fied long ago and has surfaced again in the ongoing debate about the accountable Internet (for example, see Clark and Landau2).

The list of security threats in VoIP and IM systems is naturally quite long. Of course, research and standardization has also been ongoing, and various countermeasures have been developed and are waiting to be deployed. Some specific protocols also had to be developed to support emergency services, such as the Lo-cation-to-Service Translation (LoST) protocol that is used for routing emergency calls to the appropriate Public Safety Answering Points (PSAPs). These components introduce additional attack vectors. 12

conclusion

The work on the next-generation emergency services infrastructure is progressing with NENA and EENA leading the work in North America and Europe, respectively. With the baseline technical standards coming from the IETF, security threats have been investigated and documented, and technical countermeasures have also been developed. While many of these problems are being observed in today’s emergency services system, it is likely the transition to an all-IP-based emergency services infrastructure will invite far more attacks. There are various barriers for dealing with these problems, namely:

˲ ˲ As long as attacks are still low (and the amount of IP-based emergency services is still low due to either the lack of regulation or unclear regulatory situation worldwide) there is no incentive to resolve the problem;

˲ ˲Many Internet players seem to lack economic incentives to deploy infrastructure for a high level of assurances—an area that aims to be addressed by NSTIC but with uncertain success outcome at this point in time; and

˲ ˲ A lack of harmonization at the legal level. The Internet architectural model is not well enough understood by the regulatory community. The temptation to follow well-established patterns and to talk to their existing clientele is often too big; unfortunately that work style is not a match for today’s ecosystem.

The last item is a particular area
where further work is needed to bridge
the gap between the policy and the
technical community. Organizations
developing technical standards are typ-
ically not ideally positioned to convey
messages to policymakers on how re-
sponsibilities for the deployment have
to be shared among the different stake-
holders in the ecosystem and what non-
technical considerations need to be ad-
dressed. Due to their broader mandate,
which includes training, certification,
lobbying, and operational guidance,
emergency services communities such
as NENA and EENA are in an ideal posi-
tion to close this gap.

References

1. barnes, r., Cooper, a., and tschofenig, h. technical considerations for next-generation 911—Comments in the matter of framework for next generation 911 deployment, Ps docket no. 10-255; http://fjallfoss.fcc. gov/ecfs/document/view?id=7021034355.

2. Clark, d., and landau, s. untangling attribution. In Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy, 2010.

3. eena. False emergency calls eena operations document; http://www.eena.org/ressource/static/ files/2011_03_ 15_ 3. 1. 2.fc_v1.0.pdf.

4. FbI. don’t make the call—the new phenomenon of ‘swatting,’ Feb. 2008; http://www.fbi.gov/news/ stories/2008/february/swatting020408.

5. Federal Communications Commission. Framework for next generation 911 deployment, Ps docket no. 10-255, december 21, 2010; http://www.fcc.gov/daily_releases/ daily_business/2010/db1221/FCC-10-200a1.pdf.

6. nena. nena executive board approves end-state vision for next generation 9-1-1; http://www.nena.org/stories/ technical/executive-board-approves-i3-standard.

7. nICC. VoIP—location for emergency Calls (architecture), nICC nd 1638 Issue 1. 1. 2, march 2010; http://www.niccstandards.org.uk/files/current/ nd1638%20V1.1.2.pdf.

8. nIst. draFt electronic authentication guideline; special Publication 800-63, June 2011; http://csrc.nist. gov/publications/ Pubsdrafts.html#sP-800-63-rev.%201.

9. nIst. national strategy for trust Identities in Cyberspace (nstIC); http://www.nist.gov/nstic/.

10. rosen, b. and Polk, J. best current practice for communications services in support of emergency calling; draft-ietf-ecrit-phonebcp- 17 (work in progress), march 2011.

11. rosen, b. et al. Framework for emergency calling using Internet multimedia; draft-ietf-ecrit-framework- 12 (work in progress).

12. taylor, t. et al. security threats and requirements for emergency call marking and mapping. rFC 5069, January 2008.

13. tschofenig, h., schulzrinne, h., and aboba, b. trustworthy location information, draft-ietf-ecrit- trustworthy-location-02 (work in progress), may 2011.

 

hannes Tschofenig ( [e-mail]) is employed by nokia siemens networks in Finland and spends most of his time in the Internet engineering task Force (IetF) with the design of Internet protocols. he is a member of the Internet architecture board and co-chairs the IetF web authorization Protocol (oauth) working group. For many years he was co-chair of the IetF emergency Context resolution with Internet technologies (ecrit) working group.

Copyright held by author.

Calendar
of Events

november 17–20
11th Koli Calling international
Conference on Computing
education research,
tBA, finland,
Contact: Ari Korhonen,
email: [e-mail]

november 21–24
international Conference on
management of emergent
Digital ecosystems,
San francisco, CA,
Contact: William Grosky,
email: [e-mail]

november 28–December 1
ACm multimedia Conference,
Scottsdale, AZ,
Contact: Kasim Selcuk Candan,
email: [e-mail]
Phone: [phone]

november 28–December 2
the Annual meeting of the
Australian Special interest
Group for Computer human
interaction,
Canberra, Australia,
Contact: Duncan Stevenson,
email: duncan.stevenson@anu.
edu.au

December 3–7
the 44th Annual ieee/ACm
international Symposium on
microarchitecture
Porto Alegre, Brazil,
Sponsored: SiGmiCro,
Contact: Luigi Carro,
email: [e-mail]

December 4–5
Computer human interaction
for the management of
information technology,
Cambridge, mA,
Sponsored: SiGChi,
Contact: Adam S. moskowitz,
email: [e-mail]

December 5–7
international iCSt Conference
on Bio-inspired models of
network, information and
Computing Systems,
York, United Kingdom,
Contact: timmis Jonathan,
email: [e-mail]

December 5–7
the 13th international
Conference on information
integration and Web-based
Application & Services,
hue City, Vietnam,
Contact: rahayu Wenny,
email: [e-mail]