Subject: [Raven] IP-tapping - easy or hard?

From: Greg Broiles <[email-masked]>
Date: Sun, 02 Jan 2000 22:00:42 -0800

At 04:54 AM 12/30/99 , Chris Savage wrote:
>Am I correct?  When, if ever, would an Internet entity have information
>about a subject's transmissions that would not be obtainable by a LEA simply
>tapping the carrier-provided link between the subject and the Internet?

It's relatively difficult to wiretap a conversation between two modern 
(e.g., transmission rate > 1200 bps) modems because of the fancy audio 
tricks they use to encode the data they're passing - the characteristics of 
the link between the modems is negotiated dynamically during the 
connection, and depends on the conditions at each end of the connection.

Further, it's necessary to decode several layers of protocols - e.g., at 
the most basic level, analog audio signals are used to represent digital 
data. That digital data likely consists of low-level packets (this is 
handled inside the modems) which facilitate data compression and 
error-correction at the modem level; those packets consist of data sent 
between (in a typical or canonical implementation) serial ports, which 
themselves constitute a PPP session; on top of that PPP session, you've got 
IP packets, many of which are likely to contain ICMP or UDP or TCP packets, 
which can then be assembled into sessions used by application (like email 
or web or audio traffic).

There are reportedly boxes priced in the tens of thousands of dollars which 
can perform the above processes - I don't know how well they work, or how 
widely they're deployed in law enforcement. In the context of traditional 
analog lines, it's easy and cheap to wiretap voice conversations, and 
appreciably more difficult and expensive to wiretap modem conversations. If 
an eavesdropper can force one end of a modem conversation to cooperate with 
surveillance activity, their job is much cheaper and simpler, as the 
required facilities and capabilities already exist.

Further, the above description assumes that there's been no attempt to 
preserve privacy - a subscriber operating in a privacy-sensitive 
environment might choose to negotiate a Diffie-Hellman key exchange with 
their ISP (I anticipate that this sort of consumer-level VPN setup will 
become more common/necessary, as deregulation and mandatory competition 
come to traditional service providers) that would make their communications 
unreadable to third parties.

The historical model where one business entity provides connectivity to the 
internet and email access and webserver space is changing - for example, I 
switch between ISP's with some frequency, but depend on third parties (and 
my own colocated hardware) for service other than IP transport. I predict 
that this model will become more popular, as market participants choose to 
specialize, and bare IP transport starts to look more like a commodity 
service and less like a specialty service.

--
Greg Broiles
[email-masked]
PGP: 0x26E4488C

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven