Subject: Re: Topology

From: "Lehecka, Gary R (SAIC)" <[email-masked]>
Date: Mon, 23 Aug 1999 18:48:09 -0400

Hi,

Well, Recently I read a few things:

Criminals may not have as much intelligence as the average individual
but they do have a lot more money than the average individual or company,
Many criminals embrace technology ( cell phones, digital display pagers,
personal digital assistants, ... ),
especially those dealing in controlled substances ( drugs ).

The Department of Justice is proposing the "Cyberspace Electronic Security
Act" in an attempt to override encryption in advance.

The U.S. Department of Justice ( Administrative Office of the United States
Courts ) does publish reports about legal WireTaps.
http://www.uscourts.gov/wiretap98/contents.html

Many wiretaps are authorized for only one side of the conversation.
If you are NOT the suspect, and you are wiretapped, your civil rights are
violated.
In accordance with "Electronic Communications Privacy Act of 1986 (ECPA)"

The FBI and the FCC have been pushing into legislation and regulations
many federal laws and rules that require the Telecom industry to make their
jobs easier,
such as United States Code Title 47 - Telegraphs, Telephones, and
Radiotelegraphs
Chapter 9 - Interception of Digital and other Communications SubChapter I
Sections 1001-1010
a.k.a. "Communications Assistance for Law Enforcement Act of 1994 (CALEA)",
It is rather lengthy so I did not include it in this electronic mail.
Everyone NEEDS to read it and be FAMILIAR with it in its ENTIRETY.

I suggest that you all read the ENFORCEMENT provisions below.
The "stored" provisions would apply to all and any MGC information.

United States Code
        Title 18 - Crimes and Criminal Procedure
                Part I - Crimes
                        Chapter 119 Wire and electronic communications
interception and interception of oral communications Sections 2510-2522

Sec. 2522. Enforcement of the Communications Assistance for Law Enforcement
Act
*(a) Enforcement by Court Issuing Surveillance Order. - If a court
authorizing an interception under this chapter, a State statute, or the
Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or
authorizing use of a pen register or a trap and trace device under chapter
206 or a State statute finds that a telecommunications carrier has failed to
comply with the requirements of the Communications Assistance for Law
Enforcement Act, the court may, in accordance with section 108 of such Act,
direct that the carrier comply forthwith and may direct that a provider of
support services to the carrier or the manufacturer of the carrier's
transmission or switching equipment furnish forthwith modifications
necessary for the carrier to comply.
*(b) Enforcement Upon Application by Attorney General. - The Attorney
General may, in a civil action in the appropriate United States district
court, obtain an order, in accordance with section 108 of the Communications
Assistance for Law Enforcement Act, directing that a telecommunications
carrier, a manufacturer of telecommunications transmission or switching
equipment, or a provider of telecommunications support services comply with
such Act.
*(c) Civil Penalty. -
*(1) In general. - A court issuing an order under this section against a
telecommunications carrier, a manufacturer of telecommunications
transmission or switching equipment, or a provider of telecommunications
support services may impose a civil penalty of up to $10,000 per day for
each day in violation after the issuance of the order or after such future
date as the court may specify.
*(2) Considerations. - In determining whether to impose a civil penalty and
in determining its amount, the court shall take into account -
*(A) the nature, circumstances, and extent of the violation;
*(B) the violator's ability to pay, the violator's good faith efforts to
comply in a timely manner, any effect on the violator's ability to continue
to do business, the degree of culpability, and the length of any delay in
undertaking efforts to comply; and
*(C) such other matters as justice may require.
*(d) Definitions. - As used in this section, the terms defined in section
102 of the Communications Assistance for Law Enforcement Act have the
meanings provided, respectively, in such section.

