Large-Scale Surveillance Systems Create Security Risks

from the unauthorized-access dept

There's been a lot of discussion, here and elsewhere, about the dangers that expanded government surveillance pose to civil liberties. The Constitution protects the right to be free of unreasonable searches, which the courts have held includes electronic eavesdropping, and many people, myself included, think that recent proposals for expanded wiretapping threaten that right. But less attention has been paid to the security risks created by expanded eavesdropping programs. Matt Blaze and some other computer security experts have a new article documenting the risks concerning eavesdropping systems that themselves could be compromised, allowing unauthorized third parties to use government surveillance networks for their own ends. That's what happened in Greece, when someone managed to hack into the Greek surveillance infrastructure and listen in on dozens of senior government officials. Blaze and his co-authors argue that the more information collected by a wiretapping scheme, the greater the damage that will be done if it's ever compromised. The Protect America Act, which Congress passed last August and is due to expire in a few days, authorizes virtually unchecked government interception of communications between Americans and those overseas. The paper warns that the safeguards in the Protect America Act are inadequate to protect Americans from a compromised surveillance network. Congress would do well to listen.

Filed Under: civil liberties, eavesdropping, greece, privacy, wiretapping

German Government Struggles To Tap Encrypted Skype Calls

from the crypto-works dept

The Wikileaks project is starting to bear fruit, with documents leaked to the site beginning to get a lot of attention. The latest example is correspondence between the German government and a vendor (via Slashdot) that apparently makes software for intercepting Skype calls. Interestingly, the interception technology appears to be pretty primitive and rather expensive. The software has to be installed on the Skype client, and the vendor suggests that this can be accomplished by attaching a trojan to an e-mail or physically entering the premises to install the software on the target machine. And, evidently, only Windows 2000 and XP are supported; Vista support is still in the works. The company charges thousands of euros per target computer. This suggests that Skype's encryption technology is secure against at least the eavesdropping techniques available to the German government. Apparently they haven't found a way to decode encrypted Skype traffic off the wire, so they're forced to resort to these fairly cumbersome attacks on Skype clients -- attacks that are no more convenient for law enforcement than simply bugging the target's office. That suggests that the risk of comprehensive government surveillance of online telephony is still a fair ways off. If you encrypt your online activities, they're probably pretty secure. Of course, it's entirely possible that other government agencies, such as the NSA, have more sophisticated eavesdropping technology that they haven't shared with the Germans. My guess is that any government agencies possessing really sophisticated eavesdropping tools are also less likely to have their private documents show up on Wikileaks.

Filed Under: encryption, germany, skype, trojans, voip, wiretapping
Companies: skype

Watching FISA Fizzle

from the the-political-circus dept

Sen. Chris Dodd (D-CT) appears to be the blogosphere's favorite son this week, with calls for him to replace Harry Reid (D-NV) as Majority Leader in the wake of his successful attempt to block passage of the White House–approved version of reforms to the Foreign Intelligence Surveillance Act. While perhaps most controversial for a provision granting retroactive immunity from civil suit to telecom providers who participated in the National Security Agency's program of extrajudicial wiretaps, the legislation was also loathed by civil libertarians for granting the Attorney General broad, minimally supervised power to eavesdrop on Americans' communications with foreign intelligence targets. Dodd, for his part, returns the love, thanking the netroots for making it all possible on—where else?—YouTube.

Reid, meanwhile, has said he'll move to extend the stopgap Protect America Act passed in August rather than attempt to reach a vote on a more permanent replacement in the brief time between the start of the next Senate session in mid-January and the law's scheduled sunset on February 1. This holds out at least some hope that the next serious overhaul of American intel law will, for once, not be rushed through Congress in a quasi-panic.

Major media reactions have been more or less predictable across the board, and yet I still managed to be a bit surprised by an utterly unsurprising Wall Street Journal editorial, just for the sheer chutzpah displayed in recycling talking points so far past their sell-by date:

FISA allows the government to tap communications outside the U.S. without judicial approval. But these days, many international calls pass through America en route from one international point to another. Unless Congress acts by February 1, when a temporary law expires, intelligence agents will be unable to monitor these calls without asking a judge for permission.

That may be fine with some Democrats, who have always been more comfortable treating terrorism as a law-enforcement problem rather than a real war. But it's a tough political sell to say that America should respect the "civil liberties" of al Qaeda terrorists overseas.

As I need not tell Techdirt readers, this is either clueless or disingenuous. First, and most obviously, because all of the proposed amendments to FISA allow surveillance of foreign-to-foreign traffic routed through U.S. switches, and none of them evince the slightest concern for "the 'civil liberties of al Qaeda terrorists overseas." Second (and only slightly less obviously if you're moderately familiar with FISA), because the now-familiar narrative about why reform is needed has been transparently bollocks from the get go. The probability that the FISA Court handed down a ruling simply applying a warrant requirement to domestically intercepted foreign wire traffic is, to a first approximation, zero. If you've got a few minutes and a healthy sense of Schadenfreude, watch the contortions this poor Congressional Research Service attorney goes through (pdf) trying to find some way some such implication could conceivably be read into the statute's language. Then contemplate that the administration does not appear to have sought an appeal of this putatively crippling ruling. We can't know the real substance of the Court's problems with the way wiretaps were being handled, but we can be relatively certain of two things: They are more complicated than has been publicly suggested, and they provided a convenient means of persuading a cowed Congress to loose the judicial fetters entirely.

Filed Under: chris dodd, congress, domestic wiretapping, fisa, immunity, wiretapping

German Proposal Gives A New Perspective On 'Spyware'

from the big-brother-is-hacking-yo dept

A VoIP expert has unveiled new proof-of-concept software that allows an attacker to monitor other peoples' VoIP calls and record them for later review. Unencrypted VoIP really isn't very secure; if you have access to the raw network traffic of a call, it's not too hard to reconstruct the audio. Encrypted traffic is another story. German officials have discovered that when suspects use Skype's encryption feature, they aren't able to decode calls even if they have a court order authorizing them to do so. Some law enforcement officials in Germany apparently want to deal with this problem by having courts give them permission to surreptitiously install spying software on the target's computer. To his credit, Joerg Ziercke, president of Germany's Federal Police Office, says that he's not asking Skype to put back doors in its software. But the proposal still raises some serious question. Once the installation of spyware becomes a standard surveillance method, law enforcement will have a vested interest in making sure that operating systems and VoIP applications have vulnerabilities they can exploit. There will inevitably be pressure on Microsoft, Skype, and other software vendors to provide the police with backdoors. And backdoors are problematic because they can be extremely difficult to limit to authorized individuals. It would be a disaster if the backdoor to a popular program like Skype were discovered by unauthorized individuals. A similar issue applies to anti-virus software. If anti-virus products detect and notify users when court-ordered spyware is found on a machine, it could obviously disrupt investigations and tip off suspects. On the other hand, if antivirus software ignores "official" spyware, then spyware vendors will start trying to camouflage their software as government-installed software to avoid detection. Ultimately, there may be no way for anti-spyware products to turn a blind eye to government-approved spyware without undermining the effectiveness of their products.

Hence, I'm skeptical of the idea of government-mandated spyware, although I don't think it should be ruled out entirely. That may sound like grim news for law enforcement, which does have a legitimate need to eavesdrop on crime suspects. But it's important to keep in mind that law enforcement officials do have other tools at their disposal. If they're not able to install software surveillance tools, it's always possible to do it the old-fashioned way--in hardware. Law enforcement agencies can always sneak into a suspect's home (with a court order, of course) and install bugging devices. That tried and true method works regardless of the communications technology being used.

Filed Under: germany, skype, spyware, voip, wiretapping

Senate Punts On Telecom Immunity

from the get-out-of-jail-free dept

Last night, the Senate Judiciary Committee approved wiretapping legislation. There's been quite a bit of confusion around the web about how the committee handled the most contentious issue: whether to grant telecom companies retroactive blanket immunity for violating their customers' privacy. It appears that after an effort to strip out the immunity language failed, the committee only referred part of the legislation out of committee, leaving the immunity provisions in limbo. The net effect will be to leave the issue to be decided by the full Senate, where we can be sure someone will offer an blanket immunity amendment. Sen. Specter, who is the leading Republican on the committee and has occasionally been critical of the Bush administration's civil liberties record, is apparently intending to offer a "compromise" that would have the government take the place of AT&T and Verizon in the privacy lawsuits now pending against them. Frankly, I have trouble seeing how this is a compromise. The problem with granting immunity liability is that it undermines the whole point of the fines, which is to give the companies an incentive to obey the law. If the government takes the telecom companies' place in the lawsuit, that saves them from paying any real penalty for breaking the law. As a result, they'll have no incentive to say no next time the executive branch asks them to do something illegal. If Congress wants the telecom industry to take the laws it writes seriously, then it has to insist that companies pay the penalty when they break them. Meanwhile, the House approved wiretapping legislation without an immunity clause. And the White House, for its part, has vowed to veto any legislation that doesn't include a get-out-of-jail-free card for the AT&T and Verizon. So there will almost certainly be a showdown, either between the House and the Senate, or between Congress and the White House.

Filed Under: congress, immunity, telcos, wiretapping
Companies: at&t, congress, verizon