Lawful Intercept

VoIP and tech's murky role in Mumbai attacks

Doug Mohney — Wed, 03 Dec 2008 11:38:30 -0500

Reports out of Mumbai claim the 10 member Lashker-e-Taiba terrorist attack group was steeped in off-the-shelf consumer technology. The FBI is reportedly assisting Indian intelligence agencies in deciphering "Internet telephony signatures" originating in Pakistan.

Terrorist controllers/handlers in Pakistan used VoIP to communicate with the Mumbai attack cell, with calls flowing out of Pakistan to satellite phones carried by the group. Conducting traffic analysis - number of calls, type of calls, frequency, and length - on the communications stream between Pakistan and Mumbai seems to have occurred, but it is not clear if Indian authorities have access to any media streams - the actual verbal conversations -- of calls.

The FBI is apparently providing support to trace back when calls started coming in to the cell phone. While not being publicly discussed, it is likely that a United States National Security Agency "vacuum cleaner" system sucked up the broadcasted satellite phone conversations in some form; it is unknown if the communications were encrypted end-to-end, but if they were, it would provide an additional complication to learning the substance of the communications between Lashker-e-Taiba and its Mumbai cell.

Players on both sides of the terrorist equation - both attackers and defenders - are aware of the use and application of off-the-shelf technologies for attacks. In October, a short report by the U.S. Army 304th Military Intelligence open source intelligence team examined the potential use and application of mobile phone and VoIP technologies by terrorist groups. While the media generally obsessed over the application of Twitter, the report also highlighted the use of GPS, software to change voices in conjunction with VoIP calls, and Google Maps.

For more:
- The Economic Times of India briefly discusses FBI involvement in VoIP cracking.
- Ars Technica and the media fetished on Twitter as a terrorist tool, but the U.S. Army report highlights other technologies as well.

Taliban VoIP calls

Pete Wylie — Mon, 15 Sep 2008 14:33:28 -0400

Days after the seventh anniversary of the Sept. 11 attacks on the U.S., British intelligence reported that the Taliban is using Skype to coordinate its military operations because the VoIP calls are heavily encrypted and difficult to decode. Previously, the British military and the U.S. military had intercepted Taliban communications with relative ease, because they used satellite or normal mobile phones easily traceable by British observation planes and U.S. intelligence resources.

The Skype algorithm is reportedly proving to be quite difficult to crack. British military officials have tried to introduce legislation into their Parliament requiring ISPs to track data, but the proposal raised the usual questions about privacy and government snooping on individual civilians.

Coordinated attacks based on VoIP calls are part of the Taliban's more aggressive strategy and reorganization. British officials are reportedly were working overtime with American counterparts to crack Skype encryption on suspected terrorist communications. But, as reported July 25, 2008, Austrian officials implied that Skype calls were quite easy to intercept. If that's the case, British officials need to have a chat with Vienna sooner rather than later.

For more:
- see the computerweekly.com article

Related Articles
A Skype Back Door?
Skype Wiretap Nuances

SPOTLIGHT: Skype - The other birthday

Doug Mohney — Tue, 09 Sep 2008 15:00:15 -0400

As Google celebrates 10 years of world domination, er, operation, Skype wants you to know that the peer-to-peer VoIP/IM/video client is celebrating its fifth birthday.

Skype's PR firm has sent out a pretty folder containing a time line of accomplishments over the past 5 years, a "Five Fun Facts" sheet, a couple of tear-jerker case studies on how people use the software, a voucher for three months of unlimited service and a cookie (Iced, a bit dry). From April to June 2008, Skype added nearly 29 million users and clocked 1.9 billion SkypeOut minutes.

Taking a different tack, ITWire chimes in with some of Skype's product and company stumbles, but misses three grade-A headaches for the company. First among these was a multi-day crash of Skype in August 2007 attributed to a set of Windows Update patches. Can government entities conduct lawful intercept activities on Skype? Some say there's a back door which leads to Skype's third faux pas - an utter lack of transparency and a "black box" closed system which makes security experts nervous and leaves open source developers frustrated.

For more:
- ITWire talks about Skype's lower moments. Article

A Skype Back Door?

