Subject: Re: Topology

From: "Lehecka, Gary R (SAIC)" <[email-masked]>
Date: Wed, 25 Aug 1999 01:41:15 -0400

Hi,

CALEA 1994 had a 1998, October deadline that was extended to 2000, June 30.
There is a $10k per day per surveillance penalty for carriers and
manufacturers thereafter.

What law enforcement authorities would like is not the issue.
Exactly complying with warrants for lawful intercept is the issue.
Most warrants authorize interception of the suspects side of the call.

If I am conversing with a suspect,
and I am not a subject of the warrant,
and my side of the call is intercepted,
then my civil rights have been violated.

The requirement is to give law enforcement what the warrant states,
no less,
no more.

Separate subpoenas or warrants may be needed for the signaling information
versus the call content.

The telecom industry is wrestling with the Department of Justice (DOJ),
Federal Bureau of Investigation (FBI), and Federal Communications Commission
(FCC)
over CALEA.
The FBI has an aggressive implementation plan.
The FBI wants to be able to WireTap anything and everything:
your computer, your electronic mail, your Internet Service Provider (ISP),
your pager, your telephone, your web browser, ...
you might be a drug dealer, foreign spy, or sex offender, ...
Apparently, someone missed the boat when the EU and US Congress were voting
on various EU and US Lawful Intercept laws.

Excerpt from CALEA:
United States Code
Title 47        Telegraphs, Telephones, and Radiotelegraphs
Chapter 9       Interception of Digital and Other Communications
SubChapter I    Interception of Digital and Other Communications
Section 1002    Assistance capability requirements
(a)     Capability requirements
Except as provided in subsections (b), (c), and (d) of this section and
sections 1007 (a) and 1008 (b) and (d) of this title,
a telecommunications carrier shall ensure that its equipment, facilities,
or services that provide a customer or subscriber with the ability to
originate,
terminate, or direct communications are capable of -
(1) expeditiously isolating and enabling the government,
pursuant to a court order or other lawful authorization,
to intercept,
to the exclusion of any other communications,
all wire and electronic communications carried by the carrier within a
service area to or from equipment,
facilities, or services of a subscriber of such carrier concurrently with
their transmission to or from the subscriber's equipment,
facility, or service, or at such later time as may be acceptable to the
government;
(2) expeditiously isolating and enabling the government,
pursuant to a court order or other lawful authorization,
to access call-identifying information that is reasonably available to the
carrier -
(A) before, during, or immediately after the transmission of a wire or
electronic communication
(or at such later time as may be acceptable to the government); and
(B) in a manner that allows it to be associated with the communication to
which it pertains,
except that,
with regard to information acquired solely pursuant to the authority for pen
registers and trap and trace devices
(as defined in section 3127 of title 18),
such call-identifying information shall not include any information that may
disclose the physical location of the subscriber
(except to the extent that the location may be determined from the telephone
number);
(3) delivering intercepted communications and call-identifying information
to the government,
pursuant to a court order or other lawful authorization,
in a format such that they may be transmitted by means of equipment,
facilities, or services procured by the government to a location other than
the premises of the carrier; and
(4) facilitating authorized communications interceptions and access to
call-identifying information unobtrusively and with a minimum of
interference with any subscriber's telecommunications service and in a
manner that protects
(A) the privacy and security of communications and call-identifying
information not authorized to be intercepted; and
(B) information regarding the government's interception of communications
and access to call-identifying information. ..."

CALEA would seem to impose these requirements:
MGC be able to command a Lawful Intercept in a MG.
MG be able to implement a Lawful Intercept.
There should be much verification to authenticate the Lawful Intercept.
Most routers do NOT have the functionality needed for Lawful Intercept,
High-end Fast Ethernet switches do (the ability to set-up a monitor port).

CALEA mandates that the carrier and manufacturer provide the Lawful
Intercept capability.
CALEA does not mandate that the carrier and manufacturer ensure that Lawful
Intercept cannot be defeated.
People are always going to find ways to get around the system.

Law enforcement catch many dumb criminals.
Intelligent criminals might be able to "beat the system".
MEGACO has to be "CALEA compliant" by June 30, 2000.

