Search

The article is devoted to the analysis of regulatory and legal acts and normative documents of the EU on information interception in electronic communication networks in the context of preparation of technical regulations of the united system of technical means.

IP Networks serve a variety of connected network entities (NEs) such as personal computers, servers, mobile devices, virtual machines, hosted containers, etc. The growth in the number of NEs and technical considerations has led to a reality where a single IP address is used by multiple NEs. A typical example is a home router using Network Address Translation (NAT). In organizations and cloud environments, a single IP can be used by multiple virtual machines or containers running on a single device. Discovering the number of NEs served by an IP address and clustering their traffic correctly is of value in many use cases for security, lawful interception, asset management, and other purposes. In this paper, we introduce IPvest, a system that incorporates unsupervised and supervised learning algorithms based on various features for counting and clustering network traffic of NEs masqueraded by a single IP. The features are based on the characteristics of operating systems (OSs), NAT behavior, and users’ habits. Our model is evaluated on real-world datasets including Windows, Linux-based, Android, and iOS-based devices, containers, virtual machines, and load-balancers. We show that IPvest can count the number of NEs and cluster their traffic with high precision, even for containers running on a single device and servers behind a load-balancer.

Network traffic classification is basic tool for internet service providers, various government and private organisations to carry out investigation on network activities such as Intrusion Detection Systems (IDS), security monitoring, lawful interception and Quality of Service (QoS). Recent network traffic classification approaches have used an extracted and predefined class label which come from multiple experts to build a robust network traffic classifier. However, keeping IP traffic classifiers up to date requires large amounts of new emerging labeled traffic flows which is often expensive and time-consuming. This paper proposes an efficient network classification (named Net-Stack) which inherits the advantages of various widths clustering and semi-supervised stacking to minimize the shortage of labeled flows, and accurately learn IP traffic features and knowledge. The Net-Stack approach consists of four stages. The first stage pre-processes the traffic data and removes noise traffic observations based on various widths clustering to select most representative observations from both the local and global perspective. The second stage generates strong discrimination ability for multiview representations of the original data using dimensionality reduction techniques. The third stage involves heterogeneous semi-supervised learning algorithms to exploit the complementary information contained in multiple views to refine the decision boundaries for each traffic class and get a low dimensional metadata representation. The final stage employs a meta-classifier and stacking approach to comprehensively learn from the metadata representation obtained in stage three for improving the generalization performance and predicting final classification decision. Experimental study on twelve traffic data sets shows the effectiveness of our proposed Net-Stack approach compared to the baseline methods when there is relatively less labelled training data available.

In the 4G era, cellular positioning was used for emergency services and services associated to lawful interception. In 5G, commercial use cases have gained momentum and use cases like factory automation, transportation, and logistics are included in 5G besides the regulatory use cases. Toward 6G, it is anticipated that positioning and location services will be fundamental part of the system demanded by most commercial applications, such as AR/VR/XR, gaming, sensing, low-cost tracking and new industrial applications with extremely high accuracy. As a result, positioning accuracy and latency requirements are anticipated to tighten further from 5G. Thus, positioning and location services needs to be designed as an integral part of 5G evolution to address these requirements in a scalable and efficient manner both for devices and networks. This paper discusses the technical trends and enablers to realize this vision towards 6G, such as latency and accuracy enhancements, and low-cost positioning.

Escrowed decryption schemes (EDSs) are public-key encryption schemes with an escrowed decryption functionality that allows authorities to decrypt encrypted messages under investigation, following a protocol that involves a set of trusted entities called `custodians'; only if custodians collaborate, the requesting authority is capable of decrypting encrypted data. This type of cryptosystem represents an interesting trade-off to privacy versus surveillance dichotomy. In this study, the authors propose two EDSs where they use proxy re-encryption to build the escrowed decryption capability, so that custodians re-encrypt ciphertexts, in a distributed way, upon request from an escrow authority, and the re-encrypted ciphertexts can be opened only by the escrow authority. Their first scheme, called EDS, follows an all-or-nothing approach, which means that escrow decryption only works when all custodians collaborate. Their second scheme, called threshold EDS, supports a threshold number of custodians for the escrow decryption operation. They propose definitions of semantic security with respect to the authorities, custodians and external entities, and prove the security of their schemes, under standard pairing-based hardness assumptions. Finally, they present a theoretical and experimental analysis of the performance of both schemes, which show that they are applicable to real-world scenarios.

