Tap-Tap-Tapping the Net

The IETF will be considering building wiretapping into internet protocols (see previous slashdot story) tonight at their conference; the Washington Post has a story on the subject. A great many civil liberties and technically-oriented organizations have signed onto an Open Letter urging the IETF to reject any attempt to build snooping into the net.

Comments

Whatever.

[Signal 11]

Sure, let the IETF build in wiretapping stuff. I think they need to fail horribly before they stop doing stupid things like that. For one, if it's at the protocol level it will be exploited. Alot. Remember source-routing? Notice how everybody even remotely concerned about security has it disabled, and infact under linux and most UN*X implimentations require you to specifically enable it?

Secondly, why should we care? Anyone doing anything illicit will be using encryption anyway. So catching criminals isn't the issue here. Hell, I frequently use PGP for stuff that I don't consider sensitive - like sending source back and fourth between my friends. The only use for a wiretapping protocol will be to let the l335 h4x0r d00ds have a reign of terror on the 'net.

I say to hell with the IETF - Let the chips fall where they may (and they will fall!).

--

Encryption

[Hermetic]

What with this and the recent stories about echelon, it is high time we started encrypting everything that we hold dear. Unfortuneately, we can't encrypt everything on the internet.

There was a story some time back about Freedom, a web encrption scheme that encrypts all communication between your PC and the servers you are communicating with. Does anyone have a link, or more info? I have lost mine since then.

Won't work...

[.pentai.]

Hmm, how do I connect to other computers? SSH.

What if I need to talk about important stuff on IRC? Encrypted DCC Chat.

File Transfers? Easy, compress with a password.

Any kind of protocol for this would be easy to break past. Just remember, they can't watch everyone all the time so they won't watch most of the people any of the time. Encryption wouldn't even have to be extremely strong...just powerful enough for them to not be able to look directly at it. There's FAR too much information out there to decode it all.

Wiretapping protocols

[jd]

This begs some interesting questions:

1. How do the IETF propose to wiretap -AND- have strong PtP IPSec encryption?
2. How do the IETF propose to locate packets, given that routers decide paths on-the-fly?
3. How do the IETF propose to enforce this, when they are not a regulatory body? In fact, the strongest the IETF can do is release an RFC, which is just that - a request for comments.
4. Who, exactly, is going to implement this wiretapping protocol? Even if the entire backbone used it, all you need do is tunnel through and the protocol becomes useless.
5. What protections can the IETF impose, which guarantee that the wiretapping would even work, even assuming you -could- find all the fragments of all the packets and re-assemble them all? It's easy enough to modify a TCP/IP stack. A few tweaks here, a few tweaks there, and you're sending valid data which the sniffer will reject, but which your intended recipient will accept.

In balance, I think it's useless, pointless and stupid. Stick to IPv6 promotion. That's useful. This isn't.

A matter of principle...

[Anonymous Coward]

The Clipper chip initiative was supposed to be no big deal, because the government would only use it when they had reason to suspect. When people got upset, a smaller group of people said, "Well, the NSA can probably crack your messages anyway, so why not give them your keys?" (Now, of course, it's being shown that maybe we *aren't* so far behind the NSA-- they probably *can't* break some of the stuff out there!).

The response was simple: Just because somebody can open up an envelope doesn't mean that we send all our mail on post cards. The envelope may *not* help privacy in a lot of cases, but we still use it. It's a matter of principle-- just because somebody can violate your privacy, there is no reason to openly invite them to do so!

Some people have been saying that the government is able to listen in on our communications anyway, so why not add in a provision to allow them to do it more easily?

Simple: we can't *condone* a violation of privacy. Scott McNealy may say that we have no privacy, so get over it, but I'll bet he'd raise all holy hell if one of his employees were to read through all his e-mail.

By implementing a standard that would allow the government the ability to snoop in on our conversations, we are not only condoning such action, but encouraging it! Never, at any time, should we encourage the government to (with or without permission) monitor our communications!

