Feeds

Secure phones no obstacle to wiretapping – US Govt

Uncommonly ineffective

  • alert
  • submit to reddit

High performance access to file storage

The use of so-called secure telephones presents almost no barrier to wiretapping, according to official US government documents.

This interesting revelation is contained in a recent report on Applications for Orders Authorizing or Approving the Interception of Wire, Oral, or Electronic Communications).

The report (pages 10-11 of report or 8-9 of PDF) states:

Public Law 106-197 amended 18 U.S.C. 2519(2)(b) in 2001 to require that reporting should reflect the number of wiretap applications granted in which encryption was encountered and whether such encryption prevented law enforcement officials from obtaining the plain text of communications intercepted pursuant to the court orders.

In 2002, no federal wiretap reports indicated that encryption was encountered. State and local jurisdictions reported that encryption was encountered in 16 wiretaps terminated in 2002; however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.

In addition, state and local jurisdictions reported that encryption was encountered in 18 wiretaps that were terminated in calendar year 2001 or earlier, but were reported for the first time in 2002; in none of these cases did encryption prevent access to the plain text of communications intercepted.

Bruce Schneier, the noted cryptographer, deduces from the report that encryption of phone conversations (only encountered in sixteen out of 1,358 wiretaps, so very uncommon) is ineffective at concealing conversations.

"Every time law enforcement encountered encryption, they were able to bypass it," Schneier writes.

"I assume that local law enforcement agencies don't have the means to brute-force DES keys (for example). My guess is that the voice encryption was relatively easy to bypass," he adds.

Schneier argues that the apparently weak security of secure phones is best explained by a lack of peer review.

"Telephone security is a narrow field. Encrypted phones are expensive," he writes in Cryptogram, his excellent monthly newsletter.

"Telephone encryption is closed from scrutiny; the software is not subject to peer review. It should come as no surprise that the result is a poor selection of expensive lousy telephone security products."

Schneier extends his argument beyond the narrow confines of telephone security to criticise the closed security approach (hello TCPA!) in general.

"This wiretapping report provides hard evidence that a closed security design methodology - the 'trust us because we know these things' way of building security products - doesn't work," he concludes. ®

External Links
Report of the Director of the Administrative Office of the United States Courts on Applications for Orders Authorizing or Approving the Interception of Wire, Oral, or Electronic Communications (quite a mouthful)
Schneier's essay on secrecy and security

Related stories
Open and closed security are roughly equivalent
Linus Torvalds blesses DRM, and nothing happens
Of TCPA, Palladium and Wernher von Braun

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.