Leading Security Experts Say FBI Wiretapping Proposal Would Undermine Cybersecurity

Today, a group of 20 of the world’s preeminent experts in computer and network security released a report warning that an FBI proposal to modify Internet services to make them wiretap friendly would open major security holes, and that criminals would easily circumvent the wiretap capability that would have to be built in.

This security “dream team” brings deep expertise and experience in:

• Design and implementation of secure communications software
• Cryptographic algorithms and protocols
• Computer security and security engineering
• Surveillance and associated risks
• Building communication tools for highly-adversarial contexts

The report comes on the heels of recent stories from The Washington Post and The New York Times describing the FBI wiretap proposal. The proposal would extend technical design mandates for “wiretap readiness” to peer-to-peer communications tools. According to reports, companies that do not comply with a wiretap order, including those that cannot comply because they have configured their communication service in a secure manner and do not themselves have access to user communications, or do not have access to such communications in unencrypted form, would face escalating, potentially ruinous fines. The threat of such liability would effectively force re-engineering of communications services so they are wiretap ready.

The experts’ report focuses on peer-to-peer communications tools that allow direct communications between users – essentially, peer-to-peer “endpoints.” The FBI has complained for years that peer-to-peer communications, including VoIP, video and text communications, are difficult for it to wiretap. These communications travel directly from computer to computer, and are often encrypted end-to-end. (VoIP communications that can call into the public telephone system are already covered by CALEA mandates as a result of a previous FBI demand effectuated through an FCC proceeding.)

The report makes three main points about the FBI proposal. First, wiretap functionality allows covert access to communications that can be exploited not only by law enforcement, but by criminals, terrorists, and foreign military and intelligence agencies. Wiretap endpoints will be vulnerable to exploitation and difficult to secure. Second, imposing the obligation to facilitate wiretapping on software developers forces them to choose between two dangerous, expensive, cumbersome options: they can either create a compliance department capable of responding 24/7 to law enforcement demands, or they can show personnel in law enforcement agencies world wide how to exploit their software to harvest user communications. Finally, the wiretap capability that the FBI seeks will be ineffective because it is easily disabled and because knock-off products that lack the wiretap functionality can be readily downloaded from websites abroad. Because many of the tools that people use to communicate are built on open standards and open source software, it will be trivial to remove or disable wiretap functionality.

The report concludes:

The FBI’s desire to expand CALEA mandates amounts to developing for our adversaries capabilities that they may not have the competence, access or resources to develop on their own. … We believe that on balance mandating that endpoint software vendors build intercept functionality into their products will be much more costly to personal, economic and governmental security overall than the risks associated with not being able to wiretap all communications.

That’s strong language. We hope the Administration and Congress take heed when they consider the FBI’s CALEA II proposal.