Technical Details on the FBI's Wiretapping Network

There’s a must-read article on Wired.com about DCSNet (Digital Collection System Network), the FBI’s high-tech point-and-click domestic wiretapping network. The information is based on nearly 1,000 pages of documentation released under FOIA to the EFF.

Together, the surveillance systems let FBI agents play back recordings even as they are being captured (like TiVo), create master wiretap files, send digital recordings to translators, track the rough location of targets in real time using cell-tower information, and even stream intercepts outward to mobile surveillance vans.

FBI wiretapping rooms in field offices and undercover locations around the country are connected through a private, encrypted backbone that is separated from the internet. Sprint runs it on the government’s behalf.

The network allows an FBI agent in New York, for example, to remotely set up a wiretap on a cell phone based in Sacramento, California, and immediately learn the phone’s location, then begin receiving conversations, text messages and voicemail pass codes in New York. With a few keystrokes, the agent can route the recordings to language specialists for translation.

The numbers dialed are automatically sent to FBI analysts trained to interpret phone-call patterns, and are transferred nightly, by external storage devices, to the bureau’s Telephone Application Database, where they’re subjected to a type of data mining called link analysis.

FBI endpoints on DCSNet have swelled over the years, from 20 “central monitoring plants” at the program’s inception, to 57 in 2005, according to undated pages in the released documents. By 2002, those endpoints connected to more than 350 switches.

Today, most carriers maintain their own central hub, called a “mediation switch,” that’s networked to all the individual switches owned by that carrier, according to the FBI. The FBI’s DCS software links to those mediation switches over the internet, likely using an encrypted VPN. Some carriers run the mediation switch themselves, while others pay companies like VeriSign to handle the whole wiretapping process for them.

Much, much more in the article. (And much chatter on this Slashdot thread.)

EDITED TO ADD (8/31): Commentary by Matt Blaze and Steve Bellovin.

Tags: data mining, FBI, intelligence, phones, surveillance

Posted on August 29, 2007 at 11:39 AM • 26 Comments

Comments

Power Creep • August 29, 2007 11:59 AM

What’s the big deal? This was an area where the federal government could step in and do some good, right?

David • August 29, 2007 12:18 PM

DCSNet includes at least three collection components, each running on Windows-based computers…

Let me guess. These computers can be controlled via the phone system or the internet. Soon, some blackhat will hack the systems and then all your communications are belong to us. Woohoo.

MitchUK • August 29, 2007 12:26 PM

Wow. If this is really as simple as a “few clicks” to perform these functions, then it sounds like money well-spent from an IT budget point-of-view… integrating this many different elements of a phone network into a single intercept infrastructure is quite impressive. From a taxpayer-value point of view I think you ‘mercans should be proud of yourselves.

But of course, I thoroughly disapprove of this system being used without proper oversight.

Carlo Graziani • August 29, 2007 12:35 PM

The real payload is at the end of the Wired article: The system is insecure, essentially because the people who designed it and run it have an insecure attitude about the nature of threats to the system. Outsiders may be stopped by VPNs, firewalls, etc., but insiders may wander around the system nearly at will. Not so different from the situation that set up the Vodaphone/Greece fiasco.

Glo • August 29, 2007 1:01 PM

I love my country.
I fear my government.

’nuff said.

Chief Angry Cloud • August 29, 2007 1:34 PM

Sprint runs this “encrypted backbone”, eh? Isn’t that the phone company that was thoroughly and completely hacked by mobsters in Las Vegas?

Trichinosis USA • August 29, 2007 1:35 PM

“The FBI has reported some problems intercepting push-to-talk phones such as Nextel’s “Walkie-Talkie” service, and have on occasion been thwarted by VoIP and pre-paid cell phones, according to the report.”

Maybe this particular system is thwarted, but in general VOIP is pathetically easy to tap. It can be done at the call management level via the software itself. The signal is already digital. Piece of cake to record it to a file on a hard drive.

If this is what they call “freedom”, I’d hate to see what their version of totalitarianism looks like.

Cyber Security Weenie • August 29, 2007 1:50 PM

“If cell phones are outlawed, then only criminals will have cell phones.” 🙂

CONTROL • August 29, 2007 1:52 PM

None of the “how they do it” is very surprising.

“Why they do it” is another matter.

MikeA • August 29, 2007 2:41 PM

@CONTROL: “Why they do it” is another matter.

“Because they can”

Nick Lancaster • August 29, 2007 4:35 PM

So if it’s all automated down to a point-and-click system, why is it, exactly, that a warrant can’t be assembled within 72 hours?

Alan • August 29, 2007 6:15 PM

I recommend that people watch “The President’s Analyst” for perspective on this. One of the more prophetic movies of the 1960’s.

Russian spy: “You are telling me that all the phones in America are tapped?”