                Chapter 121 Stored wire and electronic communications and
transactional records access Sections 2701-2711

Sec. 2703. Requirements for governmental access
*(a) Contents of Electronic Communications in Electronic Storage. - A
governmental entity may require the disclosure by a provider of electronic
communication service of the contents of an electronic communication, that
is in electronic storage in an electronic communications system for one
hundred and eighty days or less, only pursuant to a warrant issued under the
Federal Rules of Criminal Procedure or equivalent State warrant. A
governmental entity may require the disclosure by a provider of electronic
communications services of the contents of an electronic communication that
has been in electronic storage in an electronic communications system for
more than one hundred and eighty days by the means available under
subsection (b) of this section.
*(b) Contents of Electronic Communications in a Remote Computing Service. -
(1) A governmental entity may require a provider of remote computing service
to disclose the contents of any electronic communication to which this
paragraph is made applicable by paragraph (2) of this subsection -
*(A) without required notice to the subscriber or customer, if the
governmental entity obtains a warrant issued under the Federal Rules of
Criminal Procedure or equivalent State warrant; or
*(B) with prior notice from the governmental entity to the subscriber or
customer if the governmental entity -
*(i) uses an administrative subpoena authorized by a Federal or State
statute or a Federal or State grand jury or trial subpoena; or
*(ii) obtains a court order for such disclosure under subsection (d) of this
section; except that delayed notice may be given pursuant to section 2705 of
this title.
*(2) Paragraph (1) is applicable with respect to any electronic
communication that is held or maintained on that service -
*(A) on behalf of, and received by means of electronic transmission from (or
created by means of computer processing of communications received by means
of electronic transmission from), a subscriber or customer of such remote
computing service; and
*(B) solely for the purpose of providing storage or computer processing
services to such subscriber or customer, if the provider is not authorized
to access the contents of any such communications for purposes of providing
any services other than storage or computer processing.
*(c) Records Concerning Electronic Communication Service or Remote Computing
Service. - (1)(A) Except as provided in subparagraph (B), a provider of
electronic communication service or remote computing service may disclose a
record or other information pertaining to a subscriber to or customer of
such service (not including the contents of communications covered by
subsection (a) or (b) of this section) to any person other than a
governmental entity.
*(B) A provider of electronic communication service or remote computing
service shall disclose a record or other information pertaining to a
subscriber to or customer of such service (not including the contents of
communications covered by subsection (a) or (b) of this section) to a
governmental entity only when the governmental entity -
*(i) obtains a warrant issued under the Federal Rules of Criminal Procedure
or equivalent State warrant;
*(ii) obtains a court order for such disclosure under subsection
(d) of this section; or
*(iii) has the consent of the subscriber or customer to such disclosure.
*(C) A provider of electronic communication service or remote computing
service shall disclose to a governmental entity the name, address, local and
long distance telephone toll billing records, telephone number or other
subscriber number or identity, and length of service of a subscriber to or
customer of such service and the types of services the subscriber or
customer utilized, when the governmental entity uses an administrative
subpoena authorized by a Federal or State statute or a Federal or State
grand jury or trial subpoena or any means available under subparagraph (B).
*(2) A governmental entity receiving records or information under this
subsection is not required to provide notice to a subscriber or customer.
*(d) Requirements for Court Order. - A court order for disclosure under
subsection (b) or (c) may be issued by any court that is a court of
competent jurisdiction described in section 3127(2)(A) and shall issue only
if the governmental entity offers specific and articulable facts showing
that there are reasonable grounds to believe that the contents of a wire or
electronic communication, or the records or other information sought, are
relevant and material to an ongoing criminal investigation. In the case of a
State governmental authority, such a court order shall not issue if
prohibited by the law of such State. A court issuing an order pursuant to
this section, on a motion made promptly by the service provider, may quash
or modify such order, if the information or records requested are unusually
voluminous in nature or compliance with such order otherwise would cause an
undue burden on such provider.
*(e) No Cause of Action Against a Provider Disclosing Information Under This
Chapter. - No cause of action shall lie in any court against any provider of
wire or electronic communication service, its officers, employees, agents,
or other specified persons for providing information, facilities, or
assistance in accordance with the terms of a court order, warrant, subpoena,
or certification under this chapter.
*(f) Requirement To Preserve Evidence. -
*(1) In general. - A provider of wire or electronic communication services
or a remote computing service, upon the request of a governmental entity,
shall take all necessary steps to preserve records and other evidence in its
possession pending the issuance of a court order or other process.
*(2) Period of retention. - Records referred to in paragraph (1) shall be
retained for a period of 90 days, which shall be extended for an additional
90-day period upon a renewed request by the governmental entity.

