Northwestern Journal of Technology and Intellectual Property Volume 12 | Issue 1 Article 1 2014 Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet Steven M. Bellovin Columbia University Matt lB aze University of Pennsylvania Sandy Clark University of Pennsylvania Susan Landau privacyink.org, [email protected] Recommended Citation Steven M. Bellovin, Matt lB aze, Sandy Clark, and Susan Landau, Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet, 12 Nw. J. Tech. & Intell. Prop. 1 (2014). https://scholarlycommons.law.northwestern.edu/njtip/vol12/iss1/1 This Article is brought to you for free and open access by Northwestern Pritzker School of Law Scholarly Commons. It has been accepted for inclusion in Northwestern Journal of Technology and Intellectual Property by an authorized editor of Northwestern Pritzker School of Law Scholarly Commons. NORTHWESTERN JOURNAL OF TECHNOLOGY AND INTELLECTUAL PROPERTY Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet Steven M. Bellovin, Matt Blaze, Sandy Clark, & Susan Landau April 2014 VOL. 12, NO. 1 © 2014 by Northwestern University School of Law Northwestern Journal of Technology and Intellectual Property Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet By Steven M. Bellovin*, Matt Blaze†, Sandy Clark§, & Susan Landau‡ For years, legal wiretapping was straightforward: the officer doing the intercept connected a tape recorder or the like to a single pair of wires. By the 1990s, however, the changing structure of telecommunications—there was no longer just “Ma Bell” to talk to—and new technologies such as ISDN and cellular telephony made executing a wiretap more complicated for law enforcement. Simple technologies would no longer suffice. In response, Congress passed the Communications Assistance for Law Enforcement Act (CALEA)1, which mandated a standardized lawful intercept interface on all local phone switches. Since its passage, technology has continued to progress, and in the face of new forms of communication—Skype, voice chat during multiplayer online games, instant messaging, etc.—law enforcement is again experiencing problems. The FBI has called this “Going Dark”: their loss of access to suspects’ communication. 2 According to news reports, law enforcement wants changes to the wiretap laws to require a CALEA-like interface in Internet software.3 CALEA, though, has its own issues: it is complex software specifically intended to create a security hole—eavesdropping capability—in the already-complex environment of a phone switch. It has unfortunately made wiretapping easier for everyone, not just law enforcement. Congress failed to heed experts’ warnings of the danger posed by this mandated vulnerability, and time has proven the experts right. The so-called “Athens Affair,” where someone used the built-in lawful intercept mechanism to listen to the cell phone calls of high Greek officials, including the Prime Minister,4 is but one example. In an earlier work, we showed why extending CALEA to the Internet would create very serious problems, including the security problems it has visited on the phone system.5 * Steven M. Bellovin is a professor of computer science at Columbia University. † Matt Blaze is an associate professor of computer science at the University of Pennsylvania. § Sandy Clark is a Ph.D. student in computer science at the University of Pennsylvania. ‡ Susan Landau was a 2012 Guggenheim Fellow; she is now at privacyink.org. 1 Pub. L. No. 103-414, 108 Stat. 4279 (codified at 47 U.S.C. §§ 1001–1010 (2006)). 2 Going Dark: Lawful Electronic Surveillance in the Face of New Technologies: Hearing Before the Subcomm. On Crime, Terrorism, and Homeland Sec. of the H. Comm. on the Judiciary, 112th Cong. 10 (2011) (prepared statement of Valerie Caproni, General Counsel, Federal Bureau of Investigation), available at http://judiciary.house.gov/hearings/printers/112th/112-59_64581.PDF. 3 Declan McCullagh, ‘Dark’ Motive: FBI Seeks Signs of Carrier Roadblocks to Surveillance, CNET (Nov. 5, 2012, 1:03 PM), http://news.cnet.com/8301-13578_3-57545353-38/dark-motive-fbi-seeks-signs- of-carrier-roadblocks-to-surveillance/. 4 Vassilis Prevelakis & Diomidis Spinellis, The Athens Affair, IEEE SPECTRUM, July 2007, at 27, available at http://spectrum.ieee.org/telecom/security/the-athens-affair/0. 