Just my $0.02

Holes in one layer of the OSI model

[Yarn]

Can be patched with fair sucess at another.

For example, I think it'd be harder to make IPv6 less secure than IPv4, but we have layers on top of IPv4 that are sufficently secure.

On another related point: will the relaxation on exporting cryptographic source lead to the 'secure linux' patch being merged with the main kernel tree any time soon? Or are there other problems with the patch?

Is Wiretap Immunity An Absolute Right?

[Effugas]

This isn't going to be very popular, but I'd really appreciate some responses from people who've dedicated much more energy to the analysis of these type of questions.

Now, I say this as a hardcore privacy advocate. I'm not the enemy. I'm a theorist, who wants to know:

Is wiretapping evil?

By that, I mean do people have an intrinsic right to privacy that doesn't end when they begin violating the rights of others?

After all, few of us would complain about the subpeonas that have been delivered unto Tobacco Companies, Microsoft, and hopefully RealNetworks. Subpeonas are after the fact violations of privacy--society is demanding some chunk of personal information from the subpeona'd party. Steganography is designed to defeat such information gathering techniques...but the existence of the technology doesn't mean subpeonas must be evil.

Nor too does the existence of wiretapping prevention technology automatically make wiretaps illegal.

From what I've been able to discern from the literature, there's a slant towards arguing that wiretapping should be difficult--essentially, so it's only used for cases where national security is at risk. Can a system be designed where it is intrinsically difficult, but not impossible for society to spy on certain individuals' communications?

Again, I'm the guy at work who is the point man on SSH, on custom designed secured VPN proxy links(believe me, that actually makes sense), and all these types of technology. But I'm also the guy that, when his friend was attacked by somebody who called her on the phone a half hour before, ran to campus Information Technology demanding the phone logs(and was oh-so-irate when they wouldn't let me write the simple Perl scripts necessary to extract them from the logging port on the switch. And people wonder why IT hates me. ;-)

Screaming about how child molestors are being used to justify widespread Big Brother monitoring is all too appropriate...but begs the question, what about the child molestors? Is it possible to shield everyone but expose those who society does need exposed?

At least a government intrinsically possesses citizen oversight. Corporations and "Mafia" style operations have no such limitations, and flourish quite well under power vacuums. A government that cannot keep tabs on such organizations is arguably irrelevant to them--just look at Russia lately.

Sooner or later, I'm going to be taken to task over the secure technologies I'm personally involved with designing and deploying, and I want to be able to reply with something I believe in. I want to be able to defend my position, and I need your help to do so.

So, is wiretapping evil?

Yours Truly,

Dan Kaminsky
DoxPara Research
http://www.doxpara.com

Re:Is Wiretap Immunity An Absolute Right?

[Effugas]

A subpoena or search warrant is served to an individual. They come and knock on your door.

Or search through your files if you're a corporation. They take over your office and demand you deliver all emails archived over the course of the last year.

The government doesn't (ostensibly) wiretap Bill Gates.

After the fact, they got Gates' private email...

There is no check or balance when law enforcement can wiretap. Using technology, it becomes feasible to place a huge number of people remotely connected to someone they are investigating, scan for key words (even in voice, if not now, then soon). It's 1984. * And that's just government wiretapping. That doesn't even touch criminal wiretapping (and its technological cousins...)

So all wiretapping is bad because some wiretapping can be abused?

This is the kind of logic we hate in Internet discussions--"Some people seduce 16 year olds on IRC, so all of IRC is BAD!"

Yours Truly,

Dan Kaminsky
DoxPara Research
http://www.doxpara.com

Big company fears

[fizzbin]

It seems that (according to the Washington Post story) companies who make communications equipment were worried about the Feds requiring their equipment to comply.

This leads me to wonder: Since this has arisen because of IP telephony, is it possible that traditional phone companies, fearing a loss of business to entities who don't comply with wiretap laws, are pushing this proposal? Seems like an interesting conspiracy theory at least.

