ham radio operators to use encryption. Manufacturing something that has as its only use a function that violates the law is bound to be unprofitable if not outright illegal.

Re:you can't encrypt it before.

[Anonymous Coward]

It is legal to encrypt if you are controlling a space station or an unmanned aircraft.

Re:you can't encrypt it before.

[icebike]

Not via CB radio.

PUUULEEEZZZZ

[Anonymous Coward]

Enough with these distractions. Let's get back to deriding the Chinks for not upholding human rights if you don't mind...

Re:PUUULEEEZZZZ

[denis-The-menace]

Naw, too much money to loose.
Much more profitable to lower our standards to theirs.
Why allow privacy to just happen when you can sell privacy as a product?

Patent? WTF?

[Anonymous Coward]

If calling a man-in-the-middle attack "legal" counts as an innovation, our patent system is more deeply fucked up than I realized...

No you got it wrong

[RotateLeftByte]

Step 1, MS puts this into MS-Skype.

Step 2, MS get their paid for lackeys (sorry congress critters) to outlaw any VOIP solution that does not allow Police Interception and specifically required this tech

Step 3, Enforcement. MS-Skype becomes the only legal VOIP solution in the US. ISP's are madated to block any other type of VOIP traffic.

Step 4, MS raises the price of MS-Skype by 500% per minute. Profit.

Re:No you got it wrong

[Yvan256]

Mod parent up by about five million points.

Re:No you got it wrong

[Anonymous Coward]

No offense, but why do you see the plan in a negative way?

Maybe if one imagined something more positive, whether it is true or just a hope, then this idea will bring enthusiasm to readers and more people could start thinking the same positive plan/ideas you just imagined.

For example:

Step 1, MS puts this into MS-Skype
Step 2, MS devotes more developers to enhance the quality of Skype
Step 3, Skype and Windows,Xbox,mobile,.. teams start working together on tighter integration
Step 4, MS releases new/updates their products to support Skype voice/text messaging
etc...

Re:No you got it wrong

[RockDoctor]

Step 3a : Rest of the world searches phone book for the number of a shit supplier so that they can give a shit about what happens in America.

Step 3b : Other VOIP systems rise to fill the place left vacant by Skype.

Sure, but how will Microsoft abuse it?

[ron_ivi]

Most of us don't compete in some way against Skype. Many more software companies do compete with Microsoft. I wonder what safeguards are in place to prevent Microsoft from abusing the power of having such wiretaps.

Re:Sure, but how will Microsoft abuse it?

[Jane Q. Public]

Uhh... try the law?

Microsoft may have the technical ability to intercept private conversations, but it doesn't have the legal authority.

This should be no more worrisome than your telephone companies building in tapping capabilities, in order to comply with the federal CALEA law. And I'm writing this even though I think the CALEA law itself is a bad idea...

What it boils down to, is that it would almost certainly take law enforcement intervention in order to do a legal interception of a conversation. The fact that it is happening over the internet doesn't change any of the basic legal principles involved.

Re:Sure, but how will Microsoft abuse it?

[lostmongoose]

Uhh... try the law? Microsoft may have the technical ability to intercept private conversations, but it doesn't have the legal authority. This should be no more worrisome than your telephone companies building in tapping capabilities, in order to comply with the federal CALEA law. And I'm writing this even though I think the CALEA law itself is a bad idea... What it boils down to, is that it would almost certainly take law enforcement intervention in order to do a legal interception of a conversation. The fact that it is happening over the internet doesn't change any of the basic legal principles involved.

Because the Law was ever a deterrent to MS before. Good luck with that.

Re:Sure, but how will Microsoft abuse it?

[sqlrob]

I think it's debatable whether or not the law protects them.

Does the EULA grant the authority?

Re:Sure, but how will Microsoft abuse it?

[obarthelemy]

it appears the law says that a blow job isn't sex, dropping bombs on someone isn't war, and detaining someone doesn't make him a prisoner.

i wouldn't trust "The Law" further than my biggest check.

