[IP] EFF: Secret Surveillance Evidence Unsealed in AT&T Spying Cas

Thu Jun 14 03:33:56 PDT 2007

On Thu, Jun 14, 2007 at 06:03:18AM -0400, Tyler Durden wrote:

> So what can that Narus box do? Layer 3/4 seems obvious. Layer 7? Can it 
> detect the presence of encryption? Can it detect the type and strength of 
> encryption? Can it detect the existence of jpegs, mpegs, mp3s and so on? 
> Does it support routing protocols? So, could it handle an instruction like:
> 
> If the source of the packet is located in Brooklyn
> 
> If the destination is a cave in Aghanistan
> If encryption = YES,
> Then route to NSA...
> 
> If destination is Kebab King in Jackson Heights
> If encryption=NO,
> then route to Local Storage
> 
> etc...

http://en.wikipedia.org/wiki/Narus

...

NarusInsight

The capabilities of the NarusInsight system are alarming to many privacy advocates.

[edit] System specification

>From the Key Features list of NarusInsight:

    * Universal data collection from links, routers, soft switches, IDS/IPS, databases, etc. provides total network view across the world's largest IP networks.
    * Normalization, Correlation, Aggregation and Analysis provide a comprehensive and detailed model of user, element, protocol, application and network behaviors, in real-time.
    * Seven 9s reliability from data collection to data processing and analysis.
    * Industry-leading packet processing performance that supports network speeds of up to OC-192 at layer 4 and OC-48 at layer 7, enabling carriers to monitor traffic at either the edge of the network or at the core.
    * Scalability to support the world's largest, most complex IP networks.
    * Flexibility -- NarusInsight's functionality can easily be configured to meet any specific customer requirement (Narus SDK).
    * Extensibility -- NarusInsight's functionality can easily be configured to feed a particular activity or IP service such as security, lawful intercept or even Skype detection and blocking.

OC-192 carries about 10 gigabit per second. Ten billion bits per second, monitored in real-time. Technically, this is an extremely powerful supercomputer.

[edit] System capabilities

    * Packet-mode data intercepts for Service Providers and Carriers.
    * Wireline to wireless and Wi-Fi or dialup to broadband.
    * "Instant Compliance" with CALEA and ETSI for simple, fast and hands-free compliance.
    * Carrier-grade speeds, performance and scalability.
    * Supports all of your services, out-of-the-box.
    * Securely manages resources while simplifying audits and reporting.
    * Network and vendor agnostic.
    * Enables additional application for revenue generation or revenue protection.

This data flows right into NarusInsight Intercept Suite, which enables packet-level, flow-level, and application-level usage information is captured and analyzed as well as raw user session packets for forensic analysis, surveillance or in satisfying regulatory compliance for lawful intercept.

The Lawful Intercept module offers carriers and service providers compliance with regulatory requirements regarding lawful intercept. The Lawful Intercept module provides an end-to-end solution consisting of Administration, Access and Delivery functions. The Lawful Intercept module is compliant with CALEA and ETSI standards. It can be seamlessly integrated with third party products for testing/validation or as a complete law enforcement solution.

The Directed Analysis module seamlessly integrates with NarusInsight Secure Suite or other DDoS, intrusion or anomaly detection systems, securely providing analysts with real-time, surgical targeting of suspect information (from flow to application to full packets). The Directed Analysis module provides industry standard formats and offers tools for archival and integration with third party investigative tools.

These capabilities include playback of streaming media (i.e. VoIP), rendering of web pages, examination of e-mail and the ability to analyze the payload/attachments of e-mail or file transfer protocols. Narus partner products offer the ability to quickly analyze information collected by the Directed Analysis or Lawful Intercept modules. When Narus partners' powerful analytic tools are combined with the surgical targeting and real-time collection capabilities of Directed Analysis and Lawful Intercept modules, analysts or law enforcement agents are provided capabilities that have been unavailable thus far.

