Broad Surveillance For Voip Calls, In Ternet Leaders Urge Caution
The government’s plans to wiretap domestic voice over Internet Protocol (VoIP) calls could introduce new cybersecurity risks, impede Internet innovation, subject hundreds of thousands of Americans to law enforcement monitoring without realizing it, and cripple U.S. telecommunications leadership, warns a new Information Technology Association of America (ITAA) study.
Among the study’s authors is Google chief Internet evangelist Vint Cerf, Sun Microsystems chief security officer Whitfield Diffie, and NeuStar fellow Jon Peterson.
The report explains that pinpointing the location of communication endpoints is extremely tough, given the fundamental differences between the Internet’s architecture and that of the Public Switched Telephone Network (PSTN).
Some VoIP traffic can be wiretapped in cases where the VoIP service mimics major PSTN elements, but the slightest failure to replicate those elements greatly complicates ensured interception.
According to the ITAA report, wiretapping VoIP could be detrimental to security for several reasons, among them: Problems maintaining security at the ISP; difficulties in securely sending intercepted signals to law enforcement; the ease of crafting online identities; and the risks inherent in incorporating surveillance functionality into network protocols.
“Various attacks, including man-in-the-middle alteration of data…capture of identity information and passwords, and many other pernicious behaviors could well be enabled by CALEA-like accommodations,” the study finds.
The mobility and easy identity-switching of wiretap targets may require eavesdropping initiatives to monitor non-targeted people, which has major privacy ramifications.
The report says VoIP wiretapping entails either a vast restructuring of the Internet or the inclusion of unreasonable security risks, concluding that “The former would have significant negative effects on U.S. ability to innovate, while the latter is simply dangerous.”
Abstracted by the National Law Enforcement and Corrections Technology Center(NLECTC) from Technology News Daily (06/14/06).