There are some industry standards regarding US CALEA 1994 and EU Lawful
Intercept (LI):
American National Standards Institute (ANSI)
T1.260-1998     Telecommunications - Operations, Administration,
Maintenance, and Provisioning (OAM&P) - Extension to Generic Network
Information Model for Interfaces between Service Provider Administrative
System and Network Elements for Lawfully Authorized ...
http://www.ansi.org

European Telecommunications Standards Institute (ETSI)
ES 201 158      Telecommunications Security; Lawful Interception (LI);
Requirements for Network Functions V1.1.1 and Version 1.1.2
ES 201 671      Telecommunications Security; Lawful Interception (LI);
Handover Interface for the Lawful Interception of Telecommunications Traffic
V1.1.1
ETR 331 Security Techniques Advisory Group (STAG); Definition of User
Requirements for Lawful Interception of Telecommunications; Requirements of
the Law Enforcement Agencies
Special Mobility Group (SMG) 10:  Security
GSM 01.33       (was GSM 10.20) Lawful Interception Requirements for GSM
GSM 02 33       Digital Cellular Telecommunications System (Phase 2+);
Lawful Interception - Stage 1 Version 5.0.0
GSM 03 33       Digital Cellular Telecommunications System (Phase 2+);
Lawful Interception - Stage 2
ETR 363 Digital Cellular Telecommunications System; Lawful Interception
Requirements for GSM GSM 10.20; Version 5.0.1
TETRA
Specialist Task Force (STF) 112 Lawful Interception
TS 101 040      Terrestrial Trunked Radio (TETRA); Security, Lawful
Interception (LI) Inferface V1.1.1
EN 301 040      Terrestrial Trunked Radio (TETRA); Security, Lawful
Interception (LI) Inferface V2.0.0
EG 201 040      Terrestrial Trunked Radio (TETRA); Security, Lawful
Interception (LI) Interface; Feasibility Study Report V1.1.1
http://www.etsi.org

Telecommunications Industry Association (TIA) and Alliance for
Telecommunications Industry Solutions (ATIS) Committee T1 jointly published
J-STD-025       Interim Standard:  Lawfully Authorized Electronic
Surveillance Standard"
http://www.tiaonline.org
http://www.atis.org
http://www.t1.org

Telcordia published the following regarding CALEA compliance:
FR-64           LATA Switching Systems Generic Requirements (LSSGR)
GR-2973 Lawful Access Feature:  Generic Switching Requirements
"CALEA requires that a service provider be able to support lawful
surveillance of the traffic in its network.
Lawful surveillance is the process of identifying a targeted set of traffic
and delivering data about the traffic,
and possibly the content of the traffic itself,
to a remote law enforcement agency in real time."

GR-2974 Surveillance Administration System (SAS) Generic Requirements
"CALEA-type surveillances require that Intercept Access Points (IAPs),
such as end-office switches,
be provisioned to access and deliver call content and call-identifying
information to law enforcement."

MC-ENG-SO-001   CALEA Network Planning Support Services - Established
Wireline Carriers
"ABSTRACT:  The Communications Assistance for Law Enforcement Act (CALEA) of
1994 requires that a telecommunications service provider upgrade its
equipment to enable lawful surveillance of the traffic in its network.
To comply with CALEA,
all wireline and wireless carriers must demonstrate the ability to support
CALEA-based electronic surveillance by the compliance date of June 30, 2000,
or potentially face a $10k per day per surveillance penalty.
CALEA provides no financial gain or competitive advantage to any carrier,
and therefore cost control through cost-effective CALEA solutions is a must.
Telcordia can assist in both the planning and implementation of a CALEA
compliance program."
"Congress authorized $500M to reimburse carriers for upgrading equipment in
support of CALEA,
it is not expected that federal reimbursements will fully offset carriers'
compliance costs."

United States Code
Title 47        Telegraphs, Telephones, and Radiotelegraphs
Chapter 9       Interception of Digital and Other Communications
SubChapter I    Interception of Digital and Other Communications
Section 1009    Authorization of appropriations
"There are authorized to be appropriated to carry out this subchapter a
total of $500,000,000 for fiscal years 1995, 1996, 1997, and 1998.
Such sums are authorized to remain available until expended."
It is unclear whether these funds remain available.

