Organised criminals latch onto VOIP

By Alex Kayle, Senior portals journalist

Johannesburg, 19 May 2009

Wiretap-friendly voice over Internet Protocol (VOIP) is not impervious to hacking, and unsecure VOIP is bad for society and good for organised crime.

This is according to Philip Zimmermann, founder of Pretty Good Privacy (PGP), who will present at the ITWeb Security Summit next week at Vodaworld in Midrand.

Zimmermann claims most of the current VOIP vulnerabilities are related to denial-of-service attacks.

Says Zimmermann: “The law enforcement community will understandably be concerned about the effects encrypted VOIP will have on their ability to perform lawful intercepts. But what will be the overall effects on the criminal justice system if we fail to encrypt VOIP?

“Historically, law enforcement has benefited from a strong asymmetry in the feasibility of government or criminals wiretapping the Public Switched Telephone Network,” adds Zimmermann.

Flaws in VOIP

Zimmermann notes that VOIP interception is so easy, organised criminals are capable of wiretapping prosecutors and judges, revealing details of ongoing investigations, names of witnesses and informants, and conversations with their wives about what time to pick up their kids at school.

He adds: “The law enforcement community will come to recognise that VOIP encryption actually serves their vital interests.”

In 1991, Zimmermann published PGP, an e-mail encryption software package, for free on the Internet. This made Zimmermann the target of a three-year criminal investigation, because the US government held that US export restrictions for cryptographic software were violated when PGP spread worldwide. The government eventually dropped the case in 1996 and the following year the company was acquired by Network Associates.

In August 2002, PGP was acquired by PGP Corporation, where Zimmermann now serves as a special advisor and consultant. Zimmermann is also a fellow at the Stanford Law School's Centre for Internet and Society. He is a member of the International Association of Cryptologic Research, the Association for Computing Machinery and the League for Programming Freedom. His latest project is Zfone which provides secure telephony for the Internet.