Re:Sure, but how will Microsoft abuse it?

[PopeRatzo]

it appears the law says that a blow job isn't sex

No, it doesn't "say" that anywhere. The only time you hear the assertion that a blowjob isn't sex is from a guilty husband or boyfriend.

The "Law" is silent on the topic of blowjobs.

Re:Sure, but how will Microsoft abuse it?

[DutchUncle]

Microsoft may have the technical ability to intercept private conversations, but it doesn't have the legal authority....This should be no more worrisome than your telephone companies building in tapping capabilities

And therein lies a problem. Part of the battle about phone service over cable-originally-intended-for-TV was precisely about whether the cable operator would or wouldn't become a "common carrier" subject to the same rules as the phone company, and required to provide service to *all* locations, and required to collect the same taxes and fees - with details like being subject to the same responsibilities to not abuse their access to users' phone calls. Skype, or any other VoIP, is even further away from being a "common carrier"; heck, Skype admits that it bounces messages off users' computers when they are running the Skype client; imagine if the phone company was drawing on your power to run your neighbor's phone. It wouldn't surprise me for Microsoft to argue that they're not "intercepting" "private" communications, because after all it's just ones and zeros and it's floating around in the global tubes for anyone to see.

Re:Sure, but how will Microsoft abuse it?

[Isaac Remuant]

The problem is not what law says but how it's interpreted to fit 's needs.

Re:Sure, but how will Microsoft abuse it?

[Anonymous Coward]

Umm... Yeah, and as a user, you'll have the requisite amount of evidence and proof of them recording your conversations, exactly how?

Re:Sure, but how will Microsoft abuse it?

[sqlrob]

Actually, no it's not (or rather, it wasn't until Lawrence v. Texas)

Blowjob = sodomy in a legal sense (in some states, anything except missionary was technically sodomy)

Re:Sure, but how will Microsoft abuse it?

[obarthelemy]

yep, but, if it can be interpreted and made to say things that seem so counter-intuitive, it becomes useless.

Now, what other big text is in the same situation ... ^^

Re:Sure, but how will Microsoft abuse it?

[Jane Q. Public]

Yes, I thought about that. But you also have to take into account that there are other privacy laws in effect, both state and Federal. For some examples:

In some states it is illegal to record a conversation unless you have permission from all parties beforehand.

There are other federal laws, like one of the Electronic Information Privacy Acts (I forget which one), that says it is illegal for someone to use electronic means to monitor what goes on in your household.

That latter rule has been violated by any number of companies via cellphones, web cookies, etc., and I am surprised they haven't been challenged yet on those grounds. But the law still exists.

Re:Sure, but how will Microsoft abuse it?

[Isaac Remuant]

somehow, I made the mistake of not paying attention to the preview. It said, "insert politician's name here".

I agree with you though. The way in which a law is worded might help avoid the easy misuse but I fear that, in the current climate (lack of accountability and extreme power of the executive branch) the slightest detail will be used to advance their interests.

Re:Sure, but how will Microsoft abuse it?

[manwargi]

No, it doesn't "say" that anywhere. The only time you hear the assertion that a blowjob isn't sex is from a guilty husband or boyfriend.

Don't forget Dante Hicks' girlfriend!

Re:Sure, but how will Microsoft abuse it?

[Jane Q. Public]

In my state, thee is no way a EULA could grant the authority, because it is illegal to record a conversation unless all parties consent in advance.

The people I'm talking to can't be bound by my signing of a EULA.

Trust

[Anonymous Coward]

I won't trust the US government any more or less than any other government. After thousands of years of death, destruction, corruption, and injustice caused directly by organized coercion (i.e. government), only a fool would trust ANY government. History has proven over and over again that government serves the interest of the elite who control government, not "the people" as the age-old claim goes.

Secondly, how is it possible to secretly spy on a person in order to benefit that person? In the real world, a person who spies on you is called a stalker -- and certainly does NOT serve your best interest. What makes government any different? Lip service, blind patriotism, guns, and false promises are the only differences I notice.

