Search

The usage of instant messaging continues to grow annually in Indonesia. The shifting of mobile communication from traditional voice and SMS based telecommunication to global internet based social networks and instant messaging has brought new challenges for the government. The end-to- end encryption model which is commonly adopted in global instant messaging applications, such as Whatsapp, may challenge the interception procedures by law enforcers. This is a traditional literature review on current Indonesian policies and regulations. Scientific papers were purposively selected in supporting the arguments. The discussion of the paper consists of three sections: 1) Interception and Data Protection; 2) The Indonesian regulatory challenges; 3) The policy recommendations. The current regulation most likely is insufficient to support lawful interception (LI) for encrypted voice and text on instant messaging plaftorms. The practical implementation of the Law towards foreign instant messaging providers remain constrain particularly the Permanent Establishment status. In respect of ongoing process of LI bill drafting, this paper suggests the bill should accommodate the Circular Letter of the Minister of Communication and Information Technology regarding the formation of Permanent Establishment for foreign electronic system and transaction providers.

Lawful interception(LI) standard of telephone networks has technical limitations to lawfully intercept IMS/SIP-based mobile communication network subscriber who using Android and iPhone device. In addition, the technical standards related to legal interception of the IMS/SIP of the wireless network is insufficient compared to the systematic study of the development of a wireless network infrastructure. The architecture proposed in the standard of ETSI(European Telecommunications Standards Institute) for the seamless LI is insufficient to overcome the limitations of traditional voice-centric LI techniques. This paper proposes an IMS/SIP-based architecture to perform LI under 3G networks that focuses on mobility-supported environments with merging cellular networks and the Internet. We implemented the simulation to verify the efficiency of the proposed architecture, and the experimental results show that our method achieves higher lawful interception rate than that of existing interception methods.

Lawful interception(LI) is carried out in accordance with the relevant laws and regulations of each country‘s law enforcement authorities(LEA: Law Enforcement Agencies) and is refers to the act of receiving authorization (warrant) on the interception before performing the tapping of these legal acts. Lawful interception of the traditional public network PSTN (Public Switched Telephone Network), 2nd and 3rd generation of wireless networks was carred out by connecting directly to the switch like a conventional 접수일(2015년08월07일), 심사의뢰일(2015년08월18일), 심사완료일(1차:2015년09월02일) 게재확정일(2015년10월10일), 게재일(2015년10월31일) 701-866 대구광역시 동구 아양로 352, 사서함 304-304, 지휘통신과. email: lmr2010@korea.ac.kr 52851 경남 진주시 동진로 420, 국방기술품질원 정보화기획실. email: yshan08@gmail.com (교신저자) 04383 서울특별시 용산구 이태원로 22, 국방부 군수정보화팀. email: softkim@gmail.com 합법적 감청의 표준화 동향과 이기종 통신망에서의 연속적 패킷 수집에 관한 연구 Copyright c 2015 SERSC 428 cable network. However, the mobile phone (mobile phone) or Voice over IP (VoIP) technology those provide mobility need a new approach to ensure LI. It is necessary to perform a continuous LI in the wide range of network environments while guarantee the continuity of mobile node’s communication. In this paper, we analyzed the traditional lawful interception laws and concepts of the United States, Europe and international standardization trend of LI. In addition, we proposed continuous LI architecture to perform dynamic triggering in heterogeneous networks and verified its effectiveness by experiment.

Lawful Interception (LI) of data communications is an essential tool for Law Enforcement Agencies (LEA) in order to investigate criminal activities carried out or coordinated by means of Internet. However, the ability to secretly monitor the activities of citizens also has a great impact on civil rights. Therefore, democratic societies must prevent abuse and ensure that LI is only employed in specific cases with justifiable grounds or a probable cause. Nowadays, in many countries each interception must be authorized by a wiretap warrant, usually issued by a judge. However, this wiretap warrant is merely an administrative document that should be checked by the network or service operator before enabling the monitoring of its customers, whose communications are later handed over to a LEA in plaintext. This paper proposes the idea of employing a Digital Wiretap Warrant (DWW), which further protects the civil liberties, security and privacy of LI by ensuring that monitoring devices can only be enabled with a valid DWW, and by encrypting the captured data so only the authorized LEA is able to decrypt those communications. Moreover, in the proposed DWW framework all digital evidence is securely time-stamped and signed, thus guaranteeing that it has not been tampered with, and that a proper chain of custody has been met. In particular this paper proposes how to apply the DWW concept to the lawful interception framework defined by the ETSI LI Technical Committee, and evaluates how the additional security mechanisms could impact the performance and storage costs of a LI platform.

The ubiquity of instant messaging (IM) apps on smart phones have provided criminals to communicate with channels which are difficult to decode. Investigators and analysts are increasingly experiencing large data sets when conducting cybercrime investigations. Call record analysis is one of the critical criminal investigation strategies for law enforcement agencies (LEAs). The aim of this paper is to investigate cybercriminals through network forensics and sniffing techniques. The main difficulty of retrieving valuable information from specific IM apps is how to recognize the criminal' IP address records on the Interne t. This paper proposes a packet filter framework to WhatsApp communication patterns from huge collections of network packets in order to locate criminal's identity more effectively. A rule extraction method in sniffing packets is proposed to retrieve relevant attributes from high dimensional analysis regarding to geolocation and pivot table. The results can support LEAs in discovering criminal communication payloads, as well as facilitating the effectiveness of modern call record analysis. It will be helpful for LEAs to prosecute cybercriminals and bring them to justice.

The push in Africa for the widespread adoption of telecommunications and Internet is aimed at boosting economic growth and access to digital government services. However, it has significant effects on privacy by enabling surveillance of the networks, by allowing the collection of data about customers, their locations and transactions, which can be linked to other data and analysed for commercial or governmental purposes. Data can also be stolen or destroyed, by criminals, foreign powers and terrorists. While countries have enthusiastically created telecommunications regulatory authorities, they have only rarely created data protection authorities to oversee well established principles for the collection, use and storage of data. Similarly, they have lagged on the introduction of strategies for cybersecurity and the centres needed to collect data on attacks and defences. Surveillance by secret police has grown in sophistication, with facilities for lawful interception, IMSI-catchers and surveillance RATs, none of which is overseen by parliaments or the courts. Consequently, the rights to dignity and privacy are very poorly observed and more often breached.

Machine learning techniques are the key to success for big data analytics in forthcoming 5G and cloud networks. Internet Service Providers (ISPs) and mobile networks are still relying on traditional Lawful Interception (LI) mechanisms that use error prone meta data and are vulnerable to cyber-attacks. While new identity methods are used to monitor suspected end users, the major challenge is the amount of data that needs to be monitored to find the traffic of interest related to the specific targets. On the other hand, for a conversation (audio or video) between two or multiple attendees, such as a conference call or interview, extracting, briefing and classifying important information can be prone to errors and exhaustion of resources if it is done by humans. This paper proposes an intelligent, secure, fast and reliable platform called Lawful interception as a Service (LiaaS) to detect, analyze and intercept content from different media such as voice and video call. The proposed platform also extracts the minutes of conversation and the most important information from the media (audio or video) so any desired detail can be searched from it.

This paper presents a fast multi-stage method for on-line detection of RTP streams and codec identification of transmitted voice or video traffic. The method includes an RTP detector that filters packets based on specific values from UDP and RTP headers. When an RTP stream is successfully detected, codec identification is applied using codec feature sets. The paper shows advantages and limitations of the method and its comparison with other approaches. The method was implemented as a part of network forensics framework NetFox developed in project SEC6NET. Results show that the method can be successfully used for Lawful Interception as well as for network monitoring.

Communicating parties inside computer networks use different kind of identifiers. Some of these identifiers are stable, e.g., logins used to access a specific service, some are only temporary, e.g., dynamically assigned IP addresses. This paper tackles several challenges of lawful interception that emerged in modern networks. The main contribution is the graph model that links identities learnt from various sources distributed in a network. The inferred identities result into an interception of more detailed data in conformance with the issued court order. The approach deals with network address translation, short-lived identifiers and simultaneous usage of different identities. The approach was evaluated to be viable during real network testing based on various means to learn identities of users connected to a network.

Analyzing the composition of Internet traffic has many applications nowadays, like tracking bandwidth-consuming applications, QoS-based traffic engineering and lawful interception of illegal traffic. Even though many flow-based classification methods, such as support vector machines SVM, have demonstrated their accuracy, few practical implementations of lightweight classifiers exist. We consider in this paper the design of a real-time SVM traffic classifier at hundreds of Gb/s to allow online detection of categories of applications. We also implement a high-speed flow reconstruction algorithm able to handle one million concurrent flows. The solution is based on the massive parallelism and low-level network interface access of FPGA boards. We find maximum supported bit rates up to 408 Gb/s for classification and up to 20 GB/s for flow reconstruction for the most challenging trace. Results are confirmed using a commercial Combov2 board with a Virtex 5 FPGA. Copyright © 2014 John Wiley & Sons, Ltd.

Voice over IP VoIP is increasingly replacing the old public switched telephone network PSTN technology. In this new scenario, there are several challenges for VoIP providers. First, VoIP requires a detailed monitoring of both users' quality of service QoS and experience QoE to a greater extent than in traditional PSTNs. Second, such a monitoring process must be able to track VoIP traffic in high-speed networks, nowadays typically of multi-Gb/s rates. Third, recent government directives require that providers retain information from their users' calls. Similarly, the convergence of data and voice services allows operators to provide new services such as full-data retention, in which users' calls can be recorded for either quality assessment call centers, QoE or security purposes lawful interception. This implies a significant investment in infrastructure, especially in large-scale networks which require multiple points of measurement and redundancy. This paper proposes a novel methodology, architecture and system to fulfill such challenges, called VoIPCallMon, as well as the data structures and necessary hardware-tuning knowledge for its development. As distinguishing features, VoIPCallMon provides very high performance, being able to process VoIP traffic on-the-fly at high bitrates, novel services and significant cost reduction by using commodity hardware with minimal interference with operational VoIP networks. The performance evaluation shows that the system copes with the VoIP load of real-world operators. We further evaluated the system performance at a fully saturated 10 Gb/s link and no packet loss was reported, therefore demonstrating the potential of commodity hardware solutions. Copyright © 2014 John Wiley & Sons, Ltd.

Issues related to lawful interception, such as invasion of privacy and efficient investigation, are presently at the forefront of social consciousness. Interception technology has to consistently evolve in order to keep pace with new and varied network structures. Thus, standard lawful interception documents that are appropriate for the existing PSTN, 2G and 3G, and packet-based communication are being proposed. In particular, newly arising services based on IP Multimedia Subsystems (IMSs) that support multimedia streaming, data transmission, and voice over IP, make lawful interception even more imperative. In this paper, we propose an architecture for IMS/Session Initiation Protocol based Lawful Interception (LI) in wireless 3G networks. We also propose LI techniques that are differentiated according to the IMS characteristics where content service providers are separated from network providers. Using the standards of dynamic triggering technologies for commissioning the authority to intercept among multiple network providers as a basis, we analyze IMS architecture and service operation methods. We then propose an LI architecture that is appropriate for IMS services. In addition, we present the results of a quality of service performance analysis conducted on our proposed interception architecture for various numbers of IMS users.

The detection of encrypted multimedia traffic (like VoIP or Video) is a crucial task for both TELCO operators and authorities involved in lawful interception issues. As an example, Skype traffic that cannot be detected through classical methods as port-based detection (because of a random based choice port option) nor payload inspection (because of encryption mechanisms adopted). Dwelling on Skype, the aim of this work is to propose a novel technique that, by recasting the regularities of the data streams in terms of recurrence plots (a representation derived from Chaos Theory), extracts some unprecedented observables; such observables are then considered in a decision-tree building procedure exploiting the C4.5 algorithm in order to draw a decision about the presence or the absence of the targeted traffic. In the final section, a comparison with a reference technique is presented.

This chapter discusses techniques for the protection of mobile communications, services, users and applications. Real‐time network analysis and protection techniques are summarized such as deep packet investigation, virus protection and Legal/Lawful interception (LI). The protection needs to be scalable in order to provide carrier‐grade IPSec throughput and performance and to minimize any network latency. The protection of the Gp/S8 interface shields the packet core network against malicious intentions regarding roaming, i.e., when users are connected to services via other mobile network operator (MNO) networks. Performance monitoring and fault management of the networks can be considered an integral part of the security assurance. LI has been designed for authorized access to the communications of commercial, government and military environments. LI provides the means for mobile and fixed network operators and service providers to collect traffic and identification information of private or organizational communications for post‐analysis for law enforcement officials.

Zakonito presretanje i zadržavanje podataka u elektroničkim komunikacijama sastoji se od pribavljanja signala i podataka iz telekomunikacijske mreže te sadržaja komunikacija u svrhu analize i evidencije. Sve zemlje svijeta primjenjuju mjere presretanja i zadržavanja podataka sukladno svojim nacionalnim propisima i tehničkim mogućnostima. One su bitan dio različitih mjera nadzora osoba i predmeta koje se primjenjuju radi očuvanja nacionalne sigurnosti, zaštite ljudskih prava i temeljnih sloboda građana. U tom složenom procesu sudjeluju svi operatori na tržištu koji su obvezni omogućiti primjenu zakonskih mjera, proizvođači opreme i programske podrške, sigurnosne agencije ili tzv. ovlaštena tijela koja provode mjere zakonitog presretanja i zadržavanja podataka prema operatorima, agencije za telekomunikacije koje pružaju tehničku pomoć i nadziru provedbu zakonskih odredbi i na kraju, odnosno na početku represivni aparat koji poseže za takvim mjerama kada se izvidi kaznenih djela ne mogu provesti na drugačiji način. Stalni rast i razvoj novih telekomunikacijskih usluga, uklanjanje barijera u Europskoj uniji odnosno globalizacija općenito, sve zemlje svijeta stavlja pred nova iskušenja u efikasnoj borbi protiv organiziranog kriminala i terorizma. Međutim, u toj se borbi krije opasnost radi ograničavanja ustavnih sloboda građana, odnosno temeljnih ljudskih prava i sloboda, a pogotovo prava na nepovredivost doma, slobodu i tajnost dopisivanja. Podaci o stotinama milijuna građana koji su tiču njihova privatnog života postaju dostupni i pohranjuju se duži period. Stoga je ključno pitanje koliku prednost imaju države u borbi protiv organiziranog kriminala i terorizma primjenom takvih mjera s obzirom na nesrazmjernost u postizanju željenog cilja. Lawful interception and retention of data in the electronic communications consists of obtaining the signals and data from the telecommunications network and communication facilities for the purpose of analysis and evidence. All countries apply interception measures and data retention pursuant to its national regulations and technical capabilities. They make an essential part consisted of various surveillance measures of persons and objects that are applied to safeguard national security, the protection of human rights and fundamental freedoms of citizens. In this complex process, all the operators on the market have been involved who are required to enable the application of legal measures, the equipment manufacturers and software support, security agencies or so called authorized bodies who are carrying out the measures of legal interception and retention of data to the operators, telecommunications agencies providing the technical assistance and monitoring the implementation of legal provisions and eventually the repressive apparatus that intervenes for such measures when the investigations of criminal offenses can not be implemented in a different way. A steady growth and development of new telecommunications services as well as the removal of barriers in the European Union and globalization in general leads all the countries in the world into new temptations in an efficient fight against the organized crime and terrorism. However, that fight is danger due to the to restriction of constitutional freedoms ,fundamental human rights and freedoms, especially the right to the inviolability of the home, freedom and secrecy of correspondence. The data on hundreds of millions of citizens related to their private lives are becoming available and stored in long-term memory. Therefore, the key issue is on the priority given to the countries in the fight against organized crime and terrorism by applying such measures due to the disproportion in reaching the desired goal

The session initiation protocol (SIP) is the most widely used signaling protocol for creating, modifying, and terminating multimedia sessions in an Internet Protocol-based telephony environment. Recently, Arshad et al. proposed an authentication scheme based on elliptic curve cryptosystems for SIP. In this paper, we first show that their scheme is vulnerable to the password-guessing attack. Thereafter, we propose a new authentication and key agreement scheme for SIP, which is immune to the presented attacks. Our scheme achieves provable security and, yet, is efficient. Moreover, we also provide an extended scheme capable of protecting media stream's privacy even against SIP servers while supporting lawful interception, which is inevitably required for protecting the national security or for detecting the criminal evidence. Copyright © 2012 John Wiley & Sons, Ltd.

