Simple Law Enforcement Monitoring

Transcription

1 Simple Law Enforcement Monitoring Fred Baker draft-baker-slem-architecture-01.txt ftp://ftpeng.cisco.com/fred/ietf/slem.ppt ftp://ftpeng.cisco.com/fred/ietf/slem.pdf

2 The message I wish had been found in many Raven messages I am not a lawyer I do not play one on TV

3 Lawfully Authorized Electronic Interception (LAES) Forensic investigation of specific persons or organizations Focuses on the crime/criminal being investigated Involves disclosure of a person's communications In most countries, the difference between voice and data communication is irrelevant

4 LAES in an Internet environment Who did they speak with? What did they say? Control Device: Call Manager, SIP Proxy, Authentication Server, etc Log Stream IP Control Traffic IP Data Control Mediation Warrant Intercept Configuration Data ACL Intercepted Information Intercepted Data Data Mediation

5 The legal mandate for Lawfully Authorized Electronic Interception

6 Current state of law Laws being worked on in western countries US CALEA and related laws European legislation resulting from legal normalization process Japan, Australia, and others 11 September attack used to push US legislation Cryptography limitations and export controls discussed during debate

7 EU Efforts Council of Europe-Convention on Cyber-crime Left to each country to implement requirements. Provides for mutual assistance among signing states Applies to public and private ISPs Requires ISPs to preserve communications data (e.g., origin, route, type of service) for up to 90 days and provide it to LEA. ISP must also provide for real-time collection or recording of traffic data and content for LEA. Open to EU members and drafters, including Canada and Japan

8 Overview of Electronic Surveillance Four fundamental types of requests: Past billing/statistical records of communications In telephone system, billing records Contents of computer long term storage Eg, search and seizure of computers and disk drives Current billing/statistical records of communications, desirable in real time In telephone system, pen register or trap and trace Delivery of content Content Intercept

9 Cybercrime Treaty, Article 20 Real-time collection of traffic data Each Party shall compel a service provider, within its existing technical capability, to: i. collect or record traffic data, in real-time, associated with specified communications in its territory transmitted by means of a computer system.

10 Cybercrime treaty, Article 21 Interception of content data Each Party shall a. b. i. ii. collect or record compel a service provider collect or record co-operate in the collection or recording of, content data, in real-time, of specified communications in its territory transmitted by means of a computer system.

11 CALEA wrinkles Communications Assistance for Law Enforcement Act Voice intercept mandated Features installed only for CALEA compliance subject to FBI funding Lack of capability cause for $10K/day fines Data intercept allowed for, especially Title III and FISA If an ISP has the capability, its use can be subpoenaed If it does not, an ISP must provide reasonable assistance to law enforcement (i.e., do what it can, or provide access to install LEA-owned equipment) to permit LAES

12 IETF Comments on the thrust of law

13 IETF Issues in Internet Privacy and Security IETF primary concern: Security of the infrastructure Two statements: RFC IETF Policy on Wiretapping RFC IAB and IESG Statement on Cryptographic Technology and the Internet

14 RFC 2804 on LAES Wiretapping... releases information that the information sender did not expect to be released. The system is less secure than it could be had this function not been present. The system is more complex than it could be had this function not been present. Being more complex, the risk of unintended security flaws in the system is larger. Wiretapping, even when it is not being exercised, therefore lowers the security of the system. RFC 2804

15 RFC 2804 major findings Six major considerations: IETF is wrong forum National definitions call for national standards IETF wants to maximize security LAES can already be accomplished Adding LAES to protocols adds complexity that reduces security Encryption is your friend LAES technology should be openly described

16 RFC 2804 will not statements IETF will not Take a moral position on LAES No consensus The IETF has decided not to consider requirements for wiretapping as part of the process for creating and maintaining IETF standards. Implications At minimum, the question that triggered Raven, IETF will not add LAES capabilities to unrelated protocols Complexity and security issues Perhaps, IETF will not standardize LAES technology

17 Approaches to LAES

18 Fundamental Requirements Need to identify traffic related to a surveillance subject and (somehow) report it Need to maintain secrecy of the intercept from subject and uncleared staff Need to audit the use of intercept technology

19 Mediation Device/Delivery Function Request (a1) IRI (d2) Request (c1) Authorization (a/c) Mediation Device Content (d1) IRI (HI2) CC (HI3) Authorization Mediation Device: Formats to countryspecific handover interface Delivers to LEA(s) Replicates for multiple taps on same target Filtering of CC and IRI, and may do Request for IRI & CC

20 Three fundamental approaches Fiber splitting All traffic sent to a service center for reporting Port Mirroring All identified traffic sent to a mediation device for reporting without protection Router/Switch data intercept All identified traffic sent to a mediation device for reporting with protection

21 Trade-offs in approaches Cost/Scalability of solution Integrity of data intercepted Security perimeter Ability to handle special cases Hairpin calls, Dial access, tunnels Definition of Call Identifying Information (IRI) IPFix records? Every IP header? IP+TCP?

