Hacker News Reader

Comment by sgjohnson | Hacker News Reader

Every router is technically capable of doing this.

It's just firewall rules and pcap.

Not sure this is front-page worthy.

Seems like a feature for mandatory "intercept and log network traffic" is interesting enough for hackers for the story to land on the frontpage.

I didn't know about CALEA since before but I've dealt with lots of network infrastructure (never in the US though), so I found this interesting, and upvoted it.

> Not sure this is front-page worthy

why not ? i believe it is especially as i imagine most people are not aware that such things exist in freedom lands

To be fair, this makes perfect sense. It allows compliance with wiretap warrants. Which are perfectly reasonable.

They are not. This is broadband. This goes far beyond pen-registers.

This is bloody everything from a particular endpoint, and not in an application specific manner. There is very little but storage reqs and someone getting uppity keeping this from becoming a dragnet type of surveillance mechanism.

The warrant is part that makes it not a dragnet.

Depends on how specific and difficult the warrants are.

if you're on HN there is a level of confidence that you understand basic networking, and that you are aware your traffic goes through a multitude of devices before you get the data you requested.

it should come as no surprise that those devices can log the data passing through it.

Just wait... someone will complain this is a GDPR violation. ;)

> why not ? i believe it is especially as i imagine most people are not aware that such things exist in freedom lands

Do you mean firewall rules? Because firewall rules definitely exist in "freedom lands."

A lot of the comments here seem to show an eagerness to misunderstand this. Even in a "freedom land" law enforcement still needs the power to intrusively investigate criminal suspects, because ineffective law enforcement is a bad thing and a threat to liberty.

in freedom land people generally believe that things they own will not call the cops on them. in contrast in soviet russia people generally belived everything they owned called the cops on them

Just to be clear, this has nothing to do with a thing someone owns calling the cops on them. A CALEA intercept would be implemented before the data reaches the end user.

im taking the liberty to talk figuratively. but yeah the thing you own instead of calling the cops will by design and purpose snitch on you when they come knocking

How so? Unless you own a router with CALEA capabilities and specifically configure it to log all of your data, it's not going to snitch on you.

> router with CALEA capabilities and specifically configure it to log all of your data

the point is that in the US this [the device you own snitching on you] is required by law

https://en.m.wikipedia.org/wiki/Communications_Assistance_fo...

You're misinterpreting it. CALEA requires that service providers have the capability to do interceptions when requested by law enforcement. It has absolutely nothing to do with end-user devices.

> It has absolutely nothing to do with end-user devices.

absolutely nothing ? are you sure about that

I find that nephile mentality quite ignorant of the fact that the negative and bad things aren’t just ephemeral, regardless of whether you would like to move on to next-thing. But I guess to people with your mindset the slippery slope is no slope at all, but rather a flat plane as you are sliding down it.

“Why are you so concerned with the old Constitution” you proclaim, “we have the patriot act instead. It even has the word patriot in its title and the iPatriot act is on the way to replace the old patriot act. I support next-thing.”

It depends, I've got some junipers that only pass the application processor the first N bytes of a packet, and even captures are limited to the first N bytes. Vendor docs say that if you need captures, you should do them on the switch, or use DPI and route everything through the application processor.

You could probably develop a "NSA sniffer" to determine when captures are happening by noting network degradation, especially if it forces everything onto the application processor and off of fast-path.

like putting a script on the switch that says the cpu utilization is x% higher? Do higher end switches report out utilization of the packet processing asic? I have a few high end switches in my homelab, I can of course tell the utilization of the management processor but I have never tried to delve into what the actual switch chip is doing.

I was thinking more remotely noticing that throughput dropped - my switches can route at line speed if they avoid the CPU, but if the CPU is involved it drops to about half line speed.

If you're the one controlling the network router, you know when the sniffing is going on - this would be trying to detect that your ISP has turned the "NSA button" on.

Reply on news.ycombinator.com