In modern networks, Lawful Interception (LI) is one of the necessary means for security agencies to safeguard national security and prevent crimes. This article intends to explore the dynamic placement problem of intercept access points (IAPs) unique to SDNs, and their derived interception strategies. by selecting the optimal intercept access point, bring the shortest path among the three points-source, destination, and law enforcement agency (LEA). In order to reduce the redundant return intercepted traffic in the network, the operating cost of the LI system must be minimized. We also addressed the performance of the fastest access to the return traffic by the LEA, and the impact on the communication quality of the monitored users. Comparison among the three-interception strategies-source/destination interception model, blocking interception model, and bicast model. the simulation results expressed as a percentage that improved by using the different strategies compared with each other of the total costs of ISP, the performance of LEAs, and affected QoS of monitored users.

Communication interception for national security purposes, as well as for purposes of conducting a criminal investigation, is an invaluable asset of law enforcement agencies. In technical terms, this field has seen rapid advances in the last decade, while available software programmes and platforms for lawful interception (LI) are now able to monitor a broad spectrum of communication channels. Lawful interception of communications invariably intersects with fundamental rights and freedoms of persons in the European Union and the Member States. The purpose of this paper, as part of the discussion on the framework of lawful interception, is to present a study of advanced lawful interception software with its functionalities and processes, compare it with the most common lawful interception models and analyse the software architecture defined by the European Telecommunications Standards Institute (ETSI) as a general standard. While this particular model of LI architecture has initially been designed to intercept voice communications, it can be successfully applied to intercept communications over Internet Protocol (IP) channels. Finally, the paper offers a comparative insight into different kinds of LI software and their capabilities in line with communication interception regulation.

For the law enforcement agencies, lawful interception is still one of the main means to intercept a suspect or address most illegal actions. Due to its centralized management, however, it is easy to implement in traditional networks, but the cost is high. In view of this restriction, this paper aims to exploit software-defined network (SDN) technology to contribute to the next generation of intelligent lawful interception technology, i.e., to optimize the deployment of intercept access points (IAPs) in hybrid software-defined networks where both SDN nodes and non-SDN nodes exist simultaneously. In order to deploy IAPs, this paper puts forward an improved equal-cost multi-path shortest path algorithm and accordingly proposes three SDN interception models: T interception model, ECMP-T interception model and Fermat-point interception model. Considering the location relevance of all intercepted targets and the operation and maintenance cost of operators from the global perspective, by the way, we further propose a restrictive minimum vertex cover algorithm (RMVCA) in hybrid SDN. Implementing different SDN interception algorithms based RMVCA in real-world topologies, we can reasonably deploy the best intercept access point and intercept the whole hybrid SDN with the least SDN nodes, as well as significantly optimize the deployment efficiency of IAPs and improve the intercept link coverage in hybrid SDN, contributing to the implementation of lawful interception.

Network users apply encryption to send and receive data securely. Since ciphertext can be encrypted and decrypted only by lawful users, third parties do not have the ability to know the content of an encrypted message. However, a secret key is uesed for encryption, and if the secret key is lost or corrupted, there is a problem that the encrypted text cannot be decrypted. Additionally, malicious use of this encryption will cause problems. If encryption is used maliciously, the government cannot prevent criminal activity. Because of this law enforcement agencies need support for lawful interception to decrypt criminals or suspect’s ciphertexts. We need a key recovery system that can safely recover these secret keys or decrypt messages for lawful interception. There are two types of key recovery systems, a key escrow method and a key encapsulation method. This paper proposes secure schemes using key encapsulation. The key encapsulation method requires the key information used in the ciphertext, and the key information can be obtained from the KRF (Key Recovery Field). The obtained key can be used to decrypt the ciphertext. however, various security threats exist in key recovery system. Such as forgery and alteration of KRF, single point of failure, inability to recover keys, and collusion attacks. To solve these problems, we propose secure encapsulation schemes based on key recovery system.

Government agencies rely more and more heavily on the availability of flexible and intelligent solutions for the interception and analysis of Internet-based telecommunications. Unfortunately, the global lawful interception market has been recently put into a corner by the emerging sophisticated encryption, obfuscation and anonymization technologies provided by modern overlay communication infrastructures. To face this challenge, this work proposes a novel strategy for defeating the anonymity of traffic flows, collected within and at the exit of these anonymizing networks, relying on distributed flow-capture, characterization and correlation attacks driven by wavelet-based multi-resolution analysis. Such a strategy, starting from a properly formalized attack model, results in an effective and promising framework that can be easily deployed on real-life network equipment and can potentially scale by working according to different distribution/parallelization scenarios.

