According to The New York Times in, “Surveillance of Skype Messages Found in China,” the Chinese provider TOM has software in place that reads Skype text messages, and blocks ones that use naughty words and terms, like “Falun Gong,” “Independent Taiwan,” and so on.
A group of security people and human rights workers not only found out that TOM-Skype is not secure, but found the list of banned words because, as usual, someone didn’t set up their servers very well. A report can be found here.
Skype president Josh Silverman replied to the issue today in this article. He says that yes, it’s happening:
It is common knowledge that censorship does exist in China and that the Chinese government has been monitoring communications in and out of the country for many years. This, in fact, is true for all forms of communication such as emails, fixed and mobile phone calls, and instant messaging between people within China and between China and other countries. TOM, like every other communications service provider operating in China, has an obligation to be compliant if they are to be able to operate in China at all.
He’s right: one of the quandaries of business in China is that you have to put your belief in freedom in a trust when you go there. This is why many of us do not like doing business there.
However, he also said:
We also learned yesterday about the existence of a security breach that made it possible for people to gain access to those stored messages on TOM’s servers. We were very concerned to learn about both issues and after we urgently addressed this situation with TOM, they fixed the security breach. In addition, we are currently addressing the wider issue of the uploading and storage of certain messages with TOM.
In other words — it’s bad for the Chinese to spy, and bad for people to catch them at it. Oh, naughty Chinese, and shame on you too, Infowar for dragging this into the daylight.
This comes on top of April’s flap in which the German and Austrian governments essentially said that they have no trouble listening in to Skype. Skype hasn’t commented on that. This is a different issue, as it appears that the surveillance is being done via malware.
Despite the fact that we still don’t know what goes on inside of Skype, it appears that the software is basically secure — or at least the voice parts are. Or was at one time. The noted cryptographer Tom Berson did an analysis of Skype and showed that it was reasonably secure. There were also reverse-engineering analyses done on Skype by Philippe Biondi and Fabrice Desclaux, presented at Black Hat in 2006 that showed it was secure, if eccentric in its design.
However, despite the security of the voice parts, the text parts are obviously not secure. And we have this uncomfortable set of circumstances:
- Skype voice, while apparently secure in architecture, can be compromised by commercially available malware.
- Skype text chat is obviously not secure, as shown by TOM-Skype in China.
- Josh Silverman has washed his hands of l’affaire TOM-Skype.
- We still don’t know what’s in the Skype source code.
The problem here is one of labeling, and the market effects. I’m sophisticated enough to know that when Josh Silverman says:
… Allowing the world to communicate for free empowers and links people and communities everywhere.
that he is stating that free (as in beer) is important, even if he’s unable to do a lot about free (as in speech) in repressive countries and in the face of law enforcement technologies.
But Skype has always touted itself as a secure technology. The reason that it became popular for free (as in beer) conversations was that we thought and were assured that it was also free (as in speech). Skype themselves paid for a security analysis.
Skype thus became not only the proverbial eight-hundred pound gorilla, but (it seems) the proverbial dog in the manger. Skype’s presence has actively hindered other secure-voice technologies. Phil Zimmermann’s Zfone, for example, has had to answer the question, “why do we need you when there’s Skype?” It seems that he’ll be answering that question less. Josh Silverman needs to do something to show us the basic integrity of the system. Presently it appears that he has empowered us to have communities everywhere but China, or Germany, or any place with a sophisticated and powerful government. At the very least, he should protect eBay’s investment, because if people conclude that Skype is not secure, eBay may wish they’d invested that $1.6 billion in mortgage-backed instruments instead.
