India’s government: At last, we’ve cracked Blackberry’s encryption

Following India’s threat to shut down the Blackberry network in the country unless Research in Motion allows the government to snoop on Blackberry users made earlier this year, the country seems to have found a more pragmatic solution, and in a surprising move has publicly announced that they have finally managed to crack Blackberry’s encryption :

“The government has decrypted the data on Research In Motion’s (RIM) BlackBerry networks. The department of telecommunication (DoT), Intelligence Bureau and security agency National Technical Research Organisation (NTRO) have done tests on service providers such as Bharti Airtel, BPL Mobile, Reliance Communications and Vodafone-Essar networks for interception of Internet messages from BlackBerry to non-BlackBerry devices.

Initially, there were difficulties in cracking the same on Vodafone-Essar network but that has also been solved. This means that the e-mail messages sent on Internet through your BlackBerry sets would no longer be exclusive and government would be able to track them.” (more) (history)

"New Delhi, New Delhi"
Start spreadin' the news, RIM's leavin' today
Don't want no part of it, spy pork, spy pork
These Blackberry blues, are a freakin' dismay
Spy right through the very heart of it, New Delhi, New Delhi

If they can tap it here, They'll tap it anywhere
Fed up with you, New Delhi, New Delhi.

BlackBerry / India Ink Surveillance Contract - RIM shot

 Remember when India was threatening to shut down BlackBerry service unless it could tap user's communications? Reports have RIM operating a wiretapping facility in Mumbai to help with that.

Back in 2010, the Indian government set multiple deadlines for RIM to provide the government with access to encrypted BlackBerry communication or face a shutdown of BlackBerry services in the country. Those deadlines came and went, with RIM insisting that it has no back door that would let government authorities (or anybody else) decrypt and access communications on its BlackBerry Enterprise services. 

However, by the beginning of 2011 RIM had been working with the Indian government to provide access to consumer-level BlackBerry Messenger and BlackBerry Internet Services (BIS) email—and now the Wall Street Journal reports RIM is operating a small surveillance facility in Mumbai to process government requests for access to BlackBerry user communications. (more)

The Spin on the BlackBerry News

via FastCompany...
BlackBerry smartphones have been under fire around the world from terrorism-fearing governments. Now RIM's revealed how it'll let the Indian government spy on users, so the service can stay running. It's not too bad...

...RIM has consented to the governments wishes. It will allow access to BlackBerry Messenger communications inside India on a "case by case" basis, where "lawful" access requests are made. This means the government will have to follow due legal process to spy on BlackBerry users, on an individual basis, and with the consent of the courts. (more)

Expect more consenting as other governments squeeze BlackBerry with offers they can't refuse... "Say yes, or you're out of business."

A similar story, Anatomy of a Wiretap, in The Hindu newspaper has had the link to this graphic pulled. ("The article you are looking for is no longer available in this website.")

Putting the squeeze on Blackberry to get the juice

Talks between Indian officials and Canada's Research In Motion (RIM, the BlackBerry Bunch) would seem not to have gone very smoothly...

The backstory here is that the top brass at India's burgeoning and powerful state security services are concerned that Blackberry's advanced communications technology cannot be breached by their operatives and thus the "authorities" are currently unable to eavesdrop Blackberry users.

They have asked RIM to provide them with the capability to conduct covert surveillance on Blackberry users by requiring the company to install local servers and provide secret back door access to services, but the Canadian vendor has so far refused to comply. (more)

India Squeezes BlackBerry for Emails

The Indian government, only weeks after reaching an agreement with BlackBerry maker Research in Motion, now insists on intercepting corporate communications along with the BlackBerry Messenger service.

India cites its reasons to intercept BlackBerrys secure communication systems to combat terrorism, a problem it continues to suffer from with tensions with its neighbours Pakistan and the southern Arabian peninsula.

Research in Motion continues to state that it cannot provide a solution to intercept corporate emails, as the keys to its encryption is held by the entity which owns the server, outside of Research in Motion’s reach.  The company states that it does not possess a ‘master key’ which would allow unrestricted interceptions into corporate email accounts. (more)

India Wants to Eavesdrop on BlackBerrys

BlackBerry users, beware of the snoops. India's Telecommunications Dept. told telecom carriers, Internet service providers, and officials at Research In Motion (RIM), the Canadian company that makes BlackBerrys, that it wants to eavesdrop on transmissions from every BlackBerry phone in the country. To comply, RIM might have to route calls and e-mails through government computer servers based in India. (more)
FutureWatch... Look for other countries to jump on this bandwagon.

RIM Shot... and you're next Skype

International Telecommunications Union (ITU) secretary-general Hamadoun Toure said BlackBerry maker Research in Motion (RIM) should supply customer data to law enforcement agencies around the world, characterizing the governments’ needs as “genuine” concerns that cannot be ignored.

The ITU is primarily concerned with regulating global radio spectrum usage, supervising telecommunications standards processes, and helping regulate communication satellite orbits and transmission... the agency has no formal regulatory.. however, Toure’s comments certainly reflect the general sentiments of the ITU’s 192 members.

Canada’s RIM has recently faced regulatory issues in a number of countries over encrypted communications handled by its BlackBerry services, with governments like Saudi Arabia, the United Arab Emirates, India, Indonesia, and Lebanon all insisting that their governments be permitted access to BlackBerry users’ communications. (more)

BlackBerry Responds to Government Monitoring

RIM co-CEO Jim Balsillie has no objections if companies that make use of its secure BlackBerry smartphones want to hand over their encryption keys to government officials. However, RIM itself has no way of providing the unencrypted content of the emails that passes through its network operating center (NOC), since it doesn't have the keys in the first place.

