142,99 €
Mehr erfahren.
- Herausgeber: John Wiley & Sons
- Kategorie: Wissenschaft und neue Technologien
- Sprache: Englisch
In cyberspace, data flows transit massively and freely on a planetary scale. The generalization of encryption, made necessary by the need to protect these exchanges, has resulted in states and their intelligence services forgoing listening and interception missions. The latter have had to find ways to break or circumvent this protection. This book analyzes the evolution of the means of communication and interception, as well as their implementation since the advent of the telegraph in the 19th century. It presents this sensitive subject from a technical, historical and political perspective, and answers several questions: who are the actors of interception? Who has produced the recent technologies? How are the markets for interception means organized? Are the means of protecting communications infallible? Or what forms of power do interceptions confer?
Sie lesen das E-Book in den Legimi-Apps auf:
Seitenzahl: 445
Veröffentlichungsjahr: 2023
Ähnliche
Table of Contents
Cover
Table of Contents
Title Page
Copyright Page
Introduction
1 History and Repertoire of Communication Interception Practices
1.1. Military interceptions during the war
1.2. The interception of international communications: espionage, surveillance, war
1.3. Interception of diplomatic correspondence
1.4. Political surveillance: targeted and bulk interceptions
1.5. Criminal interceptions
1.6. Police, justice: the fight against crime, lawful interceptions
1.7. On the usefulness and effectiveness of interceptions
2 The Central Issue of Encryption
2.1. The capabilities required for interceptions
2.2. Protecting yourself against the threat of interceptions: encryption
2.3. Attacking encrypted communications, circumventing the hurdle of encryption
3 Power Struggles
3.1. State pressure on the industry: cooperation or coercion logics?
3.2. The accounts of whistleblowers and their analyses of the balance of power between the state, the citizen and companies
3.3. Limits imposed on the state’s power to control technology
3.4. Trust
3.5. Conclusion
Appendices
A.1. Legal texts
A.2. Timeline of technologies, standards and sciences
A.3. Chronology of political and economic events
A.4. Reports on the interception of communications
A.5. The international market of lawful interceptions
A.6. The international cryptography market
References
Index
Other titles from iSTE in Science, Society and New Technologies
End User License Agreement
List of Tables
Chapter 2
Table 2.1.
The evolution of etching precision
Table 2.2.
Some facts regarding the questioned security of BlackBerry device
...
Table 2.3.
Some definitions of backdoors and trap-doors
List of Illustrations
Introduction
Figure I.1.
Elementary diagram of the interception principle
Chapter 1
Figure 1.1
“The electric telegraph shocked by the news it was entrusted to t
...
Figure 1.2
Average number of people arrested due to interception practices i
...
Figure 1.3
Number of interception authorizations issued, and total number of
...
Figure 1.4
Statistics produced from the American Wiretap Report41 annual dat
...
Figure 1.5
Average number of arrests made based on interceptions, in the Uni
...
Figure 1.6
Number of interceptions where the communications requiring proces
...
Chapter 2
Figure 2.1
What happens to the data resulting from interception?
Figure 2.2
Factorization records (reconstructed from [BOU 20]). On the absci
...
Figure 2.3
How the Royal Canadian Mounted Police interception of BlackBerry
...
Chapter 3
Figure 3.1
Organization of the interception system within the operator‘s inf
...
Figure 3.2
Map of states taking part in the Wassenaar Arrangement (compiled
...
Figure 3.3
Diagram of interceptions and technologies.
Figure 3.4
Diagram of interceptions and technology actors.
Figure 3.5
Interception technologies are dependent on the evolution of scien
...
Guide
Cover Page
Title Page
Copyright Page
Introduction
Table of Contents
Begin Reading
Index
Other titles from iSTE in Science, Society and New Technologies
Wiley End User License Agreement
Pages
iii
iv
ix
x
xi
xii
xiii
xiv
xv
xvi
xvii
xviii
xix
xx
xxi
xxii
xxiii
xxiv
xxv
xxvi
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
217
218
219
220
221
Series EditorDaniel Ventre
Electronic Communication Interception Technologies and Issues of Power
Daniel VentrePhilippe Guillot
First published 2023 in Great Britain and the United States by ISTE Ltd and John Wiley & Sons, Inc.
Apart from any fair dealing for the purposes of research or private study, or criticism or review, as permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored or transmitted, in any form or by any means, with the prior permission in writing of the publishers, or in the case of reprographic reproduction in accordance with the terms and licenses issued by the CLA. Enquiries concerning reproduction outside these terms should be sent to the publishers at the undermentioned address:
ISTE Ltd
John Wiley & Sons, Inc.
27-37 St George’s Road
111 River Street
London SW19 4EU
Hoboken, NJ 07030
UK
USA
www.iste.co.uk
www.wiley.com
© ISTE Ltd 2023The rights of Daniel Ventre and Philippe Guillot to be identified as the authors of this work have been asserted by them in accordance with the Copyright, Designs and Patents Act 1988.
Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s), contributor(s) or editor(s) and do not necessarily reflect the views of ISTE Group.
