29 December 2009. GSM A5 Files Published on Cryptome

1 November 1998
Source: Christian Masson

[To: Christian Masson]

Thanks for your information. It's very interesting. What do you think 
about our recommendation R(95)4, that has become a Directive of the EC?

Spyros Tsovilis
Section protection des données/Data Protection Section
Direction des Affaires Juridiques/Legal Affairs Directorate
Conseil de l'Europe/Council of Europe


[To: Spyros Tsovilis From: Christian Masson Date: Fri, 23 Oct 1998 02:32:29 PDT] REF.: RECOMMANDATION (95)4 http://www.coe.fr/dataprotection Sir Spyros, Thanks for yr interest, 2. All the time violated. E.g. France telecom got one authorization and placed it in an access node (trunk in central, B-ISDN line in central, main server TCP/IP in France Telecom,...) and so taps simultaneously 10,000 lines. (Source: CNIL, Mr. Drouard.) 2.2 Impossible and never applied. Slot time GSM test is indirect tapping. Idem for gonio, real time tapping. Anonymity in telecom system is impossible. E.g. Swiss Natel Easy (anonymous GSM), except the first time, leads sooner or later to the automatic tapping system: Cd-Cg P, CLIP, Forcer Identication, internal billing system, PLU/back-up, words/voice recognition system, public phones automatic tapping system (airport, center of great town,...). 2.2 A wish, never applied. (Strasbourg 81, STE, no 108, art. 8 CEDH,...) is impossible to be applied. There are actually too many automatic tapping system: word(s) recognition, CLIP calling identification line system, Called-calling Parties (Cd-Cg P), billing systems, trap, others automatic identification system, public phones tapping,... 7.2 All billing information is kept 6 months-10 years. No effective control on back-ups (and back-ups of back-ups). 7.4 A wish. Actually EDVT electronic directory in public phones are tapped by Swisscom. It's the same with others public electronic directory (Minitel, France Telecom telematic web directory,...) 7.10 7.11 For me, commercial profile is public life. 7.16 7.17 Impossible, if customer can cancel (e.g. *31 or ask for operator) the identication of their number; police, urgence, telecom... have all time the number: FORCER IDENTIFICATION SYSTEM, NORA,...  7.19 Called-Calling Parties, CLIP,...: filters are impossible. The last step (judge,...): yes  7.20 In France and Belgium, each crypto system must be (quickly) breakable. In others countries, crypto's freely available but also must be (slowly) breakable, http://www.crypto.ch. The length of crypto key means nothing (under 2100 bits). The illusion of protection helps generate profitable interceptions. 7.21 Wrong and impossible. Each GSM generates a cell trace. Each back-up & PLU is actually freely accessiblefree for each GSM operator. CNIL suggests a European harmonization for it. For each GSM call, the originating cell is recording with a back-up and followed by cell/PLU trace/GSM in stand-by) all the time and for each GSM. It's a real and massive problem. Phil Karn [Qualcomm Scientist/Cryptographer]: "Cellular registration is one of the most problematical privacy issues in modern telecommunications." In conclusion, this recommendation is contradicted by Enfopol (illegal but effective) ETSI tracing equipment recommendations and the actual practice of interception. A recommendation is not a law. Without technical control, it's a joke. Pls, do not hesite to contact for any remarks, Regards, Christian Masson