Re:Trust

[Anonymous Coward]

When you spy on one person, it's stalking.
When you spy on everyone, it's security.

Move along, citizen.

Redphone

[Anonymous Coward]

Also you could use on Android devices the App Redphone from Whisper systems for full call crypto, Moxy Marlinspike got himself onto the terrorist watchlist for writing that app! LOL so you know it works. He must really hate to travel now.
here is their site:
http://www.whispersys.com/

downgrading skype

[Anonymous Coward]

Between this and the "Vested Stocks" issue, Microsoft is well on the way to burying another great product it purchased!
Fantastic business model!

Duh.

[GrantRobertson]

OK, so now there is verification. But did anyone think things would go any other way?

too late now

[Anonymous Coward]

Well, if there was no plan to do so before I'm sure that this post will be the proverbial muse M$ was looking for.

Too late

[Florian Weimer]

For a while, transcripts of Skype calls have been showing up in German court records. Law enforcement already has got access, probably through a variety of means.

The only way this will happen...

[Anonymous Coward]

is if the government first passes a law requiring ALL VoIP communication to have this recording capability in place. I don't believe Microsoft is intending to release a product here. They're just thinking about the possibility that the government might one day require it, and if so, they want to be able to make money off of it. It's not as if the concept is new, and I see no reason to believe Microsoft is actively creating a product or has any intention of doing so.

Re:The only way this will happen...

[rtfa-troll]

is if the government first passes.....

Hmm.. welcome to the 21st century. I think you will find we do things differently here.

http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act

Article and post is FUD

[harves]

In other news, Microsoft may:
  * add image processing [to Skype]
  * add remote document scanning [to Skype]
  * add virtual machine technology [to Skype]
  * add clustering capabilities for seriously big high definition video technology [to Skype]

I'm quite sure Microsoft has patents on all the above, but none are alarming enough to mention. This article is FUD. Absolutely no link has been drawn between the Skype product and this patent, except that Skype does voice transmissions and this patent is for a system that intercepts them.

Also, I believe Skype uses a peer-to-peer method for communicating between nodes, which would make it hard to apply this patent to Skype anyway. The peer-to-peer nature of Skype is why the last big outage took quite a while to resolve. They couldn't just "reboot their servers"; updated software had been deployed to the nodes (ie. you) and was malfunctioning.

Re:Article and post is FUD

[Anonymous Coward]

Your post is wasted on the blabbering lunatics here.

Re:Article and post is FUD

[Missing.Matter]

Thank you. I can't say I'm surprised it took so long for this comment to show up. Wish I had mod points.

Re:Article and post is FUD

[Anonymous Coward]

On top of all that, since NSA already has wiretap infrastructure at the major internet backbone providers, at the very least they can keep track of who's connecting to whom via Skype, and no sane terrorist is going to bet that they can't listen in on Skype conversations.

Re:Article and post is FUD

[Anonymous Coward]

Absolutely no link has been drawn between the Skype product and this patent

Wrong. The patent specifically mentions Skype as an application for this.

From TFA (emphasis added):

The patent was filed well before Microsoft’s acquisition of Skype and there is no reason to believe that the patent was filed with Skype as a Microsoft property in mind. However, the patent mentions Skype explicitly as an example application for this technology ...

It's an alarming patent, and Microsoft just acquired the program that would be the most logical (and disturbing) use for it. I think there is legitimate cause for concern.

Re:Article and post is FUD

[tgd]

Microsoft already had the most logical use for it (OCS/Lync/TellMe) for an environment (corporate) where its not already illegal, and where there may be compliance and legal reasons for *doing* the recording.

The article is FUD. Skype wasn't a blip on their radar when the patent was filed. Imagining it has anything to do with Skype is just ignorance. Skype wasn't (and isn't) a Microsoft property, and its absolutely normal in the disclosure part of a patent to call out examples of technology that the examiner would know. The whole reason that text exists is to help the examiner understand the claims.