22 PacketCable Architecture CMS = Proxy + Gate Controller for SIP = Call Agent + Gate Controller for Call Agent-Based (NCS) Authorization Interface Demarcation Point LEA LEA ICE CMS CDC Mediation Device LEA LEA COPS IP Network CCC CDC CCC LEA Intercept Subject INE MTA Cable RF Network MGC ICE MGCP MG INE PSTN CDC Channels use Radius COPS Common Open Policy Service Protocol (RFC 2748) CDC Call Data Channels (IRI) CCC Call Content Channels (CC)

23 PacketCable Architecture Configuration Commands Service Provider Voice: CMS/Call Agent, MGC and ER ICE Request (a2) Request (a1) IRI (d2) LI Administration Function (a/c) Mediation Device IRI (HI2) CC (HI3) LEA Collection Function Content (d1) Request (c2) INE COPS or MGCP RADIUS Event Messages Edge router Trunk Gateway

24 Cisco Service-Independent Intercept (SII) Data Intercept Service Provider AAA Server, CMS ICE RADIUS messages SNMPv3 Request (a1) IRI (d2) Request (c1) LI Administration Function (a/c) Mediation Device Content (d1) INE IRI (HI2) CC (HI3) LEA Collection Function UDP or RTP Nack Oriented Retransmission (RTP-NOR) Access Router, NAS Aggregation Router, MGW

25 Cisco SII - Voice Intercept Service Provider Call Agent, H.323 GK, SIP Proxy ICE PacketCable Event Message Request (a1) IRI (d2) Request (c1) LI Administration Function (a/c) Mediation Device Content (d1) INE IRI (HI2) CC (HI3) LEA Collection Function PacketCable UDP or RTP-NOR SNMPV3 CISCO-TAP-MIB

26 Cisco SII - Data Intercept ICE (e.g., AAA server) IRI Config Cmd 3 rd Party MD Court Order LEA Authenticate SNMPv3 Intercepted Data RTP-NOR Target Subscriber Edge Router (INE) Data Stream

27 PC Voice Intercept Edge/Aggregation Router Gatekeeper, SIP Proxy, Call Agent Admin IRI 3 rd Party Mediation Device Admin IRI CC Law Enforcement Agency Voice Packets SIP, H.323 or MGCPbased GW Call Control COPS Request Call Control Target Subscriber RTP Stream Aggregation Router Aggregation Router Customer Premise IAD

28 SII Voice Intercept Edge/Aggregation Router Gatekeeper, SIP Proxy, Call Agent Admin IRI 3 rd Party Mediation Device Admin IRI CC Law Enforcement Agency Voice Packets SIP, H.323 or MGCPbased GW Call Control SNMPv3 SET Call Control Target Subscriber RTP Stream Aggregation Router Aggregation Router Customer Premise IAD

29 PC Voice Intercept Trunk Gateway Hairpin Case Gatekeeper, SIP Proxy, Call Agent Admin IRI 3 rd Party Mediation Device Admin IRI IRI CC Law Enforcement Agency Call Forward to PSTN SIP, H.323 or MGCP-based GW Call Control MGCP Hair-pin case Voice Packets Call to Target PSTN Target Subscriber Gateway Forwarded Call

30 SII Voice Intercept Trunk Gateway Hairpin Case Gatekeeper, SIP Proxy, Call Agent Admin IRI 3 rd Party Mediation Device Admin IRI IRI CC Law Enforcement Agency Call Forward to PSTN SIP, H.323 or MGCP-based GW Call Control Hair-pin case SNMPv3 Voice Packets Call to Target PSTN Target Subscriber Gateway Forwarded Call

31 Simple Law Enforcement Monitoring Fred Baker draft-baker-slem-architecture-01.txt ftp://ftpeng.cisco.com/fred/ietf/slem.ppt ftp://ftpeng.cisco.com/fred/ietf/slem.pdf