IP networks were growing rapidly over past decades. Perhaps more significant is the impact that it is also provide a medium to the illicit activities. Therefore, IP monitoring of lawful interception of IPv4 Networks was proposed to combat against those illicit activities over IP Networks. The Law Enforcement Agencies (LEA) can monitor the IP packets as well as capture them for analysis or providing forensics. In order to assist IP Monitoring of lawful interception from technical perspective, we propose a scheme named Decision Tree Based Rules Redistribution Algorithm (DTBRRA) which can be fast applied on IP networks.

A conference key establishment protocol allows a group of conferees to agree on a secret key shared among them for secure group communication. This paper proposes a three-level conference key establishment protocol based on the Universal Mobile Telecommunications System (UMTS) framework to establish a group-level key, home location register (HLR) level keys, and visitor location register (VLR) level keys simultaneously for a group of conferees. The group-level key is used to secure the communications for all conferees, the HLR-level key is for those within the same HLR domain, and the VLR-level key is for those within the same VLR domain. The group-level key can be used for securing inter-domain group-oriented applications such as commercial remote conferencing systems. The HLR- and VLR-level keys can be used for securing intra-domain subgroup applications (e.g., location-based or context-aware services) and dynamic key updating. Since our proposed protocol exploits existing UMTS security functions and the exclusive-or operation, it is compatible with UMTS architecture. This means that it is fast and easy to implement on the existing UMTS architecture. Furthermore, the proposed protocol has low computational complexities and can provide cost effectiveness, load-amortization, scalability, user authentication, key establishment, key confirmation, key updating, and lawful interception.

In recent years, the number of online crimes (e.g., the various emerging scams and criminal schemes) has increased. Online crime suspects utilize the anonymous nature of web to disguise their identity through various methods and evade detection and surveillance from law enforcement agencies. This study proposes an effective lawful interception system, Real-time Crime Detection System (RCDS), which includes Criminal Investigation Bureau (CIB), Internet Service Providers (ISP), and Network Interception Server (NIS) to establish a legally sanctioned lawful interception process which can collect and store evidence for criminal detection in real time. We provide a case study of MSN Messenger to describe the MSN Protocol (MSNP), information flow process, and lawful interception methodologies. The RCDS can provide criminal detection and surveillance services for MSN to obtain criminal communication records in turn reducing online criminal activities.

Intelligence and law enforcement agencies collect large datasets, but have difficulty focusing analyst attention on the most significant records and structures within them. We address this problem using suspicion, which we interpret as relevant anomaly, as the measure associated with data records and individuals. For datasets collected about widespread activities in which the signs of adversarial activity are rare, we suggest ways to build predictive models of suspicion. For datasets collected as the result of lawful interception, we suggest a model of suspicion spreading using the social network implied by the intercepted data.

With the evolution of increasingly sophisticated Internet communication technologies, ensuing legal and policy issues have also emerged. VoIP (voice-over-Internet Protocol) and P2P (peer-to-peer) file-sharing software are two relevant examples of the differing characteristics of Internet communications compared to traditional communication technologies, e.g., telephone, cell phone or client-and-server architecture, from the viewpoint of government surveillance (or the investigation of copyright infringement) and the protection of user privacy. Herein, we try to make observations and opinions regarding the legal issues related to VoIP and P2P file-sharing software.

Lawful Interception (LI) refers to a lawfully authorized process of looking into private communication under a court-issued warrant. Quite a number of countries have been drafting and enacting laws authorizing the LI procedures on packet-switched IP networks including traditional circuit-switched ones. As the IP mobility becomes more ubiquitous, propelled by wireless networks, it becomes an issue in the LI domain to keep track of a migrating target. However, with the world's focus on the current LI architectures, little consideration has been given to a seamless LI triggering, which accommodates IP mobility and vertical handover. Proposed herein are a seamless LI architecture and relevant triggering algorithms for the heterogeneous wireless networks. The simulation results demonstrate that the proposed architecture secures a seamless LI by capturing all the suspected target traffics without any time delay, which usually occurs during an LI triggering between different service providers. Furthermore, when compared with the existing LI architectures, the architecture significantly helps reduce transmission and the time consumed for analysis of the content of communication (CC) and intercept related information (IRI).

Lawful interception (LI) involves legally accessing private communication such as telephone calls or email messages. Numerous countries have been drafting and enacting laws concerning the LI procedures. With the proliferation of portable Internet services such as the IEEE 802.16e wireless mobile networks, surveillance over illegal users is an emerging technical issue in LI. The ever-migrating users and their changing IP's make it harder to provide support for seamless LI procedures on 802.16e networks. Few studies, however, on seamless LI support have been conducted on the 802.16e mobile networks environments. Proposed in this paper are a seamless LI architecture and algorithms for the 802.16e networks. The simulation results demonstrate that the proposed architecture improves recall rates in intercepting mobile user, when compared to the existing LI architectures.

