lawful intercept for telecommunication and Earopean context

earo

1. Lawful a of IP
Traffic

The European Context

2. à L ta
Contents
Introduction to Lawful Interception
Inter: ion of Internet services

Origins in The European Community

ion Legislation in Bri

rception Suppliers & ES f niques

uture slopments é

3. Introduction to Lawful! Interception

= ET Slidefinition of (lawful) interception:

= interception: action (based on the law),
performed by an network operator/access
provider/service provider (NWO/AP/SvP), of
making available certain information an

providing that information to a law enforcement
monitoring facility.

information

4. = Data theft —In dus sirial espionage
= Drug dealers on the internet

= Why not?
= Privacy

5. = SUES

"Am J not to hear the truth?"
Objecting Counsel: “No, Your Lordsh

evidence.”

lip Is to he:

Some: ch
A
thentic — explicitly link data to individu
ceurate — reliabilii ity of Surveillance process over

ontent of interc ept
complete” story of a particular

obative value, and subjective
ation:

6. ce

INS

Vi
Hard to actually find c criminals in delicto flagrante

How to handle expert evidence? Juries are not

composed of network specialists, Legal not scientific

decision making:

se fof treating Int
not primary evident:
= Primary —

IS cle Te not th the amen source € gr
a document — a copy.

7. Interception of Internet services

r

8. Intercı Zee of Int

lat go over the
iD d Wide Y
Smal
at and ic
vo JP. FOP
ftp,

telnet

9. about enc!

PGP, S/MIM
ESAS 5

e and

S
VI
N

D

IC.

oplied by NVVO/AP/SvP then
on should be stripped before sending to

®

er s) should be made available to LEA

= a challenge for the LEA’

10. Logical Overview

TELCO domain

Pp À

National ‘Civilian International
Secret Service Police Secret
Service

11. @

nallenges

ical C

Reg, —Maintain Transparency & Standard
une [
Monitoring Radius — misses

t information — Effective

DI

omplexity increases buggin
| LEN MF

12. Origins in The European
Community

13. tion on Cyberc crime — C Sounc of Europe-
ealtime sol: e

y

¡sed approach
: Idpoint > Policy on
Wiretapping |

15. Solution Requirements

Germai
[Italy No

[Portugal |

United Kingdom

16. European

= France
110
de
= Loj si = ite Quotidienne — November 2001
4 nt
= G-10)- 2007
he Counter terrorism Act — January 2002

(Regulation) Act.

17. UK Interception Legislation

= UK
= Regulation of Investigatory Powers Act 2000.
= Anti-terrorism, Crime and Security Act 2001

= ‘The tragic events in the United States on 11 September 2001
underline the importance of the Service’s work on national security
and, in particular, counter-terrorism. Those terrible events
significantly raised the stakes in what was a prime area of the
Service’s work. It is of the utmost importance that our Security Service
is able to maintain its capability against this very real threat, both in
terms of staff and in terms of other resources. Part of that falls to.
legislation and since this website was last updated we have seen the

vent of the Regulation of Investigatory Powers Act 2000, Terrorism
Act 2000 and the Anti-Terrorism Crime and Security Act 2001. Taken
together these Acts provide the Security Service, among! others, with
preventative and investigative capabilities, relevant to the technology
of today and matched to'the threat from those who would seek to
harm or undermine our society. *— The UK Home Secretary's
Foreword) on www.MI5.gov.

18. In Holland

both legally & technic:

Telecommunications Act 1998— Operator

Fe es sponsib ilities:

e Dutc ch | ae al pure Dre peeedin ings — Initiation

¡CEP! tion Office = in) operation at ihe

CIOT= central bureau) for interception for telecom

19. = E =

SE ep Telecommunicatio

Standards Institute

20. Technical Specs. of Lawful
Interception The ETSI model

NOW / AP / SvP's domain

NWO/APISVP*
administration]
function

interc:

Network
Internal

Functionsh content of
communicatiog

11: administrative information
IF: internal interception function HI2: intercept related information
: internal network interface HI3: content of communication

21. S|

Purpose of ETS tandardiz te
economic realization of lawful interception that
with the national and international ti
leg ion

Enable Interoperabilit

Formerly Els! TC;
Now ETSI TC LI —
Handover Spec — IP expected in 2003-04-01

te committee standards docs.

Comprised primarily of operators and vendors - WG LI
ETSI TR 101 944 — The Issues

22. 5 ego mils I- Network
division)

Implementati

23. 3GPP, GPRS,

Work ca \ WG3 LI

Ll in UMTS, and produce
t those fequirem: lents:

ee

work shall be perform led
standards bodie:

ETSI TS 133 1 Lawful Interc poda
ETSI TS 183 107 — Lawful Int
Functions

Els] I 133 1

Intercep:

Manure
Interce

onjunction

cturers a

ption via SIP)

UMTS

all
This.
with the regional

equirements

25. Result V.1.0

idlines — Full IP & Email =2002

26. r transport

ntains cryg

iilbox, etc.

h results and NULL

Description c al Architect 113

\dover In
Global dat
HE) Definition:

| message flows for HI2 and HIS:

28. Al2

ure for

O
o
kr

O

=
<T

E
©

Na

0)

«=

29. ecture fi

fat
ind Hi

Collect billing

Sto

30. Decrypt packets from

>K integni

32. LI implementations

Verint formerly known as Comverse Infosys

\DC formerly known as SS8:

lardware vendors

33. imple

Active- di
Semi-Acti

capture an

N

Passive- no interaction

Only interception sah i

e

Most of the following ar
combination of active and sen mi-ac iv
Implementations

35. CoQ

ajo)

proprietary hardware
for large bandwidth ccts.

nown to be used in S

Supports CALEA — ETSI

Use of Top Layer switch

tellite Traffic

36. O
e

Ai
O
Ca

OIL ae = age depend on
da integration

37. Solutions can co:
ra 000,000 Euro for the ISP

Govt. expr to spend 46 billion over tl
tly reduced to 27 billion

ven

ected
juently

S fof non-compliance
Ss —up to 250,( £
Civil Charges

Hou:

inywhere from 100,000 Euro to

38. ‚onclusions for Law Enforceme

pr

“If you're going to do it ... do it right
» Disclosure of tools and methods

» Adherence to warrant submission requirements,
= Completeness of log sUpportin: ng info.

= Proof of non- contamination of targ

= Maintaining relationship with the El yatı

Law Enforcement personnel

= Training

= Defining role of police invest

= Defining role of ES techn!

= Handling Multi = Focall investigations

39. ure Developments

1]
(

m

pais en Hepes tipulations

Di
2
E
2]
15)

@

[nu

wide agreements on Intercept Iinitiati
over Mobile

40. WL petit tap. JE
http://www. Quin enz.at/cgi-
bin/index?fun lon nine
WWW. phrack.com

WWW. chyptome. org
WWW. Stat

www.privacy.org
www.infowan.org
WWW.TEgIAW.CO. uk

‘Caveat — org ? com

41. Q&A / Discussion

| deliver added value to Law

c,

torcement's ability to protect the public?

hat about open source Interception

Clipper Chip?
6 Key EScrow of
ISP's en \cryption Keys,

Whattypes, of oversight need) to be built
into the system) to prevent abuse?

42. Thank You.

Ja + Baloo