Chinese Skype spies archive a million conversations

Davey Winder
Thursday, 02 October 2008 16:31

Your IT - Home IT

The researchers managed to determine a whole host of keywords that seemed to trigger the message censorship and archiving process. These included the politically obvious such as Falun Gong and Taiwan independence.

However, less likely keywords such as earthquake, milk powder and the Chinese Communist Party are also thought to be used as triggers. And don't even think about swearing.

One researcher apparently monitored encrypted messages being sent to a remote location every time he typed the F word into a TOM-Skype client text message conversation.

The fact that TOM-Skype seemingly blocks transmission of certain words, and sends a copy of the offending message to a server where it is stored is bad enough. That personal information about the message writer is also recorded just makes it of even greater concern.

Researchers reckon that text conversations (there is no evidence that Skype voice calls are monitored in the same way) between TOM-Skype users in China and Skype users internationally are also recorded.

How do we get to know all of this? well that's the really freaky bit: the remote computers used to store the surveillance data were not configured securely and so researchers were able to access the directories using nothing more secret squirrel than a web browser.

At this moment in time neither eBay nor Skype are saying much beyond the usual we take the security and privacy of our users very seriously line. Certainly it is not addressing the monitoring issue, nor the extent to which it will "work with local authorities" in China to aid this censorship strategy.

Jennifer Caukin, an eBay spokeswoman, did tell the New York Times that eBay had "expressed our concern to Tom Online about the security issue and they have informed us that a fix to the problem will be completed within 24 hours."

So at least those pesky researchers will no longer be able to access the surveillance data store. Not quite the response that privacy advocates and pro-democracy activists would have been hoping for, I suspect...