With the rapid growth of the Internet and wireless communications, people make extensive use of portable wireless devices to access information such as voice, data and multimedia, any time from any place, enjoying ubiquitous services. IP multimedia subsystem (IMS) are regarded as the total solution for packet-switched networks, combining wired and wireless infrastructures, providing a standardized interface for information services. We propose the IMSKAAP key exchange protocol and fit it into the IMS session initiation procedure to achieve media plane end-to-end security. This mechanism also mitigates the impact of spam over IP telephony (SPIT) using mutual authentication, fulfilling the lawful interception requirement. The simulation result shows that the proposed mechanism provides a more secure session key exchange and does not need the additional message exchange cost. The voice call end-to-end delay is also lower than the hop-by-hop security associations defined by 3GPP.

Mathieu Gorge examines how police in different countries track the electronic movements of terrorist and criminals and how their methods will develop.

Phone tapping was one issue at the top of the headlines last year, after the NSA was discovered listening in to US citizens' conversations. But the issue of lawful intercept stretches back for years. During the mid-nineties, legislation was signed in the US that outlined a more structured framework for telephone carriers' compliance with law enforcement requests, and created standards for the exchange of such information. Now, thanks to the rise of VoIP, P2P and other forms of communication, the law is being updated. And Europe has also been working to put its own legislation in place governing the retention of such information. Stephen Gleave, VP of marketing at SS8 Networks, explains how the legal requirements surrounding lawful interception have evolved over the years, and describes where we're headed. For years, communication service providers (CSPs) wanting an operating licence have had to meet set conditions. One such condition is that they must work with law enforcement to gather intelligence which may be used as evidence in the prosecution of criminals. Governments around the world have passed legislation that mandates this co-operation and have continually strived to update these statutes as technology advances and criminal communications become more sophisticated.

Příspěvek se zabývá instituty odposlechu a záznamu telekomunikačního provozu v trestním řízení proti právnické osobě. Jsou analyzovány specifika použití těchto institutů v trestním řízení vedeném proti právnické osobě, zásady ovládající jejich aplikaci a limity omezující jejich použití. Příspěvek se zabývá instituty odposlechu a záznamu telekomunikačního provozu v trestním řízení proti právnické osobě. Jsou analyzovány specifika použití těchto institutů v trestním řízení vedeném proti právnické osobě, zásady ovládající jejich aplikaci a limity omezující jejich použití. This text deals with problem of use of lawful interception and access to retained data in criminal prosecution of legal person. It focuses on main principles governing their use in this type of criminal proceedings and limits to their use.

The detection of encrypted streamed traffic (like VoIP or Video) is an increasingly important issue for authorities involved in lawful interception. Aside from well established technologies like Skype, Facetime and MSN Messenger a new one is recently spreading: Web Real-Time Communication (WebRTC), which, with the support of powerful encryption methods as DTLS, offers capabilities for encrypted streaming voice and video without the need of installing a specific application but using a common browser like Chrome, Firefox or Opera. WebRTC traffic cannot be detected through methods of semantic recognition since it does not exhibit a distinguishable sequence of information pieces and hence statistical recognition methods are called for. In this paper we propose and evaluate a decision theory based system allowing to recognize encrypted WebRTC traffic by means of an open-source machine learning environment: Weka.

The detection of encrypted real-time traffic, both streaming and conversational, is an increasingly important issue for agencies in charge of lawful interception. Aside from well established technologies used in real-time communication (e.g. Skype, Facetime, Lync etc.) a new one is recently spreading: Web Real-Time Communication (WebRTC), which, with the support of a robust encryption method such as DTLS, offers capabilities for encrypted voice and video without the need of installing a specific application but using a common browser, like Chrome, Firefox or Opera. Encrypted WebRTC traffic cannot be recognized through methods of semantic recognition since it does not exhibit a discernible sequence of information pieces and hence statistical recognition methods are called for. In this paper we propose and evaluate a decision theory based system allowing to recognize encrypted WebRTC traffic by means of an open-source machine learning environment: Weka. Besides, a reasoned comparison among some of the most credited algorithms (J48, Simple Cart, Naive Bayes, Random Forests) in the field of decision systems has been carried out, indicating the prevalence of Random Forests.

GSM Networks were initially designed for communication purpose and security aspect was not covered in the system, but now different systems are using diverse encryption techniques to protect the SMS text from unwanted receivers. Most of work has been done in GSM to secure message from person who can eavesdrop the GSM Channel, from the hacker who can perform replay attacked using his historical messages and from the hacker who can disclose the message secrecy. Eavesdropping in a radio channel is easy but due to a lot of traffic there is a very less chances to find the correct information and the desired SMS however in today's GSM system still have two problems. The easiest way to read the text message from any person is the mobile operator network entities so there is a need to make it possible that our sent SMS is not in the format that should be easily read, so Protection of message text, its readability at operators end at different network entities like, SMSC, MSC and Lawful Interception System, and the second problem is message non-repudiation, this term is used for the behavior of an attacker such that it impersonates as some other genuine user. Because in today's network it is possible that at operator end messages can be sent using any sender number and receiver cannot confirm that this message is generated from the specified number or from any other network operator.

The traffic classification is the foundation for many network activities, such as Quality of Service (QoS), security monitoring, Lawful Interception and Intrusion Detection Systems (IDS). A recent statistics-based approach to address the unsatisfactory results of traditional port-based and payload-based approaches has attracted attention. However, the presence of non-informative attributes and noise instances degrade the performance of this approach. Thus, to address this problem, in this paper, we propose a hybrid clustering-classification approach (called CluClas) to improve the accuracy and efficiency of network traffic classification by selecting informative attributes and representative instances. An extensive empirical study on four traffic data sets shows the effectiveness of our proposed approach.

