Skype Surveillance: Are Your Calls And Chats Being Watched?

Skype, the popular VoIP application, has been at the centre of a debate surrounding user privacy and wiretapping. In 2012, Skype made changes to its call routing process, which sparked concerns that the platform could be used for wiretapping. This is because calls are now routed by Microsoft- or Skype-owned computers, making digital eavesdropping a possibility.

The Communications Assistance for Law Enforcement Act (CALEA), passed in 1994, requires telecommunications carriers to build surveillance capabilities into their equipment, allowing federal agencies to monitor all telephone, broadband internet, and VoIP traffic. While Skype's peer-to-peer architecture previously made it difficult to intercept conversations, the recent changes have led to speculation that wiretapping may now be possible.

The implications of these changes are significant, especially for users in authoritarian regimes or those with a reasonable expectation of privacy. While Skype has stated that the changes were made to improve the user experience, the potential for privacy invasions remains a concern for many.

Skype's architecture and its susceptibility to wiretapping

However, in 2012, Skype, which is owned by Microsoft, made a change to how it routes calls. Previously, third-party "supernode" computers with fast internet connections would act as a directory service for routing calls. Now, these supernodes have moved onto computers owned by Skype or Microsoft. This change has raised concerns about the potential for wiretapping, as it could allow the company to "wiretap" video calls, especially since Microsoft owns the supernodes and knows the encryption keys.

Skype has stated that this update has not changed the underlying nature of its P2P architecture and that supernodes only allow users to find one another, with calls not passing through them. However, some experts are skeptical of this statement and believe that certain types of connections may require calls to route through supernodes.

In terms of legal considerations, Skype is subject to the Communications Assistance for Law Enforcement Act (CALEA), which requires telecommunications carriers to have "lawful intercept" capabilities to support law enforcement. While Skype has a long reputation for guarding the privacy of its callers, it is possible that they may be compelled to comply with wiretapping requests under certain circumstances.

While the exact susceptibility of Skype to wiretapping is unclear, it is recommended that people living in authoritarian regimes avoid using Skype due to the relative likelihood that communications could be tapped.

The legality of recording Skype calls without consent

In addition, Skype's privacy policy states that they use all available information on their users for various purposes and reserve the right to review content for the purpose of enforcing their terms. While Skype calls are usually routed from one caller to another without a middleman, the company has made technical changes that push some of the video calling process onto their own computers. This has raised concerns about the potential for digital eavesdropping and wiretapping, particularly in light of Skype's cooperation with law enforcement agencies.

Regarding the legality of recording Skype calls without consent, it depends on the specific jurisdiction. In "one-party consent" states, it may be legal for an individual to record a Skype conversation without the other party's knowledge, as long as they are a participant in the conversation. However, distributing such recordings to third parties could potentially lead to an invasion of privacy lawsuit if the recorded individual had a reasonable expectation of privacy. On the other hand, some states require "two-party consent", meaning all parties must be aware of and consent to the recording.

Outside of the US, the legality of recording Skype calls without consent varies by country. For example, in Germany, telephone recording without the consent of both parties is a criminal offence, while in India, there is no specific law prohibiting the recording of phone calls without consent as long as the recorder is a participant in the conversation.

The use of Skype data in court

In 2004, the FCC ruled that CALEA applies to "internet phone services" with connections to the public telephone network. Skype is such a service. This ruling was upheld by the US Court of Appeals in 2006.

However, Skype's privacy policy has long been a source of concern for users. In 2012, Skype made changes to its infrastructure, replacing peer-to-peer client machines with Linux boxes. This gave rise to fears that Microsoft, which owns Skype, could facilitate wiretapping. While Skype denied these claims, it is important to note that Skype's privacy policy states that it "reserves the right" to review content for the purpose of enforcing its Terms.

In terms of using Skype data in court, it depends on the jurisdiction and the nature of the data. For example, in the US, some states require the consent of all parties to a phone call or conversation for it to be recorded lawfully, while others only require the consent of one party. Therefore, it is essential to consult the specific laws of the relevant state or jurisdiction when considering the use of Skype data in court.

