DEPARTMENT OF ENERGY
INFORMATION SECURITY RESOURCE CENTER
PACIFIC NORTHWEST NATIONAL LABORATORY
ADVISORY NOTICE No. 12
January 20, 1997
NEW COMPUTER TECHNOLOGIES CONTINUE TO PRESENT NEW THREATS
INTRODUCTION
This Advisory Notice contains information which addresses a risk associated with using a computer as an audio recorder. If malevolently applied, this audio recording capability represents a potential risk to the protection of sensitive conversations.
SUMMARY
With the rapid growth in interactive educational and business software applications, and the increase in demand for multimedia desktop and laptop computers, audio recording capabilities involving computers have evolved dramatically during the past two years.
Using free software widely available on the Internet, and the internal microphone installed by the manufacturer in a laptop computer, or an externally attached microphone, it is possible to record hours of conversations on a computer or laptop to the available free hard drive space. This provides a means to surreptitiously record and compromise discussions.
The risk of a miniature tape recorder in a briefcase or pocket being secreted into a meeting or facility has long been known. Now, however, mitigation measures must also be applied to the audio recording threat posed by laptop and personal computers.
BACKGROUND
Audio recording software programs are both abundant and free from various sources, including the Internet. Several software applications that can provide extended recording on both Windows and Macintosh platforms have been located. These programs permit a computer to operate in the same manner as a tape recorder. These programs can run in the background, activating the microphone connected to the sound card. Sound levels can be customized so that only sounds above a defined threshold triggers recording.
These audio recording programs have capabilities which take advantage of your built-in or remote microphone and use all available space open your hard drive to store to recorded file. As an example, 100 MB of hard disk space will yield about 8 hours of high quality audio recording. It is not usual to have over 1 GB of hard disk space in today's PC or laptop. One such software package can record over 20 hours of audio conversation to 500 MG's of free disk space.
VALIDATION EFFORTS
A one hour search of the Internet yielded freeware, shareware, and commercial software application that can be used in this manner. The potential applications were found for many platforms including Microsoft Windows 3.1, Windows 95, and Macintosh II, Ci, Cx, and Power PC's. Most programs record sound for the duration of available hard drive memory.
The ISRC has tested several software applications and have found them to function as described. Three programs were tested on Windows 95 and Macintosh operating systems. All were determined to accurately capture audio conversations occurring within the range of the computer microphone. Some of the programs can be hidden from an unwitting user. Most can be automatically launched by placing them in a startup folder, unknown to the user, or by a simple operating system macro.
POSSIBLE IMPACT
As computers and computer software technology continues to advance, more is being discovered of how some programs can be used for means other than originally intended. The ability of a laptop computer to record a meeting for later playback and transcription, from the same computer, represents a useful tool. However, surreptitious recording can be accomplished in exactly the same way.
Increasingly, as vulnerabilities are discovered, risks must be reevaluated. Risk acceptance or mitigation must be addressed to ensure a protected environment wherein business can be conducted securely.
RECOMMENDED ACTION
Awareness information should be disseminated throughout the Department complex.
New information technology, especially computer software, must continually be evaluated to ascertain if security vulnerabilities or risks exist.
Return to Advisory Table of Contents
Security and Privacy Notice
To contact send email to ISRC
Last Updated October 2001