Sec. 2704. Backup preservation
*(a) Backup Preservation. - (1) A governmental entity acting under section
2703(b)(2) may include in its subpoena or court order a requirement that the
service provider to whom the request is directed create a backup copy of the
contents of the electronic communications sought in order to preserve those
communications. Without notifying the subscriber or customer of such
subpoena or court order, such service provider shall create such backup copy
as soon as practicable consistent with its regular business practices and
shall confirm to the governmental entity that such backup copy has been
made. Such backup copy shall be created within two business days after
receipt by the service provider of the subpoena or court order.
*(2) Notice to the subscriber or customer shall be made by the governmental
entity within three days after receipt of such confirmation, unless such
notice is delayed pursuant to section 2705(a).
*(3) The service provider shall not destroy such backup copy until the later
of -
*(A) the delivery of the information; or
*(B) the resolution of any proceedings (including appeals of any proceeding)
concerning the government's subpoena or court order.
*(4) The service provider shall release such backup copy to the requesting
governmental entity no sooner than fourteen days after the governmental
entity's notice to the subscriber or customer if such service provider -
*(A) has not received notice from the subscriber or customer that the
subscriber or customer has challenged the governmental entity's request; and

*(B) has not initiated proceedings to challenge the request of the
governmental entity.
*(5) A governmental entity may seek to require the creation of a backup copy
under subsection (a)(1) of this section if in its sole discretion such
entity determines that there is reason to believe that notification under
section 2703 of this title of the existence of the subpoena or court order
may result in destruction of or tampering with evidence. This determination
is not subject to challenge by the subscriber or customer or service
provider.
*(b) Customer Challenges. - (1) Within fourteen days after notice by the
governmental entity to the subscriber or customer under subsection (a)(2) of
this section, such subscriber or customer may file a motion to quash such
subpoena or vacate such court order, with copies served upon the
governmental entity and with written notice of such challenge to the service
provider. A motion to vacate a court order shall be filed in the court which
issued such order. A motion to quash a subpoena shall be filed in the
appropriate United States district court or State court. Such motion or
application shall contain an affidavit or sworn statement -
*(A) stating that the applicant is a customer or subscriber to the service
from which the contents of electronic communications maintained for him have
been sought; and
*(B) stating the applicant's reasons for believing that the records sought
are not relevant to a legitimate law enforcement inquiry or that there has
not been substantial compliance with the provisions of this chapter in some
other respect.
*(2) Service shall be made under this section upon a governmental entity by
delivering or mailing by registered or certified mail a copy of the papers
to the person, office, or department specified in the notice which the
customer has received pursuant to this chapter. For the purposes of this
section, the term ''delivery'' has the meaning given that term in the
Federal Rules of Civil Procedure.
*(3) If the court finds that the customer has complied with paragraphs (1)
and (2) of this subsection, the court shall order the governmental entity to
file a sworn response, which may be filed in camera if the governmental
entity includes in its response the reasons which make in camera review
appropriate. If the court is unable to determine the motion or application
on the basis of the parties' initial allegations and response, the court may
conduct such additional proceedings as it deems appropriate. All such
proceedings shall be completed and the motion or application decided as soon
as practicable after the filing of the governmental entity's response.
*(4) If the court finds that the applicant is not the subscriber or customer
for whom the communications sought by the governmental entity are
maintained, or that there is a reason to believe that the law enforcement
inquiry is legitimate and that the communications sought are relevant to
that inquiry, it shall deny the motion or application and order such process
enforced. If the court finds that the applicant is the subscriber or
customer for whom the communications sought by the governmental entity are
maintained, and that there is not a reason to believe that the
communications sought are relevant to a legitimate law enforcement inquiry,
or that there has not been substantial compliance with the provisions of
this chapter, it shall order the process quashed.
*(5) A court order denying a motion or application under this section shall
not be deemed a final order and no interlocutory appeal may be taken
therefrom by the customer.