MC-ENG-SO-002   Lawful Access Support Planning Services - New Wireline
"ABSTRACT:  New entrants into the wireline and wireless carrier arena are
legally obligated to support law enforcement's traditional forms of lawful
access
(i.e. electronic surveillance and subpoena processing)
and the more sophisticated capabilities required by the Communications
Assistance for Law Enforcement Act (CALEA) of 1994.
To comply with CALEA,
all wireline and wireless carriers must "purchase, test and install such
equipment and facilities throughout their networks" by June 30, 2000,
or potentially face a $10k per day per surveillance penalty.
Telcordia can assist new carriers in the planning and implementation of
lawful access support programs to meet these requirements."
http://www.telcordia.com

Thanks,
Gary Lehecka
[email-masked]
BP  250 - 3671
US  ( 216 )  586 - 3671
> ----------
> From:         Christian Huitema[SMTP:[email-masked]]
> Reply To:     Christian Huitema
> Sent:         Tuesday, August 24, 1999 1:48 PM
> To:   [email-masked]
> Subject:      Re: Topology
>
> At 07:09 PM 8/24/99 +0200, Alessandro Mordacci (ERA) wrote:
>
> >4) You can have a lot of different topologies. For example, if you have a
> >call between A and B, you can have FBI monitoring A AND another agency
> >monitoring B (in the same call). Or, you can have A and B monitored with
> two
> >independent calls to a monitoring center (would you like to mix the
> channels
> >in an ISDN data call?). Or any combination...
>
> I think we have some confusion between "monitoring a call" and "monitoring
> a transmission direction." As far as I can tell, when the police builds a
> wiretap, they are interested in the whole call, not in just what one of
> the
> parties says. Suppose that the FBI is monitoring A and the Swedish police
> monitoring B (do they actually do that in Sweden?). Then the FBI will have
> a call originating from gateway A, and the Swedish police a call
> originating from gateway B.  None of them will know that the other is also
> monitoring the call.
>
> My point is, you can easily do that with a basic star topology.
> Christian Huitema
>

---

From: Christian Huitema <[email-masked]>
Date: Wed, 25 Aug 1999 11:33:02 -0400

>The requirement is to give law enforcement what the warrant states,

Nobody proposes flouting the laws (at least, I certainly don't.) The debate
is first whether the MG/MGC protocol is the right place to implement the
requirement, and then whether the proposed "topology" extensions are
actually required in order to comply with the requirements. I already
explain why, IMHO, network based monitoring, e.g. in an edge router, is
much more appropriate than MG based monitoring when the MG is located
within the user premises. This shows that the requirement cannot be met by
the MG/MGC protocol alone.

Supposing however that we want to actually implement monitoring from the
MG, we have to understand exactly what the requirement means.  In the
paragraph above, you wrote that your civil rights would be violated if you
were not a suspect and your calls were intercepted. On the other hand,
suppose you call Don Corleone, who is suspect and whose phone is monitored.
The monitoring log would say that, "On April 1st at 3 am, Don Corleone
received a phone call from Gary Lehecka." Does this violate your rights?  I
believe not.

Let's then consider the proposed topology extension. Miami's telephone
company duly intercepts the call and connects a call branch to the
monitoring center. It seems quite obvious to me that the monitoring will
include both Don Corleone's voice and yours.  Monitoring just one of the
speaker in the call does not strike me as very valuable...

Yet, the whole purpose of the proposed topology extension seems to be this
"asymetric monitoring requirement." The basic star configuration allows for
an easy wiretap: add a termination to the context, and it will receive the
sum of all the speaker's voices. The termination  mode can be used to
eliminate all risks of wiretap detection by the wiretapped parties. The
proposed extension would only be useful if  only some of the voices in the
call should be recorded, while others should not.  This seems to defy
common sense.
Christian Huitema

---

From: Stephen Terrill <[email-masked]>
Date: Wed, 25 Aug 1999 18:47:18 +0200

Hello Christian,

Unforunately, we don´t make the requirements, we just have to implement them.  It is a fact that the "asymetric monitoring" is a Legal Intercept requirement (or mono monitering as Alessandro termed it), and required for trunking gateways, regardless of what is felt to be obvious or not.  I have seen this described a number of times on this thread, so I have trouble understanding why the basic requirement is still being questioned, especially as legal intercept was identifed as a requirement on a trunking gateway some time ago.

Cheers,

..//Steve