Subject: Re: how to do wiretaping , what streams and topology is needed

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 1 Feb 2001 09:56:40 -0500

I think you have a reasonable way to do wiretapping in your
proposal.  Your concern about "mixing" is correct.  Basically,
if you have to deliver a one-way audio stream which is the
sum of a two way stream (i.e. tap both sides of the call), then
you need a real mixing function.

You also need to allow a 3 termination context, which also
implies mixing.  The function is actually the same, with the
one way restriction making it a little easier.

I'll note that this mechanism would only work (at least in this
country) on a gateway that was in a customer premises,
because it would be easy to observe the message sequence
difference between a tapped and an untapped call.  Of course it
would work on a "trunk" gateway that was in the service provider's
premises.  Since it won't work in the general case (i.e. unless
all calls went through the trunk gateway), I wonder if it is
useful enough to worry about.

Brian

> -----Original Message-----
> From: Shlomo Kabaz ECItelecom [mailto:[email-masked]]
> Sent: Thursday, February 01, 2001 7:45 AM
> To: [email-masked]
> Subject: how to do wiretaping , what streams and topology is needed
>
>
> Hi  list  !
>
> I  read the relevant  history mail regarding streams, topology and
> wiretaping and could not find
> the complete answer to my problem which is :
>
> I  have  tow terminations in a context , T1  and T2  , and i
> constructed a
> full regular call on them , T1 is physical
> and T2 is ephemeral .   In  both terminations there is one
> stream which has
> the default streamId = 1 , and both
> stream in both terminations are set to send/receive mode .
>
> I want  to do wiretaping to that call , I understand that i
> have to do the
> following :
>
> 1. add a new ephemeral termination to the context that will send the
> wiretaped stream out of the gateway.
> 2. send a topology descriptor that will tell : T1,T3, oneway .
> T2,T3,oneway .
> 3. do not add new streams to T1 and T2 .
>
> Is that correct and  can you add this scenario to the "call
> flows" that is
> being talk about .
>
> Another issue that  trabbled me a bout the wiretaping is this:
> Actually , when the  tow people  are talking in the call that
> i mentioned ,
> termination T1  with T2 , the flows of data ,
> is going in bothways , meaning send and receive , to the
> people talking ,
> and if for instance the man from one side
> talk at the same time with the man from the other side than ,
> each of them
> receives rx flow  tx flow at the same time ,
> and the "conferecing"  funtionality is doen in the people minds .
> So my question is : Is wiretaping to this call , even with
> tow terminations
> , needs confferecing functionality ??
>
> best regards !
>

---

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 1 Feb 2001 10:36:27 -0500

See my earlier reply.  I don't think you can tap at the gateway,
so I don't think it matters.  You have to create a circumstance where
the customer is not aware of tapping.  Therefore, no message sequence
can be different with a tap then without.  This rules out tapping
at any MG on a customer premises.  It also rules out a "tap box"
(ie connect the tappee to the tap box and the tap box to the
other end, or mix the tap box with an end).  It means that the box
with the tap hardware has to always be in the path of the media
stream, but not at the end (at least not at the end in a customer
premises).  I claim the obvious place is the access router.

I'll note that this discussion may get us in trouble with the privacy
zealots, who succeeded in creating a rule in the IETF that no feature
used solely for wiretap would be permitted.

Brian

> From: Tom Taylor [mailto:[email-masked]]
> Sent: Thursday, February 01, 2001 9:45 AM
> Subject: Re: how to do wiretaping , what streams and topology
> is needed
>
>
> I maintained during the wiretapping debate that you didn't
> need topology
> to do it.  In fact, if there is modem traffic or if the MG
> can't (as you
> postulate in your final question) mix the two directions of
> traffic, you
> really need to add TWO wiretapping terminations to the context and use
> topology to direct the flow from each participant separately
> to its own
> wiretap.  In some cases the legal authorities are entitled to
> hear only
> one side of the conversation, in which case there would just be one
> wiretap termination.
>
> I have to apologize to Christian for not pushing to make topology a
> compulsory part of the spec.  I think people will find it is
> compulsory
> in the real world.
>
> Shlomo Kabaz ECItelecom wrote:
> >
> > Hi  list  !
> >
> > I  have  tow terminations in a context , T1  and T2  , and
> i constructed a
> > Actually , when the  tow people  are talking in the call
> that i mentioned ,
> > talk at the same time with the man from the other side than
> , each of them

---

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 1 Feb 2001 11:42:27 -0500

Sure, and that would work, but how many operators would accept a solution
that
was as limiting as that, in preference to solving it in a way that works as
you get
to residential gateways on one or both ends?  I think that solutions that
only work
when both ends are Access or Trunk gateways will fail in the face of forward
thinking
solutions that work for a wider range of networks.  After all, the trunk and
access
gateways wouldn't have to change in any other way to expand to residential
GWs.