The recent Pegasus Project revelations of about half a lakh people across the world, including several in India, being targeted for cyber surveillance has firmly brought the spotlight on the Pegasus spyware, which is widely understood to be the most sophisticated smartphone attack tool. The revelations also mark the first time that a malicious remote jailbreak exploit had been detected within an iPhone. Pegasus is a spyware (Trojan/Script) that can be installed remotely on devices running on Apple’s iOS & Google’s Android operating systems. It is developed and marketed by the Israeli technology firm NSO Group. NSO Group sells Pegasus to “vetted governments” for “lawful interception”, which is understood to mean combating terrorism and organized crime, as the firm claims, but suspicions exist that it is availed for other purposes. Pegasus is a modular malware that can initiate total surveillance on the targeted device, as per a report by digital security company Kaspersky. It installs the necessary modules to read the user’s messages and mail, listen to calls, send back the browser history and more, which basically means taking control of nearly all aspects of your digital life. It can even listen in to encrypted audio and text files on your device that makes all the data on your device up for grabs. Since Pegasus hacks into the operating system, every activity within the phone can be monitored when the phone is switched on. It's as if someone is monitoring your phone activity over your shoulders. Pegasus operators can remotely record audio and video from your phone, extract phone messages, use GPS for location tracking, and recover passwords and authentication keys without the user even noticing. It's only when a device is sent for forensic screening, and experts look into the transfer of data to and from the phone, is when a potential attack can be confirmed. The dooming fact of it all is that since Pegasus exploits zero-day vulnerabilities, there is nothing that can be done regarding such breaches unless operating system developers proactively ship out an update to your phone, aimed to protect you from hi-tech malware like Pegasus.

Due to the increasing use of encrypted communication and anonymous services, many countries introduced new regulations that allow law enforcement to perform remote forensic investigations. During such investigations, law enforcement agencies secretly obtain remote access to a suspect’s computer to search for and collect evidence, including full copies of the (unencrypted) communication data. In this paper, we argue that the evidential value of the acquired evidence can be substantially increased by two technical methods: (1) employing integrity verification techniques offered by secure hardware, and (2) exfiltrating the decryption key of encrypted communication only in order to decrypt communication obtained by lawful interception. To prove the practicality of both methods, we design and implement TEE-BI, a solution for Trusted Execution Environment-based introspection. We deploy TEE-BI on an Android-based hardware platform featuring an ARM TrustZone and demonstrate the stealthy extraction of Secure Sockets Layer encryption keys from an Android userland application. We evaluate the effectiveness, performance, and compatibility of our prototype and argue that it provides a much higher level of evidential value than (the known) existing remote forensic software systems.

Today, in any society where crime is possible, communication surveillance is a necessary evil. This is because technologies now offer faster means of preventing crime while they are also capable of undermining the right to privacy. However, protecting privacy should not be mutually exclusive of ensuring public safety. This article argues that while communication surveillance may be permissible under narrow and limited circumstances, the laws made to regulate it in Nigeria, South Africa and Uganda do not comply with international human rights standards. In demonstrating this, this article analyses the major laws in these countries alongside the various international human rights principles that must be complied with in framing a rights-respecting law on communication surveillance. The major contribution of this article is that communication surveillance laws can be designed in compliance with international human rights standards in the countries under focus. These include Nigeria, South Africa and Uganda carrying out specific legal reforms targeted at problematic laws on communication surveillance in order to bring them in ine with international human rights standards. This can also be supported by developing a more robust set of comprehensive guidelines through the African Commission and Human and Peoples' Rignts and ensuring that Nigeria, South Africa and Uganda embark on critical and strategic training for stakeholders involved in the enforcement and implementation of communication surveillance laws in these countries

