Police and intelligence agencies are lobbying hard for means of snooping on internet-based telephony, arguing that they need them to catch criminals, reports Peter Warren
In numerous advertisements, you are encouraged to buy an internet phone so you can make free calls to friends. Meanwhile, a gaggle of online programs such as Skype boast of the boon of online calls: they’re free. But the UK’s top law enforcement agencies don’t see it the same way.
The Guardian has learned that police and security agencies have been lobbying ministers and senior officials, expressing fears about the potential for voice-over-internet-protocol technologies to hide a caller’s identity. Their aim? To get VoIP providers to monitor calls and find ways to identify who is calling whom – and even record them.
Though enforcement agencies say their main concern is VoIP’s inability to deliver a 999 service, sources counter that this is a smokescreen to cover police efforts to monitor calls and identify individuals – an agenda that becomes more credible in the light of submissions made by police to the communications regulator, Ofcom.
One document, sent to Ofcom on May 3 by Detective Superintendent Stuart Macleod, outlined the worries of the Data Communications Group – a police and industry liaison body that reports to the Association of Chief Police Officers (Acpo), Revenue and Customs, the Serious and Organised Crime Agency (Soca) “and other law enforcement agencies”.
“At present, law enforcement agencies have great difficulty in tracing the origin of VoIP calls,” wrote DS Macleod. “This poses significant threats to our democratic society and it is for this reason that the DCG believes that it must be mandatory for VoIP service providers to be required to retain adequate records in respect of calls made using this technology.
“Without these records, VoIP services will become the communication method of choice for criminals and terrorists, secure in the knowledge that their activities are untraceable by law enforcement agencies. If this situation is allowed to emerge because of inadequate regulation, then the DCG believes that … criticism of government and those responsible for implementing regulatory controls will be huge.”
Acpo’s submissions to Ofcom did not mince words, either, saying that Ofcom’s considerations about the impact of VoIP appeared to have overlooked the issue of “how law enforcement and the security services will be able to respond to the demands and expectations of the public and government to trace and identify those who seek to harm our citizens, and who may seek to use VoIP services to propagate their activities by hiding behind a cloak of virtual anonymity”.
DS Macleod says the DCG has “grave concerns” about the approach to regulating VoIP services and that these have been “largely ignored”.
Ofcom’s response: “Some of the issues raised are to do with privacy, and that is not within our ambit. Any application of the law in relation to peoples’ records should be addressed to the Information Commissioner. Ofcom is not able to propose, recommend or make decisions on personal records.” The Information Commissioner’s office said that because the directive is still with the government – specifically, the Home Office – it had no comment.
Since the emergence of the internet, the police and the government have wrestled with a technology that has eluded their best efforts to control it. Internet telephony has continued that trend.
Under the exchange-based telephony system, the location of a phone is pinned to a geographical address and a record that a phone call had taken place is stored centrally. But with the internet that is no longer the case.
The problem with VoIP, from a law enforcement perspective, is that it does not travel through an exchange. There is no simple way to catch the packets travelling over the internet, or even to link the 12-digit internet “IP addresses” between which a call travels online to any two people. Wireless routers can generate a one-time IP address that can be pinpointed to that wireless router, but – as in the case of a wireless hotspot – that will show only that the call was made from that router.
Attractive proposition
One Soca officer told The Guardian: “It’s another area where the technology has outstripped the legislation, the traceability and the powers that we have … You could buy a smart phone or PDA that’s wirelessly enabled that comes pre-loaded with £10 of wireless credit on it, download a program like Skype and then start making calls anonymously, and that’s got to be attractive to a criminal.”
New wireless phones, wireless-enabled smart phones and PDAs not only log on to Wi-Fi hotspots but make calls from any unlocked domestic wireless access point, making tracking them a nightmare. If they use a VoIP company they will at least leave a record of the IP addresses between which the call was made.
Yet instant messaging systems such as MSN, Skype and Yahoo, which communicate directly between computers, leave no central recording of an IP address – something technology experts say police should recognise as they seek to impose “traceability” on VoIP companies.
“Some of the concerns over points like emergency calls seem genuine,” said Dan Cole, the head of product portfolio for the internet service provider Thus, which offers VoIP services. “One of the benefits of VoIP is greater mobility: with regard to traceability we can search backwards and provide IP address data and find where a call came from, but it will mean storing a massive amount of data and providing access to that information and making it usable.
“But the big problem, and the one that people will have to face, is the free services like MSN and Skype and the fact that some providers are abroad and outside the UK’s legislative framework.”
It is on this issue that the VoIP industry is crying foul, claiming there is a confusion between a responsible UK VoIP industry, whose services are governed by domestic regulations, and the use of VoIP technology at a global level.
“It’s the very worst of all worlds,” said Colin Duffy, the chief executive of Voipfone, which specialises in VoIP services for business. “This is bolting the front door so that your friends can no longer get in just because you happen to have a key and it makes you feel safer, whilst leaving the back door open to the world.”
The problems do not end there. One issue the police do not appear to have considered, according to a former intelligence officer, is how to make a criminal case using the data they want held by VoIP companies, as they will also have to find the IP information on any machine they seize to prove the machine made the call. The law does not make clear which data the police will need to prove a phone call was made.
But not everything is going against the police. By 2010, internet telephony companies in the EC will be required by Directive 2006/24/EC to store details of internet phone calls, though not their content.
Location-based service
By 2009, BT’s 21st century network, developed in consultation with Ofcom and the government communications monitoring agency GCHQ, will be in place and will offer a full location-based service, though only for those using BT’s VoIP services.
However Matt Beal, BT’s director of Core Convergence and Capabilities for the new network, admits there is a need for a more far-reaching solution in the long term.
“This is a new world and what we are talking about here is the evolution of an environment. We as an industry are working on solutions at the moment.”
According to experts at BT’s Martlesham Heath research labs, the only real solution would be a complete overhaul of the routers that make up the internet backbone, an exercise they estimate will cost £1bn.
“The network was never designed with identity in mind. When it was set up it was for the free and easy exchange of data.”
The industry has pledged its cooperation. “In relation to security matters and traceability and emergency access, VoIP has tremendous opportunities to bring more features than are available under the old network. This is the new means of communication across the world and it bring a new promise; a knee-jerk reaction would not be the most sensible approach and might not help the industry, consumers or the police themselves,” said Eli Katz, chair of the Internet Telephony Service Providers Association.
Whether that will suffice to keep the police happy is unclear. It could be a long, uneasy summer for VoIP providers.
___________________________________________________________________________________________
Published 27th of July, 2006 – The Guardian under headline ‘Lifting the veil on internet voices’