But anti-MS articles (no matter how stupid) get ad impressions, so you'll keep seeing them a few times a week on /.

Re:Article and post is FUD

[Anonymous Coward]

I guess for people like you who want convenience (faster recover from occasional downtime) over privacy and integrity of your communications.. people like you are idiots.. please diaf.

EPIC FAIL or EPIC WIN:

[Anonymous Coward]

EPIC FAIL or EPIC WIN:

When I opened this article, the advertisement at the top was for SKYPE. When I worked @ a business journal and we produced web based articles and emails sent out, we rearranged articles to ensure that they were not right next to advertisements that were promoting/denouncing the same thing as each other.

Bad demographic ad placement, imo.

Re:EPIC FAIL or EPIC WIN:

[obergfellja]

Total Epic Fail, man.

Recent activity on Zfone?

[Futurepower(R)]

Apparently little has changed on the Zfone web site since 2007. The download has been unavailable since 29 January 2011.

Anyone have a link to a download?

Re:Recent activity on Zfone?

[Anonymous Coward]

Its in several places:

http://thepiratebay.org/torrent/5727745/DEFCON.15_T203_-_The_Zfone_Project_(Cryptophone)

http://www.mediafire.com/?l3d4nn62nez22lc

http://www.kat.ph/search/zfone/

Re:Recent activity on Zfone?

[Anonymous Coward]

There is a GNU implementation for ZRTP available, C++ and Java, which is used in the following
client:
- Twinkle (C++ SIP client, needs some know-how to build it)
- Jitsi (former SIP Communicator), a Java based Client, available for Linux, Windows, Mac,
    often "ready-to-go" installation packages availbel (some Linux, Windows, Mac). Active development.
- CSipSimple - an Android clinet that supports ZRTP
- some iPhone clients are currently under development AFAIK

and the development goes on (for example GNU ZRTP is available for the well known PJSIP/PJSUA library that many
projects use to build clients.

Re:Recent activity on Zfone?

[Anonymous Coward]

At that point, why not just use mumble and/or a mumble port to android?

The only thing stopping it from being 'centralized' is having one or both ends able to connect to a port/ip for the other device.

And it's crazy low bandwidth too. I used it to connect to someone in an island nation that had like T1 level access.

Who Cares?

[Anonymous Coward]

Is this really that big of a development? I mean how long have our landline calls been monitored?

You are so wrong

[Anonymous Coward]

I hate sharing the world with thoughtless people like you. You enable injustice and oppression, which in turn harm me.

The worst part about people like you is how uncompromising you are about your stupidity. You staunchly refuse to listen to reason, be educated, or rub two damn neurons together and get a clue.

I hope you die young.

Hey freetards

[Anonymous Coward]

There are already more secure alternatives to Skype. Like mumble and SIP. and they're copyleft.

Re:Hey freetards

[the linux geek]

SIP isn't an application, it's a protocol. Calling it "copyleft" is moronic.

Just FYI (Xbox Live)

[Blakey Rat]

Just FYI, Xbox Live already does this. All data sent over the Xbox Live network is encrypted, *except* voice communications. This is to allow Federal agencies to listen-in if required.

So this isn't a big shock; Microsoft buys a VOIP product, changes it to comply with policies it's already established for VOIP products.

The Intercept?

[Andy_w715]

I thought Morgan was the Intercept.

Re:What'd he say?

[Steauengeglase]

Honestly, that is kind of one of the legitimate uses of this.

If you call up a number and they require your card number, you don't want a recording of that part of the transaction sitting on their servers somewhere waiting to get hacked or sold off or abused in some other way, but you will want a recording of the call for liability reasons. You also don't want the servers that are handling your connection doing this job, because that kill resources, to you hand that job off to another machine (many machines actually, it is a complex process when you have a bunch of concurrent calls at the same time).

