Schneier on Security

A blog covering security and security technology.

« Memoirs of an Airport Security Screener | Main | Remote-Control Airplane Software »

July 28, 2006

Broadening CALEA

In 1994, Congress passed the Communications Assistance for Law Enforcement Act (CALEA). Basically, this is the law that forces the phone companies to make your telephone calls -- including cell phone calls -- available for government wiretapping.

But now the government wants access to VoIP calls, and SMS messages, and everything else. They're doing their best to interpret CALEA as broadly as possible, but they're also pursuing a legal angle. Ars Technica has the story:

The government hopes to shore up the legal basis for the program by passing amended legislation. The EFF took a look at the amendments and didn't like what it found.
According to the Administration, the proposal would "confirm [CALEA's] coverage of push-to-talk, short message service, voice mail service and other communications services offered on a commercial basis to the public," along with "confirm[ing] CALEA's application to providers of broadband Internet access, and certain types of 'Voice-Over-Internet-Protocol' (VOIP)." Many of CALEA's express exceptions and limitations are also removed. Most importantly, while CALEA's applicability currently depends on whether broadband and VOIP can be considered "substantial replacements" for existing telephone services, the new proposal would remove this limit.

Posted on July 28, 2006 at 11:09 AM • 19 Comments

To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.

Comments

When does PGP come out with their VOIP upgrade?

Posted by: PRNG at July 28, 2006 11:31 AM

@PRNG
see: http://www.philzimmermann.com/EN/zfone/...

Posted by: Anonymous at July 28, 2006 11:42 AM

Anyone who has read the 9/11 report knows that all the significant planning was done face to face. How long before someone suggests that all rooms be equipped with listening devices so that illegal conversations can be detected and acted upon?

Some people seem to be using 1984 as a manual rather than a warning.

Posted by: Geoff Lane at July 28, 2006 11:45 AM

Has an SDK. Submitted IETF. Damn good work, Phil Z.

Posted by: PRNG at July 28, 2006 12:00 PM

Related story in the UK

http://technology.guardian.co.uk/weekly/story/...

"The Guardian has learned that police and security agencies have been lobbying ministers and senior officials, expressing fears about the potential for voice-over-internet-protocol technologies to hide a caller's identity. Their aim? To get VoIP providers to monitor calls and find ways to identify who is calling whom - and even record them."

Posted by: Davi Ottenheimer at July 28, 2006 12:13 PM

I probably should have also included this quote from the Guardian story:

"'At present, law enforcement agencies have great difficulty in tracing the origin of VoIP calls,'" wrote [Detective Superintendent] Macleod. 'This poses significant threats to our democratic society'"

Um, ok, but are we to believe that surveillance does not also pose a significant threat to democratic society?

Posted by: Davi Ottenheimer at July 28, 2006 12:16 PM

Given that the intent of CALEA appears to be law enforcement's monitoring of citizens' electronic communication, then it really isn't very shocking that as people move to VoiP, IM and SMS, the regulations would try to extend to those technologies as well. While I don't agree w/CALEA's provisions from a violation of privacy perspective, I can rationalize law enforcement's desire to extend it given their original intent.

Posted by: direwolff at July 28, 2006 1:27 PM

Looking here..
http://www.itaa.org/news/docs/CALEAVOIPreport.pdf
It's the ITAA's "Security Implications of Applying the Communications Assistance to Law Enforcement Act to Voice over IP" dated June 13.

My summary of this is "is possible only if the law enforcement agencies agree to best intelligence at a reasonable cost rather than 100% compliance"

Posted by: Will at July 28, 2006 1:40 PM

Sorry, you commented on this document last week.

Posted by: Will at July 28, 2006 1:43 PM

Huh? "Difficulty tracing the origin of VoIP calls" ???

Because tracing a phone number is too difficult for them? or because tracing an IP address is difficult for them?

Lets think about it.
1) Dial the number for the {Vodaphone, BT, AOL, whoever} helpline.
2) Ask them "is a subscriber of yours?"
3) If they say yes, you say "Give me their name and address."
4) If they say "No", try another provider.
5) Do not forget to write down the name and address.
6) Do not loose the paper you used.
7) Do not get donut jam on the paper.

Taxing stuff for our Police, clearly.

Sounds like his incompetance is a "significant threat to our democratic society"....

He'll pee himself when he finds out that totally annymous pay-as-you-talk mobile phones exist, can be bought just about anywhere in the world, and used just about anywhere else in the world.

This all scares me deeply: he's either an idiot, guided by idiots, or possibly (worse) actually believes that privacy is a threat to "our democratic society".....