Dr Edmon Makarim S.Kom., S.H., LL.M sets out the present controversy over the introduction of a new Bill dealing with lawful interception and puts the Bill into context, including issues over the constitutionality of regulations issued by ministers permitting interception.

Lawful Interception (LI) is a fundamental tool in today's Police investigations.Therefore, it is important to make it as quickly and securely as possible as well as a reasonable cost per suspect. This makes traffic capture in aggregation links quite attractive, although this implies high wirespeeds which require the use of specific hardware-based architectures. This paper proposes a novel Bloom Filter-based monitoring station architecture for efficient packet capture in aggregation links. With said Bloom filter, we filter out most of the packets in the link and capture only those belonging to lawful interception wiretaps. Next, we present an FPGA-based implementation of said architecture and obtain the maximum capture rate achievable by injecting traffic through four parallel Gigabit Ethernet lines. Finally, we identify the limitations of our current design and suggest the possibility of further extending it to higher wirespeeds.- Best Paper Award The work presented in this paper has been funded by the INDECT project grant number FP7-ICT-218086, and the Spanish CramNet project (grant no. TEC2012-38362-C03-01). European Community's Seventh Framework Program

Voice over IP (VoIP) technologies such as Skype are becoming increasingly popular and widely used in different organisations, and therefore identifying the usage of this service at the network level becomes very important. Reasons for this include applying Quality of Service (QoS), network planning, prohibiting its use in some networks and lawful interception of communications. Researchers have addressed VoIP traffic classification from different viewpoints, such as classifier accuracy, building time, classification time and online classification. This previous research tested their models using the same version of a VoIP product they used for training the model, giving generalizability only to that version of the product. This means that as new VoIP versions are released, these classifiers become obsolete. In this paper, we address if this approach is applicable to detecting new, untrained, versions of Skype. We suggest that using cost-sensitive classifiers can help to improve the accuracy of detecting untrained versions, by testing compared to other algorithms. Our experiment demonstrates promising preliminary results to detect Skype version 4, by building a cost sensitive classifier on Skype version 3, achieving an F-measure score of 0.57. This is a drastic improvement from not using cost sensitivity, which scores an F-measure of 0. This approach may be enhanced to improve the detection results and extended to improve detection for other applications that change protocols from version to version.

Cellular network operators are dealing with the increased data requirements of their customers by attempting to offload traffic from the mobile core network. The 3rd Generation Partnership Project (3GPP) standards have defined several strategies that allow for offloading user traffic from the mobile core network. The 3GPP standards also define requirements for the mobile networks to support lawful interception of subscriber traffic. The current methods employed by mobile network operators to perform lawful interception are insufficient to support the traffic offload methods. This paper describes the current lawful interception landscape as well as the methods to perform traffic offload. It then proposes the architecture and methods that allow for traffic offload while satisfying law enforcement needs.

Wireless communication between vehicles is protected by digital certificates but these certificates and related identifiers must not be usable to track vehicles. Therefore, short-term pseudonymous certificates are applied and regularly changed in order to protect the driver's privacy. But in well defined situations, e.g. network attacks or traffic accidents, it should be possible to retrieve the appropriate long-term identifier from the certificate issuer. Hence, the resolution of pseudonym identifiers is a balancing act between full privacy and uncontrolled access to long-term identifiers. We propose a generic pseudonym resolution protocol that can be applied by network infrastructure entities to request pseudonym resolution information only under defined conditions. It is shown that the protocol is balanced and flexible to be applied for different use cases (e.g. lawful interception or misbehavior detection). In contrast to related protocols our solution does not increase pseudonym certificate size and avoids additional overhead and delay in the certificate acquisition phase. Further, a new feature is proposed that enables the infrastructure entities to validate the stated reason for the desired pseudonym resolution before respective information is provided. Measurements from field operational test implementations show the feasibility and practicability of the protocol when applying misbehavior detection in wireless vehicular communication networks.

This doctoral thesis analyzes the balancing and proportionality analyses performed by Swedish legislators over time in the creation of legislation allowing for the interception of communica- tions data and metadata by the Swedish Security Service for intelligence purposes. By examining the concept of proportionality within the field of constitutional law, a framework for performing proportionality tests is identified. This framework is used as a contrast against the actual proportionality analyses performed by legislators in preparatory works, and to analyze three components of the legislators’ policy choices: the legislators’ view of national security, the legislators’ view of privacy; and the effect of technological development on the former two components. These components are analyzed through a study of preparatory works from a historical comparative perspective, allowing for the study of shifts in policy outcomes over time. The study shows that legislators’ views on national security have shifted during the last 50 years. as could be expected the focus has shifted towards a more preventive approach. Following this development however the study further identifies a shift in the legislators’ views on privacy. Whereas the importance of privacy from a societal perspective seemed pivotal in the ’pre-preventive era’ of communications interception, the view in the last 15 years has gradually shifted towards a view of privacy as an almost exclusively individual interest, resulting in a weakened status of the right to privacy against competing national security interests. Finally, the importance of technological developments within this field can hardly be overestimated. The range of permitted forms of communications interceptions has closely followed what has been technologically possible, and economically feasible to intercept. Intelligence gathering has increasingly become a legal sphere of its own, where most forms of metadata can be collected without the involvement of the judiciary, and where evidentiary requirements have been lowered to facilitate the use of interception in preventive intelligence gathering. Overall the thesis concludes that these factors have enabled a different outcome of the legislators’ proportionality analyses, where previous ideals have been supplanted by the preventive paradigm.

