Subject: RE: [Megaco] Legal Intercept using MEGACO

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 1 Mar 2002 08:34:17 -0500

I'm sorry, but this is highly unlikely to be true.
Unless the addresses, message sequences and parameters of 
trace and handover were identical - and handover happened on every
call to particular endpoints - it would be trivial to determine
that a call was being traced by examining sniffed messages.

I believe there is no way to support legal intercept with Megaco
(or MGCP or SIP or ...).  You either have to force routing of all
calls through a trace box, or something like the access router/switch
has to do the intercept.

Brian

> -----Original Message-----
> From: Christian Groves [mailto:[email-masked]]
> Sent: Thursday, February 28, 2002 6:23 PM
> To: Tom-PT Taylor
> Cc: [email-masked]'; [email-masked]'
> Subject: Re: [Megaco] Legal Intercept using MEGACO
> 
> 
> G'Day Tom,
> 
> Even with a message trace this is not necessarily the case if topology
> is being used for other things in the MG ie. handover.
> 
> Christian
> 
> Tom-PT Taylor wrote:
> > 
> > It can be done using the existing protocol.  To 
> discriminate between the two
> > directions of conversation, you need the topology 
> descriptor.  Brian Rosen
> > raised the point that someone doing a message trace on the 
> MG would be able
> > to tell that legal interception was happening.
> > 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]
> > Sent: Thursday, February 28, 2002 11:25 AM
> > To: [email-masked]
> > Subject: [Megaco] Legal Intercept using MEGACO
> > 
> > Hi All,
> >       Probably this has been discussed below, so if someone 
> can point me to
> > the
> > archive, it will help...
> >       My main query is whether legal intercept can be 
> supported using
> > existing
> > MEGACO protocol.
> >       This could be to support a Packet-based IAP or a circuit IAP
> > (Intercept
> > Access Point) depending
> >       on the deployment requirements. If the existing 
> MEGACO does not
> > support
> > this, then would a package
> >       help or would these be better done as modifications 
> to the base
> > protocol.
> > 
> > Thanks,
> >   Rohit Gupta
> >   www.hssworld.com
> > 
> > "DISCLAIMER: This message is proprietary to Hughes Software 
> Systems Limited
> > (HSS) and is intended solely for the use of the individual  
> to whom it is
> > addressed. It may contain  privileged or confidential 
> information  and
> > should
> > not be circulated or used for any purpose other than for what it is
> > intended. If
> > you have received this message in error, please notify the 
> originator
> > immediately. If you are not the intended recipient, you are 
> notified that
> > you
> > are strictly prohibited from using, copying, altering, or 
> disclosing the
> > contents of this message. HSS accepts no responsibility for 
> loss or damage
> > arising from the use of the information transmitted by this 
> email including
> > damage from virus."
> > 
> > _______________________________________________
> > Megaco mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/megaco
> > 
> > _______________________________________________
> > Megaco mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/megaco
> 
> 
> 
> _______________________________________________
> Megaco mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/megaco
> 

_______________________________________________
Megaco mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/megaco

---

From: "Kevin Boyle"<[email-masked]>
Date: Fri, 1 Mar 2002 12:45:12 -0500

If you encrypt all the messages, it shouldn't matter... unless the
surveilled party has access to the messaging from inside the MG, after
decryption takes place.

Kevin

-----Original Message-----
From: Rosen, Brian [mailto:[email-masked]]
Sent: Friday, March 01, 2002 8:34 AM
To: 'Christian Groves'
Cc: [email-masked]'; [email-masked]'; Taylor, Tom-PT
[CAR:B800:EXCH]
Subject: RE: [Megaco] Legal Intercept using MEGACO

Brian

---

From: "Kevin Boyle"<[email-masked]>
Date: Fri, 1 Mar 2002 12:45:12 -0500

Kevin

-----Original Message-----
From: Rosen, Brian [mailto:[email-masked]]
Sent: Friday, March 01, 2002 8:34 AM
To: 'Christian Groves'
Cc: [email-masked]'; [email-masked]'; Taylor, Tom-PT
[CAR:B800:EXCH]

Brian

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 1 Mar 2002 13:29:08 -0500

If you encrypt all messages between all elements involved, and there is no
discernable
message pattern that changes for intercept (for example, length of
messages), and
the addresses the messages are sent to don't change, then it might work.
Then again, if you do that, you might as well just drop a tap termination in
the context.
But you know what I think of topology, right?
 