Sec. 2709. Counterintelligence access to telephone toll and transactional
records
*(a) Duty to Provide. - A wire or electronic communication service provider
shall comply with a request for subscriber information and toll billing
records information, or electronic communication transactional records in
its custody or possession made by the Director of the Federal Bureau of
Investigation under subsection (b) of this section.
*(b) Required Certification. - The Director of the Federal Bureau of
Investigation, or his designee in a position not lower than Deputy Assistant
Director, may -
*(1) request the name, address, length of service, and local and long
distance toll billing records of a person or entity if the Director (or his
designee in a position not lower than Deputy Assistant Director) certifies
in writing to the wire or electronic communication service provider to which
the request is made that -
*(A) the name, address, length of service, and toll billing records sought
are relevant to an authorized foreign counterintelligence investigation; and

*(B) there are specific and articulable facts giving reason to believe that
the person or entity to whom the information sought pertains is a foreign
power or an agent of a foreign power as defined in section 101 of the
Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801); and
*(2) request the name, address, and length of service of a person or entity
if the Director (or his designee in a position not lower than Deputy
Assistant Director) certifies in writing to the wire or electronic
communication service provider to which the request is made that -
*(A) the information sought is relevant to an authorized foreign
counterintelligence investigation; and
*(B) there are specific and articulable facts giving reason to believe that
communication facilities registered in the name of the person or entity have
been used, through the services of such provider, in communication with -
*(i) an individual who is engaging or has engaged in international terrorism
as defined in section 101(c) of the Foreign Intelligence Surveillance Act
[1] or clandestine intelligence activities that involve or may involve a
violation of the criminal statutes of the United States; or
*(ii) a foreign power or an agent of a foreign power under circumstances
giving reason to believe that the communication concerned international
terrorism as defined in section 101(c) of the Foreign Intelligence
Surveillance Act (FOOTNOTE 1) or clandestine intelligence activities that
involve or may involve a violation of the criminal statutes of the United
States.
*(c) Prohibition of Certain Disclosure. - No wire or electronic
communication service provider, or officer, employee, or agent thereof,
shall disclose to any person that the Federal Bureau of Investigation has
sought or obtained access to information or records under this section.
*(d) Dissemination by Bureau. - The Federal Bureau of Investigation may
disseminate information and records obtained under this section only as
provided in guidelines approved by the Attorney General for foreign
intelligence collection and foreign counterintelligence investigations
conducted by the Federal Bureau of Investigation, and, with respect to
dissemination to an agency of the United States, only if such information is
clearly relevant to the authorized responsibilities of such agency.
*(e) Requirement That Certain Congressional Bodies Be Informed. - On a
semiannual basis the Director of the Federal Bureau of Investigation shall
fully inform the Permanent Select Committee on Intelligence of the House of
Representatives and the Select Committee on Intelligence of the Senate, and
the Committee on the Judiciary of the House of Representatives and the
Committee on the Judiciary of the Senate, concerning all requests made under
subsection (b) of this section.

One of the places the United States Code is available from:
http://www4.law.cornell.edu/uscode

The FCC has references to CALEA too numerous to mention:
http://www.fcc.gov/

A Telecom Law mailing list archive:
http://www.ari.net/telecomlaw/

Hyperlink page of privacy related resources:
http://www.hotwired.com/Lib/Privacy/index.html

