IP Convergence: Beyond VoIP, Beyond Cost Savings

For those not in the know, CALEA is the Communications Assistance for Law Enforcement Agencies – meaning it’s all about getting the bad guys.  There are many facets to the law and one can learn more at Ask CALEA.  A big part of helping the cops is “tapping” or “snooping” on the evil-doers’ phone calls.  Here’s the thing – VoIP and the entire “Converged” model of communications makes it more difficult to tap these calls.  I don’t believe that I am going out on a limb here, or telling anyone what they don’t already know.  It’s more that I am reinforcing some preconceived notions.

Tapping VoIP calls is more difficult than TDM calls for one simple reason: VoIP is a connection-oriented application (voice) using a connection-LESS medium (IP) as transport.  As a result of using a connection-less medium, the transport path can’t be safely assumed.  There’s no deterministic route that everything to or from an “evil-doer” traverses. Without that knowledge, where do you “tap”?  One option would be to “tap” every possible path that communications could take, but the cost involved with that is astronomical.  The other option is to ensure deterministic routing, or force routing in a way that makes thing “interceptable”. This problem starts lessening the closer to the intercept target the tap is placed, but there are still use cases where communications are "load-balanced" across multiple broad-band communications, say both cable and DSL broadband access to a home.  One could easily setup routing to use both networks simultaneously.  For me, this would mean that Time Warner would get half of my conversation, and my DSL provider (Frontier) would get the other half. 

So now for some outstanding questions that linger in my mind on CALEA:

- What about SKYPE or other peer-to-peer communications?  How is that addressed by the govt and LEAs?
- Is it beyond comprehension that sRTP (encrypted media) might be outlawed by our govt because it’s not “interceptable”?
- To what extent are equipment and software vendors held accountable to create “interceptable” flows?  If it’s mandated by our govt, then what’s preventing them from moving and setting up shop in a country that doesn’t have such regulations?
- Do the rules apply to “on-net” call flows where the PSTN is not involved at all?  

The bad-guys and evil-doers, especially the more sophisticated ones, are going to use cryptography, encrypted tunnels and encrypted peer to peer communications as well – so this begs the question – is all the trouble, expense and hassle worth it? Is it even plausible?

Adam “voiploser” Uzelac