5 Steven M. Bellovin, Matt Blaze, Sandy Clark & Susan Landau, Going Bright: Wiretapping Without Weakening Communications Infrastructure, IEEE SECURITY & PRIVACY, Jan/Feb 2013, at 64–66, available at https://www.cs.columbia.edu/~smb/papers/GoingBright.pdf. NORTHWESTERN JOURNAL OF TECHNOLOGY AND INTELLECTUAL PROPERTY [ 2014 In this paper, we explore the viability and implications of an alternative method for addressing law enforcements need to access communications: legalized hacking of target devices through existing vulnerabilities in end-user software and platforms. The FBI already uses this approach on a small scale; we expect that its use will increase, especially as centralized wiretapping capabilities become less viable. Relying on vulnerabilities and hacking poses a large set of legal and policy questions, some practical and some normative. Among these are: (1) Will it create disincentives to patching? (2) Will there be a negative effect on innovation? (Lessons from the so-called “Crypto Wars” of the 1990s, and in particular the debate over export controls on cryptography, are instructive here.) (3) Will law enforcement’s participation in vulnerabilities purchasing skew the market? (4) Do local and even state law enforcement agencies have the technical sophistication to develop and use exploits? If not, how should this be handled? A larger FBI role? (5) Should law enforcement even be participating in a market where many of the sellers and other buyers are themselves criminals? (6) What happens if these tools are captured and repurposed by miscreants? (7) Should we sanction otherwise illegal network activity to aid law enforcement? (8) Is the probability of success from such an approach too low for it to be useful? As we will show, these issues are indeed challenging. We regard the issues raised by using vulnerabilities as, on balance, preferable to adding more complexity and insecurity to online systems. 2 Vol. 12:1] Steven M. Bellovin, Matt Blaze, Sandy Clark, & Susan Landau I. INTRODUCTION .................................................................................................. 3 II. CALEA: THE CHANGE IN WIRETAP ARCHITECTURE ................................ 6 A. History of CALEA .................................................................................................. 7 B. Wiretap Consequences of Splitting Services and Infrastructure ............................. 9 C. New Technologies: Going Dark or Going Bright? ............................................... 13 D. The TPWG’s Tracking Preferences Expression Standard .................................... 17 III. THE VULNERABILITY OPTION ...................................................................... 22 A. Definition of Terms............................................................................................... 22 B. How Vulnerabilities Help ..................................................................................... 24 C. Why Vulnerabilities Will Always Exist ............................................................... 27 D. Why the Vulnerability Solution Must Exist Anyway ........................................... 30 IV. VULNERABILITY MECHANICS ...................................................................... 31 A. Warrant Issues ....................................................................................................... 31 B. Architecture........................................................................................................... 32 C. Technical Aspects of Minimization ...................................................................... 33 D. Technical Reconnaissance .................................................................................... 35 E. Finding Vulnerabilities ......................................................................................... 37 F. Exploits and Productizing ..................................................................................... 39 G. The Vulnerabilities Market ................................................................................... 41 V. PREVENTING PROLIFERATION ..................................................................... 44 A. Public Policy Concerns in Deploying Exploits to Wiretap ................................... 44 B. Ethical Concerns of Exploiting Vulnerabilities to Wiretap .................................. 47 C. Technical Solutions to Preventing Proliferation ................................................... 48 VI. REPORTING VULNERABILITIES .................................................................... 49 A. Security Risks Created by Using Vulnerabilities.................................................. 50 B. Preventing Crime .................................................................................................. 51 C. A Default Obligation to Report............................................................................. 55 VII. EXECUTIVE AND LEGISLATIVE ENFORCEMENT ..................................... 57 A. Enforcing Reporting.............................................................................................. 58 B. Exceptions