Thanks,
Gary Lehecka
[email-masked]
BP  250 - 3671
US  ( 216 )  586 - 3671
> ----------
> From:         John Segers[SMTP:[email-masked]]
> Reply To:     John Segers
> Sent:         Monday, August 23, 1999 5:16 PM
> To:   [email-masked]
> Subject:      Re: Topology
>
> Christian,
>
> I'm sure you see that some of the things that can be done with the
> topology addition cannot be done with termination mode.  It was brought
> in at the Berlin meeting by Ericsson, citing a one-way legal intercept
> requirement.  Maybe someone from Ericsson (or someone else) can explain
> in more detail where that requirement comes from.
>
> I agree with you that support of this would not be mandatory on MGs.
> Doing a legal intercept on a customer premises residential gateway is
> probably not the best way to catch criminals :)
>
> John
>
> Christian Huitema wrote:
> >
> > I am not sure whether the "topology" addition is worth the added
> > complexity.  We can already use the termination-mode to select which
> > termination is or is not sending/receiving in the context. The topology
> > addition moves us from the basic "star" definition of a context, which
> we
> > add agreed to back in Minneapolis, towards a "shape on demand"
> definition.
> > Frankly, this seems like a non-benign departure from the original model.
> At
> > a minimum, if we add anything of that nature, support should be
> optional.
> > Christian Huitema
>
> --
> John Segers                                  email: [email-masked]
> Lucent Technologies                                        Room HE 344
> Dept. Forward Looking Work                      phone: +31 35 687 4724
> P.O. Box 18, 1270 AA  Huizen                      fax: +31 35 687 5954
>

---

From: Christian Huitema <[email-masked]>
Date: Tue, 24 Aug 1999 10:51:35 -0400

Gary,

There is no question that Telcommunication Providers will be mandated to
install wiretaps in some cases. It is however quite dubious whether the MG
is the proper place to implement wiretaps:

1) The "residential gateway" variety of MG is often installed within the
customer premises. This means that the wiretap targets have ample
opportunities to tamper the box and defeat any wiretap command. Even if
they don't actually tamper the box, they can easily monitor the box's
behavior and detect that a wiretap has been installed, wich defeats the
purpose of wiretapping.

2) The "trunking gateway" variety may look as a better place, as it is
located inside the network.  But installing wiretaps there has to be
performed on a call by call basis. The same wiretaps could be installed in
the network by routing the calls to a "wiretap server." In any case, the
"in network" solution fails to capture "on net" calls.

3) In fact, the only type of wiretap that meets all request is obtained by
actually taking a copy of all network traffic to the wiretap target, which
is better done by a monitoring device plugged to the line, or maybe by a
command to an edge router.

The main consequence for Megaco has to do with the handling of encryption
keys.  If the MGC's know the keys, they must be capable of passing them to
the exploitation center, along with a copy of signalling information. Given
the general inadequacy of "wiretap from the media gateway", I am very
reluctant to use wiretap requirements as a reason to add complexity in Megaco.
Christian Huitema

---

From: Christian Groves <[email-masked]>
Date: Tue, 24 Aug 1999 17:34:51 +1000

Comments below marked [CHG]:

> behavior and detect that a wiretap has been installed, wich defeats the

[CHG]
Can you give details of how Wiretaps would be achieved in this case if
two residential gateways communicate? I can see any other way of doing
this because the media stream goes directly (via an IP router network)
between 2 residential gateways?

> "in network" solution fails to capture "on net" calls.

[CHG]
There are strict requirements on wiretapping so that even the operators
don't see that calls  are being tapped. Setting up a new route and
sending all calls to a wiretapping server is a pretty good indication
that the calls are being tapped. Even if you get to a Wiretap 'server'
its going to need media part (MG) and if you follow H.248 then we have
to same problem. I didn't understand your 'on net' calls comment?

> command to an edge router.

[CHG] Isn't then only place you know where a the media is going is
through the MG? The media  could go nearly anywhere in a router network.

> reluctant to use wiretap requirements as a reason to add complexity in Megaco.

[CHG]
Despite being a 'difficult' requirement and an unpopular requirement
(noone likes their phone tapped), I think that this requirement should
still be left in as its essential so that we can pass the regulators
requirements.

