-
Bavarian trojan for non-germans
From Wikileaks
Contents |
Transcript of bayern-skype-interception.pdf
Reading the document for transcription, many contradictions turn up. The transcript is done as literal as possible to ensure capturing the real message, which in many cases appears to be very eventual.
Also, a closer look indicates two more very important details:
- the prosecutors office talks about DigiTask being involved in this case with the Prosecutors Office Munich I. Taking it for the word, this suggests there are other companies contracted for such software or services.
- which is even more important, the document written by the Ministry of Justice states the software has already been made us of. It refers to massive cost that has turned up and apparently is in this case already in a negotiator position between police and prosecution, trying to figure out who is to pay.
- the first document further mentions, that the prosecutors office only had to pay if it was involved in the permission/decision of using this software on a suspect. does that imply that the police does not need a prosecutors permit to start such a surveillance/interception?
Leaves the curious to wonder who would buy anything based on such an offer?
Part 1: Cost distribution communication (completed)
Bavarian Ministry of Justice
(to)
General Prosecutors
President of the State Courts
Munich, Nuernberg, Bamberg
Costdistribution between police and Prosecutors office in criminal
proceedings; here: cost for telecommunication surveillance of
Voice-over-IP and the software Skype
one attachment
In scope of preliminary proceedings conducted by the Prosecutors Office Munich I, telecommunication surveillance has shown, that the owner of the line communicates to the suspect over the internet via so-called Voice-over-IP, a modern form of voice-communication in real-time via the Internet Protocol. Communication is being encrypted by the software used by the suspect and can thus not be read by the investigation unit. To maintain the technical implementation of this surveillance, a software needs to be installed on the computer of the suspect, that enables to "grab" all relevant information before encryption and send them to the Bavarian State Police.
The telecommunication surveillance proceeding is connected to extensive costs, as the equipment needed, especially software, so far has been rented and installed from private contractors (in this case the company DigiTask). According to the service description in the attached document of the 4th of september 2007 by DigiTask, the following cost (netto) can arise:
- Rental of the Skype-Capture-Unit per month and instance EUR 3.500
- One-time installation and deinstallation fee on-site EUR 2.500
- Rental SSL-decoding per month and instance EUR 2.500
- Rental of two proxy servers for obfuscation of own IP unknown
The question who has to cover these costs is not regulated explicitely in the law. According to Nr 1.1 of VormerkR-Pol all expenditures rising from police investigation and prosecution of unlawful actions have to be generally covered by the police household. Only compensation of witness, subject matter experts, translators and third person according to §23 JVEG, that the police engages with upfront permission of the prosecutors office, are to be paid by the prosecutors office. Covering of the cots by the prosecutor would thus only occur for costs from a prosecutor-initiated proceeding according to §23 JVEG (§1 Abs 1 Nr 1, Abs 3 JVEG). The requirements for §23 JVEG are not fulfilled though. Also did the company not provide the telecommunication surveillance and recording installation, but rather provides the police with equipment for decryption of telecommunication.
With concurrent perception of the Ministries of the Inner
and of Justice the cost for purchasing a DV-unit (hard and software)
are to be covered solely by the police household. This also is true for
cases where equipment has to be rented. Also the rental and one-time
fees are subject to the police household. The Ministry of the Inner has
communicated this via IMS of 10th of decemer 2007 Gz. IC1-1054-1.
Please inform all related servants as well as the district revisions accordingly.
Part 2: offer by DigiTask to the State of Bavaria (completed)
Service description
Dear ...
As requested by you, we hereby submit an offer for a surveillance method of the encrypted VoIP protocol Skype.
Skype
Encryption of communication via Skype poses a problem for surveillance of telecommunications. All traffic generated by Skype can be captured when surveilling a Dialin- or DSL-link, but it cannot be decrypted. The encryption of Skype works via AES wih a 256-Bit key. The symmetric AES keys are negotiated via RSA keys (1536 to 2048 Bit). The public keys of the users are confirmed by the Skype-Login-Server when logging in. To surveil Skype-communication it thus becomes necessary to realize other approaches than standard telecommunications surveillance.
