Re: How the Greek cellphone network was tapped.

On Sat, 21 Jul 2007 04:46:51 -0700 (PDT)
bear <bearsonic.net> wrote:

> 
> 
> On Thu, 19 Jul 2007, Charles Jackson wrote:
> 
> >An earlier post, talking about vulnerabilities and
the lack of an
> >appropriate market response, said:
> >____________
> >We're talking about phone calls -- did all of the
well-publicized
> >cellular eavesdropping (Prince Charles, Newt
Gingrich (then a major
> >US politician), and more) prompt a change?  Well,
there are now US
> >laws against that sort of phone eavesdropping gear
-- a big help....
> 
> Halfway, I think.  ISTR there are laws against
manufacture for sale,
> sale, purchase, or most usage of such gear - but no
laws against
> manufacture without intent to sell, posession, or some
exempted
> types of use of such gear.
> 
> Basically, owning such devices is not a crime, nor is
using them
> provided the "target" has been duly notified
that their call will be
> or is being intercepted.  So you can build the gear,
and you can demo
> the gear you've built on a call made for purposes of
demo-ing the
> gear.

Not as I read the statute (and of course I'm not a lawyer). 
Have a
look at 18 USC 2512
(http://www4.law.cornell.edu/usc
ode/html/uscode18/usc_sec_18_00002512----000-.html)

	any person who intentionally ...

	manufactures, assembles, possesses, or sells any
electronic,
	mechanical, or other device, knowing or having reason to
know
that the design of such device renders it primarily useful
for the
	purpose of the surreptitious interception of wire, oral,
or
	electronic communications, and that such device or any
component
	thereof has been or will be sent through the mail or
transported
	in interstate or foreign commerce;

	...

So simple possession of a surreptitious interception device
is illegal,
with exceptions for things like sale to law enforcement or
communications companies.

> 
> Consult a lawyer first, but I believe it may also be
legal to monitor
> calls made in a given location provided you first put
up a sign that
> says "all cell calls made on these premises will
be monitored" etc.
> But you can't legally buy or sell the equipment to do
it.

Probably -- that's not surreptitious.
> 
> > I think the most publicized cases of cellular
interception,
> > including the two mentioned above, were
interceptions of analog
> > calls.  Such interception was not too hard to do. 
In some cases you
> > could pick up one side of such calls on old
American TV sets (sets
> > that tuned above channel 69 on the UHF dial).
> 
> The technical requirement was for a TV with a UHF
analog *tuner* as
> opposed to a digital channel-selection dial.  The
channels that the
> cellular network used (still uses?  I don't know) were
inbetween the
> channels that were assigned whole numbers in TV tuning.
 So you could
> pick up some cell traffic if you tuned, for example, to
UHF TV
> "channel" 78.44.  But not if you tuned to
channel 78 or channel 79.

The specific law I had in mind when I posted that note was
the
ban on scanners capable of picking up cellular bands, as
well as
decoders to convert digital cellular signals to analog. 
See
http://findarticles.com/p/articles/mi_m3457/is
_n17_v11/ai_13701996
and http://www.eff.org/Legislation/?f=bills_affect_o
nline.notice.txt

There are other provisions in the law that bar interception
of
encrypted or scrambled signals, but I haven't waded through
the
verbiage enough to know if they apply here.



		--Steve Bellovin, http://www.cs.columbi
a.edu/~smb

------------------------------------------------------------
---------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography"
to majordomometzdowd.com

On Sat, 21 Jul 2007, Steven M. Bellovin wrote:

>Not as I read the statute (and of course I'm not a
lawyer).  Have a
>look at 18 USC 2512
>(http://www4.law.cornell.edu/usc
ode/html/uscode18/usc_sec_18_00002512----000-.html)

>	any person who intentionally ...
>
>	manufactures, assembles, possesses, or sells any
electronic,
>	mechanical, or other device, knowing or having reason
to know
>that the design of such device renders it primarily
useful for the
>	purpose of the surreptitious interception of wire,
oral, or
>	electronic communications, and that such device or any
component
>	thereof has been or will be sent through the mail or
transported
>	in interstate or foreign commerce;
>
>	...
>
>So simple possession of a surreptitious interception
device is illegal,
>with exceptions for things like sale to law enforcement
or
>communications companies.

Hm.  Okay, we're looking at the same law, and I am not a
lawyer
either; but I read "knowing or having reason to know
... that such
device or any component thereof has been or will be sent
through the
mail or transported in interstate or foreign commerce"
as a limiting
clause on what would otherwise be an unconstitutional law.

