A day late and a dollar short, but we're the ones who'll pay.

19 February 2011

For nearly twenty years in the United States a law called CALEA (Communications Assistance for Law Enforcement Act of 1994) has been on the books. To summarize, CALEA set the federal requirement that telecommunications companies (phone companies, long distance companies, cellular carriers, and so forth) had to modify their infrastructures such that various forms of wiretapping of customers had to be possible upon presentation of a warrant. Contrary to popular belief, there are methods of surveillance other than recording a conversation. The simplest involves making a list of every phone number that a particular number calls, when the calls were placed, and for how long the calls lasted. This is called a pen register, and all it amounts to is having someone run a Perl script on the logs of some telephony switches. Conversely, a trap and trace is a running list of all of the phone numbers that called a particular line, the length of the call, and whatever routing information accompanies those calls. True wiretapping involves recording all parties involved in phone calls placed, and is usually performed in concert with a pen register or trap and trace to correlate the information.

Then, in the late 1990's, things started to get difficult. It is possible to record and play back a modem connect (case in point: InSoc's 300bps 8n1) but sometimes data got garbled, or the wiretappers' modems weren't well suited to passive demodulation of the signals, or a host of other problems that can crop up (protip: If you can help it, avoid government suppliers. Their products aren't as flexible as the stuff you can buy at Micro Center for a fraction of the cost.) Nowadays there are online services used by millions of people around the world which use strong cryptographic technologies to protect their users' comms traffic, and law enforcement agencies aren't able to get hold of information other than recording blobs of cyphertext off the wire. While it is possible for subpoenas to be used to coerce those services to hand over some users' data for analysis, sometimes a subpoena isn't enough. Case in point: interoperable services that are trivial to set up in other jurisdictions, like Twitter-alikes and social networking software that anybody can upload, install, and let people sign up for.

The FBI calls this the "going dark" problem. Their surveillance capabilities are limited when it comes to new technologies and they find themselves at a distinct disadvantage. Thus, the FBI is going to begin lobbying to require surveillance backdoors for online services. Encrypted voice communication systems like ZFone and Skype would have to implement a means of decrypting voice traffic for them to be legal in the states (though there are people who don't trust Skype because the source code for their software can't be audited, nor is their key generation and storage understood). Social networking sites of all kinds would have to provide a separate control panel with which law enforcement personnel could search for and download user information and content. Peer to peer software would have to make it possible for LEOs to monitor who is downloading what, where, and when without making their presence known. Also, and this is a bit closer to the heart of the matter, they are pushing for manufacturers of networking hardware to add surveillance capabilities to their products, just as the manufacturers of telephony equipment did back in the 90's.

What they're specifically not saying is that this will likely make the infrastructure more vulnerable to attackers, as well as provide another capability that can be turned to abusive ends. In the discipline of hardware and software engineering, the more complex something is, the more bugs there are. The more bugs there are, the greater the chance that they're going to either cause a crash or be exploited by someone to do things that they aren't authorized to. Or the functions can be abused - a couple of years ago in Greece somebody used the wiretapping capability of Vodafone cellular hardware to spy on, among others, government offices, Greek politicians, diplomats, and embassies. Over the years, the Russian mob and industrial spies from Israel have cracked telco switches to spy on voice (and probably data) traffic to gain an advantage. Wiretapping and surveillance technologies in the States are being abused, too, and the people getting caught aren't being punished in any meaningful way. Oh, and let's not forget this.

Ultimately, if you care about your privacy to any extent, your choices are limited. You can kick the twenty-first century in the head, pack up, and move to the middle of nowhere, off the grid and away from everyone and everything. You can give up, live as clean a life as you can, and be content with the fact that aspects of your life you might not even be aware of will occasionally come under scrutiny by someone in a SCIF because so much of the world you live in is monitored, recorded, and archived. Or you can go decentralized and stay away from single points of failure or supervision. There are enough aggregation and syndication services out there that practically any kind of site you want to set up - website, microblog, journal, photo album, telecom - can be pieced together out of different packages, hosted all over the Net, and stitched together into a web of media that can be tightly controlled, because you would be the sole arbiter of what does and does not get posted or disseminated. The lesson the twenty-first century seems to be teaching us is that we have great power at our fingertips. Our abilities to circulate, index, cross-reference, organize, and retrieve information are unparalleled in human history. However, so the saying goes, with great power comes a great responsibility. If we are to not be consumed by our powers and extended instruments of cognition, we cannot allow others to use these sciences and mechanisms in ways against our best interests. It behooves us to take direct command of our communication technologies and not be content to allow others to run them for us. We must decide what to make available, what not to share, and what measures to take in the event of an information leak. It means acting deliberately and decisively, and assuming an active, not passive, role in the world as we create it around us every day.