Lawful Hacking: Using Vulnerabilities to Wiretap Internet Communications

25 Mar
Wednesday, 03/25/2015 10:30am to 11:30am
Seminar

Susan Landau
Worcester Polytechnic Institute
Social Science and Policy Studies

Marston 132

Faculty Host: Brian Levine

For years, legal wiretapping was straightforward: the officer doing the intercept connected a tape recorder or the like to a single pair of wires. The changing structure of telecommunications and new technologies such as ISDN and cellular telephony made executing a wiretap more complicated for law enforcement, and such simple technologies would no longer suffice. In response, the US passed the Communications Assistance for Law Enforcement Act  (CALEA), which required  that wiretapping capabilities be built into digital telephony switches. (Europe has similar requirements.)  With new real-time communications technologies using packet-switching technologies, law enforcement has claimed it is "going dark." Several years ago, the FBI proposed changes in wiretap laws to require a CALEA-like interface in Internet software.

By requiring an architected security breach, such a "solution" would, in fact, create a great insecurity in all communications technology.  I will present an alternative, namely using current vulnerabilities in order to wiretap.  In this talk, I will discuss the technology issues and policy implications.

This represents joint work with Steve Bellovin, Matt Blaze, and Sandy Clark.

Bio:

Susan Landau is Professor of Cybersecurity Policy at the Worcester Polytechnic Institute Department of Social Science and Policy Studies, where her research focuses on communications security and surveillance, critical infrastructure protection, identity, and privacy. Landau is the author of Surveillance or Security? The Risks Posed by New Wiretapping Technologies (MIT Press, 2011) and co-author, with Whitfield Diffie, of Privacy on the Line: The Politics of Wiretapping and Encryption (MIT Press, 1998, rev. ed. 2007). She has testified to Congress on security risks in wiretapping and on NIST's Cybersecurity Activities. Landau has been a senior staff Privacy Analyst at Google, a Distinguished Engineer at Sun Microsystems, a faculty member at the University of Massachusetts at Amherst and Wesleyan University and has held visiting positions at Harvard, Cornell, Yale, and the Mathematical Sciences Research Institute. A 2012 Guggenheim fellow and 2010-2011 fellow at the Radcliffe Institute for Advanced Study, Landau is the recipient of the 2008 Women of Vision Social Impact Award, and is also a fellow of both the American Association for the Advancement of Science and the Association for Computing Machinery.