Perspective: Fahrenheit FBI

A new U.S. government decision extending wiretapping regulations to the Internet raises far more questions than it answers.

The Federal Communications Commission voted 5-0 last week to prohibit businesses from offering broadband or Internet phone service unless they provide police with backdoors for wiretapping access. Formal regulations are expected by early next year.

But the commissioners didn't give the FBI and its allies at the Justice Department and the Drug Enforcement Administration everything they wanted.

In the police agencies' original request, submitted in March, they asked the FCC to force surveillance back doors into instant-messaging programs and voice over Internet Protocol (VoIP) applications that do not use the traditional telephone network. The FCC politely declined, with Chairman Michael Powell saying those services were exempt from the Communications Assistance for Law Enforcement Act (CALEA) and that it was "unnecessary to identify future services and entities subject to" mandatory wiretapping requirements.

How will you force a company based in Luxembourg to insert backdoors in its software when it has no obligation to do so?

So what happens next? Here are some questions that could be asked of Attorney General John Ashcroft and FBI Director Robert Mueller:

•  Your request to the FCC said that broadband and VoIP companies may raise prices to "recover their CALEA implementation costs from their customers." How do you square higher prices with President Bush's speech in March calling for "affordable broadband" for all Americans?

•  Congress gave telephone companies $500 million to buy new equipment to comply with CALEA. Why should Internet companies not receive the same treatment? Is it because Verizon, SBC and the other former Bells have well-connected lobbying outposts in Washington, D.C.--but Vonage, 8x8 and other VoIP start-ups do not?

•  Skype CEO Niklas Zennstrom told me last fall that "we do not have any legal obligation to provide any means for interception" in his company's VoIP software. How will you force a company based in Luxembourg to insert backdoors in its software when it has no obligation to do so?

•  Even if Skype redesigned its software to satisfy the FBI, how would you stop its users from switching to a competitor that offered secure communications without back doors for police surveillance? Why would criminals, terrorists and other miscreants choose to use eavesdropping-enabled software if a secure option was available?

•  The FBI rarely gives up when it comes to demanding eavesdropping access. Your predecessors Louis Freeh and Janet Reno strong-armed Congress into approving CALEA on Oct. 7, 1994, one day before politicians left town for a fall recess. Capitol Hill is already considering VoIP regulation--will the FBI now ask Congress for regulatory power over peer-to-peer VoIP applications and instant messaging?

•  The popular SourceForge.net site lists dozens of free VoIP applications and programming libraries without FBI back doors. Fortunately for you, SourceForge.net is run by VA Software of Fremont, Calif., and is under U.S. jurisdiction. Should VA Software be permitted to continue distributing VoIP programs that don't guarantee access to the FBI?

•  Skype, PGPfone, and the still-incomplete GPGfone intentionally glue encryption into their VoIP applications to make them untappable. Your predecessor, Louis Freeh, lobbied Congress to ban strong encryption, and one House of Representatives committee agreed to his proposal in 1997. Will you pick up where he left off?

•  Conservative groups including Americans for Tax Reform, the Free Congress Foundation and the Rutherford Institute

Given that VoIP and instant-messaging clients aren't widely used yet, why not try the voluntary approach before talking about banning certain technologies?

warn that granting your requests would "drive up costs, impair and delay innovation, threaten privacy and force development of the latest Internet innovations offshore." These groups share President Bush's commitment to the war on terror and backed you, John Ashcroft, when your nomination to be attorney general was foundering in the Senate. When they suggest other ways to accomplish your stated goal of protecting America, might they be right?

•  Two of the FCC's five commissioners expressed reservations about the legality of extending CALEA to broadband and certain VoIP services. Commissioner Michael Copps warned: "If these proposals become the rules and reasons we have to defend in court, we may find ourselves making a stand on very shaky ground." Do you think that the FCC has the authority to extend CALEA to the Internet, given that Congress explicitly rejected that notion a decade ago?

•  You've been saying that terrorists may use VoIP services to "evade lawful electronic surveillance." But the only detailed court statistics available show that 77 percent of wiretap applications were for drug crimes, and terrorism-related offenses were so few they didn't even make the chart. Is terrorism the real reason behind your wiretap push?

•  The best figures available show that only 4 percent of wiretaps were targeted at computers and electronic devices last year, with the rest aimed at the traditional phone network. Vonage and other VoIP companies have pledged to work with you. Given that VoIP and instant-messaging clients aren't widely used yet, why not try the voluntary approach before talking about banning certain technologies?

•  American technology companies would like to help the FBI with legitimate investigations done under proper judicial oversight. But CALEA's requirements go hand in hand with the Patriot Act, which expanded the circumstances under which police may obtain wiretaps without a judge's prior approval. What assurances can you provide that the substantial powers you're seeking won't be abused?

Biography
Declan McCullagh is CNET News.com's chief political correspondent. He spent more than a decade in Washington, D.C., chronicling the busy intersection between technology and politics. Previously, he was the Washington bureau chief for Wired News, and a reporter for Time.com, Time magazine and HotWired. McCullagh has taught journalism at American University and been an adjunct professor at Case Western University.

More Perspectives

[trutkowski]

Inappropriate focus on U.S. and DOJ

Declan's well meaning article focuses on U.S. Federal action - fairly oblivious to the reality that the requirements exist worldwide to produce network forensic evidence for law enforcement authorities. Indeed, in most other countries, the current support controversies revolve around extensive data retention requirements, not real-time intercept capabilities which are rquired by all providers - Internet or otherwise in almost every country. The only exemption provided by the U.S. Congress pertains to narrowly defined "information services" - not the entire IP-enabled infrastructure. If there is any doubt, the CALEA supportive statements of essentially every congress person in recent hearings, makes that abundantly clear.

As is fairly evident in the comments filed in the CALEA proceeding, the primary benefactors are state and local authorities, rather than the large federal agencies.

Lastly, there are really no other viable solutions here other than to deploy the necessary capacity in the infrastructure - which is largely occurring anyhow for a plethora of network management and operations reasons - as well as the global LI requirements. The appropriate focus is on making LI implementations by government as trusted as possible through accountability and authentication mechanisms.

--tony

[Fray9]

But

Thats all well and good but I feel the main problem with the whole idea is that its severely outdated.

The only criminals going to get caught by this are the very few who are smart enough to use the technology but dumb enough not to use free and widely available encryption software with it to elude eavesdropping.

The only people who will be effectively watched by this program are the honest citizens.

Not to mention putting a backdoor in is just begging for trouble. The only reason unauthorized wiretapping isnt more common now is because the physical network makes it an expensive and complex endeavour.

Bring in the internet and suddenly youve got 14 year olds in china banging on the door. When one gets in then what? Suddenly we have recordings of the presidents private phone conversations with his wife posted on the internet?

Bet he'll be all for this idea then.

[fuzzyCWD]

Fahrenheit FBI

Not trying to sound like a conspiracy is going on, but isn't there?
I have been a regular reader of history and in all "ages", after the ruling parties have been ther long enough, the "people" need a guardian to protect them from thier "guardian".
I read in the paper and hear on the local news how this police officer committed these crimes or that governor did this, or, when the state was cutting public funding for services ot the elder, the same state was spending $1 Mill on a new office(not an office building, JUST ONE OFFICE).

[trutkowski]

conspiracies

Conspiracy theories are like religion. Believe what you will. However, a great many crimes are committed using communications media, and the collection of related forensic evicence when there is probable cause to obtain it, is a fundamental part of all legal systems worldwide. This is what the FCC action (and similar actions by counteless FCC equivalents in other countires) are dealing with.