Cheers, Christian

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 24 Aug 1999 10:36:07 -0500

Christian,

I suggest you read Telcordia's GR-2973 and your CALEA act again.  You have
greatly oversimplified the matter.  A physical wiretap is not sufficient.
Call Forwarding easily bypasses a line-side tap.  Network-based surveillance
is the only alternative.  An ITSP platform which does not provide CALEA
capabilities may well be in breach of the Act and the manufacturer and operator
subject to fines.  RFP's are citing CALEA and other acts abroad and asking for
compliance of MGC and MG equipment.  There is likely a point in every
jurisdiction beyond which a manufacturer or operator will not be reimbursed
for retrofitting previously mandated capabilities.  This point is coming soon.
The capability deserved consideration at the onset: why ignore it now?

--
Brian F. G. Bidulock
Associate Director - New Products
Inet Technologies Inc.
972-578-3959

---

From: Christian Huitema <[email-masked]>
Date: Tue, 24 Aug 1999 13:51:29 -0400

>between 2 residential gateways?

The subscriber's traffic joins the "IP router network" through an access
equipment, such as a DSLAM or a cable head-end router.  This is the best
place to position a monitoring equipment.
Christian Huitema

---

From: Matt Holdrege <[email-masked]>
Date: Tue, 24 Aug 1999 11:41:19 -0700

>is the proper place to implement wiretaps:

I agree that we need to limit the complexity of MEGACO. But regulators are
a big part of the reason that the PSTN is so complex today and it's hard to
stop them.

I won't pretend to understand any EU laws, but I did read the EU's proposal
for wiretapping next-gen networks and they want to be able to tap anywhere!

If Telcordia wants to lobby the EU against this idea they would do the
industry a great service. :)

---

From: Michael Thomas <[email-masked]>
Date: Tue, 24 Aug 1999 18:02:12 -0700

> between 2 residential gateways?

   Assuming that there exists a sniffer-like
device with sufficient information to detect the
flow (something to bear in mind here is that it's
not just the bearer that needs to be snooped, but
the signaling too) as well as the proper
decryption keys, the sniffer could then record the
traffic as well as potentially play it out, real
time. This could be integrated into the
functionality of edge routers, aggregating
routers, or duplicated and forwared to a
standalone device, etc. This could be either under
the administrative control of the MGC, or some
other interface to the sniffer.
   This solution solves the problems with lawful
intercept without involving the actual MG's.
Network architectures which have *any* untrusted
MG's will need to use this, or some functional
equivalent of this scheme.
   The solution you're proposing with the topology
descriptor only works in a limited set of
situations, so the larger question is whether the
the added complexity to the protocol is worth
adding if that's the main benefit. A large class
of devices would, most assuredly, never use the
nominal reason the feature was added, and as
Christian points out, if it is manditory to
implement, adds a significant amount of complexity
to the MG.

                Mike

---

From: Rex Coldren <[email-masked]>
Date: Tue, 24 Aug 1999 18:16:46 -0700

If you are correct, are you then suggesting "mandatory" should be "optional"?

Rex

---

From: Michael Thomas <[email-masked]>
Date: Tue, 24 Aug 1999 18:31:36 -0700

> If you are correct, are you then suggesting "mandatory" should be
"optional"?

   At the very least. You'd probably need YAAV
(yet another audit value) to determine whether the
MG supports the feature.

   BTW, at some point we need to round up all of
the "optional" features and make certain that the
MGC, probably through auditing, can find out which
features are supported.

                Mike

---

From: Chip Sharp <[email-masked]>
Date: Tue, 24 Aug 1999 22:59:21 -0700

A wiretap capability can be builtinto the MG without megaco.  All megaco
allows you to do is control it from an MGC (via megaco).  I could just as
easily set this up via a management interface.

VoIP-based networks were not remotely considered when CALEA was
written.  If  megaco seems to be a problem, end-to-end VoIP calls (and
SIP-based networks) will be even more fun.  In that case, where do you
apply the wiretap.