Library of Congress Control Number: 2023936114
British Library Cataloguing-in-Publication DataA CIP record for this book is available from the British LibraryISBN 978-1-78630-802-3
Introduction
For several decades, the practices surrounding the interception of communications have steadily occupied a prominent place in the news, giving rise to societal, political, legal and sociological debates. The risks of the democratic states’ abuse of practices reminiscent from totalitarian regimes have been repeatedly pointed out by the advocates of freedom in the western world. The further the communication technologies evolve, the more communication spaces are deployed, and the stronger the temptations to control what is said and written seem. Alongside targeted interceptions – aiming at one or a few individuals in particular – the possibilities for bulk interception have multiplied. These two practices have quite a long history. But the advent of the Internet society (“cyberspace”) has undoubtedly marked a turning point in the practices and ambitions of those who resort to interceptions. Despite requiring technically complex operations, the very architecture of cyberspace – a planetary network of continuous flows – facilitates the exploitation of these masses of data, which simultaneously provide information about individuals, observable one by one, and human groups. While communication technologies have multiplied and extended, interception technologies have also done so, be it for security, surveillance or control purposes, for economic, political or military espionage, or for other applications. The practice seems unabashed: all states practice legal interceptions. There are many who practice interceptions outside the legal framework, or have failed to define a proper set of rules. Interceptions seem to be practiced all around, with many reasons legitimizing their use. They also benefit from a panoply of technologies which allegedly have no limits. Such commercial products are capable of intercepting almost every communication, by wire or wireless, regardless of the protocols or the media the communication infrastructures pass through (land, air, sea). The debates over the past decade have emphasized the erosion of trust between allied countries that have never ceased to spy on each other, intercepting the communications of their political or industrial leaders; debates have also insisted on the weakening of the rights and freedoms of citizens all over the world. While the responsibility of the actors deciding on the implementation of interceptions is essential, the role of technology is also relevant. Because, beyond the law itself, technology determines what can actually be done. The role of inventors, researchers, engineers, developers, industrialists and merchants is just as crucial as that of the customers who benefit from such technologies, even if the latter are not always totally aware of how technology works, nor the effects it may produce. Not only do the end users of interception depend on technologies they cannot master, but also on the designers, technicians and engineers who certainly master their technical side, but who sometimes remain distant from the social and political implications of their work. There are many who navigate in a universe of misunderstanding, ignorance, beliefs and even the unthought-of.
Definitions of interception (and some associated notions)
Let us start by clarifying the terms of our study.
If we refer to the definition proposed by the Centre national de ressources textuelles et lexicales1 (CNRTL, National Center of Textual and Lexical Resources), interception denotes at least two categories of action. The first category involves detaining the object or message so that it does not reach its recipient, whereas the second one refers to the act of reading a message intended for a third party. Interrupting the progress of the message can also result in its destruction. These two facets of interception are broken down as follows by the CNRTL:
The action of taking something in passing, of diverting it from its destination; the action of becoming aware of a conversation, of a message intended for others; the action of hindering the spread of something, someone’s progress; in the military field, the attempt at destroying an enemy target (ship, plane, missile) in motion.
Interception is also defined in legal technical or political documents. Thus, the ITU (International Telecommunication Union) formulates a definition which insists on the technological dimension of interceptions. It contemplates several practices such as:
the acquisition, viewing, capture, or copying of the contents or a portion thereof, of any communication, including content data, computer data, traffic data, and/or electronic emissions thereof, whether by wire, wireless, electronic, optical, magnetic, oral, or other means, during transmission through the use of any electronic, mechanical, optical, wave, electromechanical, or other device [INT 12].
Interception refers to a set of practices, which are reserved for specific actors, mainly the state, for intelligence purposes and/or for fighting against crime, terrorism and for the defense of national security: “Interception includes all acts of monitoring, copying, diverting, duplicating and storing communications in the course of their transmission by or for law enforcement or intelligence agencies” [PRI 21].
Interception can be implemented on all communication vectors, and applied to all types of content (voice, image, text). It involves the use of diverse interception means, depending on the media and the targeted content: “The term ‘intercept’ is defined in 18 U.S.C.§ 2510(4) to mean the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device” [DEP 20].
An “intercept” is the term used to describe the covert interception of a private communication by intelligence services or law enforcement agencies. The interception of telephone calls – e.g. by use of wiretaps, etc. – is perhaps the best-known example. However, under the Regulation of Investigatory Powers Act 2000 (“RIPA”), “intercepted communications” also covers other kinds of communications, including mobile phones, email, fax and ordinary post [JUS 06].
A distinction should also be made between interception and surveillance, even if the two practices are closely related.
For the CNRTL2, surveillance is:
The action or act of watching over a person that you are responsible for or interested in; the monitoring of suspicious persons or risky environments by the police, in order to prevent criminal actions and guarantee public security.
According to the CNRTL3 dictionary, to surveil is to:
Observe someone with a certain attention to understand their behavior; to watch over a person that you are morally responsibility for or interested in; to observe the actions of potential adversaries, the places where danger may arise from. A sentry surveilling the bridge; to be kept informed about the activities of people deemed suspicious, the behavior of communities, groups or places at risk, by police means.
Therefore, interception is generally only one component of surveillance. It is possible to monitor individuals without necessarily resorting to the interception of their communications. But when surveillance is exercised over communications, a whole set of practices and techniques take place alongside interception, such as observation, collection, etc., creating a long chain of processes into which interception is inserted:
Communications surveillance is the monitoring, interception, collection, preservation and retention of information that has been communicated, relayed or generated over communications networks to a group of recipients by a third party […] In turn, communications surveillance is no longer limited to intercepting a messenger or attaching a ‘crocodile clip’ to a telephone line. There are now four main methods of communications surveillance: internet monitoring, mobile phone interception, fixed line interception, and intrusion technologies (which are explained in detail below). Surveillance over internet, mobile, and fixed-line networks can take place with or without the cooperation of the network operator… [PRI 18].
