November 30th, 2005 by Chandler Howell

According to a New York Times article, Security Flaw Allows Wiretaps to Be Evaded, Study Finds (full text from Interesting People mailing list, too),

The technology used for decades by law enforcement agents to wiretap telephones has a security flaw that allows the person being wiretapped to stop the recorder remotely, according to research by computer security experts who studied the system. It is also possible to falsify the numbers dialed, they said.

Someone being wiretapped can easily employ these “devastating countermeasures” with off-the-shelf equipment, said the lead researcher, Matt Blaze, an associate professor of computer and information science at the University of Pennsylvania.

“This has implications not only for the accuracy of the intelligence that can be obtained from these taps, but also for the acceptability and weight of legal evidence derived from it,” Mr. Blaze and his colleagues wrote in a paper that will be published today in Security & Privacy, a journal of the Institute of Electrical and Electronics Engineers.

A spokeswoman for the F.B.I. said “we’re aware of the possibility” that older wiretap systems may be foiled through the techniques described in the paper. Catherine Milhoan, the spokeswoman, said after consulting with bureau wiretap experts that the vulnerability existed in only about 10 percent of state and federal wiretaps today.

“It is not considered an issue within the F.B.I.,” Ms. Milhoan said.

I’m with the FBI on this one. This is a non-issue.

According to the research paper the story is based on, a person with the appropriate technology can disable some wiretapping systems. Mafia cypherpunk “Little Nikki” Scarfo notwithstanding, the people who traditionally are the targets of wiretaps (organized crime) are not the most technical of folks. They’re not stupid, however.

If someone suspects they are being wiretapped, they’re not going to try to mitigate the risk by implementing technology which only works some of the time. A countermeasure that’s less than 100% effective is completely useless when the cost of a breach is 10 to 20 with time off for good behavior.

Instead, they’re going to avoid the risk by shifting their communications to alternate, secure channels such as face-to-face meetings, messages hand-carried by trusted intermediaries, or even carrier pigeons.

This isn’t necessarily Mafia-specific, but since wiretaps have been used primarily as a law enforcement tool against organized crime, I limit my analysis to the mafioso’s perspective. While telephone intercepts have been used in some counter-terror operations overseas, but I couldn’t find any on-line evidence of their successful use in the United States.

- Posted in Security and Risk Management, Risk Management

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.




- Leave a Reply