In the case of someone who manufactures and posesses such a
device,
but never sends it or its components through the mail nor
transports
it in interstate or foreign commerce, I don't think this law
gets
broken.  Despite intimidation tactics that do their best to
try to
spread the opposite impression, this is explicitly *not*
forbidden by
this law.

And the statute on using such a device, IIRC, also has a
limitation,
in that it bans using such devices *surreptitiously* - which
I think
permits non-surreptitious use such as demonstrations.

Still, it's a case of two reasonably educated people being
able to
look at the same statute and draw different conclusions:
Sooner or
later it will have to be decided in a trial to see who can
pay the
best lawyers^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H see
which
interpretation of the statute best serves justice.

				Bear

------------------------------------------------------------
---------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography"
to majordomometzdowd.com

On Sat, Jul 21, 2007 at 12:56:00PM -0400, Steven M. Bellovin
wrote:
> On Sat, 21 Jul 2007 04:46:51 -0700 (PDT)
> look at 18 USC 2512
> (http://www4.law.cornell.edu/usc
ode/html/uscode18/usc_sec_18_00002512----000-.html)
> 
> 	any person who intentionally ...
> 
> 	manufactures, assembles, possesses, or sells any
electronic,
> 	mechanical, or other device, knowing or having reason
to know
> that the design of such device renders it primarily
useful for the
> 	purpose of the surreptitious interception of wire,
oral, or
> 	electronic communications, and that such device or any
component
> 	thereof has been or will be sent through the mail or
transported
> 	in interstate or foreign commerce;
> 
> 	...
> 
> So simple possession of a surreptitious interception
device is illegal,
> with exceptions for things like sale to law enforcement
or
> communications companies.

	This language was originally aimed at "bugs",
hidden
microphones,  and other similar devices with essentially no
purpose
other than intercepting conversations. These devices are
usually called
"Title III" devices and are indeed illegal as
defined above except in
the hands of law enforcement and the like. Private use and
even
possession is forbidden. 
 
	And there have been many prosecutions for possession,
sale,
trafficking in, and importing "bugs" and similar
intercept hardware -
mostly of "Spy Shop" operators who import this
stuff from abroad and
sell it to sleazy private investigators and divorcing
spouses.

	This language has been around since the 1968 Omnibus Act
was
passed and was extended with the passage of the 1986 ECPA to
cover
"wire, oral, or electronic communications".  It is
not new and did not
result from the Newt Gingrich intercept or other more recent
incidents.

	AFAIK, (and IANL), the DOJ has rarely if ever applied Title
III 
to ordinary radio receivers or other hardware which has
general purpose
uses. Scanners and other radio receivers sold to the general
public are
regulated by the FCC under authority created in 1993, and
FCC rules were
substantially toughened around 1999 to require scanners not
be readily
modifiable to tune analog cellular frequencies and meet
certain design
criteria intended to make this harder and make it harder to
hear
cellular calls on image frequencies. These rules also make
it illegal to
modify scanners to tune cellular calls.

	I know of no court case which has established that sale or
possession of scanners or radio receivers built before the
ban on
cellular reception went into effect is illegal, and many
tens of
thousands if not hundreds of thousands of such radios are in
circulation
(and sold regularly on eBay).

	In recent years there have a small number of  prosecutions
for
sale or possession of radio equipment and software to
intercept
commercial common carrier pager transmissions under Title
III.   There
is at least one precedent that defines such software as a
Title III
device.

	This probably means that software specifically intended to
enable intercept of any other  signal that is not legal to
listen to
might also be declared a Title III device, though I am
unaware of this
having happened as of yet.

	However, even though the cell industry asked the FCC to do
so,
the FCC has declined to regulate test equipment - including
test
equipment that can tune and demodulate digital cellular and
other
forbidden RF signals - provided it is not marketed to the
general
public.   It is not illegal to possess or sell, import or
export,
manufacture or modify such gear though of course it is
illegal to
actually use such gear to intercept signals not included in
the list of
allowed to listen to signals in section 119 of Title III.

	And obviously regulation of test equipment would pose some
very
difficult problems - since many many common real world RF
tests require
DC to daylight  coverage without gaps to spot spurious
signals, mixing
products, noise, interference etc... and crippled test
equipment COULD
not do this job.


-- 
  Dave Emery N1PRE/AE, diedieconsulting.com  DIE
Consulting, Weston, Mass 02493
"An empty zombie mind with a forlorn barely readable
weatherbeaten
'For Rent' sign still vainly flapping outside on the weed
encrusted pole - in 
celebration of what could have been, but wasn't and is not
to be now either."

------------------------------------------------------------
---------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography"
to majordomometzdowd.com