Skype likely to provide means of VoIP interception – eavesdropping by “state trojans” disproportionate

The widely used voice-over-IP and video chat software Skype is likely to provide a way to monitor Skype-internal conversations. It seems that the answer to the lively debated question whether there is an alternative to the so-called “source-interception” (trojan-based eavesdropping) is “yes”, at least from a technical point of view. In order to avoid the infiltration of computer systems by monitoring software which infringes fundamental rights, enforcement agencies should enter into negotiations with Skype, now a Microsoft subsidiary, to strive for the practical implementation of less intrusive surveillance measures.

For years, rumors are circulating on the net that Skype software may include a monitoring interface for government agencies. These suspicions are underlined by the “small print” of the Skype Privacy Policy, which states (Section 3):

Skype, Skype’s local partner, or the operator or company facilitating your communication may provide personal data, communications content and/or traffic data to an appropriate judicial, law enforcement or government authority lawfully requesting such information. Skype will provide all reasonable assistance and information to fulfil this request and you hereby consent to such disclosure.

However a definitive proof for such a function has thus far not become known publicly.

Nevertheless, the system may already provide a technically simple way of listening to voice calls within the Skype network even without breaking the proprietary encryption of the audio data stream. The network operator, Skype, should be able to do this simply by secretly combining the “Skype In” and “Skype Out” features.

The “Skype In” and “Skype Out” call routing options are used to make calls from within the Skype network to the “normal” telephone network. For Skype-Out, the Skype user connects to an extension designated by a classic telephone number. With Skype-In things are just the other way round: A “normal” telephone number is assigned to a Skype user name, thus calls to this number are put through over the Skype network to a Skype client that has registered with the respective associated Skype username.

Both Skype-In and Skype-Out connections technically require the use of a gateway between the Skype network and the conventional telephone network. In detail two separate connections are established which are both linked to the gateway at one end, namely a Skype VoIP connection between the gateway and the Skype client as well as a normal telephone connection between the gateway and the called extension. The latter compound in turn requires that the encrypted Skype connection ends at the gateway: The – as far as is known, as such, secure – encryption therefore ends at the gateway to the traditional telephone network, where a plaintext audio signal can be retrieved (possibly digital, but certainly not encrypted).

…