This doctoral thesis analyzes the balancing and proportionality analyses performed by Swedish legislators over time in the creation of legislation allowing for the interception of communica- tions data and metadata by the Swedish Security Service for intelligence purposes. By examining the concept of proportionality within the field of constitutional law, a framework for performing proportionality tests is identified. This framework is used as a contrast against the actual proportionality analyses performed by legislators in preparatory works, and to analyze three components of the legislators’ policy choices: the legislators’ view of national security, the legislators’ view of privacy; and the effect of technological development on the former two components. These components are analyzed through a study of preparatory works from a historical comparative perspective, allowing for the study of shifts in policy outcomes over time. The study shows that legislators’ views on national security have shifted during the last 50 years. as could be expected the focus has shifted towards a more preventive approach. Following this development however the study further identifies a shift in the legislators’ views on privacy. Whereas the importance of privacy from a societal perspective seemed pivotal in the ’pre-preventive era’ of communications interception, the view in the last 15 years has gradually shifted towards a view of privacy as an almost exclusively individual interest, resulting in a weakened status of the right to privacy against competing national security interests. Finally, the importance of technological developments within this field can hardly be overestimated. The range of permitted forms of communications interceptions has closely followed what has been technologically possible, and economically feasible to intercept. Intelligence gathering has increasingly become a legal sphere of its own, where most forms of metadata can be collected without the involvement of the judiciary, and where evidentiary requirements have been lowered to facilitate the use of interception in preventive intelligence gathering. Overall the thesis concludes that these factors have enabled a different outcome of the legislators’ proportionality analyses, where previous ideals have been supplanted by the preventive paradigm.

EXPERT OPINIONS CONCERNING DRUG SLANG AND DRUG CRIME COMPILED ON THE BASIS OF TELEPHONE TAPPING DATASummaryThis article discusses the value for courts of opinions drawn up by experts on drug slang and drug crime, especially in criminal proceedings involving organised crime. It presents a dictionary of the most frequently used Polish drug slang. The author describes the principles governing the protection of classified information obtained by telephone tapping (lawful interception); he also outlines the limits to the access the expert appointed by the court has to intercepted data on the grounds of their status as classified information. The article addresses the use of the expert’s opinion both in the preliminary proceedings phase as well as in court.

In recent years deep packet inspection (DPI) has often been cited as a major factor in the debate concerning net neutrality. Packet inspection (PI) enables a profound analysis of the contents of IP-packets, especially with respect to the application layer and private data. To protect against this sort of privacy invading attack users are usually advised to encrypt as much of their data as possible in an online transaction. However, current PI-engines not only use plain text analysis but also employ a variety of statistical methods. This in turn allows the analysis and classification of packets even if encryption or obfuscation methods have been applied. It is possible to monitor and shape packet flows in real time and on a large scale. These PI-engines are deeply embedded in the current network infrastructure due to the requirements of lawful interception. This brings about a huge potential for misuse, because the engine’s operation is not ‘visible’ to the end-user.

Mobile network operators are adapting femtocells in order to simplify their network architecture for increased performance and greater revenue opportunities. While emerging as a new low-cost technology which assures best connectivity, it has also introduced a range of new potential risks for the mobile network operators. Here we study the risks associated with the location verification techniques of femtocells. First we state the goals of location verification and describe techniques implemented in the existing femtocells. We demonstrate how location locking techniques can be defeated by using modern attack vectors against the location verification methods. Our experimental result suggest that location security methods are insufficient to avoid femtocell's misuse. An attacker can operates the femtocell from an unregistered location, thereby creating problems for various important services such as for assisting emergency call services, for following licensed spectrum rules, for Lawful interception services, and for the commercial purposes.

Lawful interception (LI) has evolved over the past few decades from target based monitoring & interception of telecomm conversations, to the monitoring & interception of packet switched (IP) communications. However, in spite of this evolution, the nature of the communication remained linear, where the initiator communicates with one, or a number of, recipients. Initially, with telecomm, all of the participants in the call were online, i.e. active participants at the time of the call; whereas, with the introduction of packet-switched or IP traffic, some of the interaction between the participants became turn-based, where the recipients receive the information from the initiator after an interval. Notwithstanding spam, the participants, more often than not, opted to receive the information.

Smartphones providing proprietary encryption schemes, albeit offering a novel paradigm to privacy, are becoming a bone of contention for certain sovereignties. These sovereignties have raised concerns about their security agencies not having any control on the encrypted data leaving their jurisdiction and the ensuing possibility of it being misused by people with malicious intents. Such smartphones have typically two types of customers, independent users who use it to access public mail servers and corporates/enterprises whose employees use it to access corporate emails in an encrypted form. The threat issues raised by security agencies concern mainly the enterprise servers where the encrypted data leaves the jurisdiction of the respective sovereignty while on its way to the global smartphone router. In this paper, we have analyzed such email message transfer mechanisms in smartphones and proposed some feasible solutions, which, if accepted and implemented by entities involved, can lead to a possible win-win situation for both the parties, viz., the smartphone provider who does not want to lose the customers and these sovereignties who can avoid the worry of encrypted data leaving their jurisdiction.