MS is just covering their bases and cornering as much as they can (granted we have been doing this kind of stuff for years, so I'm not sure how valid the patent is).

Gov't listening everywhere

[Anonymous Coward]

This is all about limiting Free Speech. After all, censorship is everywhere. The gov’t (and their big business cronies) censor free speech, shut down dissent and ban the book “America Deceived II”. Free speech for all.
Last link (before Google Books bans it also]:
http://www.iuniverse.com/Bookstore/BookDetail.aspx?BookId=SKU-000190526

MS Licensing

[Anonymous Coward]

All MS has to do is set the license fee to $1M. That would just about stop anyone else from selling any VOIP software in the US that wasn't Skype.
This is a 'Legally Mandated Monopoly' They'll get away with is because of the 'War on Terror'/Patriot Act.

Hang on

[Pop69]

So this records voip calls in the same way you can record pots calls ?

How is this patentable as not obvious ?

Re:Hang on

[Anonymous Coward]

because of the simple word: digital

XMPP / Jingle / SRTP

[Sami Lehtinen]

I have been looking for XMPP alternatives for Skype for a good while. Jingle using SRTP does look good. http://xmpp.org/extensions/xep-0167.html#srtp

FAIL

[Anonymous Coward]

adding evavesdropping would ruin skype. Its time to switch,

Isn't that called Wiretapping?

[Anonymous Coward]

If you have a patent on wiretapping, does that mean you don't have to get a warrant?

Somebody needs to get a patent on a method for using a cell phone to record police traffic stops. That would invalidate any state law saying otherwise.

Sexist much?

[Anonymous Coward]

it appears the law says that a blow job isn't sex

No, it doesn't "say" that anywhere. The only time you hear the assertion that a blowjob isn't sex is from a guilty husband or boyfriend.

Or perhaps even a guilty wife or girlfriend...

But don't let me stop you being sexist.

Re:Sexist much?

[TangoMargarine]

No no no, everybody knows you can't be sexist against men.

Probably legally required to do so. . .

[JSBiff]

Any company offering a VoIP service is, I would think, legally *required* to provide law enforcement with a means to do a wiretap.

If the Law gets a Warrant, that's quite appropriate according to the Constitution.

If you want untappable VoIP, you'll need to use a direct, encrypted connection, and better hope the NSA hasn't figured out how to crack the cipher you pick.

Going through any third-party service (Skype, Google Talk, etc), is just asking to be tapped.

Re:Probably legally required to do so. . .

[peppepz]

They already have a means, although a bit less comfortable to use than traditional wiretapping. They can install on the user's computer a trojan that samples the machine's microphone input. It can be used to eavesdrop Skype, but also for environmental interception. Italian police used this technique very recently against an alleged criminal who thought to be safe from wiretapping by virtue of using Skype.

Don't you think that Apple would not do the same?

[Anonymous Coward]

Do you think that Apple, if given the opportunity, would not do the same?

Nice little research demo

[Anonymous Coward]

http://info.ee.surrey.ac.uk/Personal/N.Katugampala/pubs/pubs.htm

And to make it worse, Skype already has this in Ch

[kervin]

Not to mention, Skype already has interception in China, and probably in other countries with governments that require it.

You maybe able to get around this by getting the full ( not the stub ) international installer and using that. But the Chinese Skype definitely has censoring and interception built-in.

Here's an article, but there are lots of references to this on the web...

http://www.wired.com/threatlevel/2008/10/chinese-skype-s/

Oh noes

[Anonymous Coward]

Ahh man they'll be listening to our Sunday skype call with the family and listening in on my son's first words. THAT IS if they actually do this. Just because they have a patient doesn't mean they'll do it.

Sky is falling!

Legal how?

[ThePeices]

How can this be legal worldwide? In my country ( a non-american, western democracy ) it can only be legal to record a private conversation if both parties have been notified that they are being recorded.

The only other way to legally record, is by law enforcement after they have received a warrant from a court judge, which is fine by me if due process has been followed.