Communication interception for national security purposes, as well as for purposes of conducting a criminal investigation, is an invaluable asset of law enforcement agencies. In technical terms, this field has seen rapid advances in the last decade, while available software programmes and platforms for lawful interception (LI) are now able to monitor a broad spectrum of communication channels. Lawful interception of communications invariably intersects with fundamental rights and freedoms of persons in the European Union and the Member States. The purpose of this paper, as part of the discussion on the framework of lawful interception, is to present a study of advanced lawful interception software with its functionalities and processes, compare it with the most common lawful interception models and analyse the software architecture defined by the European Telecommunications Standards Institute (ETSI) as a general standard. While this particular model of LI architecture has initially been designed to intercept voice communications, it can be successfully applied to intercept communications over Internet Protocol (IP) channels. Finally, the paper offers a comparative insight into different kinds of LI software and their capabilities in line with communication interception regulation., Tajni nadzor komunikacija koji se rabi za potrebe nacionalne sigurnosti i u svrhu provođenja policijskih istražnih radnji vrijedno je tehničko sredstvo i koristan alat tijela policijskog, pravosudnog i sigurnosnog sustava. U tehničkim aspektima, ovo polje bilježi značajne pomake u posljednjem desetljeću gdje su dostupni softver i platforme za provođenje tajnog nadzora proširene mogućnostima nadzora širokog spektra različitih komunikacijskih kanala. Funkcija tajnog nadzora komunikacija u suštini predstavlja ograničenje temeljnih prava pojedinaca na području Europske unije i država članica. Svrha ovog rada kao priloga raspravi o mehanizmima tajnog nadzora jest izložiti osobine modela naprednog softvera razvijenog u svrhu tajnog nadzora, usporedba s najčešćim modelima tajnog nadzora i analiza softverske arhitekture definirane od strane Europskog instituta za telekomunikacijske norme (ETSI) kao dominantne norme u ovom području. Iako se ovaj model arhitekture tajnog nadzora razvio inicijalno za nadzor glasovnih komunikacija, može ga se uspješno primijeniti i za tajni nadzor komunikacija koje koriste internet protokol (IP). Konačno, članak pruža komparativni pregled različitog softvera tajnog nadzora u skladu s regulativom funkcije tajnog nadzora.

The fifth generation (5G) of cellular networks will bring 10 Gb/s user speeds, 1000-fold increase in system capacity, and 100 times higher connection density. In response to these requirements, the 5G networks will incorporate technologies like CUPS, NFV, network slicing, and CIoT. Each of these 5G features requires system adaptations to enable acquisition and forensic processing of cellular network evidence. This paper reviews the digital forensics mechanisms for Lawful Interception and user localization available in LTE and LTE-Advanced networks together with the associated evidence types, tools for forensic analysis, and supporting legal framework. The challenges and potential adaptations for retaining these capabilities in the future 5G networks are also discussed to outline the future research directions for cellular network forensics.

There has been an ongoing and heated public policy debate on the appropriate role of and limitations to government hacking in maintaining a proper balance of national security and privacy. Asserting that they are compelled to use government hacking tools to protect their countries and populations, law enforcement and government agencies are increasingly strident in expressing the importance of accessing and intercepting encrypted communication data. However, many non-governmental and civil society organizations and activists strongly oppose government hacking because they consider its methods and techniques are extremely invasive and potentially compromising to the fundamental right of privacy. They are also concerned that the implementation of hacking techniques or similar methods would weaken encryption standards and place the security of the Internet at risk. This paper presents an overview of the current status of government hacking and discusses challenges to lawful interception (LI) technology and rules. The current state of LI and government hacking in five countries is reviewed, and capability is assessed in terms of several widely publicized events, in an effort to analyze the limitations of current solutions. Finally, the open challenges to and future direction of government hacking are highlighted.

The traffic classification is the foundation for many network activities, such as quality of service (QoS), security monitoring, lawful interception, and intrusion detection system (IDS). A recent statistics-based method to address the unsatisfactory results of traditional port-based and payload-based methods has attracted attention. However, the presence of non-informative attributes and noise instances degrade the performance of this method. Thus, to address this problem, in this chapter, a hybrid clustering-classification method (called CluClas) is described to improve the accuracy and efficiency of network traffic classification by selecting informative attributes and representative instances. An extensive empirical study on four traffic data sets shows the effectiveness of the CluClas method.

The legal mandate for taking secret interception measures has increased. Law enforcement agencies can now not only monitor the communications of individuals when they are suspected of a crime. Secret interception measures can be taken before a crime is committed, if there are vague signs that an individual could perhaps commit a crime. This progress in preventive direction is a cause of internationalization, social and technological development and increased organized crime and terror. Therefore, the state and the public have a strong interest in gaining access to an increased amount of data. However, these coercive measures constitute an infringement of the individual's interest in privacy and protection of privacy. In this paper, based on a legal dogmatic method, the relationship between the rule of law security guarantees, personal integrity and crime prevention is analysed. The paper finds that it is important for both the individual and the state power that the legislature carefully considers whether a breach of personal integrity is justifiable. Moreover, some aspects of preventive use of coercive measures are of greater importance than others. These include the requirements for the functioning of the legislation in a democratic society, the precision and predictability of the law, as well as the existence of independent review, control and protection against abuse. A regulation without these requirements could lead to negative legal consequences and both mistrust and insecurity among citizens.