Skype's compliance with law enforcement requests

In 2012, Skype made a change to how it routes calls, moving from a peer-to-peer system to using Microsoft- or Skype-owned computers, known as "supernodes," to route calls. This change raised concerns that Skype could now potentially "wiretap" video calls, especially since Microsoft owns Skype and knows the keys used for the service's encryption. However, a Skype spokesman stated that "calls do not pass through supernodes – they act in a directory function only," implying that Skype cannot intercept calls just because it owns the supernodes.

In terms of legal compliance, Skype, as a Voice-over-Internet-Protocol (VoIP) service, falls under the jurisdiction of the Communications Assistance for Law Enforcement Act (CALEA). This US law requires telecommunications carriers and manufacturers to modify their equipment and services to enable surveillance capabilities for law enforcement agencies. While CALEA does not currently apply to Skype as it is not considered a telecommunications service, it is still subject to other laws and regulations, such as the Electronic Communications Privacy Act.

Microsoft, the owner of Skype, publishes a Law Enforcement Requests Report twice a year, disclosing the number of legal demands for customer data received from law enforcement agencies worldwide. The report covers various Microsoft services, including Skype. According to the report, Microsoft requires a valid subpoena or its local equivalent to request non-content data and a warrant, court order, or its local equivalent for content data. In 2012, out of approximately 75,378 requests, Microsoft disclosed content in 2.2% of instances, amounting to 1,558 disclosures.

While Skype's infrastructure changes and compliance with law enforcement requests have sparked concerns about privacy and surveillance, it is important to note that Microsoft states it does not provide direct or unfettered access to customer data to any government or law enforcement agency. They also mention that they do not build back doors into their products and have a track record of declining requests for voluntary access to customer data.

The impact of Microsoft's acquisition of Skype on its security

Microsoft's acquisition of Skype in 2011 for $8.5 billion was a significant event that raised questions and concerns about the security and privacy of the popular telecommunications application. Here are some key points regarding the impact of the acquisition on Skype's security:

Changes to Skype's Infrastructure

Microsoft's acquisition led to changes in Skype's infrastructure, including the replacement of peer-to-peer client machines with Microsoft-operated supernodes. This centralization made it easier for Microsoft to facilitate wiretapping, as they controlled the connection and routing of calls. This raised concerns among privacy advocates and users, who feared that Skype could intercept and monitor calls more easily.

Compliance with Law Enforcement

Microsoft's ownership of Skype brought the application under the purview of law enforcement agencies. The Communications Assistance for Law Enforcement Act (CALEA) requires telecommunications carriers to modify their equipment and services to enable surveillance by federal agencies. As a result, Skype may now be subject to wiretapping if authorized by an FBI warrant, despite previous assertions that its peer-to-peer architecture prevented such interception.

Integration with Microsoft Technologies

Skype was integrated into various Microsoft technologies, including Xbox, Windows devices, Lync, Outlook, and Xbox Live. While this integration expanded Skype's reach and functionality, it also raised concerns about data sharing and user privacy. Microsoft could potentially access and share user data across its various platforms, raising questions about the security and privacy of Skype users.

Security Updates and Improvements

Following the acquisition, Skype implemented several security updates and improvements. They introduced automatic updates to better protect users from security risks and made changes to allow law enforcement access to user addresses and credit card information. However, these updates also received criticism, particularly from Mac users, due to the inability to disable them.

Handover of User Data

In 2012, Skype faced criticism for allegedly handing over user data to a private security company without a warrant or court order. This breach of user data privacy sparked concerns about Skype's commitment to protecting user information, especially as the company was now a part of Microsoft.

In summary, Microsoft's acquisition of Skype had a significant impact on the security and privacy of the application. While Microsoft's resources and integration improved Skype's functionality and reach, it also raised concerns about wiretapping, data sharing, and user privacy. The centralization of Skype's infrastructure and its inclusion under law enforcement surveillance programs changed the security landscape of the application, leading to a more complex and potentially less secure environment for its users.

Frequently asked questions