The concept of DigiTask intends to install a so called Skype-Capture-Unit on the PC of the surveilled person. This Capture-Unit allows recording of the Skype communication, such as Voice and Chat, as well as diverting the data to an anonymous Recoridng-Proxy. The Recording-Proxy (not part of this offer) forwards the data to the final Recording-Server. The data can then be accessed via mobile Evaluation Stations.
The mobile Evaluation Units can, making use of a streaming-capable multimedia player, playback the recorded Skype communication, such as Voice and Chat, also live. To minimize bandwidth usage special codecs for strong compressions are used. The transmission of data to the recording unit is encrypted using the AES algorithm.
Functions of the Skype-Capture-Unit
- Live diversion of voice
- Live diversion of chat
- Live diversion of video
- Live diversion of data
- Skypein
- Skypecasts
- SkypeSMS
- Buddylist
- compressed data transmission
- encrypted data transmission
- streaming-capable mediaplayer
- Obfuscation of Recording-Server address via proxies
- Time-restricted usage (will self-delete after a set time-frame)
- Conceiled updates via normal data streams
- Deinstallation at any time via normal data stream
- Skype Capture Unit for operating systems Windows 2000 and Windows XP
Recording Server
The Skype Recording Server can record 10 Skype interceptions in parallel and also replay 10. Recording uses a bandwidth of ca. 30Kbit/s, playback uses a bandwith of ca. 40kbits. The DSL-bandwidth of your bureau should be dimensioned accordingly. The bandwidth relates to the Skype-Capture-Unit development as of today. Should the Skype-Capture-Unit at any later point in time be modified to support new features such as Videotransmission, the number of concurrent interceptions might decrease according to the increase of bandwidth. This also has to be regarded for the number of concurrent playbacks.
Installation of the Skype Capture Unit on the target system
For the installation of the Skype Capture Unit an executable file will be delivered, that can for instance be attached to an e-mail or directly be installed on the target machine. Further installation routines can be integrated at any time. These will then be costed via time & material.
Evaluation of recorded data
The recorded data is being analyzed with a mediaplayer coming with the installation. This streaming-capable mediaplayer can playback Voice- and Chatdata in real-time. Requirement for the mediaplayer is a PC system with a webbrowser. The mediaplayer is approved for Microsoft Internet Explorer Version 6 and Mozilla Firefox Version 1.5
Rental of Skype Capture Software per month and installation instance EUR 3.500,00
One-time installation and de-installation fee on-site EUR 2.500,00
SSL-Encryption
Confidential data is not longer being transmitted on the internet. A cryptographic process often very often used is the SSL-encryption (Secure Socket Layer).
The SSL-protocol provdides that data cannot be read or modified during transmission and also establishes identity verification of a website. SSL encryption is supported by all common webbrowsers. A SSL connection can easily be spotted in the first part of a URL, as http:// changes to https://.
SSL encryption is used mainly for the following applications:
- Online Banking
- Internet shops
- Webmail
- Chatnetworks
- e-Commerce applications
- POP3, SMTP, NNTP, SIP, IMAP, IRC, FTP
Decoding of SSL connections
Key material and metadata are diverted via the existing broadband surveillance via a MITM-attack (Man in the Middle). The lawful interception unit can make use of the key and metadata to decrypt the generated SSL-traffic.
The data encrypted by SSL can thus be visualized.
A decoding of SSL-connections can at this point in time be done for data generated by Firefox-Browser or Internet Explorer.
A visualization of SSL-encrypted data can only be done if DSL is in place and a DigiTask lawful interception unit is used for decoding.
Rental prices for SSL-decoding per month per instance EUR 2.500,00
To disguise the own IP address two proxy servers need to be rented by your department. It is recommend to rent server in over-seas.
The Skype-Capture-Unit is connected to an exisiting DSL-connection with an upload possibly bigger thhan 128Kbit/s. For access control we recommend usage of a firewall, provisioned and deployed by your department.
The minimum rental timeframe is 3 months.
The usage of the Skype Capture Unit and SSL-decoding is in full responsibility of your department. DigiTask will cannot be held responsible for usage of the software or any damages caused by it.
Technical changes in harmony with improvement reserved.
All mentioned prices are netto and are to be taxed with VAT accordingly.
Payment timeframe: 14 days - 2% skonto, 30 days real netto
Delivery time: 4-6 calender weeks after order
With best regards