Subject: Wiretapping

From: Tom-PT Taylor <[email-masked]>
Date: Mon, 30 Aug 1999 15:51:52 -0400

Based on Brian's description below, we do not need the topology attribute to
control wiretapping.  So long as A and B are talking together, it suffices
to have a wiretap termination (which the protocol need not identify as such)
sitting in the same context which is send-only toward the exterior.  If A is
put on 'network hold' either by removing it to a separate context or by
making all of its media streams inactive, the same treatment must be
accorded to the wiretap termination.

> -----Original Message-----
> From: Brian F. G. Bidulock [SMTP:[email-masked]]
> Sent: Wednesday, August 25, 1999 2:42 PM
> To:   [email-masked]
> Subject:      Re: Topology
>
> Hong Liu wrote:
>
> > (1) What is wiretap in a simple two-way conversation, say between A and
> B?
> > Suppose A is to be tapped, shall the monitoring be one way from A to B,
> or two
> > way? If it is two way, will B's civil rights be violated? I seem to
> remember one
> > email talked about one way media flow monitoring. But I don't know how
> to make
> > sense out of a one way conversation, -:)
>
> In most jurisdictions, the communication on both the path from B to A and
> from
> A to B are monitored.  Upon delivery to LE the A and B channels may have
> been
> "recombined," however, for 4-wire facility taps (which this is) the call
> content
> channels B->A and A->B and delivered to LE separated.  There is a good
> reason
> for this:  suppose in the middle of the conversation, A is put on "network
> hold".
> That is, both channels between A and B are suspended.  In this
> circumstance, what
> A delivers to the network on the "open" channel is delivered to LE and
> what A
> receives from the network is delivered to LE (kind of like an open mike to
> A's
> phone).  However, in most jurisdictions it is not permitted to deliver B's
> transmissions to the dead connection (the open mike to B's phone): any
> conversations that B has in the room while waiting on hold is B's business
> and
> not subject to warrant.  This is CALEA, US.  Other jurisdictions are not
> so
> careful concerning suspending B's rights.
>
> > (2) In addition to media tapping, Brian also mentioned call signaling
> monitoring
> > and the correlation between signaling and media. I would like to know
> how this is
> > done in today's PSTN. In particular, I would like to know how it is done
> in the
> > context of ATM, where call signaling and bearer connection setup are
> separated.
>
> In the situation above (network hold) and in conferencing situations, it
> is
> essential that Law Enforcement be able to determine in an evidentiary
> fashion
> who was priviy to what parts of the conversation.  This is state
> information
> concerning the session or context of the connections which is only
> transferred
> via signaling (or control such as MEGACO) information.  Not only do call
> content
> channels have to be cut through to LE or not according to law, but LE must
> be
> given the call identifying information to be able to determine (while the
> call
> is happening and after the fact) who was able to talk/listen to who when.
>
> > (3) Conference. I would like to understand (1) and (2) more before
> getting into
> > this more complicated case.
>
> It is actually not much more complicated: instead of having to know the
> precise
> state of 2 channels for two participant's, it is necessaty to know the
> precise
> state of 2*n channels for (n) participants.  Also, it is necessary to know
> whether
> it is the target (e.g., A) or the participant (e.g., B) who subscribes to
> the
> conferencing service.  In the case where the conferencing service is
> subscribed
> to by A, it makes no difference whether only B and C are on the bridge: LE
> is
> still legally able to monitor the conversation between B and C "supported"
> by A's
> service.  Again, other jurisdictions are less careful concerning B and C's
> rights.
>
> Hope this helps a bit.
>
> If you can get access to GR-2973 or J-STD-025 things may be a lot clearer.
> There
> are specific call scenarios in the appendices of J-STD-025 which assist
> greatly
> in the understanding.
>
> --
> Brian F. G. Bidulock
> Associate Director - New Products
> Inet Technologies Inc.
> 972-578-3959

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 31 Aug 1999 00:02:27 +0000

Tom,

I may have spoke to highly about `B's civil rights on "hold."  It appears that
one monitoring pair must go with `A' and the other with `B'.  At least here
the feds may have won the right to listen to parties on hold.  In othere
jurisdictions it may be different.  Normally for J-STD-025, it would be necessary
to establish a new call content channel and track the "split" participants.
This is also the case for stuff like call waiting, conference calling, and
combintations of the two where parties (and particularly the target) can join
and leave the call.  Where separated call content channels are used the rules
can appear rather complex, but is best handled with a ``context'' approach
anyways.  Calls should be able to be `split' into two contexts with participants
separated into the two contexts and new call content channels assigned to one of
the new halves.  Which half is particularly specified in the Appendix of
J-STD-025.  When contexts are rejoined, a redundant call content channel can
be dropped.  As a general rule, the first call content channel always
"follows the target" or the context in which the target is involved, new
call content channels are established for the contexts which have split off
from the target and are dropped when the context rejoins the target's context.

> accorded to the wiretap termination.

As I noted, this may not be the case in some jurisdictions.  In some jurisdictions,
or if the feds have won the right to listen to B on hold, if B is removed to a
separate context, a new send-only would have to be established to track B (the
original one staying with A).  Making all of B's media streams inactive might not
be acceptable.

---

From: Christian Groves <[email-masked]>
Date: Tue, 31 Aug 1999 16:16:10 +1000

G'Day Brian,

You mentioned below about splitting contexts in a call. How would you
achieve the linkage between the contexts? Would this be a the case where
a termination could belong to multiple contexts? (I think this is what
Chip alluded to earlier).

Cheers, Christian