So in many countries, the eavesdropping 'features' MS are adding may be illegal to use without a court granted warrant.

So what?

[Anonymous Coward]

PSTN calls aren't encrypted so why would you expect Skype calls to be encrypted?

Skype and Interception?? Old news folks...

[Anonymous Coward]

Skype has been "intercept-able" for some time now - thanks to CALEA.

And yes, before Microsoft, before Yahoo, it was secure enough to some degree as only the endpoints of the conversation had the only keys (AES-128) for the conversation, but Skype has long been vulnerable to man in the middle (MITM) type attacks due to their requirement to permit CALEA monitoring of the traffic.

Also, you folks are aware of the little "additions" that the NSA put into the AT&T offices years ago to monitor data throughput - this shouldn't surprise you, but there are switch vendors that make interception gear that can record conversations off DS3's (that was 2005) and stream them out.

R U nuts? Realtime VOIP over Tor?

[Anonymous Coward]

Lemme get this. A software based voice encryption app, run on a phone. Then run through a wireless telco data connection. Then run through Tor. Then it exits another wireless telco data connect. Then is decrypted via software on another phone. The only question is if the latency is measured in 10s of seconds.

The lag is bad enough with small plain text web pages, and you expect Tor to be realtime with voice? Though a typical phone data connection? If you're gonna posit a "solution", at least make sure they have a realistic use.

Re:R U nuts? Realtime VOIP over Tor?

[Kamiza Ikioi]

You are thinking in terms of exit nodes. If setup correctly as a hidden service, Tor maintains the pathway, and you never hit an exit node.

Diné Bizaad

[zooblethorpe]

Diné Bizaad yee Nidaazbaa'ígíí éí doo t'áá diné bizaad chodayoos'iid da ndi, naabeehó bisiláotsooí bizaad chodayoos'iid.

The Navajo Code Talkers didn't use just Navajo, they used military Navajo.

I.e., the Navajo they used was itself encoded, albeit not very strongly, so things like "abreast" in the plaintext English worked out to "ant breast" (pure gibberish) in the Navajo.

Hágoónee / Cheers,

QuteCom

[Anonymous Coward]

The relatively new QuteCom (aka Gizmo5), available in debian/ubuntu, supports SRTP (which is basically the same thing as zfone, as far as I understand things). It's very usable (more than zfone), and also happens to be the best linux VOIP client I've ever used.

Ahh, but you're missing the true beauty of this

[hawk]

It's not at ms could yap for the government, but that no one else could, withoutht violating the patent?

FBI: "here is our warrant. Intercept that call."
Non-ms skype competitor: I'm sorry, but I'm prohibited from doing that. Perhaps you could get the target to use skype?

Secure VoIP alternative to Skype

[Anonymous Coward]

Try www.gold-lock.com.

Every authority has the capacity to intercept telecommunications. The only real difference is the extent to which that facility is used for legitimate crime prevention / law enforcement purposes or abused for the purposes of economic interest of the state in question. The ex head of the French Secret Service (Claude Silberzahn) has openly admitted to this type of spying for the benefit of French state owned commercial interests ... so this is not a practice that is restricted to international backwaters in strange far-off lands. If you are communicating over an unsecured public network you should assume that somebody could be listening - not necessarily that they hare, but that it is possible for them to do so.

We've used the Gold Lock product to good effect - works well on mobiles (not all - iPhone, Nokias, Blackberrys and Android) and PC too, so is very similar to Skype (no video, but who cares for serious business / secure communication?).

Meh

[Anonymous Coward]

Yea cuz Microsoft REALLY wants to know what I had for dinner last night.

Unless you make yourself a target by doing stupid things, this isnt a issue. Of over the 600 million users of skype, microsoft really doesnt give a flying **** about your conversations unless it involves harm to their company or terrorism, or other illegal activities.

And those smart enough to DO those illegal activities wouldnt be stupid enough to use skype to communicate in the first place.