"Breaching Trust," a 16-page report released yesterday by Nart Villenveuve of the University of Toronto Citizen Lab, has unearthed disturbing monitoring practices of TOM Online, Skype's partner in China.
Text messages and call logs of communications on the TOM-Skype network are being stored on poorly secured public servers along with the encryption codes for the transmissions, according to the report. Text messages are filtered for keywords that trigger logging of the message, namely, messages mentioning dissidents, Taiwan, Falun Gong, or independence. These texts are not delivered to the intended recipient; instead, the full text of these messages is stored on the publicly-accessible servers, which the study's author was able to access and decode. Also, many texts were filtered and stored that did not contain any of the flagged words on the file the report's author was able to access. This, according to the report, insinuates that individual users of the software could be flagged for surveillance of all communications, once a banned word has been found in messages of voice transmissions.
The findings of the report suggest that TOM Online and perhaps Skype itself are much more complicit with the Chinese government than they will admit. Skype has denied cooperation with the Chinese in call and text monitoring numerous times, and responded to the author of the survey asserting that records of texts were discarded and not displayed or transmitted anywhere, according to the report. But Villenveneuve was able to find records of IP addresses, usernames and other identifying information on the servers dating to August 2007. Skype representatives attribute the security issues to TOM's practices, not Skype's, but the evidence is rather damning that they at least had to be somewhat aware of the volume and sensitivity of data being stored by the Chinese.
For more:
- see the full report "Breaching Trust" here [1]
Related Articles
Skype: VoIP is dead [2]
A Skype Back Door? [3]
Will Ebay auction Skype? [4]
Links:
[1] http://www.nartv.org/mirror/breachingtrust.pdf
[2] http://www.fiercevoip.com/story/skype-voip-dead/2008-09-17
[3] http://www.fiercevoip.com/story/skype-back-door/2008-07-25
[4] http://www.fiercevoip.com/story/will-ebay-auction-skype/2008-09-12