Posted by: Dom De Vitto at July 28, 2006 1:48 PM

It would be nice if CALEA costs came out of the Justice Deparments budget so that it would be properly balanced versus other things that they spend their money on rather than forcing people to pay for having their communications bugged.
Also look for the crypto wars to be restarted. As VOIP gets more traction, peer to peer with distributed lookup is going to become popular. Unless goverments outlaw strong encryption, they will be limited to doing traffic analysis. While that is still very useful for them, it isn't what they can do today.

Posted by: Anonymous at July 28, 2006 1:50 PM

Yet another reason why _everyone_ should be taught about good password practices:

http://tinyurl.com/rxrvo (child porn through buddy lists)

Posted by: Chris at July 28, 2006 2:11 PM

Bruce - How anonymous is posting here? Do you keep IP addresses? Or would I be safer posting through a proxy or tor?

Posted by: D at July 28, 2006 3:18 PM

I'm thinking we need an encrypting man-in-the-middle module for SIM cards. Buy a pre-paid celllphone, remove the SIM, insert the module, place the SIM in the module. How long before it was outlawed?

Posted by: blink at July 28, 2006 3:23 PM

@Davi

"Um, ok, but are we to believe that surveillance does not also pose a significant threat to democratic society?"

You know that they are aware of it.

That's why the convenient term 'society' is used constantly to hide the power motive, that is clear as daylight once the term 'society' is deconstructed.

At least Bruce pointed out who forces who to invade your privacy. This law directly does it, but other laws do it indirectly as well.

"Bruce - How anonymous is posting here? Do you keep IP addresses? Or would I be safer posting through a proxy or tor?"

I wouldn't worry, Bruce is not a narc,
and there are bigger fish to fry.

@blink

"How long before it was outlawed?"

It already is? No FCC stamp - no electronic product. I'm speculating that the FCC would not exactly be too willing in letting this slide.

@Anon

"It would be nice if CALEA costs came out of the Justice Deparments budget so that it would be properly balanced versus other things that they spend their money on rather than forcing people to pay for having their communications bugged."

It is paid by monetary expansion, foreigners (including foreign governments), and future generations here and abroad! - just like all new and recent 'programs'.

@ Dom

"This all scares me deeply: he's either an idiot, guided by idiots, or possibly (worse) actually believes that privacy is a threat to "our democratic society"....."

He's not at all an idiot, I would even say that he's a genius. One shouldn't confuse rhetoric with intentions.

This guy believes that privacy is a threat to his job, and the bureaucracy that he can build underneath him. His prestige, possible kickbacks, and high-class employment are riding on duping the public, luckily his interest is aligned in various parts of the agency that he is lobbying.

Posted by: quincunx at July 28, 2006 6:36 PM

I agree with the poster who commented that it is logical for CALEA to extend to forms of comunication such as SMS.

The increasing use of the legislation, however, as a blunt instrument coupled with the governements actions against the State of Missouri to quash discussion of the AT&T wiretapping scandal is worrying.

The old adage that you have nothing to fear if you have nothing to hide seems to be a common excuse now.

Posted by: Iain Wilkinson at July 31, 2006 2:05 AM

"Um, ok, but are we to believe that surveillance does not also pose a significant threat to democratic society?" Sure as hell. It's all about authoritarianism:

"For almost half a century, social scientists have been exploring authoritarianism. We do not typically associate authoritarianism with our democracy, but as I discovered while examining decades of empirical research, we ignore some findings at our risk... What I found provided a personal epiphany. Authoritarian conservatives are, as a researcher told me, "enemies of freedom, antidemocratic, antiequality, highly prejudiced, mean-spirited, power hungry, Machiavellian and amoral."

Authoritarianism's impact on contemporary conservatism is beyond question. Because this impact is still growing and has troubling (if not actually evil) implications, I hope that social scientists will begin to write about this issue for general readers. It is long past time to bring the telling results of their empirical work into the public square and to the attention of American voters. No less than the health of our democracy may depend on this being done. We need to stop thinking we are dealing with traditional conservatives on the modern stage, and instead recognize that they've often been supplanted by authoritarians."

http://economistsview.typepad.com/economistsview/...

Posted by: piglet at July 31, 2006 9:56 AM

it seems to me, that no one is learning from history. being a european and living in a country where several times there has been total control about each individual I might be called oversensitive.

the fact is, islamic terrorism already won the war against USA. get the sand out of your eyes and face it. you aren't a free country any more. nearly no country, except some non-democratic regimes control the life of their inhabitance as much as the US.

it is sad, but it is true.

Posted by: tom at August 1, 2006 2:43 AM

Trackback disabled on Mambo. So to give you credit, I referenced this post here:
http://www.bhe-security.com/component/...

Posted by: Natalie at August 1, 2006 11:08 AM

Subscribe to comments on this entry