Chip

> > reluctant to use wiretap requirements as a reason to add complexity in

--------------------------------------------------
Chip Sharp                 Consulting Engineering
Cisco Systems              Telco Bio-region
Reality - Love it or Leave it.
--------------------------------------------------

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Wed, 25 Aug 1999 03:15:06 -0500

Chip,

> easily set this up via a management interface.

It's not just a wiretap, and that was my point.  According to GR-2973,
which pretty much turned into J-STD-025, there is specific coordination
required between the delivery of Call Identifying Information (acquired
from signaling) and Call Content (acquired from the bearer channel).
The format of the Call Identifying Information must at all times provide
complete and evidentiary details as to the connection (in all directions)
of all of the participants in a communications session or context.

Conferencing is a particular example, where Call Information must identify
when participants join and leave the conference.  Further, laws complicate
the participants whose communications can be monitored in a conference.
Only participants whose communications are supported by a service subscribed
to by the target are fair game.  Participants on hold are not fair game.

Simple call forwarding (where the forwarding is provided by the target's
call forwarding service) are fair game.

In some instances, the specifications call for monitoring of a communications
channel before the call is even cut through on the target's side.

Call Identifying Information (and even Call Content) on abandoned calls
is required by the specifications.

Traditional wiretap capabilities were deemed insufficient for the Act and
compliance to CALEA cannot be met with traditional wiretaps, inviting fines.

Approximately 80% of the calls missed by a duly authorized warrant are due
to call forwarding (or a variant such as voice mail).

I fail to see how one could be compliant at the MG when it lacks the
signaling (and call state: read MGC) information necessary to provide the
Call Identifying Information required by the Act and the specifications.
Further, I fail to see how it would be able to deliver information pertaining
to abandonned calls for which the MGC has disposed of and not delivered
so much as a message to the MG.

No, clearly the MGC and MG must work in tandem to provide both the Call
Information and the Call Content in a tightly coupled fashion to be
compliant, requiring support from the communicating protocol, in this
case megaco.

> SIP-based networks) will be even more fun.  In that case, where do you

Au contraire, VoIP was considered: so were a whole raft of new services
and communications capabilities, including Internet redirect and xDSL
technologies and the surveillance of packet data.  Each of these were
designed without consideration for assistance to law enforcement, while
further reducing the effectiveness of a traditional line wiretap: thus
the call for legislation: not just here in the US but abroad as well.

Megaco is no more a problem than any other communications protocol or
service.  What has and will continue to cause a problem is if the
communications industry persists in providing advanced services to
criminals without regard to assistance to law enforcement.  It sure looks
to me like the FCC pushed the compliance date to watch the industry sit
on its heels for another 18 months.

(MOAMO-NNTOME)

--
Brian F. G. Bidulock

---

From: Hong Liu <[email-masked]>
Date: Wed, 25 Aug 1999 10:40:26 -0400

Brian,

I have been monitoring the discussion on this thread for a few days. It seems
that we need to identify exactly what we mean by wiretap, in the context of
megaco, before we rush into devising mechanisms to solve it. Otherwise, with
different problem definitions in mind, we end up with arguing oranges vs. apples
without much progress. Of course, Tom will need to decide whether we should beat
this topic to death now, or can be left for further discussion.

I think Brian's email is a good start. Let's take a step back. I am very naive,
so I will ask a number of naive questions below. I am requesting experts in this
area to clarify the issues for me, and some other people on this list. Hopefully,
in the process we can refine the requirements on wiretap for MEGACO:

(1) What is wiretap in a simple two-way conversation, say between A and B?
Suppose A is to be tapped, shall the monitoring be one way from A to B, or two
way? If it is two way, will B's civil rights be violated? I seem to remember one
email talked about one way media flow monitoring. But I don't know how to make
sense out of a one way conversation, -:)
(2) In addition to media tapping, Brian also mentioned call signaling monitoring
and the correlation between signaling and media. I would like to know how this is
done in today's PSTN. In particular, I would like to know how it is done in the
context of ATM, where call signaling and bearer connection setup are separated.
(3) Conference. I would like to understand (1) and (2) more before getting into
this more complicated case.

