Security
Skype Policy
October 2007 Revision
Computing Services have monitored the use of Skype on the campus network over the last year following the increasing demand for this Peer to Peer telephony software. Previously the use of Skype required registration with IT Services so we could ensure a reliable service for mission critical applications. IT Services no longer requires this registration. The use of Skype, though officially not supported, does not currently pose a significant risk to service.
We will allow Skype to be installed and used if the following conditions are met:
-
Skype version 3.0 or greater is installed.
-
Skype is downloaded from: www.skype.com. Skype Windows Download is available at www.skype.com/intl/en-gb/download/skype/windows/, or follow the links on the right-hand side for other operating systems.
-
Skype is not loaded at startup and is only running whilst the user is at the computer to receive or make calls.
-
Should an excessive amount of bandwidth be used by a computer with Skype installed, the user must remove the software immediately at our request and if the user is not available we will disconnect the computer from the network.
-
Should the JANET A.U.P. (Acceptable Use Policy) www.ja.net/documents/publications/policy/aup.pdf subsequently change to explicitly prohibit Skype then the user must remove the software immediately at our request.
-
The user has read this policy in its entirety and fully understands the security implications and risks to privacy.
Full Policy Statement
Skype (www.skype.com) is a free application that facilitates free telephone calls through the use of an Internet connection. It is not a true VOIP (Voice over IP) solution and should not be treated as such.
Calls made using the system are routed through Supernodes, which can be ordinary computers with Skype installed. Computers on fast and well connected Internet feeds, combined with certain firewall restrictions, are more likely to automatically become Supernodes and route a considerable amount of traffic.
Also when becoming a supernode computers obtain a large number of concurrent connections almost instantaneously and the debilitating effect this can have on the local machine's IP stack and our firewalls could cause service affecting issues.
The current End-User Licence Agreement (EULA) for Skype is the August 2006 revision located at: www.skype.com/intl/en-gb/legal/eula/.
The original clause that grants Skype permission to install and use third-party software on computers running Skype has now been removed and therefore has alleviated concerns raised by the user community.
The EULA has been amended to reflect the concern over the applications use of the processor:
"4.1 Utilisation of Your computer. You hereby acknowledge that the Skype Software may utilise the processor and bandwidth of the computer (or other applicable device) You are utilising, for the limited purpose of facilitating the communication between Skype Software users."
Skype have responded to our queries and acknowledge that the supernode feature is integral to the operation of the software. It is worth knowing that if your computer is a supernode you are likely to be routing a lot of other people's calls / conversations. Conversely if your computer is not a supernode and neither is the computer of the person you are conversing with, then your calls / conversations will be routed through someone else's computer at any location on the Internet. Although the calls are encrypted, we are unsure at this point how strong this encryption is and if anyone would be able to eavesdrop easily.
Therefore clearly stating the application could carry traffic from users outside the JANET network between JANET nodes and out of the JANET network again therefore it appears to be in breach of the JANET Acceptable Use Policy www.ja.net/documents/publications/policy/aup.pdf.
Clarification in the Skype and JANET Guide March 2006 states:
"Section 11 of the Policy prohibits 'provid[ing] access to JANET for third parties without the prior agreement of JANET (UK)', but permits a limited amount of such use provided this is regulated by the customer organisation. Uncontrolled use of Skype, and particularly its bandwidth-hungry super-node behaviour, is likely to breach one or both of these sections."
www.ja.net/documents/development/voip/skype-and-janet.pdf.
There are several references on the JANET (UK) site regarding the establishment of acceptable use of Skype at JANET connected nodes:
"Usage of software VoIP clients. The issue of using free VoIP clients such as SKYPE was discussed, the main point of concern being the way in which SKYPE may use host PCs as a repeater. Although this is not ideal - the use of the technology ultimately lies with local usage policies - the use of SKYPE on JANET is not against any acceptable usage policy."
www.webarchive.ja.net/development/voip/events/event-summary.html
"If an individual is involved with more than one of these groups, then they may have to install and use many software tools in order to join or work with each community. Tools such as Microsoft Messenger, AOL Instant Messenger, Skype, IRC, VNC, Blogs, and so on are all in use by different research and project groups."
www.webarchive.ja.net/development/e-science/e-sciencevc/report1.pdf.
We hope this is a clear explanation of the current situation.
We are aware of other solutions that may provide similar facilities, e.g. Microsoft NetMeeing, Gizmo, and hardware based SIP interfaces, but we are unable to recommend any specific solution at the moment.