Automating telephony surveillance is an appealing and appropriate technology from the view point of being able to detect/spot if a person from a specific watch-list is on line. Such an automatic solution is of considerable interest in the context of homeland security where a potentially large number of wire tapped conversations may have to be processed in parallel, in different deployment scenarios and demographic conditions, and with typically large watch-lists, all of which make manual lawful interception unmanageable, tedious and perhaps even impossible. In this chapter, we first introduce this problem domain starting with a sketch of a glamorous fictitious example, followed by an outline of lawful interception and wire-tapping; we then take a brief look at similar watch-list based negative recognition application using the now very successful Iris biometrics and consider equivalent scenarios in the context of speaker-spotting based on voice as a biometric. Further, in the main body of this chapter, we first provide the basic framework for watch-list based speaker-spotting, namely, open-set speaker identification, subsequently refined into a ‘multi-target detection’ framework. We then examine in some detail the main theoretical analysis available within the framework of multi-target identification, leading to performance predictions of such systems with respect to the watch-list size as the critical factor. In a related note, we also briefly touch on the prioritization mode of operation which also lends itself to interesting theoretical analysis and performance predictions. Speaker-spotting systems face unique challenges, in a way combining the difficulties inherent in conventional speaker authentication applications as well as forensic speaker recognition applications; we consider these, while using the NIST SRE evaluation results to gain insights on the performances achievable presently and the latent performance limitations which seem to warrant a cautionary approach before widespread use of speaker recognition technology for surveillance applications becomes possible. In the later part of the chapter, we outline related topics such as speaker change detection, speaker segmentation and speaker diarization, followed by a summary of product level solutions currently available in the context of surveillance and homeland security applications, finally concluding with discussions highlighting the state-of-the-art and potential future research directions.

Since the need of the communication data in revealing the crime are just emerged after the event detected, communication data retention for lawful interception (LI) are really demanded. This paper aim to give recommendation for telecommunication regulatory body in making communication data retention regulation. This research describes points of recommendation to National Telecommunication Regulatory Body in establishing LI data retention regulation which conducted by the Communication Service Provider in the country. These recommendations are very useful for countries that do not have relevant regulations of this field. This paper suggests that propose data retention system must have an ability to run administrative function, data collection function and data management function. Each function should maintain such a log. Administrative log has to keep warrant information include target identity and date start, and the duration of data retention needed. In telecommunication infrastructure target are either MSISDN, IMEI or IMSI. For communication data through IP mechanism, target is either email address, account name or IP address. Information item that have to be retained are include subscriber data, usage data and traffic data, equipment data, network element data, additional service data and the call contents. If storage capacity are not fully provided yet, the retention for data that need the largest storage space such as video and file might be less priority. Regulatory Body must determine the data retention format based on handover interface. To prevent abuse of data, regulation should put clauses that obligate each party to delete data longer than retention period. Besides this paper recommends decentralize location of storage media, apart from operational system and have a hot site backup.

In this paper, we proposed a security system which can accomplish several various functions. The primary applications of this system includes: (1) lawful interception for the data of voip, email, instant message and other kinds of data; (2) filtering abnormality data packages; (3) blocking the illegal URL or sites; (4) performing net traffic and flow analysis and user behavior analysis; (5) doing network bandwidth monitoring, DDOS traffic cleaning; (6) SPAM filtering and so on. All the problems we involved are the most concerned by the operators engaged in telecommunication. The system architecture and the function we designed are based on the research of Lawful Interception (ETSI).

Information security standards are essential to ensure interoperability among systems and networks, compliance with legislations and adequate levels of security. These standards provide the means for protecting the user, creating a more secure and profitable environment for the industrial sector, from SMEs to large global companies, and providing benefits for a diverse range of interest groups that include government organisations, research bodies and universities. The increasingly rapid evolution and growth in the complexity of new systems and networks, coupled with the sophistication of changing threats and the presence of intrinsic vulnerabilities, present demanding challenges for maintaining the security of Information and Communications Technology (ICT) systems and networks. To minimise exposure to risks, security must be built in from the beginning when designing new architectures, not added on later as an optional feature. As a response to such challenges, ETSI, the European Telecommunications Standards Institute, is committed to the establishment and continuous improvement of effective and interoperable telecommunications systems for the benefit of the global community. As such, ETSI is a key player of the global Cybersecurity efforts, by addressing security issues in a broad number of areas including Next Generation Networks (NGN), protecting communications and the ICT infrastructure, working on mobile/wireless communications, emergency telecommunications, lawful interception and data retention.

The entire telecommunications and services world has focused its attention on the newest 3GPP architecture, 4G. Proposing high speed data transfer, all flat-IP network for the core systems and stronger authentication and AAA methods, this architecture seems to be the answer for the mobile networks of the future. Another architecture described by 3GPP as well, but based on IETF standards is the IMS architecture. This is focused on mobile services, mainly VoIP, but also presence, push-to-talk, location and multimedia and broadcast services. The IMS core network has its own security mechanisms, which are constantly tested and improved. Looking in the perspective, the user equipment, specially the one found in roaming has to do a lot of signaling in order to authenticate to both networks and use the services available for it in a secure manner. From the provider's point of view, the issue is even more complicated, because it has to secure its network, securely interoperate with other networks, be able to obtain granular charging information and also provide lawful interception capabilities for the government institutions. This paper reviews the authentication security architecture available in 3GPP for providing secure access to application services, with emphasis on the interaction of 4G and IMS components, being the first step in a larger 4G-IMS interaction study with regards to security.