Cheers,

--Hong

---

From: John Segers <[email-masked]>
Date: Wed, 25 Aug 1999 16:49:15 +0200

FWIW, here's my understanding:
1) It has to be possible to listen only to what A says in a conversation
with B.
2) How wiretaps are implemented in existing ATM networks is largely
irrelevant to our discussion.
3) Same as in 1): if there's five people in a conference, it has to be
possible to listen to what one of them says.

John

--
John Segers                                  email: [email-masked]
Lucent Technologies                                        Room HE 306
Dept. Forward Looking Work                      phone: +31 35 687 4724
P.O. Box 18, 1270 AA  Huizen                      fax: +31 35 687 5954

---

From: Hong Liu <[email-masked]>
Date: Wed, 25 Aug 1999 11:02:50 -0400

...[snip]

> irrelevant to our discussion.

How can you be so sure? You missed my point completely. It is about correlation of call
signaling information with media information, as Brian suggested. ATM is just one
example of that.

Regards,

--Hong

....[snip]

---

From: Stephen Terrill <[email-masked]>
Date: Wed, 25 Aug 1999 17:48:00 +0200

Hi Hong Liu,

Answers (attempts) below.

..//Steve

> sense out of a one way conversation, -:)

It is at least a requirement to be able to monitor a one-way stream from A.

> context of ATM, where call signaling and bearer connection setup are separated.

The monintoring of the signalling in PSTN networks today (DSS1 or ISUP) (In ISUP, the call signalling is sepate from the uPlane on the line - ie this occures also in environments other than ATM), a copy of the signalling is recorded and sent out (this is not legal intercept).  This is likely to be a role of a MGC.

> this more complicated case.

The same applies

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Wed, 25 Aug 1999 13:41:55 -0500

> sense out of a one way conversation, -:)

In most jurisdictions, the communication on both the path from B to A and from
A to B are monitored.  Upon delivery to LE the A and B channels may have been
"recombined," however, for 4-wire facility taps (which this is) the call content
channels B->A and A->B and delivered to LE separated.  There is a good reason
for this:  suppose in the middle of the conversation, A is put on "network hold".
That is, both channels between A and B are suspended.  In this circumstance, what
A delivers to the network on the "open" channel is delivered to LE and what A
receives from the network is delivered to LE (kind of like an open mike to A's
phone).  However, in most jurisdictions it is not permitted to deliver B's
transmissions to the dead connection (the open mike to B's phone): any
conversations that B has in the room while waiting on hold is B's business and
not subject to warrant.  This is CALEA, US.  Other jurisdictions are not so
careful concerning suspending B's rights.

> context of ATM, where call signaling and bearer connection setup are separated.

In the situation above (network hold) and in conferencing situations, it is
essential that Law Enforcement be able to determine in an evidentiary fashion
who was priviy to what parts of the conversation.  This is state information
concerning the session or context of the connections which is only transferred
via signaling (or control such as MEGACO) information.  Not only do call content
channels have to be cut through to LE or not according to law, but LE must be
given the call identifying information to be able to determine (while the call
is happening and after the fact) who was able to talk/listen to who when.

> this more complicated case.

It is actually not much more complicated: instead of having to know the precise
state of 2 channels for two participant's, it is necessaty to know the precise
state of 2*n channels for (n) participants.  Also, it is necessary to know whether
it is the target (e.g., A) or the participant (e.g., B) who subscribes to the
conferencing service.  In the case where the conferencing service is subscribed
to by A, it makes no difference whether only B and C are on the bridge: LE is
still legally able to monitor the conversation between B and C "supported" by A's
service.  Again, other jurisdictions are less careful concerning B and C's rights.

Hope this helps a bit.

If you can get access to GR-2973 or J-STD-025 things may be a lot clearer.  There
are specific call scenarios in the appendices of J-STD-025 which assist greatly
in the understanding.