The interception of communications is simply one type of covert surveillance among the many used by law enforcement agencies and intelligence services in order to prevent and detect serious crime (including terrorist activity). However, for reasons that are examined in detail below, UK law has long treated the use of information gained from intercepted communications differently from other forms of surveillance [JUS 06].
Therefore, surveillance cannot be reduced to the sole practice of interceptions.
Interception involves performing an action on the telecommunications system (modifying or tampering with the system or its operations, monitoring transmissions). This should result in the provision of the communication’s contents to a person who is not its originally intended recipient. Interception can take place during the transmission of information, or in a deferred manner during its storage, for example, before or after the transmission:
Interception is the obtaining of the content of a communication – such as a telephone call, email or social media message – in the course of its transmission or while stored on a telecommunications system [HOM 17].
The principle of interception can be summarized in a simple diagram. If we consider two interlocutors, A and B (two individuals, groups or “actors”) who exchange one or more messages, interception is the intervention of a third (C) uninvited party the exchange, whose aim is to be able to hear, read or know what is being said or written within this intimate space formed between A and B.
Figure I.1.Elementary diagram of the interception principle
This implies that for C, the exchange between A and B contains a certain value, a (real or potential) interest. C hopes to draw some benefit from, or to gain an advantage over A, B, or other parties not directly involved in the exchange between A and B. In the view of A and B, entity C is an intruder who undermines the intimacy space conveyed by communication.
This basic scheme will be further discussed later, as it can be supplemented and made more complex by integrating other actors, in particular, those related to technology.
Let us recall some of the features characterizing the interception of communications:
– The access to the very contents of the exchanges is the main specificity of interception. Does the access to metadata (and not to the content) imply interception, and if so, which legal framework governs this?
– Interception does not appear to be strictly limited to data-in-transit, but can also apply to statically stored data in a storage space or “data-at-rest” (but in that case, what is the difference between interception, access and intrusion?).
– Interception is one of the modalities of surveillance, which it can supplement and accompany.
– Interception is of interest only insofar as the message’s sender and receiver are unaware of its existence, and ignore the presence of an indiscreet ear or furtive glance over their communications. But, as will be shown, sender and receiver have learned to adapt, even when their communications are intercepted or threatened with being intercepted. Resistance tactics or strategies have been developed.
The notion of interception is thus broken down into legal, strategic, tactical, bulk, passive and active interception (non-exhaustive list). The distinction between targeted interception and non-targeted or bulk interception is key.
Targeted interceptions are those aimed at one or more distinct individuals, in a specific manner. Targeted interception can be used on UK citizens who are suspected of illegal activity. It can be conducted on a specific person or a specific location by the police, intelligence agencies or the armed forces. The request must be specific as to who or what will be spied on and where. Targeted can also be used in a thematic way. Thematic means groups of people, an area of locations, a number of organisations4.
States have access to a number of different techniques and technologies to conduct communications surveillance of a targeted individual’s private communications. Real-time interception capabilities allow States to listen to and record the phone calls of any individual using a fixed line or mobile telephone, through the use of interception capabilities for State surveillance that all communications networks are required to build into their systems. An individual’s location can be ascertained, and their text messages read and recorded. By placing a tap on an Internet cable relating to a certain location or person, State authorities can also monitor an individual’s online activity, including the websites he or she visits [LAR 13].
Bulk interceptions differ from the previous ones both by their target and their technological dimension: capturing data in larger volumes, for example, by exploiting the data flows circulating on the Internet, they are not used in the context of surveys, but rather for intelligence collection: “Bulk interception is a vital tool designed to obtain foreign-focused intelligence and identify individuals, groups and organizations overseas that pose a threat to the UK” [FAC 15]:
[Bulk interception] is done by tapping internet cables carrying the world’s internet traffic. The intelligence agencies now have the lawful power to tap these cables and grab chunks of internet activity. Bulk interception is broad, rarely based on a specific investigation and is used to look for plots, behavior or activity which may potentially be of a criminal or terrorist nature5.
Interception is the ability to listen in on what someone says or writes. There are two types of interception in the Investigatory Powers Act; targeted and bulk. Targeted is used when the focus of the investigation is known. Bulk is used when the target is unknown. Bulk interception describes the gathering of large chunks of internet traffic from around the world. Because bulk is used to discover rather than investigate it could be described as a form of pre-crime investigation6.
Bulk interceptions began long before the recent harshly criticized American intelligence agency programs:
Mass interception of telegrams, known as “cable censorship”, began along with postal censorship on 2nd August 1914, days before the formal outbreak of the First World War. The primary aim in the beginning was to ban enemy diplomatic traffic altogether rather than to selectively intercept it. Censors were installed at London cable offices and in Porthcurno, Cornwall, which had by then become a relay hub for the world’s international submarine cables [KEE 17].
The second essential notion is that of “data”, which can be classified into several categories. The term “data” does not only refer to the content (the information communicated), but also to traffic data (i.e. its communication), metadata (a category of data that is differentiated from the content7 itself), computer data, location data, stored communication data (“data-at-rest”, “in the cloud”, “in storage”), dynamic data (“data-in-transit”, “data-in-motion”), personal data, private data, sensitive data, confidential data, secret data, etc.