Anyway, the IETF will probably kill this bad idea.

Enough is enough.

[Parity]

Obviously, this would have to be only the first step; outlawing implementations w/o the trapdoor would have to follow or we'd all just ignore it. Outlawing all other forms of encryption would be necessary too. I don't -think- that there's a chance in hell we'd let it get that far, but I'm not taking any chances. Between the DVD-blowup and this nonsense and the censorship issues, I just went and signed up to be a member of the EFF. Lots of us are tech professionals. I, at least, can put off a memory upgrade on my linux box for a few more weeks for a little piece of mind.

--Parity

IETF isn't the bad guys

[The G]

The IETF, contrary to many posts here,

(1) isn't the bad guys, and
(2) probably will decide to ignore wiretapping concerns in protocol definitions

The question the IETF is debating the answer to is, roughly, "should wiretapping laws (of varoius countries) be considered a factor in protocol designs." It's a good and important question to ask and folks shouldn't demonize them for asking it.

That having been said, the answer will probably -- quite sensibly -- be "no."
--G

Lions and Tigers and FBI wiretaps (oh my!!)

[karb]

At the end of the article there is something said by an FBI agent about Internet Service Providers already being required by law to be able to provide wiretapping services.

I hate to tell you all of this, but this is not echelon. This is not a grand government plot. This is about the application of existing law-enforcement techniques (wiretapping phones) to new technology (wiretapping information transactions). The same procedures for getting a wiretap on a phone will be required for getting a wiretap on information transactions.

So, what, exactly, is the problem? Unless you are a criminal, and quite a significant one, you have nothing to fear from the FBI. If you did have something to fear from the FBI, your phone would be wiretapped already, your house will be bugged, and your actions monitored. And no, the FBI does not have the manpower to listen into your phone unless you are quite the bad*ss. Even then, a federal judge has to approve the warrant (the legal document, not the band) that will allow them to wiretap you.

While I feel there are some security issues introduced by this, I hardly think that it isn't worth the value given. I mean, on one hand, some incompetent sysadmin gets his system hacked (and it would have been anyway), or we can't get the information needed to convict dangerous criminals.

I hate to be this way, but I feel that some /.ers are law-enforcement luddites. On one hand, they believe technology is great, and we can use it in new and exciting ways. On the other hand, they believe law-enforcement shouldn't be allowed to expand their existing abilities to take new technologies into account.

I'm just rambling anyway -- really, if ISP's would really be required by law to provide wiretapping capabilities to the FBI, they'll have to figure out some way to do it, regardless of what the IETF says or does.

Re:I'll worry when Bill has a near fatal head inju

[PD]

I'll worry when the temple is rebuilt. There's a great big mosque there right now. Until then, party time.

the problem is who do you trust?

[SEAL]

I think the U.S. government has shown little evidence of trustworthiness. THAT is the issue and that is why privacy advocates hate this sort of thing. The government thinks it knows what's best for the peons, and be damned if they want to run their own lives.

Stop for a moment and imagine the government's ideal scenario. They want unhampered access to as many forms of communication as possible. At the same time, they want people to think their communications are secure. That way, people will talk openly, and they can gather more information on the bad guys.

So they say.

How far does it go, though? Take a few sample cases...

• The FBI has evidence of a guy sharing kiddie porn over the net. Instead of busting him right away, they listen in, and get enough evidence to nail his circle of friends who are involved. Pretty straightforward - mission accomplished. I think most would agree that's a job well done.
• Another federal organization suspects a group of "religious" fanatics of hoarding weapons and plotting generally Bad Things(tm). They tap in on conversations to prepare an assault. Now if laws were being violated, ok. But it begins to blur the line a bit eh?
• During an information sweep, gathering from many source emissions (Echelon?) another government organization hears you joke about the president's life. Not so funny when they show up at your door...
• You're a witness to a crime, but fearful of testifying (for whatever reason). The government digs up past info on you and "leans" on you, even though you were not involved in the crime in question. (This has really happened). Is that a fair use of wiretapping info?