[edit] Usage

It is useful to examine the OSI model of seven layers which underpins all communication on the Internet. NarusInsight focuses on two layers: number four, the transport layer, built on standards like TCP and UDP, the physical building blocks of Internet data traffic, and number seven, the application layer, built on standards like HTTP and FTP, which are dependent on the application using them, i.e. Internet Explorer, Kazaa, Skype, etc. NarusInsight monitors 10 billion bits per second at level four and 2500 million bits per second at level seven. For reference, a 256K DSL line equals 0.25 million bits per second (Mbit/s), and a normal modem around 0.05 Mbit/s. So a single NarusInsight machine can monitor traffic equal to the maximum capacity of around 39,000 DSL lines or 195,000 modems. In practical terms 10 Gbit/s equals the combined traffic of millions of broadband users, so the number of subscribers monitored by one installation is several millions. It can also perform semantic analysis of the same traffic as it is happening, in other words analyze the content, meaning, structure and significance of this entire traffic, as it is happening.

The exact use of this data is not fully documented. A starting point is the Internet Protocol Detail Record, used to record information about usage activity within the telecom infrastructure (such as a call completion). NDM-U stands for "Network Data Management - Usage". It refers to a functional operation within the Telecom Management Forum's Telecom Operations Map. The NDM function collects data from devices and services in a service providers network. Usage refers to the type of data which is the focus of this document. These standards were built into Narus' systems.

    "IPDR.org has been in existence since 1999 and more than a dozen vendors have actual IPDR implementations "etched in code". Their systems are actually able to talk to each other and interoperate. Version 2.5 and up of the NDM-U represents a stable basis for development. IPDR.org's Interoperability Pavilion is a working demonstration of multiple companies exchanging service usage data in that format."

Service usage data. That would be data on the actual usage of the Internet. And what kind of data would this be? Way back in 1999, this article stated:

    "In an effort to provide more complex network traffic analysis, Narus is introducing its semantic network traffic service. The company cites research which predicts the fast-growing ISP sector will become stagnant without the ability to offer differentiated services. In order to gain significant revenues from these services, a technology was necessary to allow usage based pricing.
    "We realized that, at the heart of the data that is needed to accurately measure usage and enable 'pay-as-you-go' business models for Internet service providers, is what we call the 'semantics' of network traffic," said Ori Cohen, Narus' founder and chief executive officer.
    "In short, by seeing the 'semantics' of network traffic, service providers can see 'inside' the data, providing much more detailed insight about the use of the Internet and the perceived value of specific applications than existing technologies allow."
    "Semantic Traffic Analysis uses network technology to consistently capture and analyze all IP data streams on heavily trafficked networks remotely and non-invasively. In addition, the semantics of the data stream are determined also, as well as the protocol used and the application taking place. A variety of other data is available as well."

In this context, semantics is not just the data, but rather the meaning of the data. It looks at the data in a more comprehensive way than looking for keywords. Each NarusInsight machine does this at 2500 million bits per second, in real-time.

One website calls this "the biggest invasion of privacy in history by several orders of magnitude."

>From Narus' Lawful Intercept and Regulatory Compliance page:

    "Explosive Internet growth in recent years has transformed worldwide communications, yielding tremendous efficiencies and benefits, as well as many risks."
    "For example, terrorist attacks around the globe have been carefully orchestrated through Internet-based forms of communications such as e-mail, messaging, hidden Web pages and now VoIP, forcing governmental organizations and law enforcement agencies to re-evaluate how they are providing public security as it becomes so much easier and faster to communicate electronically."
    "Recent mandates and the resulting standards referenced under CALEA in the United States and ETSI in Western Europe aim to preserve the right of law enforcement agencies to conduct authorized electronic surveillance in an effort to protect the public and its right to privacy. However, these mandates create IT headaches for carriers as they struggle to meet the requirements."
    "With a suite of products targeted at meeting lawful intercept requirements, Narus simplifies lawful intercept tasks helping carriers and agencies meet requirements without experiencing any degradation in service quality."

-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE