Surveillance or Security?: The Risks Posed by New Wiretapping Technologies

The Risks Posed by New Wiretapping Technologies

Susan Landau

Author's Note
ix

Preface
xi

Acknowledgments
xv

1
Introduction
1

2 Communication Networks and Their Architectures
13

3 Securing the Internet Is Difficult
37

4 Wiretaps and the Law
65

5 The Effectiveness of Wiretapping
97

6 Evolving Communications Technologies
123

7 Who Are the Intruders? What Are They Targeting?
145

8 Security Risks Arising from Wiretapping Technology
175

9 Policy Risks Arising from Wiretapping
203

10 Communication during Crises
225

11 Getting Communications Security Right
233

Epilogue
255

Notes
257

Bibliography
339

Index
345

Throughout this book, when I say the Internet, I mean the packet-moving
layered architecture described in chapter 2. The Internet does not include
the applications-the Googles, Facebooks, and so on-that lie above this
architecture. Often the public conflates these two. I owe the observation
about the confusion to Stefan Savage, who pointed out that engineers and
the public have two differing definitions of the Internet. While there are
security problems in both Internets, the ones that make securing the Internet extremely difficult are the ones inherent in the packet-moving architecture. This book focuses on these problems.

Several years before this book was completed, I gave a talk at a company's
annual meeting for its technologists. There was nothing particularly
unusual about that; I was representing Sun Microsystems to technologists
of a major customer. I spoke on new technologies being developed in Sun
Labs. Someone from Microsoft also spoke, as did someone from Google,
Intel, and so on. The meeting was held at a combination hotel/convention
center. That, too, was not surprising. What was odd was the phalanx of
hotel security guards who carefully monitored the meeting room as three
hundred attendees trooped back and forth between talks, meals, and coffee
breaks.

Because outsiders had been invited to attend the sessions, there was no
company proprietary information presented at the talks. The hotel was
somewhat isolated; it was a large complex on the edge of several four-lane
roads. I did not really think much about the security guards until the
evening a guard walked into the elevator as I was going up to my room.
Except for the United States right after September 11, and traveling in the
Soviet Union and China, I could not recall ever having been in a place
with so many security personnel, and I commented on the large number
of guards I had seen in the hotel.

"That's good," he replied. I thought about this a day later, as the hotel's
shuttle service took me back to the airport. The driver had a uniform that
included a white shirt with epaulettes. I have taken shuttles in more states
of the union and to and from more airports than I care to count. Some
shuttle services are more professional than others, but never before had I
been driven to the airport by someone who looked like he worked for the
military in a third-world dictatorship. That's when I began to reflect on
the security guards who had stood before the conference room.