Lighting the dark: Must you make your application wiretap-able?

28.02.2011

While Caproni specifically did not ask for any new laws to be enacted at this point, the implication was that it would be a good idea if the developers of Internet applications included the ability to wiretap the communications among their users.

But adding the ability to wiretap presents its own issues -- issues that were well covered by and privacy expert . She pointed out that adding wiretap functionality is, by definition, adding an exploitable vulnerability. She also provided examples of such exploitation in current telecommunications systems.

The FBI's Caproni said that court orders for wiretaps are "the most difficult for investigating authorities to obtain and use" because of the protections in U.S. law. She did not suggest that these protections be lessened, but also did not mention that many other countries lack such protections. Since U.S.-developed technology is in use all over the world, wiretap back doors in U.S.-developed applications are likely to be exploited by governments far less interested in civil liberties than is the U.S. government.

Thus, application developers are placed in a quandary. On one hand, the law enforcement problems are very real -- there are some very bad people "out there." On the other hand, adding wiretap ability to your application may mean that some of those bad people, as well as bad governments, will be able to exploit your application in furtherance of their own aims.

If you are in the application writing business and your applications permit users to directly communicate with each other, you may be inadvertently developing a communication vehicle for terrorists, or for dissidents fighting a corrupt government. Adding wiretap functionality may help fight use by bad guys, while the same functionality may put good guys in danger. At this point adding such functionality is still your choice; in the future it may not be.