VoIP - soon to be under attack?

SA Mathieson

Governments will learn to love encrypted voice-over IP (VoIP), even though it may curtail their ability to eavesdrop on telephone conversations, according to the inventor of PGP encryption Phil Zimmermann.

Zimmermann, speaking at the Oxford Internet Institute on March 15, says that VoIP is eroding law enforcement organisations’ competitive advantage in tapping telecommunications. This echoes what happened in encryption, he told an audience at the Institute, part of Oxford University, where publicly-available software has matched that used secretly by governments for around a decade.

He said that conventional wire-tapping is asymmetrical in favour of government, as it requires access to the physical wires in secure locations such as telephone exchanges. However, VoIP can be attacked remotely through the internet. “When VoIP grows big enough, it will become an attractive target for organised crime,” he said. “They will begin attacking it with the same ferocity they attack the rest of the internet today.” This will endanger police officers and government lawyers, as criminals could overhear their professional plans and their personal movements.

Although encrypting VoIP will stop both sides’ surveillance of content, Zimmermann says that law enforcement can make greater use of traffic – who contacts whom – than criminals. Those outside the law have more to lose from traffic analysis as it suggests who is involved in a plan, while it is criminals will learn less from the fact that those enforcing the law, such as government lawyers, are speaking to each other – it is what they discuss that counts.

Zimmermann is the principal designer of Zfone (http://zfoneproject.com/), a secure VoIP product which protects against “man-in-the-middle” attacks where the interceptor of a call allows it to go ahead without the participants realising they are not alone. Zfone is available on both an open-source and a commercial basis: as well as being available in a free beta version, it has also been licenced by vendors including BorderWare Technologies, CounterPath, Ripcord Networks and PGP Inc, the company Zimmermann founded and now works for as a member of its technical advisory board.

© SA Mathieson 2007.