Frankly, I think the government can shove wiretapping up its ass. Joe Average is the one who really gets the brunt of their scrutiny. Is our society so paranoid that we must spy on our own people? That's not the kind of life I want, although it gets more that way every day.

Best regards,

SEAL

Huh?

[john187]

Tapping is already built into 'the net.'

Anybody ever look at the output from a packet sniffer?

Moreover, there are three key problems:

1. Any protocol for transmitting data, can also transmit encrypted data.

2. Any protocol is a software specification, and therefore must be adopted by the industry before having impact on the community.

3. Any Internet protocol must support the wide variety of computers on the Internet, including, old computers, legacy systems, and technology being deployed TODAY. Who's gonna upgrade software to facilitate snooping their data?

John

my way...

[Haven]

I feel safe with my data, and you can too. All you need is:
-Set up a dedicated secure linux firewall running IP_MASQ
-Install and configure CIPE. Here's the HOW-TO

That allows Virtual Private Networking with 128bit encryption. Its GPLed, and after you get it set up its incredibly fast (I use it over a cable modem). Its a lot more secure than a NFS+SAMBA solution.

Bill of Rights.

[zCyl]

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probably cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

- Ammendment IV

It looks to me like they got it right the first time. Nowhere in there does the U.S. Government have the mandate to universally require wiretap ability, but may force it only on specific people or places when justified by probable cause with supporting testimony.

I've seen no politicians stand up and oppose this section of the Bill of Rights, yet far too many try to violate it. I think the U.S. would do well as a country if its politicians read the Constitution once through...

Re:Bill of Rights.

[Effugas]

against unreasonable searches and seizures

This presumes there are reasonable searches and seizures.

Nowhere in there does the U.S. Government have the mandate to universally require wiretap ability,

Well, if there are reasonable searches, there must be an ability to execute that search. Since it's impossible to predetermine which communications can be reasonably searched, all must be made searchable, and the courts must determine which ones may be searched.

At least, that's how the argument goes. Where's the flaw in it?

Yours Truly,

Dan Kaminsky
DoxPara Research
http://www.doxpara.com

Re:Bill of Rights.

[Kaa]

Well, if there are reasonable searches, there must be an ability to execute that search.

First, the Constitution does not specify what *must* be -- only what must *not* be. It permits reasonable searches, but does not make them obligatory.

Since it's impossible to predetermine which communications can be reasonably searched, all must be made searchable...

And here is the flaw. You are saying that everything under the sun must be made searchable and seizurable by the government, in case at some point in time the court system will let it. This implies that if I write some document, encrypt it and destroy the key, I have committed a crime since at some later point the government may present me with a subpoena for this document and I cannot produce it. I don't think that this is how the law works.

To reiterate, the Constitution does not *prohibit* the government from establishing wiretapping facilities, but it also does not *demand* them.

Kaa

Don't let the facts stop a good flame.

[Xenu]

The IETF is discussing the following questions:

"should the IETF develop new protocols or modify existing protocols to support mechanisms whose primary purpose is to support wiretapping or other law enforcement activities"

"what should the IETF's position be on informational documents that explain how to perform message or data-stream interception without protocol modifications"

Mass Confusion!

[Otto]

Ummmm.. I'm confused...

Since when the hell did IETF gain any form of actual control? They can release an RFC, right? BFD... It's not like they write any actual CODE or anything..

You don't want people spying on your communications? Use code that doesn't implement that spec. Wheeee!

Does anyone honestly think that, given a choice, an indiviual would choose a piece of software that is intentionally insecure? Really, given an actual, informed choice, mind you...