Dynamic data, or data-in-motion, are the main target of interceptions.
Our definition of the interception of communications: rebalancing an informational asymmetry
Interception creates or reveals power relationships that aim to rebalance an informational asymmetry existing between the parties involved in a communication, and those who are left outside of it.
The communicating parties thus create a confidentiality space, and those who are excluded feel that this situation is prejudicial to them, or that the access to knowledge is essential to them.
The variables at stake are:
– the communication space, the target area of interception attacks, essentially involving communication technologies;
– the defensive dimension: the protection techniques (against interception threats);
– the offensive dimension: interception technologies.
The technological dimension is key. Law itself may seem constrained by the technology whose developments it strives to integrate:
Section 702 itself is a relatively new amendment to the FISA statute […] It was written to accommodate prior developments in technology, but also intended to adapt to future changes by remaining technology neutral8.
Even the Supreme Court has begun to recognize the limitations on its ability to set out a legal framework that suitably marries Fourth Amendment doctrine with emerging technology9.
State of the art of recent research on interceptions
CITs (Communication Interception Technologies)10 and more broadly, electronic surveillance technologies, ignited hot debates in the 1980s [OFF 85, OFF 87], and then specifically at the end of the 1990s, with the reports regarding the Echelon network [WRI 98, BEC 99, CAM 99, SCH 01]. These debates were renewed in the early 2010s, even before Edward Snowden’s revelations [HOF 05, DEA 10, BUT 12, CON 13, BEL 14]. CITs are portrayed as essential “weapons” in the fight against crime, namely as indispensable police intelligence tools. Apart from these few academic references and reports produced over the period, it becomes clear that the volume of works specifically addressing interception technologies in the humanities and social sciences remains relatively low. Legal and ethical debates take the lion’s share (interceptions, and more broadly surveillance, motivate debates on the right to privacy), and the theme of the surveillance society or panoptic society has declined in sociological and political works. These debates mainly focus on all kinds of interception and surveillance practices, the effects produced, the organizations that deploy them, their consequences on societies, the international scene or individuals.
Over the past decade, works in the human and social sciences that addressed the phenomenon of interceptions have essentially adopted three types of approach: the legal, the historical or the political/sociological/geopolitical approach.
These works are indicative of the shock wave caused by the Snowden revelations, which manifested through debates on a planetary scale regarding the questions of surveillance, freedoms (of speech, of opinion, etc.), privacy, as well as Internet geopolitics [CLE 14] or governance, digital sovereignty, data protection, security and national defense, the configuration of the balance of power in the international scene, the relationship between economy/industry, citizens and the state.
The legal approach
Legal studies deal with interceptions in several aspects and propose to:
– compare the legal regimes applicable to interception in several countries [GAL 16a] through their particularities or convergences in terms of the distribution of interception powers, the levels and methods for protecting communication secrecy, the conditions for content interception, the access to traffic and user data, the access to stored data [POL 16];
– debate the question of fundamental rights (freedom of expression, respect for the secrecy of correspondence, etc.) in contrast with the evolution of national laws on interception [MAK 11; NGW 17];
– analyze the role of each actor involved in interception procedures from a legal perspective [GAL 16a];
– discuss the limits to weight-of-evidence approaches regarding the data collected during interceptions [GAL 16b];
– consider the conditions for respecting individual rights in the face of illegal interception, or the abuse of legal interception [EIJ 18];
– confront existing law with technological developments and the adaptation of crime to its environment (e.g. when criminal interceptions exploit Wi-Fi communications) [THO 15].
The historical approach
Similarly to the study by David Sherman [SHE 16], which focuses on the Bletchley Park code breakers since the start of World War II, many works explore particular moments in history (interceptions during World War I, World War II, the Cold War, etc.).
On the contrary, the work by Bernard Keenan [KEE 16; KEE 17] on interceptions covers several centuries. It offers a chronology of interceptions in England, which he classifies into three periods: the so-called royal “prerogative” phase, from 1590 (or 1634) to 1984; the “obfuscation” phase from 1985 to 2015; and the so-called “transparency” phase, since 2016.
The first phase (1634–1984) began with the English Royal messenger service opening up to public use, introduced as a means for disseminating knowledge, information and commerce. The centralized control of information paved the way for new intelligence methods, in fields as diverse as the fight against crime and against any form of political conspiracy, whether domestic or foreign. From a legal point of view, since those times, the secrecy of correspondence has been a principle enshrined in law (1657)11, establishing that mail can only be intercepted and opened with the authorization of a judge. The law makes it possible to sanction anyone who interferes with the Post Office. However, authorizations are not expected to ensure control over state-related power practices, which have been covered by secrecy until the 21st century.
The second period (1985–2015), known as the “obfuscation” phase started with the Malone case, named after a criminally prosecuted dealer who forced the issue in the High Court in 1979, after he found out that the police had been tapping his telephone line. The High Court dismissed Malone, recalling that there is nothing illegal about wiretapping, with the principle of privacy protection not being contemplated by Common Law. Malone then brought the case before the European Court of Human Rights in Strasbourg. The latter considered that Article 8 of the European Convention on Human Rights grants the British people a right to privacy, and therefore, that the interception of communications interfere with this right. To make such interceptions legal, several conditions must be met, under Article 8: the country must specify the legal limits to interception, and the legality of interference has to comply with two principles: necessity and proportionality. In 1985, the United Kingdom adopted a law (Interception of Communication Act, 1985), passed by the Thatcher administration, which privatized telecommunications companies and allowed the state to maintain its prerogatives, by retaining its interception power. This law from 1985 was replaced with the RIPA (Regulation of Investigatory Powers Act) in 2000. This text was sufficiently imprecise or general to grant the authorities ample powers, applicable to all kinds of technologies. The text was intended to be technologically neutral: “its high degree of abstraction served to ensure it was ‘technology neutral’, in that it established general rules applicable across different forms of digital media” [KEE 17].