JackG't • August 29, 2007 6:32 PM

“…phone calls sucked in by DCSNet…??? sounds ominous.

Pat Cahalan • August 29, 2007 6:39 PM

[quote]

But the documents show that an internal 2003 audit uncovered numerous
security vulnerabilities in DCSNet — many of which mirror problems unearthed
in the bureau’s Carnivore application years earlier.

In particular, the DCS-3000 machines lacked adequate logging, had
insufficient password management, were missing antivirus software, allowed
unlimited numbers of incorrect passwords without locking the machine, and used
shared logins rather than individual accounts.

The system also required that DCS-3000’s user accounts have administrative
privileges in Windows, which would allow a hacker who got into the machine to
gain complete control.

Columbia’s Bellovin says the flaws are appalling and show that the FBI fails
to appreciate the risk from insiders.

[/quote]

That’s fantabulous.

Carlo Graziani • August 29, 2007 7:46 PM

ZFone.

Phil Zimmerman will save the World, again.

Milan • August 29, 2007 8:09 PM

You do need to ask whether terrorism can justify this. While terrible, it kills hundreds or thousands of people. Many phenomena that kill more do not receive this kind of attention. Certainly, they do not lead to such considerable sacrifices of basic freedoms and privacy.

deputycleric • August 29, 2007 8:26 PM

encrypted backbone

Isn’t that the phone company that was thoroughly and completely hacked
by mobsters in Las Vegas?

And once again we return to the classic notion of “rubber hose cryptanalysis”.

A variant of which is undoubtedly “broken kneecap key management”.

Can it be a coincidence that Clark County (location of Las Vegas) has a unique history in Nevada of making it painful for regular folks (like phone company staff) to obtain self-defense weapons?

Who, in those circumstances, would fail to add suitable extra individuals to their key quorum?

Of course, such things could NEVER happen at the national level.

DBH • August 29, 2007 9:14 PM

Wait, part of the argument for the ‘updating’ of fisa was issues surrounding mobile phone tapping, etc…doesn’t seem to be an issue!

Some Dude • August 29, 2007 11:40 PM

If this type of co-ordination had been applied to discerning environmental hazards instead, thousands more lives (at least) would have been saved. Instead we’re chasing down the boogeymen with all this new legislation, ignoring the fact that all of the information necessary to capture the 9/11 terrorists before they struck was already in the hands of these same organizations that are now using these new-fangled technologies. And what did they do with that information?

This is a pointless waste of taxpayer money. Sure, a few jobs are created, but it’s not fixing the fundamental flaws that allowed 9/11 to happen in the first place/

Hagbard_c • August 30, 2007 2:39 AM

Wait a minute, I may have misread this, but according to the article this has nothing to do with capturing terrorists (it’s a different system). I thought the fascinating part they hardly touched upon is ‘what to do with all the data’. I wonder how feasible it is to actually get something usefull out of the hours of nonsense you record. All I saw was a vague reference to a lot of manhours being spend.

bob • August 30, 2007 7:13 AM

I agree, I dont see this has anything to do with 9/11; the FBI has been wiretapping since Bell called Watson (in fact I believe they just finished analyzing that call). After all, at the speed of (US) government a system this large would have to have been initiated in ~1982.

averros • August 30, 2007 2:24 PM

Hagbard_c – you are absolutely correct, the massive surveilance networks are totally useless against threats by unknown individuals – because the three letter agencies don’t know whose phone to tap, and cannot conceivably have resources to trawl all conversations.

It is, however, very useful for intimidating and collecting dirt on those who are known as critics of the regime. Like, it never happened in the US before.

Jim • August 30, 2007 4:04 PM

My phone called somebody all by itself earlier today. I was thinking that maybe the whole system is hacked and cracked or whatever. You can’t seem to count on your phone these days.

Ralph • August 30, 2007 9:11 PM

Well it’s lot more efficient than the old East German system, that’s for sure.

We can all be proud of the technological advances.

Anonymous • September 4, 2007 1:13 PM

Wasn’t there a big issue in the last year or so about failure to deliver on a large FBI project worth 10’s of millions? Seems since this project succeeded, and has only come to light after several years, perhaps the FBI has learned from the miltary how to conceal black projects and use funding from other (supposedly failed) projects…

Dom De Vitto • September 5, 2007 7:18 AM

averros:

Actually no – think about it, if a few clicks can setup a tap, presumably call details could be screen scrapped, and fed back in. Automagic tapping of people who are 1/2/3…100 degrees of separation from the initial target. This could be optimised by cross-referencing, so if A and B talk to Z through Q, then anyone else talking to Q is flagged as interesting.

Of course, this is all assuming the box doesn’t BSOD, or stop completely at 3am to demand that it get a license to play the audio, install critical patches [like windows validation updates] etc…. 🙂

Schneier on Security

Technical Details on the FBI's Wiretapping Network

Comments

Leave a comment Cancel reply