I'd think that would be close to impossible to achieve in what most people
seem to be
thinking is the system architecture.
 
Now, if there is a tap box, and it has all the circuits running through it
(routed through it),
and the control channel is encrypted, and the control channel keeps
approximately
constant data rate, then you meet the terms of the CALEA law, and I think
that is
practical.   
 
We are getting dangerously close to prohibited speech here, but if every MG
had the capability to tap,
and all of the MGs were on a service provider network, and the tap channel
was encrypted
and had constant data flow (that is, it was filled with random data when no
actual data was
sent), and the Megaco link was encrypted, and it too had constant data flow,
then you can
make that work.  I think that the "all MGs are in the provider network" is
pretty hard to do.
 
If the access router (where all the MGs outside the network attach to the
service providers
network), and internal routers connected to internal MGs have tap
capability, and the
tap channel and tap control channels are encrypted and constant data rate,
that works,
and is very practical.  That's the way we need to do it I think.
 
Oh, and yes, it means tapping data is a law change away, sorry.
 
You can imagine a hybrid approach where the internal MGs had tap capability
and external
MGs tapped at the access router, but I think if you implement tap at the
router than you might
as well use that for the internal MGs.  YMMV.  
 
Now, if you want to use Megaco as the tap control protocol to the access
router, I think
that would be just fine.  No special capability is needed -- it's raven
compatible :)
although we might need a package.
 
Brian

-----Original Message-----
From: Kevin Boyle [mailto:[email-masked]]
Sent: Friday, March 01, 2002 12:45 PM
To: Rosen, Brian; 'Christian Groves'
Cc: [email-masked]'; [email-masked]'; Tom-PT Taylor
Subject: RE: [Megaco] Legal Intercept using MEGACO

Kevin 

-----Original Message----- 
From: Rosen, Brian [ mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Friday, March 01, 2002 8:34 AM 
To: 'Christian Groves' 
Cc: [email-masked]'; [email-masked]'; Taylor, Tom-PT 
[CAR:B800:EXCH] 
Subject: RE: [Megaco] Legal Intercept using MEGACO 

Brian 

> From: Christian Groves [ mailto:[email-masked]
<mailto:[email-masked]> ] 
> > From: [email-masked] [ mailto:[email-masked]
<mailto:[email-masked]> ] 
> > arising from the use of the information transmitted by this 
<https://www1.ietf.org/mailman/listinfo/megaco>  
<https://www1.ietf.org/mailman/listinfo/megaco>  
<https://www1.ietf.org/mailman/listinfo/megaco>  

_______________________________________________ 
Megaco mailing list 
[email-masked] 
https://www1.ietf.org/mailman/listinfo/megaco
<https://www1.ietf.org/mailman/listinfo/megaco>

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 1 Mar 2002 13:29:08 -0500

Brian

-----Original Message-----
From: Kevin Boyle [mailto:[email-masked]]
Sent: Friday, March 01, 2002 12:45 PM
To: Rosen, Brian; 'Christian Groves'
Cc: [email-masked]'; [email-masked]'; Tom-PT Taylor
Subject: RE: [Megaco] Legal Intercept using MEGACO

Kevin 

-----Original Message----- 

Brian

---

From: "Blatherwick, Peter" <[email-masked]>
Date: Sun, 3 Mar 2002 15:06:11 -0500

...  and, of course, all of the below tricky work could simply be stepped around by the bad guys building their own point-point over Internet app, using any darn encryption level they want, and avoid the entire gamut of CALEA approaches ...  .... oh, unless we ban internet architecture ...  
-- Peter

-----Original Message-----
From: Rosen, Brian [mailto:[email-masked]]
Sent: March 1, 2002 13:29
To: 'Kevin Boyle'
Cc: [email-masked]'
Subject: RE: [Megaco] Legal Intercept using MEGACO

If you encrypt all messages between all elements involved, and there is no discernable
message pattern that changes for intercept (for example, length of messages), and
the addresses the messages are sent to don't change, then it might work.
Then again, if you do that, you might as well just drop a tap termination in the context.
But you know what I think of topology, right?
 