This method is what Keenan denominates obfuscation12. Duncan Campbell’s revelations (on the nature of the Echelon network) as well as those by Snowden, confirmed the existence of state practices neglecting citizen’s rights, by capturing massive amounts of data from ordinary individuals. The scope of powers related to interception is broad, giving authorities free rein to conduct mass interception programs, share data with third countries, hack systems, impose constraints on operators, etc. The opacity surrounding these practices was such that none of the organizations (Investigative Powers Tribunal, Interception of Communications Commissioner) that were expected to monitor interception practices and formulate opinions or receive complaints from citizens seemed to be fully aware of their extent.
The debates opened by Snowden and some pro-privacy organizations coincided with a growing awareness of the unprecedented ways in which life lived online renders us transparent to both private companies and state actors. This is the third period that Keenan proposes to consider, which he calls the transparency phase, starting in 2016.
According to Keenan, what has changed in recent decades is how the individual is now less central. The individual is no longer the essential “reference point”, with surveillance powers having the ability to reach not only individuals, but entire groups; these individuals and groups can be defined according to characteristics suggested by their data. The fact that the states can collect or intercept data on a massive scale creates the conditions for mass surveillance. This does not imply that all individuals in society are subject to specific observation, but rather that the data drawn from each of us can be present in an analysis process.
The political, sociological, geopolitical approach
The UTIC project
The UTIC research project (research project carried out in France, coordinated by Didier Bigo – Science Po Paris – and funded by the French National Research Agency) focused on “the uses of technologies related to the interception of telephone and internet communications by the police and intelligence services, and by their private providers”, specifically addressing the case of France in its European environment. The project was carried out over the 2014–2019 period, set within the post-Snowden context, a period of controversy and polemics around state practices in terms of the interception of communications and their consequences on modern societies, democracies and individuals. The project focused on four areas: surveillance logics, the justification discourse, the redefinition of the boundaries of democracy and state sovereignty.
The project analyzed several aspects of interception:
– Thanks to the Internet, states have a greater oversight on companies through the surveillance of their communications. New technical capacities have contributed to establishing its massive character. Has the fact that they are carried out in bulk, without any individual warrants, changed the nature of the interception? How do we define their bulk character? Does it infringe on the privacy of all the individuals whose data are collected in this way?
– Bulk interceptions are justified by various purposes: the fight against crime, terrorism, economic or political intelligence, etc. The justification for the bulk nature of interceptions changes depending on the intelligence services involved within the same country, and from country to country. The project attempted to analyze these relationships.
– The internationalization of security issues, coupled with the global dimension of the Internet, gives a new dimension to interception and surveillance practices. Data collection escapes the national framework, data are exchanged between intelligence services and private operators that are internationally engaged in data collection, retention and processing. The project focused on these hybridizations (public–private, alliances, international cooperation, etc.) and their effects on the definition of security goals, interception practices, the assessment of the risks and effects produced, and in particular, on fundamental rights.
The project resulted in the production of a series of reports, whose main conclusions are summarized as follows:
– The report produced by Guillot and Ventre, “Capacités d’interception et de surveillance. L’évolution des systèmes techniques”, explores the wide range of technologies or interception techniques available in the era of electronic communications, as well as the means to protect ourselves against these practices and counter them. “Understanding the techniques, technologies, capacities, resources, means used, deployed and developed, is essential […] Because there can be no sound measurement of what is at stake without a proper assessment or understanding, even if minimum, of what is possible” [GUI 19].
– The first part of the report “Techniques et contre-mesures techniques” [SIL 18] specifically addresses the use of deep packet inspection (DPI) in French and European surveillance. For its authors, in terms of bulk interceptions, law is continually evolving in order to adapt to technological developments. It is therefore not so much that the law constrains technological capacities and their uses, but rather that the latter impose themselves over the law. It is the meeting between the economic interests of companies and the states’ security goals that seems to dictate the rules of the game. DPI technologies have been misused in several states. “The tacitly accepted limit between the legitimate or illegitimate use of these technologies, depending on whether the state is ‘democratic’ or not, and those of the purposes, is subtle” [SIL18, p. 77]. The second part of the report analyzes the phenomenon of resistance to surveillance.
– Bonelli and Ragazzi [BON 14] recall that in a highly technical context, intelligence still resorts to traditional collection and information processing techniques, since the practices of security professionals are rooted in institutional habits.
– The contribution by Bigo and Bonelli [BIG 19] also discusses intelligence actors and their practices, stressing the heterogeneity of the world of intelligence, particularly when it comes to surveillance techniques:
it seems that digital techniques are put to use in two ways. First, they can be used in support of the more traditional framework of conjectural reasoning in order to provide necessary evidence for the judiciary. Second, they can also be used to impose a preventive and predictive reasoning. The logics and mechanisms of reasoning that are specific to each universe and its actors – be it the police, military, or communications – are therefore to be considered more important than the technology itself themselves. In other words, it is not computer technology itself that plays a role, but rather the entry of computer scientists into intelligence circles and the manner in which they frame problems in relation to technology.
