Schneier on Security

Clive Robinson • January 23, 2014 11:46 PM

@ BJ,

The question is… Will Micro$haft breaking ranks be just a crack in the dam, that can be repaired, or a major breach leading to a total dam burst?

Hopefully the latter, but I suspect the bought legislators will try to patch it up with a typical bodge job.

I know some people will claim it’s the equivalent of “Barbarians at the gates of Rome” to imply it will cause “the colapse of the American Empire” and thus “American Society” but on looking you will find they have vested interests or hope to curry favour with those who do.

I’m wondering just what sort of influance Bill Gates is regaining over MS, after all from his point of view his name is still intermately linked to it, thus he’s bound to be upset about how things are currently playing out.

Clive Robinson • January 24, 2014 12:30 AM

@ BJ,

Does the switch to digital video signaling make capturing the signal easier or harder?

Traditionaly you would look for a “serial signal” with high frequency content and either the analog video signal or CRT gun signal was the favourit to go for.

This was due in part to the fact that parellel data signals effectivly only radiated noisy avarages that were at best a “majority vote”. However parellel data buses have fallen out of fasion for various technical reasons so serial is back but at several magnitudes of order increase in clock speed. And worse for the evesdropers the serial data on the cable is starting to be either compressed or differance data thus removing the advantage of averaging.

Further work started at the UK Cambridge Computer Labs has gone into removing high frequency content in analog images.

Thus I suspect that “illuminating the cables” is becoming a thing of the past.

The question is what’s going to replace it…

You have to view the likes of the NSA, GCHQ, et al like “Drug Addicts”, you make heroin unavailable and they will find an alternative opiate to get their fix, rather than face the pain and loss of withdrawal. In fact as with Drug Adicts the loss is likely to push their aggression and criminality buttons hard to societies cost.

So to predict what they will do you have to start thinking like them and the thoughts you have are not nice, even when for you they are just theoretical and to others apparently paranoid.

So where to start on the “paranoid thinking” well for non contact systems you want to find a clear serial signal with low bandwidth or significantly repeated data such that averaging will buy you an advantage.

If you can not find one then you have to start thinking about contact systems such as either bugs or implants. In the case of bugs they need to be both easy to fit and covert which is going to be difficult with modern technology.

So you start thinking of implants at the design, manufacture or supply chain stages. And it’s here where traditional and mass surveillance differ. Anything done in design or manufacture stages is going to enable mass surveillance the supply chain less so.

The easiest and cheapest and potentialy the most covert way is to build something into standards or licencing requirments, which is where I would start.

Clive Robinson • January 24, 2014 8:18 AM

@ 65535,

With regards the bit you quote,

Illegal or unauthorized telephone tapping is often a criminal offense. However, in certain jurisdictions such as Germany courts will accept illegally recorded phone calls without the other party’s consent as evidence

It’s actually conflating two seperate legal issues,

1, The legality of intercepting common carrier traffic.
2, Getting consent to record the specific traffic.

It is perfectly legal to connect recording equipment to a telephone line “behind the demark” providing the equipment is type approved under the prevailing legislation in the juresdiction. That is as the owner of the property or one who holds title on it you may connect to the telephone line even if you are not the person paying for the service, likewise you can engage an agent to do the work for you. Further use of a phone pair is not considered exclusive to a person paying for a service, otherwise various shared/party lines etc would be illegal for the service supplier or others to operate.

Now having quite legaly placed a recording device on the line there is a thorny issue of what is and is not “presumed consent” with another party or parties, and this gets very very complicated depending on if you are the first party (initiating the call) the second party (terminating the call) or a third party (evesdropping on the call).

As the first party you are supposed to inform the second party that you are making a recording (as opposed to making a record) of the conversation prior to it starting and at regular points within it. That is there is no presumed consent for an audio recording but there is for you making a personal written record…

Likewise similar rules apply to the second party which is why you get that automated message about “calls are recorded for training purposes”. Basicaly it translates to “we are going to record the call wether you like it or not, we will play it to who ever we chose when ever we chose, but you have no rights to a copy at all even in the event of legal action”. BUT the fact they are recording does not give you consent to also record the call for training or other purposes without notifing them (though you are still free to make a record).

Now as a third party you again have no presumed consent to record a call but you can if you “chance” to hear the call make a record (Parellel Construction anyone?). However as a third party you can gain contractual consent, that is as the service provider you put it in the T&Cs and as the person with title to a property you can put it in a lease or tenancy agremment, likewise with shared service it will be in the contract small print probably under “technical” or “repair/servicing” terms.

Now there is a big fat loop hole of a legal get out for making audio recordings without gaining consent. Remember you are alowed to make a written record of the call. The law says nothing about how you arive at that written record… Thus whilst it’s not permissable to make an audio recording for evidentiary purposes, it is permissable to do it as an “aid memore” for making a contempranious written record or transcript. The law does not say what you can or cannot do with this aid to your memory after you have made and checked your written record.

Thus if you go to court and you present your written record as evidence (which is legal) the other party can chalenge it (and probably will) you maintain it’s accurate and that they are wrong. If the other party is a chancer they will press you as to why you belive that to be true and you simply say “because I checked carefully”… Now at this point if the other parties council is an idiot they will make further enquires. If they don’t the judge may well or your own council will under re-examination. It’s then you say how you checked importantly saying of the recording “to use as an aid memore” but don’t say “I’ve still got the audio recording” untill you are asked to which you simply say “yes” and if you are then asked as you probably will be why you did not include it in the evidence submition you simply say “I was under the impression that the evidence submission was only for my written records”. At this point it’s game over because if the judge does not ask to hear the tape as confirmation they have to accept the written evidence as fully factual not doing so and ensuring that the jurry understands this point is probable grounds for appeal should the final judgment go against you.

As always it’s not what you do or how you do it, but how you present it at the appropriate time…