on Secure Communication: Is Blackberry Safe?

Now, if we could identify that 'someone'...
~James Bond, For Your Eyes Only

Current events make wiretapping not only popular but fashionable. Just recently, Indonesians discovered that all sorts of phones can be tapped. Cellular phones with prepaid numbers are just as easy to get into – sms and voice alike – particularly so when there are law enforcement agencies involved.


In the DPR these days, you can’t get anyone on the phone. It is probably because people are very busy but it’s also because nobody would really answer their own phones. They no longer believe in them. I think my phones are also tapped but I regularly say stupid things on the phone so that’s not to worry really.

These days, they use Blackberry because somebody think it more secure. A police general (whose phones were also allegedly tapped, claimed that he uses only the Blackberry to chat with his wife because it’s more secure). Let’s hope he chat only with his wife because it’s time to set the record straight on what secure communication means.

Generally speaking, these days, you can break into anything. RIM (of Blackberry fame), Yahoo, Google, AOL and Microsoft are all multinationals and will generally cooperate very well with the law enforcement agencies – written communication in all forms including chat, email, IMs and status updates are presumably properly archived and might be made available to the authority under most jurisdictions.

Cellular phones of all kinds are similarly susceptible to eavesdropping. Operators can help but only barely necessary. A prepaid number is no less secure than using a registered number – particularly so if you’re making the calls from an easily designated areas (aka, your office or your mistress’ hideout).

As a phone, Blackberry is not really much different from any others and yes, people can get to it too. Blackberry (and most other smart phones, iPhone et al) are probably more susceptible to be compromised due to the different ways the applications are installed on the phone. Yahoo Messenger, Gmail, BB IM and Facebook chat are all theoretically less secure on smart phones than on a PC because of the way things are configured (read this article if you want the gritty details). In France, government officials are not allowed to carry Blackberry for their official business due to the security concerns.

Technically, accessing personal information from your phones is probably not an easy job but there are geeks and nerds and experts out there whose lives are dedicated to breaking into things. With a legal mandate, listening in to your phone conversation, regardless of the make and origin of the phone, is a breeze. If you work with sensitive documents – or regularly hold embarrassing conversations – I’d strongly advise you to find new ways to do it and dump your Blackberry.

Frankly, I think everyone should stop touting Blackberry altogether because it promotes rude and antisocial behavior (I’m the only person I know without one). Carrying more than one Blackberry is excessive, not to mention less secure – because you’re more likely to drop one and lose the whole thing altogether.

So, my friends asked me, what to do when they need a truly private and secure communication.

Lacking a face to face opportunity, then the easiest way is to set up an anonymous account, write down whatever it is you want to write down, save it in your draft folder, pass the account and the password to the person intended – preferably in person or via some other pre-agreed codes. The recipient could then log into the account, retrieve the information, delete all the files and shut down the account.
The Germans used this method in World War II and caused a great deal of trouble for the Allies to break those codes and when they finally did, it made for wonderful readings (Neal Stephenson, Cryptonomicon or google “Enigma”).

Keep in mind that this method only works if you use the public email service – if you use your own mail servers then really, it’s up to the idiots in tech support to help with the subpoenas and court orders. The whole point about using a single source account is that so the information will not travel all over the place and turn up in a Google cache somewhere.

Whenever possible, it is best to meet in person, away from angled buildings. Current technologies make it possible for plucking your voice out of thin air over a great distance. You can also be photographed (unsafe, from the mistress’ POV). A video camera could also be easily trained at you and the eavesdroppers are just as likely to employ a mute to lip read your mouth movement.

I’d recommend thick scarves and areas remote from large crowds and discerning eyes. Park your cars within a convenient exit and plan your getaway route. Tin foil hats provide extra protection but probably not necessary. Instead, wear long overcoat and wrap around glasses and speak quietly facing the river,  under the Brooklyn Bridge. It works so well in films, I’m surprised there aren’t federal warrants for large bridges.

 

3 comments:

  1. pj said,

    There was talk in Canada of forcing RIM to make their phones more tappable - don't know if it ever got off the ground. It's still the preferred phone for criminals in north america.

    http://www.cbc.ca/canada/british-columbia/story/2009/03/24/tech-090324-blackberry-wiretap.html?ref=rss#articlecomments

    I suppose there will always be some cat-and-mouse between programmer/hackers and hacker/programmers

    on July 7, 2009 5:01 PM


  2. Rob Baiton said,

    So, you develop codes that only you and those who need to know, know. Maybe the Jedi Council can come up with a code and then use it in all their mobile communications.

    Let's face it, it was not all that long ago the it surfaced that most mobile providers in Indonesia were keeping vast databases of customers' communications.

    That said, the human race is a creative bunch and I am sure that someone somewhere will come up with a means to make communications secure again.

    on July 7, 2009 5:11 PM


  3. treespotter said,

    well, i think they should just all watch Sopranos and learn all about phone security. I don't like phones, so this isn't really my problems :)

    on July 8, 2009 10:16 PM