– In “Seeing like big tech: security assemblies, technology, and the future of state bureaucracy”, Tréguer [TRE 19] depicted the growing power of private companies as a result of their control over data. To exercise power over a digitized world, the state must reason as the Big Data industry does, adapt to its logics and appropriate them. It must surpass the simple public–private partnership and traditional arrangements aimed at regulating telecommunications networks.
– The report written by Laurent and Kheloufi [LAU 18] offers a legal analysis focusing on two categories of standards applicable to the exchange of individual communications: the “secrecy of correspondence” (SC) and “personal data protection” (PDP). According to the authors, the first was replaced by the second in our cybernetic universe. They concluded that despite the adaptation of legislation to enhance personal data protection, “states have not relinquished their right to exercise digital surveillance”.
– In “Les gouvernances mondiales fragmentées de l’Internet” [LAU 19], the more global issue of Internet governance is discussed. The Internet’s power, its network infrastructures, applications, the organization of its architecture, the role of states and the sharing of responsibilities with the private sector, the possibility of imposing its rules, has a tremendous grip over data, deciding on their flow, and possibilities for interception and the control of planetary communications.
The work of Joseph Fitsanakis
Since the 19th century, governments have always made sure to grant access to user communications, legitimized by the fight against crime and national security requirements. They did this without encountering any real resistance from the telecommunications operators. In the 1930s, the arrival of the telephone hardly changed this situation, which is why many states nationalized their telephone systems, considering them sensitive, in the same way as the army or the police. The United States was an exception, with the telephone being privatized, but the state exercised a strict control over it. These historical periods date the closely cooperative relationship between telecommunication companies and the state (its police, intelligence agencies). But in the 1980s, two factors upset this balance. First of all, digitization revolutionized the telecommunication sector, technically authorizing the creation of a wide range of new services, which can be perceived as obstacles to state interception capacities. Second, a political factor threatened these capacities, namely market deregulation and the privatization of companies in the telecommunication sector (during the mandate of Reagan in the United States and of Thatcher in the United Kingdom). This signaled the end of the AT&T monopoly in 1984 (United States) and the privatization of part of British Telecom in 1984 (United Kingdom), inducing a market fragmentation and an increase in the potential number of interlocutors for the state. Interactions between state security agencies and the private sector are becoming more complex.
The technological transition imposes a rapid evolution of interception means and for the governments, this requires guaranteeing the possibility of their implementation. They have pursued this goal via regulations in order to limit the network’s technical means to ensure information security. It is to this end that the governments voted for CALEA (1994, United States) and RIPA (2000, United Kingdom). In both cases, the main measure involved compelling telephone operators to adapt their systems and technologies to meet the state’s interception needs. Note that these laws do not define technical standards or specific criteria, but simply establish the principle of obligation.
The work also proposes a state-of-the-art of the literature, reaching back to the 1960s in the United States and the United Kingdom. From the works it lists, let us outline a number of key ideas: telecommunication operators responded without any resistance to police requests for interception [DAS 59]; it denounced the practices of an intrusive American government, exercising citizen surveillance by resorting to illicit means (in the 1970s); a mistrust of governments and security authorities then set in, official data on interceptions were called into question, intelligence agencies were suspected of hiding the reality of their practices to escape their responsibilities. Since the Watergate scandal, the criticism of the state only deepened. Interception is one of the most important practices for western security apparatuses, to the point of assuming banned uses, with the excesses being facilitated by the close, intimate relationship between security or intelligence agencies and operators.
The author usefully recalls the taxonomy of interceptions which had been proposed in the United Kingdom in the report by the expert “Smith Group 2000” [SMI 00], which draws a distinction between three types of interception:
– Active: designates software interception, configured by an Internet service provider (ISP) and which is applicable, for example, to email surveillance. Targeted emails are copied and sent to the authorities’ server.
– Semi-active: a collection unit is placed on the premises of the intelligence agency (the GCHQ, Government Communications Headquarters) and connected to the network. The communications of persons under surveillance are routed via the collection unit; pre-selected IP addresses are assigned to people under surveillance.
– Passive: a data collection unit is connected to the network. But in this configuration, the unit permanently supervises the traffic. State agencies are here to supply, install and maintain hardware and software, and the unit can intercept without notifying the provider.
In semi-passive and active models, systems are an integral part of telecommunication networks.
The important development in terms of interception practices lies in the transfer of the interception burden to the industry. Contrary to the practices which had prevailed until then, interception operations are now implemented by the operators.
Most of the publications on interceptions focus on the practices and their legal and political dimensions. Apart from the specialized technical literature (computing, telecommunications), only a few works discuss the interception technologies themselves, what they concretely make it possible to achieve, the way in which they operate, the way in which they are designed and by whom (researchers, engineers, industrialists, hackers, etc.), how they are disseminated and by whom (companies, markets, customers), the effects they produce on the tactical, strategic and political levels, and broadly speaking, in terms of power.
In an article published in 2018, Akin Unver [UNV 18] explored the issues raised by digital surveillance in democracies and autocracies, as well as the mechanisms that characterize the Surveillance Industrial Complex (SIC). The place of technology, and more specifically, of the technological race, is at the center of his political analysis of the surveillance-privacy protection dilemma. This author believes that it is not so much the intentions that make surveillance problematic, as its economic model. While the debates centered on the challenges raised by the antagonism between security and privacy protection are not entirely new, the terms have radically changed not only due to the evolution of the technological environment, but also the political scene. The author dates this transition on September 11, 2001:
Rapidly changing connection technologies create a system where digitized personal information and official data now have multiple points of interception, cannot reliably be deleted, don’t expire and can be disseminated across digital platforms at an infinite rate and dizzying speed [UNV 18].
