Internet wiretapping still a threat

["http://www.hyperreal.art.pl/cypher/remailer/" <mix@hyperreal.art.pl>]

Internet wiretapping still a threat
By Robert Lemos, ZDNN
November 11, 1999 5:24 PM PT
URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2392616,00.html?chkpt=zdnnstop

A push by law enforcement to make the Internet wiretap-friendly hit a major snag on Wednesday, when members of the Internet Engineering Task Force -- the body responsible for setting Internet standards -- overwhelmingly said 'no' to a key question.

The question: Should the IETF put features in forthcoming protocols whose sole purpose is to facilitate wiretapping?

Scott Bradner, director of the Transport Area of the IETF -- where the motion was originally proposed -- estimates that 55 percent of the members answered 'no,' another 15 percent said 'yes,' and the rest abstained.

Not resolved While that may seem definitive, Bradner stressed that the issue remains open.

"The IETF doesn't vote; we work on rough consensus," said Bradner, who stressed that without a large majority -- say, 80 percent -- of its members voting one way, the issue would not be resolved.

"After the meeting, we are still in somewhat of an ambiguous area," he said. "There is clearly not strong support for doing it, but there is not strong enough support to definitively block wiretapping from future standards."

That leaves the issue tabled for the moment, but certain to be brought up again.

"This is just the beginning," said Jim Dempsey, senior staff counsel with the policy think tank Center for Democracy and Technology, who attended the meeting. "The vote was about 10 to 1 against, but that won't stop it."

Expanding wire-tapping The whole Internet wiretapping concept is a direct result of the Communications Assistance for Law Enforcement Act of 1994, which requires telecommunications companies to aid law enforcement in legally obtained wiretaps by making their network infrastructure wiretap-friendly.

For the past two years, law enforcement officials have been lobbying Congress and putting pressure on cellular phone companies to apply the law to their phone network as well. The Internet is the next communications network on the list.

"If it is a one or a zero, or an analog signal, the government is entitled to intercept the signal," said CDT's Dempsey. "But does that mean they can force companies to design their systems to make it easy to get the signals they want, when they want it? That's the CALEA question."

Privacy advocates such as the Electronic Privacy Information Center spoke out adamantly against a pro-wiretapping Internet.

"... We believe that such a development would harm network security, result in more illegal activities, diminish users' privacy, stifle innovation, and impose significant costs on developers of communications," wrote EPIC in an open letter to the IETF. "At the same time, it is likely that Internet surveillance protocols would provide little or no real benefit for law enforcement."

Fear of hacking The IETF answered more out of security concerns than any thoughts about privacy, said Bradner.

"If you put in some mechanism where someone with legal authority can tap your telephone, what stops some hacker from doing that?" he asked.

The FBI could not be reached for comment on the issue.

In any event, the whole debate may be moot. The vote just barred specific development of features solely for wiretapping, but other pieces already present in the Internet could be used to create an effective wiretap.

"Some people think that all the functions necessary to do an intercept may already be in the protocol for other reasons," said Bradner.

For example, the Internet allows servers to do accounting: Finding out where a packet came from and where it is going. In wiretapping, such a feature is called a pen register and is considered the first step in narrowing down the calls that need to be tapped.

CDT's Dempsey believes the vote may be moot for a different reason.

"Two thousand engineers get in a ballroom and raise their hands -- that means nothing to the government," he said. "What it DOES mean is that they will have to go to the CEOs ... and make their case."