Re: REPEAL CALEA
Wyden has been consistent during his entire time in Congress as being against all these backdoors, PATRIOT Act, all that stuff.
But his proposal doesn't seem to be suggesting a repeal of CALEA, but enforcing it further. It's already the law for telcos, but might also be expanding the remit to include CSPs and apps like Facetime, Signal, WhatsApp etc. It does also seem to suggest that CALEA is the culprit and was compromised, as I suspected. But-
The legislation doesn't specify what these safety measures should include, other than they must "prevent the interception of communications or access to call-identifying information without lawful authorization by any person or entity, including by an advanced persistent threat."
That's nice, but.. how? This describes some of the challenges-
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cfg/configuration/xe-16/sec-usr-cfg-xe-16-book/sec-lawful-intercept.html
The mediation device uses SNMPv3 to instruct the call connect (CC) IAP to replicate the CC and send the content to the mediation device. The CC IAP can be either an edge router or a trunking gateway for voice, and either an edge router or an access server for data.
To increase the security and to mitigate any SNMPv3 vulnerability, the following tasks are required:
Restricting Access to Trusted Hosts (without Encryption)
Encrypting Lawful Intercept Traffic and Restricting Access to Trusted Hosts
And also one of the possible (probable) vulnerabilities, ie the security of the mediation device, which may not be under the telco's control. One problem with CALEA is the US has many LEAs that could lawfully request metadata or a Title III warrant. So configuring and managing trusted hosts & encrypted VPNs is non-trivial, hence why that's generally outsourced to the mediation device and service.
Plus the telco/SP has no real way of knowing if the intercept request is lawful. An SPs counsel might see a valid Title III warrant, but that doesn't mean the warrant is lawful, ie an LEO may be abusing their powers. And you probably don't want the SP to know the target of an intercept request because if the SP's staff are compromised, maybe they tell the target that Big Brother really is watching you.
So the problem is probably one for the LEAs and security services to solve, ie creating and maintaining a secure mediation layer that can vett and validate requests, then pass that to the mediation gateways to act on. Then it's just the small matter of ensuring that vendors like Cisco etc don't have bugs in their SNMPv3, RADIUS etc implementations that compromise whatever CALEA2.0 turns out to be. Other countries have already kinda solved this problem by restricting the audience, then again they're also complicating it by legislation requiring lawful intercept for additional classes of data, like 'social' media apps. Telcos and SPs might be able to intercept that data, but can't decode or decrypt it.
And then there's the small matter of whether the providers of the mediation gateways can really be trusted, given they have a lot of power.