Putting Surveillance Myths to Rest

Updated: August 20, 2012

Given the furor surrounding the recent CALEA deadline for U.S. VoIP providers to implement wiretapping capabilities, it would be understandable if you thought most of the world's lawful intercept (LI) laws were about dictating surveillance methods for service providers. Not so, according to LI vendor SS8 who has just published a global guide showing that most of the world's laws on the subject have more to do with putting limits on surveillance than on mandating how to do it. But that won't be the end of the commotion; SS8 has found, when it comes to surveillance, there are plenty more misconceptions where that came from.

The goal of the guide--which describes LI laws in 24 countries in Asia, Europe, North America and South America--is to reduce both the delusions and heightened emotion surrounding the issue, according to SS8 marketing director Scott Coleman. Accordingly, it shows that many LI laws around the world focus more on what governments can't do, rather than on what they can dictate service providers to do.

"A lot of the legislation to do wiretapping is more related to privacy than to actually doing wiretaps," Coleman says. "Most countries have annual reports that have to be made back to their legislative bodies to show how they're using that [surveillance] power, and to prove law enforcement is not abusing this power."

Now that's not to say that there aren't laws that go into detail about what service providers must do. A law in the Netherlands, for example, mandates standards both for the interception of e-mail traffic and for its handover to law enforcement agencies. The U.K.'s Regulation of Investigatory Powers Act (RIPA) similarly requires that handover interfaces conform to ETSI standards. Such specificity, though, is the exception rather than the rule.

Other misconceptions have more to do with broad political values than with specific laws. For example, many observers may be surprised to learn that the level of electronic surveillance in North America is low compared to Europe. The U.S. rate, measured in instances per 100,000 population, is less than one percent that of Europe-leading Italy and second-place Netherlands, according to numbers from the Max Planck Society, a German government-sponsored research institution. It's also far below Switzerland — as well as France, Denmark, Germany, Norway and Australia, in that order. It is, however, higher than Canada.

The type of wiretapping that prevails in the U.S. may be similarly startling. Fans of the TV show The Sopranos , for example, will be disappointed to learn that most electronic surveillance doesn't involve law enforcement personnel listening in on dramatic and incriminating phone conversations. Rather, it usually involves real-time acquisition of data such as call records that show who has been talking to whom, according to Coleman.

The fact that IP surveillance is a sort of bulk collection process may also surprise some. "There's no [standard] warrant in the U.S. that says if this is an IP session the only content I'm allowed to see is e-mail or chat, but I'm not allowed to see other things such as HTML," he explains. "Right now if there are restrictions on the warrant about what information can or cannot be seen, then it's up to law enforcement to sort through that, because there's nothing in the standards or anything right now that would allow for that separation."

That may change, however. "Many countries we've met with have said that might be the next step, where the judicial system will approve warrants that say e-mail only or chat only or whatever," Coleman says. "Then we will have to partition things according to protocol or application or whatever there will be on the warrant."

With such advancements, SS8 will have to rewrite its guide, but this is a small price to pay for the increased revenue it can expect from implementing such complex new requirements.