Feeds

Microsoft patent points to Skype snooping

Just what the government ordered

Combat fraud and increase customer satisfaction

A new Microsoft patent points towards Skype becoming equipped for lawful interception, which could be important as the service grows up to challenge traditional telcos.

The patent was filed back in 2009, but published* last week and picked up by Computerworld. Titled "Legal Intercept", it covers one way in which a VoIP-based communications system might enable a call to be intercepted and covertly recorded, naming Skype as one of the services to which it could be applied.

Microsoft bought Skype back in May, but only received approval for the deal in June – so hasn't had much time to do anything with the VoIP leader. Skype is hugely successful, with 170 million registered users, but it's been very secretive about its protocols and security, refusing interoperability and asking users to just trust in Skype for their security.

That won't wash in the real world, and neither will denying governments the right to listen in on their citizens. Most of us accept that security forces need to occasionally tap into phone lines, hopefully with suitable judicial oversight, but Skype's apparent reluctance to permit such taps has resulted in rumours of secret deals and government-backed attacks on the cryptography used to protect Skype calls.

The patent describes how client, or network, software can be surreptitiously alerted that incoming and/or outgoing calls are to be monitored for a specific user. Such calls are then copied (packet by packet) to the monitoring server without the user being aware. The patent suggests the interception software could be placed in a NAT or router, but also incorporated into the VoIP client itself.

India has made it clear that Skype risks being kicked out of the country unless it sorts out some sort of lawful intercept capability, and other countries will be quick to follow India's lead. So if Microsoft wants to see Skype spreading around the world then it will need to have just what's described in the Legal Intercept patent.

Citizens aghast that their VoIP calls could be intercepted might be annoyed, but they'd be better off petitioning their governments, rather than raging against the companies trying to obey the law. ®

* That's "published", not "granted" as we earlier stated - our mistake.

SANS - Survey on application security programs

More from The Register

next story
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.