This paper presents a performance comparison of the cuckoo hash table and Bloom filter for packet classification with application in packet filtering with emphasis on lawful interception systems. Alongside enabling fast packet capture on commodity hardware, Data Plane Development Kit offers those methods already implemented in its library. We have chosen the cuckoo hash table as an exact classification method and the Bloom filter as a space-efficient probabilistic method that should have a better cache utilization and therefore more viable usage in performance critical systems, but allows false positive results. The execution time and memory requirements of the two methods are compared to determine whether the performance benefits of using a probabilistic method outweigh its drawbacks, and in which context those benefits arise.

Lawful interception was developed in a closed manner and is usable for pervasive monitoring, which the Internet community has deemed an attack. Further developing lawful interception technology is therefore counter-productive unless accompanied by an open re-evaluation of targeted monitoring requirements assigning equal priority to requirements for security, privacy, and Internet-scale interoperability.

Sniffers are among the commonest approaches for capturing network traffic activities and collecting digital evidences in cybercrime investigations. The ubiquity of instant messaging (IM) apps on smartphones has provided criminals with communication channels that are difficult to decode. Moreover, investigators and analysts of cybercrimes are encountering increasingly large datasets. To combat criminal activity, law enforcement agencies (LEAs) often rely on call-record analysis. In this paper, cybercriminals are investigated by network forensics and sniffing techniques. Retrieving valuable information from specific IM apps is difficult because the criminal’s IP address records are not easily recognisable on the Internet. Here, a criminal’s identity is located more effectively by a packet filter framework that isolates the WhatsApp communication features from huge collections of network packets. A rule extraction method for sniffing packets is proposed that retrieves the relevant attributes from high-dimensional analysis based on geolocation and a pivot table. The utility of this methodology is illustrated on real-time network forensics and a lawful interception system in Taiwan. The methodology also meets the ISO/IEC 27043:2015 standards of fear, uncertainty, and doubt avoidance. Besides supporting LEAs in discovering criminal communication payloads, prosecuting cybercriminals and bringing them to justice, it improves the effectiveness of modern call-record analysis.

The rise of cloud computing led to the need for highly flexible and dynamic infrastructures, which are able to handle a variety of different applications, the accruing big data and the requests of various customers simultaneously. By the use of virtualization modern datacenters provide an environment for cloud computing infrastructures. In these environments hundreds of thousands of physical servers host hundreds of thousands of virtual machines. This huge number of involved systems as well as additional virtual layer inside these environments impede lawful interceptions and network forensic investigations, which are performed to wiretap a suspicious system. Without any constraints, all phases of a network forensic investigation are faced with arising challenges like access and packet capture of virtual network interface cards, record the captured packets on hardware devices or the subsequent analysis of encapsulated network packets. Due to the huge number of relevant systems, the investigation gets inflexible and slow, which prevents a valid and usable wiretapping of a suspicious system. In this paper we propose an improvement of the packet capture process, which in turn enhances the recording and the subsequent analysis of the lawful interception. By reducing the number of relevant physical servers the number of involved hosting servers is decreased. In combination with further information of the virtual environment an enhanced process is possible, which ensures a valid lawful interception of the relevant network traffic.

3GPP Release 15, the first 5G standard, includes protection of user identity privacy against IMSI catchers. These protection mechanisms are based on public key encryption. Despite this protection, IMSI catching is still possible in LTE networks which opens the possibility of a downgrade attack on user identity privacy, where a fake LTE base station obtains the identity of a 5G user equipment. We propose (i) to use an existing pseudonym-based solution to protect user identity privacy of 5G user equipment against IMSI catchers in LTE and (ii) to include a mechanism for updating LTE pseudonyms in the public key encryption based 5G identity privacy procedure. The latter helps to recover from a loss of synchronization of LTE pseudonyms. Using this mechanism, pseudonyms in the user equipment and home network are automatically synchronized when the user equipment connects to 5G. Our mechanisms utilize existing LTE and 3GPP Release 15 messages and require modifications only in the user equipment and home network in order to provide identity privacy. Additionally, lawful interception requires minor patching in the serving network.