Feeds

Skype crypto stumps German cops

Police boss attempts to justify Trojan plan

Security for virtualized datacentres

German police have expressed frustration about their inability to decipher the encryption used by Skype in order to tap into the VoIP calls of suspected terrorists.

Lawful interception (or wiretapping) of telephone calls has happened since before the time of rotary phones. In many countries, telecos must promise to allow wiretapping to be granted a license. VoIP services provided by software firms independent of ISPs complicate this picture.

"The encryption with Skype telephone software... creates grave difficulties for us," said Joerg Ziercke, president of Germany's Federal Police Office (BKA) at an annual gathering of security and law enforcement officials. "We can't decipher it. That's why we're talking about source telecommunication surveillance - that is, getting to the source before encryption or after it's been decrypted."

Ziercke's comments are an attempt to justify controversial German plans, yet to be legally approved, to develop "remote forensic software" (AKA a law enforcement Trojan). Proposals to give explicit permission for law enforcement officials to plant malware stem from a Federal Court ruling earlier this year declaring clandestine searches of suspects' computers to be inadmissible as evidence, pending a law regulating the practice.

The idea of a law enforcement Trojan has sparked a fierce civil liberties debate, as well as objections from the IT security community. German police are reportedly looking to hire two "specialists" to develop "white hat" malware. Ziercke's comments provide an insight into the sort of capabilities, such as capturing the raw output of microphones on compromised PCs, that these law enforcement Trojans ought to have.

Ziercke told reporters that it was not asking Skype to divulge its encryption keys or leave "back doors open" for law enforcement authorities, arguing that such requests would leave the eBay-owned VoIP firm at a competitive disadvantage to other services. "There are no discussions with Skype. I don't think that would help. I don't think that any provider would go for that," he said.

Beginner's guide to SSL certificates

Next page: Uncrackable Skype?

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.