Tapping Into Web Telephony

Wiretapping takes on a whole new meaning now that phone calls are being made over the Internet, posing legal and technical hurdles for the FBI as it seeks to prevent the emerging services from becoming a safe haven for criminals and terrorists.

The FBI wants regulators to affirm that such services fall under a 1994 law requiring phone companies to build in surveillance capabilities. It is also pushing the industry to create technical standards to make wiretapping easier and cheaper.

But privacy advocates fear that because online eavesdropping technology is crude, tapping into the data stream for voice means getting more than what a court ordered - including possibly e-mail and other digital communications.

Service operators also question who should pay.

The increasingly popular "Voice over Internet Protocol," or VoIP, technology breaks phone conversations into data packets, sends them over the Internet and reassembles them at the destination.

Such calls, made on handsets or using computer microphones, are more efficient and cheaper than traditional calls, which require that a dedicated circuit remain open.

The technology creates gray areas in applying the 1994 Communications Assistance for Law Enforcement Act. That law required that then-emerging digital phone technologies, which are more difficult to wiretap than analog circuits, be designed so authorities could monitor them.

Lawmakers exempted information services like the Internet, but didn't anticipate Net-based voice calls.

Now, as the Federal Communications Commission considers the extent that high-speed Internet services through cable and DSL should be free of regulation, the FBI and the Justice Department want assurances that those services also build in surveillance functions.

Because VoIP is so new, standards don't exist for setting up networks, let alone for eavesdropping. Several groups, including the Telecommunications Industry Association, are working on VoIP surveillance standards.

In January, the FBI convened a summit for law enforcement and industry representatives to identify core issues.

"We're seeing major changes in the network, and we are trying to be ahead of the curve," said Les Szwajkowski, the FBI's unit chief for electronic surveillance.

On its face, the debate is less about law enforcers' surveillance authority and more about whether Voice over Internet companies need to provide capabilities ahead of time.

Authorities should be the ones providing and paying for such capabilities on a case-by-case basis, said Michael Altschul, general counsel for the Cellular Telecommunications and Internet Association.

lthough Szwajkowski said law enforcers are merely applying existing authority to emerging technologies, David Sobel of the Electronic Privacy Information Center worries about an expansion in wiretaps.

Some court orders cover only call information - who called whom and when - but not what they said. But Sobel said the call contents and data on other subscribers could get mixed in by FBI surveillance tools.

In addition, he said, once capabilities are enabled for voice calls, they could easily be extended to cover e-mail, Web traffic and more.

Sobel, at this week's Computers, Freedom and Privacy conference, also noted that under draft legislation from Justice, dubbed Patriot II, legal wiretap authority for phones would automatically cover e-mail and electronic calendars.

Szwajkowski said he was mostly worried about voice communications online, but acknowledged that the FBI later might be "potentially looking at other things as well."

So far, the FBI has not publicly cited any case in which VoIP impeded a wiretap. Szwajkowski indicated his efforts were more about looking ahead.

Some services, like Vonage and Net2Phone, say they are already working to incorporate surveillance capabilities, even though they believe they are under no legal obligation.

But the Internet poses challenges not found in phone networks.

For one, intercepting a voice stream means diverting it, making a copy and sending it along again, and tech-savvy criminals might be able to tell that the call was relayed through an intermediary.

By Anick Jesdanun