Brian

-----Original Message-----
From: Tom-PT Taylor [mailto:[email-masked]]
Sent: Thursday, February 01, 2001 11:27 AM
To: [email-masked]
Subject: Re: how to do wiretaping , what streams and topology is needed

The most likely case where you could have a gateway doing the tap is where
the MGC and MG are both on telco premises (i.e.) the MG is replacing a more
traditional line peripheral serving analogue or ISDN lines.

> From: Rosen, Brian [ mailto:[email-masked]
<mailto:[email-masked]> ]
> Sent: Thursday, February 01, 2001 10:36 AM
> To: Taylor, Tom-PT [NORSE:B901:EXCH];
> [email-masked]
> Subject: RE: how to do wiretaping , what streams and topology
> is needed
>
>
> > From: Tom Taylor [ mailto:[email-masked]
<mailto:[email-masked]> ]

---

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 1 Feb 2001 12:14:13 -0500

Sure, but you are then assuming there are no cases of a
wiretap within the net, and specifically, where one end
has a device on the customer premise.  The wiretap rules
apply uniformly (CALEA arguments about DATA SERVICES
not withstanding).

Actually, the PSTN already has all the wiretap it needs,
there is no really good reason to tap in the TGW except
that the LEA might have the order issued to the provider
that had the TGW rather than the provider that has the PSTN.
But, as I said, it's not a good idea to start building tap
capability into any GW because you can't put it in all GWs.
We have to put the tap somewhere else.  Get used to the idea!

Brian

> From: Chandrika Nair [mailto:[email-masked]]
> Sent: Thursday, February 01, 2001 11:52 AM
> A trunking gateway may have to do wiretap when a call is forwarded
> offnet(to the PSTN).
>
> Chandrika.
>
> > Tom-PT Taylor wrote:
> >
> > The most likely case where you could have a gateway doing the tap is
> > where the MGC and MG are both on telco premises (i.e.) the MG is
> > replacing a more traditional line peripheral serving
> analogue or ISDN
> > lines.
> >
> > > From: Rosen, Brian [mailto:[email-masked]]
> > > > I have to apologize to Christian for not pushing to
> make topology
> > a
> > > > > and the "conferecing"  funtionality is doen in the
> people minds
> > .

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 5 Feb 2001 09:30:16 -0500

IF that was true, and there was NO hint in the sequence that could be used
to discern that tapping was taking place, then it might be legal.
For example, you would need to use the topology descriptor the same way
at the beginning of every call, and you would always need to have two
streams (the real one, and the potential tap one) out of the MG at all
times.  I suspect that such ideas are not viable, but YMMV.

In most of the systems I'm familiar with, topology is not used at all.
Even handover doesn't need topology, especially considering you want
make-before-break results.

Brian

> From: Christian Groves [mailto:[email-masked]]
> Sent: Sunday, February 04, 2001 6:23 PM
> G'Day Brian,
> Topology is a general purpose mechanism. A change of sequence
> and use of
> topology could be from a number of services or mobile interactions ie.
> handover. So just because there's a topology descriptor doesn't mean
> you're being tapped. If we'd called it "hey I'm tapping you"
> descriptor
> then I think we should be concerned.
>
> Cheers, Christian
>
> "Rosen, Brian" wrote:
> >
> > Please explain how you could use topology to control
> > tapping without having any observable difference in
> > the Megaco message sequences when a tap was ordered.
> > There is no doubt that you can use it if you don't
> > care what the message sequences are, but of course
> > you don't need to use topology to do that, the
> > termination for the tap could simply be defined to
> > be one way -- it will be a specific package for
> > a physical tap, or simply a one way RTP or ATM...
> > ephemeral.
> >
> > I have agreed all along that you CAN use tapping at
> > an MG IFF both ends of the conversation are always
> > on MGs not located on customer premises.  What I
> > don't understand is how many network designs will
> > be so constrained.
> >
> > Brian
> >
> > > From: Christian Groves [mailto:[email-masked]]
> > > Sent: Friday, February 02, 2001 12:11 AM
> > > G'Day all,
> > > Depending on your network scenario you'll wiretap at
> different points.
> > > Wiretapping at a MG is a perfectly acceptable and practical way of
> > > wiretapping in certain network scenarios. ie. What is an
> access router
> > > when you don't have an IP network??? Megaco gives you the
> tools via
> > > topology to do this without the end terminations knowing that this
> > > occurs.
> > >
> > > Cheers, Christian
> > >
>