I'd think that would be close to impossible to achieve in what most people seem to be
thinking is the system architecture.
 
Now, if there is a tap box, and it has all the circuits running through it (routed through it),
and the control channel is encrypted, and the control channel keeps approximately
constant data rate, then you meet the terms of the CALEA law, and I think that is
practical.   
 
We are getting dangerously close to prohibited speech here, but if every MG had the capability to tap,
and all of the MGs were on a service provider network, and the tap channel was encrypted
and had constant data flow (that is, it was filled with random data when no actual data was
sent), and the Megaco link was encrypted, and it too had constant data flow, then you can
make that work.  I think that the "all MGs are in the provider network" is pretty hard to do.
 
If the access router (where all the MGs outside the network attach to the service providers
network), and internal routers connected to internal MGs have tap capability, and the
tap channel and tap control channels are encrypted and constant data rate, that works,
and is very practical.  That's the way we need to do it I think.

You can imagine a hybrid approach where the internal MGs had tap capability and external
MGs tapped at the access router, but I think if you implement tap at the router than you might
as well use that for the internal MGs.  YMMV.  
 
Now, if you want to use Megaco as the tap control protocol to the access router, I think
that would be just fine.  No special capability is needed -- it's raven compatible :)
although we might need a package.
 
Brian

-----Original Message-----
From: Kevin Boyle [mailto:[email-masked]]
Sent: Friday, March 01, 2002 12:45 PM
To: Rosen, Brian; 'Christian Groves'
Cc: [email-masked]'; [email-masked]'; Tom-PT Taylor
Subject: RE: [Megaco] Legal Intercept using MEGACO

If you encrypt all the messages, it shouldn't matter... unless the surveilled party has access to the messaging from inside the MG, after decryption takes place.

Kevin 

-----Original Message----- 
From: Rosen, Brian [ mailto:[email-masked] <mailto:[email-masked]> ] 
Sent: Friday, March 01, 2002 8:34 AM 
To: 'Christian Groves' 
Cc: [email-masked]'; [email-masked]'; Taylor, Tom-PT 
[CAR:B800:EXCH] 

Brian 

> From: Christian Groves [ mailto:[email-masked] <mailto:[email-masked]> ] 
> > From: [email-masked] [ mailto:[email-masked] <mailto:[email-masked]> ] 
> > https://www1.ietf.org/mailman/listinfo/megaco <https://www1.ietf.org/mailman/listinfo/megaco>  
> > 
> > https://www1.ietf.org/mailman/listinfo/megaco <https://www1.ietf.org/mailman/listinfo/megaco>  
> 
> 
> 
> https://www1.ietf.org/mailman/listinfo/megaco <https://www1.ietf.org/mailman/listinfo/megaco>  
> 

_______________________________________________ 
Megaco mailing list 
[email-masked] 
https://www1.ietf.org/mailman/listinfo/megaco <https://www1.ietf.org/mailman/listinfo/megaco>

---

From: "Blatherwick, Peter" <[email-masked]>
Date: Sun, 3 Mar 2002 15:06:11 -0500

-----Original Message-----
From: Rosen, Brian [mailto:[email-masked]]
Sent: March 1, 2002 13:29
To: 'Kevin Boyle'
Cc: [email-masked]'
Subject: RE: [Megaco] Legal Intercept using MEGACO

 

 

Brian

-----Original Message-----
From: Kevin Boyle [mailto:[email-masked]]
Sent: Friday, March 01, 2002 12:45 PM
To: Rosen, Brian; 'Christian Groves'
Cc: [email-masked]'; [email-masked]'; Tom-PT Taylor
Subject: RE: [Megaco] Legal Intercept using MEGACO

Kevin 

-----Original Message----- 
From: Rosen, Brian [ mailto:[email-masked] <mailto:[email-masked]> ] 
Sent: Friday, March 01, 2002 8:34 AM 
To: 'Christian Groves' 
Cc: [email-masked]'; [email-masked]'; Taylor, Tom-PT 
[CAR:B800:EXCH] 

Brian