Unver draws a distinction between two categories of techniques or practices: those organized on the basis of surveillance technologies and those bypassing surveillance. These technologies evolve concomitantly and equilibrate the balance of power: “[…] technology itself is neutral and supports all sides of the spectrum in comparable measure” [UNV 18].
Even though by analogy, we may deem the SIC complex to be similar to the notion of “military-industrial complex”, its nature is quite different. In the SIC, the relationship is no longer based on mutual benefit, but on a logic of constraint whose “complex” nature is no longer specific to American politics alone. The state acts as the dominant party: intelligence agencies collect the data from private sector databases or communication systems; agencies take advantage of the permanently evolving technology, thus offering the means to bypass restrictive legal frameworks; they make private companies bear the political and economic costs of surveillance.
The historical prism helps to understand the nature of technological developments and their applications. We will be more particularly attentive to the forms of power that make it possible to build, maintain, reinforce or weaken interception technologies used in their multiple contexts.
The questions addressed in this book
This book is organized as follows:
– The first chapter describes the multiple contexts in which the interceptions of communications have taken place and continue to do so. Implemented by belligerents during wars from past to present, their usefulness has never been denied, as they are essential to intelligence, providing key information at the tactical, operational and strategic levels, guiding political and military decisions. But interception is also at the service of political power, in the hands of the prince, who spies on diplomats, as well as on his relatives or political opponents, to better establish his power by mastering secrecy. Interception is also one of the tools used by the police to fight against crime. Undeniably, the intelligence services also use interception, and states do not hesitate to use it to monitor and control. The frameworks for their use are multiple. Technological developments in the field of communications have introduced new modalities to which interception techniques have had to adapt.
– The second chapter focuses on the challenges of encryption. Many interception techniques, methods and technologies exist at present, which make it possible to intercept (virtually) everything. The catalogs of companies commercializing interception technologies at least suggest so. The encryption of communications appears to be one of the means – if not the only means? – to protect communication content. But, regardless of their motivations, those who try to intercept intend to circumvent the encryption barrier. Even if cryptography is not infallible (encryption systems can simply be badly implemented), there are methods to weaken it (such as backdoors, in particular), and others to circumvent it. Encryption is a political issue, around which the debates on state sovereignty crystallize. The liberalization of cryptography in the 1990s undermined this absolute control power of the states over what was then a “war weapon”, before becoming a tool accessible to all, and therefore, much more difficult to control. The states have not surrendered of course, and while the interceptions of planetary communications such as those implemented by the NSA seem to only target metadata and not the contents directly, the latter preserve all their strategic value. How to access them despite cryptographic hurdles is an ongoing challenge.
– The last chapter delves into “power” and the relationships that have taken shape between the various stakeholders involved in interception technology, including its creation, design, marketing and various uses. The relationships between citizens, researchers, technology designers, companies and states are analyzed. The focus will be on the special relationship between the state and companies, which oscillates between constraint and cooperation; the states’ desired control limits over technologies (so as not to be controlled by them) and the fragility of the foundations of power built on the confidence in encryption.
Notes
1
See:
https://www.cnrtl.fr/definition/interception
.
2
See:
www.cnrtl.fr/definition/surveillance
.
3
See:
www.cnrtl.fr/definition/surveiller
.
4
See:
www.bigbrotherwatch.org.uk/wp-content/uploads/2016/03/Interception.pdf
.
5
See:
www.bigbrotherwatch.org.uk/wp-content/uploads/2016/03/Interception.pdf
.
6
See:
www.bigbrotherwatch.org.uk/wp-content/uploads/2016/03/Interception.pdf
[Accessed March 1, 2017].
7
“Données techniques nécessaires à l’acheminement d’une communication” [Online]. Available at:
www.signal.eu.org/blog/2015/04/20/eu-org-les-metadonnees-et-la-loi-information
. “Metadata designate a set of standardized information relating to a file, such as author name, resolution, color space, copyright information, and other keywords applied to it” [Online]. Available at:
www.helpx.adobe.com/fr/bridge/using/metadata-adobe-bridge.html
.
8
“Judicial Oversight of Section 702 of the Foreign Intelligence Surveillance Act, Presented to The Robert S. Strauss Center for International Security and Law and The University of Texas School of Law, Austin, Texas”, September 14, 2014 [Online]. Available at:
www.nsa.gov/DesktopModules/ArticleCS/Print.aspx?PortalId=70&ModuleId=9757&Article=1619167
.
9
“Failing to Keep Pace: the Cyber Threat and Its Implications for Our Privacy Laws, Washington”, May 23, 2018 [Online]. Available at:
www.nsa.gov/news-features/speeches-testimonies/Article/1608850/
.
10
We will retain this acronym (CIT) so as not to confuse it with ICT (Information and Communications Technology).
11
British History (1911). June 1657: An Act for settling the Postage of England, Scotland and Ireland. In
Acts and Ordinances of the Interregnum, 1642–1660
, Firth, C.H. and Rait R.S. (eds). British History, London [Online]. Available at:
www.british-history.ac.uk/no-series/acts-ordinances-interregnum/pp1110–1113
.
12
Obfuscation can be defined as a strategy for protecting privacy on the Internet by publishing false or sufficiently inaccurate information so that the true or relevant information is masked (obfuscation is therefore an anonymization, a masking strategy); it can also refer to a technique for making a program unreadable to human beings, while keeping it fully functional. See:
https://en.wiktionary.org/wiki/obfuscation
.
1History and Repertoire of Communication Interception Practices
The interception of correspondence has been ongoing for centuries. However, we will not attempt to date its origin. By focusing on the period closest to the present, it is possible to identify its multiple contexts of use, as well as its civil, military, political, economic and diplomatic applications. On the one hand, the emergence of new modes of communication in the 19th century led to a considerable increase in the volume and distribution speed of correspondence, and to changes in the geographical dimension, on the other hand. It became much easier to correspond with the other side of the world, thanks to the speed of messages reaching their destination and the reduction in communication costs. Communication also diversified its methods: there was a gradual shift from writing to voice transmission with telephony and radio communications.
The principle of the optical telegraph, then called the aerial telegraph so as to differentiate it from the electric telegraph, has been known since antiquity. As early as the second century BC, the Greek general, statesman and historian Polybius described, in Book X, Chapter VII “Fire Signals” of his General History, a system “by means of which anyone who cares to do so even though he is at a distance of three, four, or even more days’ journey, can be informed”1. He describes the process in the following terms:
Divide the alphabet into five groups of five letters each […] the signaling party raises first torches on the left to indicate which of the tablets he means. […] He next raises torches on the right showing in a similar manner by their number which of the letters in the tablet he wishes to indicate to the recipient.
As early as the 18th century, many inventors proposed and experimented with optical devices for remote communication:
in 1672, the Englishman Robert Hooke (1635–1703) imagined an assembly of three masts equipped with a horizontal girder for encoding cut-out symbols;
in 1690, the Frenchman Guillaume Amotons (1663–1705) improved the mechanism to transmit alphabetic symbols;
in 1786, while in the presence of the Prince of Hesse-Cassel, the German Johan Andreas Benignus Bergsträsser (1732–1812), rector of the University of Hanau, experimented with a mast equipped with two pivoting arms, in order to transmit a message made up of numbers;
in 1788, Charles-François Dupuis, future deputy to the Convention for Seine-et-Oise, carried out a communication between Ménilmontant and Bagneux using an alphabetical telegraph.
But the telegraph would only experience real growth after 1791 with the invention of the optical communication method by Claude Chappe (1763–1805), which bears his name. After numerous demonstrations and improvements, including a rapid transmission experiment on July 12, 1793 covering a 40 km distance, the Convention decided to nationalize the invention on July 26 of the same year and to entrust its administration to Chappe, under the aegis of the Ministry of War. From this followed a considerable development of the invention, which Chappe and his brothers exploited on a large scale.
Its actual construction at the end of the 18th century did not respond to technical innovations, but to a particular need in the context of the French Revolution and its centralized state administration, for which the speed of communication was crucial.
A Chappe telegraph station is a small stone building furnished with a mast carrying three articulated arms, painted black: the central arm is called the regulator and the two side arms are the indicators. Information is conveyed by the relative position of the regulator and the indicators.
A first Paris–Lille line completed in 1795 included 16 stations and made it possible to transmit a 25-word message within an average of 15 minutes, compared to a whole day required by traditional postal services. This first line was followed by others, forming a network which covered not only metropolitan France, but also Algeria and Tunisia.
In 1844, the French territory had 534 towers for connections over more than 5,000 km between the main cities. The telegraph was initially reserved for government communications. In 1824, the network expanded to commerce, and was made available to the general public in 1851, when it began to decline.
As the position of the articulated arms carrying the transmitted information is visible to all, it is necessary to use a confidential code. The code’s secrecy is based on a hierarchical organization with pseudo-military discipline. In 1823, the Central Administration was at the top of the structure, with three administrators, a chief and two assistants for four bureaus: dispatches, staff, equipment and accountability. Then there were the directors in charge of a department, who were responsible for coding, decoding and sending dispatches, using a codebook which was kept secret. From 1795 onwards, 92 arms positions were retained, each being identified by a two-digit number. This number referred to the codebook pages and the lines on each page containing a word or a group of words, which resulted in a total of 8,464 meanings. After the code was revised in 1830, increasing the number of arm positions to 184, 33,856 meanings could be conveyed.
The message could only be understood by the directors at the lines’ ends, but remained incomprehensible for all the intermediaries.
The directors supervised the activity of the inspectors assigned to a department who were responsible for a line section comprising around 10 stations.
At the bottom of the hierarchy, stationary workers represented 90% of the staff. Each station was staffed by two operators: one was in charge of the telescope observation, while the other manipulated the controls. The stationaries were poorly paid, as much as 1.25 francs per day until 1826, the salary of a daily laborer. This was considered as a side work, since most of the stations were located in rural areas. Due to budgetary reasons, the stationary position was soon to be occupied by only one person.
Its last use was a light, transportable model on the back of a mule, at the service of military operations during the Crimean war (1853–1856), allowing stations to be moved according to military operations.
Having been the first organized telecommunications system, the Chappe telegraph gradually disappeared from 1847 and was definitively replaced by the electric telegraph in 1855. The latter had the advantage of also operating at night and in foggy weather, while its undersea cables made it possible to cross the seas.