IETF has no real power. They can define the spec all they want, just don't use that spec. There's already specs out there which are not tapable. Use those instead. The whole point of the RFC system is "may the best protocol win", right? So.. May the best protocol win. :-)

---

Means of appeasement

[jabber]

The IETF full-well knows that IPv6 will make wiretapping of the internet a moot point. "Yeah Mr. NSA, you can listen to ciphertext zip by, be my guest"...

My suspicion is that this is a way of saying "Nice doggy" to the 'powers that be', because the 'powers that be' can fund backbone upgrades, provide research grants, and lobby in favor of certain protocols and technologies...

This support from the federal government would mean a lot to the members of the IETF, and if the price of the support is providing a back door that leads nowhere, so be it.

The people on the IETF are not as dumb as those twisting their arms are.

Besides, what better way to convince big business to lobby for strong encryption than to show that lack thereof is tapable?

Slickness points to the IETF.

Colors intentional

[jabber]

Areas are now being color coded. It's on purpose, and it should be consistent within a topic.

I suspect that Rob/Andover is trying to increase ad revenue by increasing membership. Making slashdot contain more eyecandy, thereby attracting AOL users like moths to a lamp.

I just hope that it's actually a bug-light. :)

Just ignore them. The colors should fade in 8 to 12 hours... Have a nice trip.

Not for Technically Savvy Linux Users

[Greyfox]

They haven't a prayer of foisting anything on Linux users that Linux users don't want. I can just go into the kernel source and rip out anything that I don't like.

No, the only people this would affect will be closed source OS users, notably the 90% of PC users who use Windows.

clarification

[Haven]

I use this solely between 3 private networks that need 128bit encryption. This is overkill for everyday usage.

Youthful Run-Ins with Authority

[Greyfox]

I'd hazard a guess that most /. readers had run-ins with authority figures when younger and quickly learned how idiotic people can be. The Hellmouth series of stories is a good indication of this.

We're different; mappers instead of packers, to use another metaphor recently seen on here. One day the Government could decide we're dangerous and should be tracked. Ever see the Sci Fi show about the kid who's killed because his IQ was too high? (Outer Limits, I think it was.) We innately distrust authority because we've seen what idiots buerocrats can be, from the school administration who classified us as "Learning-impared" because we didn't do well in classes that bored us to Pointy-hairs at any given company.

And just because you're paranoid doesn't mean they're not out to get you. Abuses of power within the various three letter agencies are well documented in the states. From the McCarthy witchunts to the surveilance of assorted leaders of the 1960's to the incidents just recently in WACO and Ruby Ridge, the proof is there that you can be eliminated or harassed for the rest of your life if you attract the wrong attention, even if you're innocent of any wrongdoing. The government and its agencies need lots of accountability and lots of roadblocks to keep such abuses to a minimum. And we need to make sure that every government keeps their hands the hell off the Internet, which will one day be the main medium for communication around the world, not because we're not afraid that criminals will use it and leave no tracks in the real world but because we're afraid that the government will use it to, say, silence a whistle blower who is trying to force some accountability.

4th amendment

[sterno]

The fourth amendment guarantees your right not to be searched without due process of law. Most of the time this is the case. This same guarantee protects your right not to be wiretapped.

Now, the problem with building in backdoors into the fundamental security of the Internet or any system is that it provides the possibility for abuse by both authorities and third party criminals (as opposed to the criminals who are the authorities). If somebody can get access to that back door they can create endless havoc.

The other problem is that with this back door so readily available, authorities will be very tempted to use the door without warrants. If they think you are a bad guy they can sniff your traffic get enough evidence then go get the warrant to get the rest of your traffic. And don't think they won't do it. There are countless cases of cops using wiretaps illegaly to get information and go after people who otherwise would not be prosecutable. In all likelyhood they would surrpeticiously just sniff all traffic for naughty bits, and nobody would be the wiser because it is all the kind of stuff locked up in the dark recesses of the FBI and NSA headquarters.

Nah I'm not paranoid... :)

---