CIO —
U.S. government efforts to require most voice-over-IP (VoIP) providers to permit law enforcement agencies to wiretap phone calls could introduce new cybersecurity problems to the Internet, a group of Internet security experts said Tuesday.
A U.S. Federal Communications Commission (FCC) rule requiring VoIP providers to allow wiretapping by May 2007 would either require a massive re-engineering of the Internet or introduce broad security risks, said authors of a new study released by the Information Technology Association of America (ITAA), an IT vendor trade group.
In addition, the requirements would stall Internet innovations in the United States by adding hundreds of thousands of dollars in setup and maintenance costs to VoIP providers and potentially to other Internet applications that provide voice services, including instant messaging and online games, according to the study.
The study, co-authored by several people including TCP/IP co-creator Vinton Cerf and former U.S. National Security Agency encryption scientist Clinton Brooks, comes days after a U.S. appeals court upheld the FCC’s VoIP wiretapping rules. On Friday, the U.S. Court of Appeals for the District of Columbia upheld the ruling, requiring that VoIP providers offering a substitute for traditional telephone service comply with a 1994 telephone wiretapping law called the Communications Assistance for Law Enforcement Act (CALEA).
The FCC did not immediately respond to a request for comment about the ITAA study. But on Friday, FCC Chairman Kevin Martin said allowing law enforcement wiretapping of VoIP calls is of "paramount importance" to U.S. security.
Tracking VoIP calls would be more difficult than tracking calls on the traditional telephone network, because VoIP providers have little control over how their calls are routed across the Internet, said Whitfield Diffie, chief security officer at Sun Microsystems. VoIP providers "have no special Internet privileges" to control traffic, said Diffie, one of the study’s authors.
VoIP wiretapping would require law enforcement to have access to both customer data from the VoIP providers and real-time tracking of calls routed across the Internet, he said. Requiring ISPs to respond in real-time to requests for them to record VoIP calls would open up the Internet to new vulnerabilities, he added.
"You find yourself in a technologically very, very complicated problem," Diffie added. "It’s not inconceivable that a system of that kind could be built. You have a magnitude of vulnerability. I can’t think of any parallel in any system we’ve seen so far."
Such a wiretapping system would require a "major research and development effort" in order to reduce security vulnerabilities, he added. In addition, it would be difficult to apply the FCC wiretapping rules to VoIP calls worldwide, he said.
