29 December 2009. GSM A5 Files Published on Cryptome

1 November 1998
Source: Christian Masson

    [To: Christian Masson]

    Thanks for your information. It's very interesting. What do you think
    about our recommendation R(95)4, that has become a Directive of the EC?

    Spyros Tsovilis
    Section protection des données/Data Protection Section
    Direction des Affaires Juridiques/Legal Affairs Directorate
    Conseil de l'Europe/Council of Europe

    http://www.coe.fr/dataprotection

    [To: Spyros Tsovilis
    From: Christian Masson
    Date: Fri, 23 Oct 1998 02:32:29 PDT]

    REF.: RECOMMANDATION (95)4
    http://www.coe.fr/dataprotection

    Sir Spyros,

    Thanks for yr interest,

    2.
    All the time violated. E.g. France telecom got one authorization
    and placed it in an access node (trunk in central, B-ISDN line
    in central, main server TCP/IP in France Telecom,...) and so taps
    simultaneously 10,000 lines. (Source: CNIL, Mr. Drouard.)

    2.2
    Impossible and never applied.
    Slot time GSM test is indirect tapping. Idem for gonio,
    real time tapping. Anonymity in telecom system is impossible.
    E.g. Swiss Natel Easy (anonymous GSM), except the first time,
    leads sooner or later to the automatic tapping system:
    Cd-Cg P, CLIP, Forcer Identication, internal billing system,
    PLU/back-up, words/voice recognition system, public phones automatic
    tapping system (airport, center of great town,...).

    2.2
    A wish, never applied.
    (Strasbourg 81, STE, no 108, art. 8 CEDH,...) is impossible to be
    applied. There are actually too many automatic tapping system:
    word(s) recognition, CLIP calling identification line system,
    Called-calling Parties (Cd-Cg P), billing systems, trap, others
    automatic identification system, public phones tapping,...

    7.2
    All billing information is kept 6 months-10 years.
    No effective control on back-ups (and back-ups of back-ups).

    7.4
    A wish. Actually EDVT electronic directory in public phones are tapped
    by Swisscom. It's the same with others public electronic directory
    (Minitel, France Telecom telematic web directory,...)

    7.10
    7.11
    For me, commercial profile is public life.

    7.16
    7.17
    Impossible, if customer can cancel (e.g. *31 or ask for operator)
    the identication of their number; police, urgence, telecom...
    have all time the number: FORCER IDENTIFICATION SYSTEM, NORA,...

    7.19
    Called-Calling Parties, CLIP,...: filters are impossible.
    The last step (judge,...): yes

    7.20
    In France and Belgium, each crypto system must be (quickly) breakable.
    In others countries, crypto's freely available but also must be (slowly)
    breakable, http://www.crypto.ch. The length of crypto key means nothing
    (under 2100 bits). The illusion of protection helps generate profitable
    interceptions.

    7.21
    Wrong and impossible.
    Each GSM generates a cell trace. Each back-up & PLU is actually
    freely accessiblefree for each GSM operator. CNIL suggests a European
    harmonization for it. For each GSM call, the originating cell is
    recording with a back-up and followed by cell/PLU trace/GSM in stand-by)
    all the time and for each GSM. It's a real and massive problem.

      Phil Karn [Qualcomm Scientist/Cryptographer]:
      "Cellular registration is one of the most problematical privacy
      issues in modern telecommunications."

    In conclusion, this recommendation is contradicted by Enfopol
    (illegal but effective) ETSI tracing equipment recommendations
    and the actual practice of interception.

    A recommendation is not a law. Without technical control, it's a joke.

    Pls, do not hesite to contact for any remarks,

    Regards,

    Christian Masson