CALEA and VoIP:
The Internet is not the PSTN

Steven M. Bellovin

smb@research.att.com

http://www.research.att.com

“On the Internet, no one

knows what a phone call is.”

The PSTN and the Internet

One major service: telephony

Primarily two-party; dedicated circuits

In-band signaling

The network defines the applications

Many services, all different

Multi-party; packet-switching

Out-of-band signaling

The edges define the applications

What is the Service Being Tapped?

What is a “phone call”?

The standard Internet telephony protocol – SIP – is used for very many other things besides voice

The signaling path is not necessarily the voice path – whose call is being tapped?

The service provider does not know or care what applications the customer is using – how can they tap it intelligently?

The Dangers of Engineered Back Doors

It's hard enough getting base functionality correct and secure

A wiretap feature is designed to disclose private information – is it secure?

Claims about security problems with CALEA interfaces

The IETF has declined to add wiretap interfaces to its protocols (RFC 2804):

“Experience has shown that complexity almost inevitably jeopardizes the security of communications even when it is not being tapped by any legal means; there are also obvious risks raised by having to protect the access to the wiretap.”

Steven Bellovin

2004-04-20T23:36:12