Doug Mohney — Fri, 25 Jul 2008 15:28:40 -0400

High-ranking officials at the Austrian interior ministry have said it isn't a problem to listen into Skype conversations, implying that there is a back door built into the program.

Heise online has talked to a number of parties present at a June 25 meeting between ISP representatives and the Austrian regulator on lawful intercept of IP services who confirm the report. Skype has declined comment on if the software has a back door or if there is a specific key for decrypting data streams.

Rumors have been floating around on Skype selling a special listening device to interested governments and there has long been speculation about a back door to the program. Because Skype's code and protocols are both proprietary and closed, security experts have long wondered what Skype is capable of and what risks may arise in deploying the software in an enterprise environment.

Austrian officials have demanded that ISP allow the interior ministry to install network bridges and Linux servers in their network centers to copy and filter data traffic. If they don't, officials will work to enforce more expensive European ETSI lawful intercept standards.

For more:
- Heise Online reports on the potential for a Skype backdoor

Related articles:
Skype Wiretap Nuances
Skype resists inter-operability

Skype Wiretap Nuances

Doug Mohney — Tue, 10 Jun 2008 20:49:24 -0400

Skype says it is unable to comply with court-authorized wiretap requests, says News.com. A closer examination of the question and Skype's reply bears examination and thought.

News.com conducted a survey asking a number of big name vendors about the privacy of instant messaging and other services they offer. One of the questions was: "Have you ever received a subpoena, court order or other law enforcement request asking you to perform a live interception or wiretap, meaning the contents of your users' communications would be instantly forwarded to law enforcement?"

Skype's reply with underline emphasis provided by this reporter: "We have not received any subpoenas or court orders asking us to perform a live interception or wiretap of Skype-to-Skype communications. In any event, because of Skype's peer-to-peer architecture and encryption techniques, Skype would not be able to comply with such a request."

Skype doesn't say it hasn't received any requests to perform live interception of phone calls, just that nobody's asked them for Skype-to-Skype communication. This would imply that SkypeIn and SkypeOut, the services that touch the PSTN, might be fair game. The company has said in the past that it cooperates with all lawful requests from "relevant authorities," so a reasonable person might assume that if you're making calls through Skype that touch the PSTN, those calls could be subject to lawful intercept.

However, there's a rolling assumption that peer-to-peer calls that stick to Skype's peer-to-peer network and are encrypted with 256-bit AES are potentially untouchable, while centralized voice/VoIP services operated by Yahoo, AOL, Microsoft and others could be readily tapped.

Fanning the flames of speculation is Skype's closed software architecture and a large body of work by independent researchers that have going through detail reverse engineering of the program and how it works. Since Skype is a "black box," there is no way to know if there's a backdoor of sorts to tap into a client and copy the voice stream to somewhere else or any way to know if such a process was occurring.

For more:
- News.com's speculation that Skype is secure
- For security geeks, a very cool compilation of Skype independent security analysis

Related articles:
Skype resists inter-operability
Skype: Stand-by for violence with open telephony.
Do as we say, not as we do; Skype wants open access to wireless devices

VoIP Befuddles Lawful Intercept

Doug Mohney — Sun, 18 May 2008 11:18:51 -0400

VoIP is ready to cause another set of legal headaches when it comes to lawful intercept, says Eric Litchblau, New York Times reporter and author of a book on federal wiretapping. The NSA can't tap Americans' conversations without a warrant, but VoIP doesn't give clear distinctions on the location of either a caller or a call recipient, unlike POTS.

If you can't determine the physical location of a caller, does that make the call fair game for intercept? Nobody really knows where the NSA has drawn the lines because government electronic surveillance work is classified, but after 9/11, the agency may err on the side of caution and more data collected.

Surprisingly, Litchblau doesn't think much of publicly available encryption and efforts such as the Zfone solution as a showstopper for government wiretapping. He suggests more money has been funneled into the intelligence community to close a supposed technology gap, but there hasn't been a widespread outcry by Congress and government agencies to place limits on encryption.

For more:
- Litchblau's interview on government wiretapping by Forbes

Related articles:
Hyping VoIP encryption