veyepar: OpenLI: Lawful Intercept Without the Massive Price Tag

Author(s):	Shane Alcock
Location	A2
Date	jan Fri 25	Days Raw Files
Start	13:30	First Raw Start	13:01
Duration	0:45:0	Offset	0:28:51
End	14:15	Last Raw End	14:31
Chapters	00:00 0:01:50 0:31:50
Total cuts_time	49 min.

https://2019.linux.conf.au/schedule/presentation/177/
raw-playlist raw-mp4-playlist encoded-files-playlist host public tweet mp4 svg png

assets release.pdf OpenLI_Lawful_Intercept_Without_the_Massive_Price_Tag.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

Lawful intercept (LI) obligations for Internet service providers have changed significantly in the past few years. Whereas law enforcement agencies were previously willing to accept a simple pcap trace of customer traffic (typically delivered some number of hours or days of delay) for the requested time period as a valid intercept, new standards for LI, such as the ETSI LI standards, are much more onerous for operators to comply with. Specifically, intercepted traffic must be delivered to the agencies in real time, encapsulated within LI-specific headers and delivered alongside additional meta-data records that describe how and when the target was interacting with the operator's infrastructure (i.e. RADIUS servers, SIP servers, etc.).

In New Zealand, all Internet service providers that have at least 4000 subscribers must be capable of delivering an ETSI-compliant intercept (live-streamed) upon receipt of a warrant from a law enforcement agency. Many hardware vendors offer licenses that will enable LI capabilities in their devices, but the cost of these licenses is extremely high. This creates a problem for smaller network operators: how can they meet their LI obligations without bankrupting themselves on vendor licenses?

The OpenLI project is a collaboration between the WAND Network Research Group at the University of Waikato and a group of New Zealand network operators aimed at providing an alternative (and much cheaper) way for operators to meet their lawful intercept requirements as defined in New Zealand law. WAND provides the experience and programming expertise to develop an ETSI-compliant software solution that can be used by the operators to meet their LI obligations. In turn, the operators each contribute a relatively small sum of money to cover the cost of the programmer's time and provide access to realistic deployment environments and traffic workloads for testing. The eventual finished software will be released as open-source under a GPL license.

This talk will cover a number of relevant topics, including:
 * The ETSI LI standards and why pcaps aren't good enough anymore.
 * The LI landscape in New Zealand specifically and how it led to OpenLI being started.
 * Why hasn't anyone tried to solve LI with OSS before?
 * Overview of other OSS that OpenLI is built upon.
 * Design and structure of the OpenLI software.
 * Interesting anecdotes about tricky problems we've had so far and how we've solved them.
 * Where the project is at right now.
 * What you can do to help out, if you are that way inclined.

Comment:

production notes