This was the most direct answer to date given by RIM in response to government sanctioned wiretapping, a topic that was brought to the front even as countries such as the United Arab Emirates and India have threatened to ban the BlackBerry service unless RIM accede to their demands to a backdoor into its encryption system. Other countries such as Lebanon, Indonesia and Saudi Arabia were reportedly considering similar steps. (more)

Are governments going to accept this explanation, or say with finger poking their lips, "You will change your NOC, Mr. Berry. Un-zip it." 
Stayed tuned.

Indians Put Squeeze on BlackBerrys... again

India - Security concerns associated with the services of BlackBerry, the smartphone used by nearly a million customers in India, have come to the fore again, raising the possibility of a fresh standoff between the Canadian service provider and the government.

The government plans to give BlackBerry maker Research in Motion (RIM) 15 days to ensure that its email and other data services comply with ‘formats that can be read by security and intelligence agencies’ after its spooks recently raised a red flag against the popular handset, said department of telecom (DoT) officials familiar with the matter. (more)

Private Investigator + Software Firm = Cell Phone Spyware Arrest

India - The Central Crime Branch (CCB) police arrested two persons, who allegedly used a software to collect confidential and personal data of cellphone users, for detective purposes...

The preliminary investigation has revealed that several mobile numbers of clients all over India have been snooped upon over the past year, the police said.

[The] firm was allegedly involved in using snooping software on Android and Blackberry based mobile phones. The firm was allegedly monitoring phone calls and messages of people, on behalf of their clients for detective purposes...

Once the software is installed and whenever user starts using the mobile, all data pertaining to his calls including conversation recordings / messages / e-mails, chats, picture and videos on the mobile phone would be automatically uploaded to a server hosted somewhere else using the target mobile phone’s GPRS data.

Even the exact geographical movements of the target in terms of latitude and longitude would be recorded and sent to the server in real time. The clients of detective agencies would be provided with a login username and password to view the data and movements of target’s mobile phone on a web browser and Google maps. (more)

BlackBerry Squeezing Season

Indonesia considers joining a growing list of countries, including India, Saudi Arabia and the UAE in banning BlackBerry devices; Research in Motion is receiving increasing pressure to allow government access to data generated by the hand-held devices. (more)

World Spy News Roundup

The world is a busy place when it comes to spying.
Here is the action over the last few weeks...

Australia
• Government email spying plan under criticism.
• Government report... embrace "illegal", "deceptive" and "underhanded" espionage overseas.

Canada
• Was the bedroom of minister's ex really bugged?

China
• China calls computer spying claim ‘totally groundless’.
• Video surveillance equipment will be installed at Beijing schools.

European Union
• In-flight spycams - one in every seat; software analyzes you.

France
• Privy Privacy in Cannes - Madonna's unpaid $93,000 hotel bill over spying camera.

Germany
• Businesses across Germany spy on their workers.
• German spying scandals reawaken dark memories.
• Deutsche Telekom admits bugging phones of top management; then denies that it listened!
• The spying scandal affecting Deutsche Telecom continues to grow.
• Government gives police greater powers to monitor homes, phones and computers.
• Heinz Geyer, deputy head of former East German spy agency, dies.
• Lufthansa admits spying on journalist.

India
• Debate continues: Should Blackberry allow government security to spy on users.
• India practices unacceptably intrusive electronic surveillance.

Israel
• Israel frees Hezbollah spy for soldiers' remains.

Italy
• Ferrari spying may still be an issue.

The Netherlands
• Netherlands banned electronic voting machines; "eavesdropping risk".

Pakistan
• Dueling wiretaps. Battle of the political phone bugs.

Poland
• Lech Walesa angry with President Kaczynski about spying accusations.
• President Kaczynski denies ordering wiretaps on ex-prime minister Kazimierz Marcinkiewicz.

Russia
• Russia to demand Georgia ends spy flights.

Saudi Arabia
• 6 caught selling eavesdropping devices.

Sweden
• Swedish government may soon get power to spy on its citizens.

Taiwan
• National Security Bureau denied wiretapping telephone calls of officials and president.

Turkey
• A possible Turkish Watergate scandal.
• “AK Party is eavesdropping” claims the opposition.
• Turkish opposition claims security forces bugged its headquarters.

Uganda
• MP accuses government of spying on committees.

United Kingdom
• Government refused to investigate BT's covert wiretapping of thousands of customers.
• Councils admit spying on residents.
• Councils admit phone, e-mail spying.
• Bugging epidemic spreads - Vodafone fingered in new spying row.
• Top gadgets for spying on fellow SEO’s.
• Redcar hotel owner set up video camera to spy on couple.
• Government considering interception and data-mining all electronic communications.

United States
• Former S. Korean spy granted asylum. Had divulged illicit wiretapping of mobile phones.
• Court upholds conviction of Cuban spies.
• Study secretly tracked cell phone users outside US.
• Chinese expelled from the US for suspected industrial spying.
• Sheriff's Office disbands tarnished spy squad.
• Gutierrez possible victim of Chinese cyber spying.
• Former police chief accused of illegally bugging his secretary's office has pleaded guilty.
• P.I.'s In HP spying scandal fined.
• Billboards look back. Tiny cameras gather and analyze viewer's faces.
• Woman pleads guilty to aiding Chinese spy.
• Rent-A-Spy - 3/4's of the U.S. intelligence budget now goes to outside contractors.
• Feds encrypt 800,000 laptops; 1.2 million to go.
• Ex-CIA official indicted over agency job for mistress.
• TJX staffer sacked; talked about lax information security.

Venezuela
• Hugo Chavez's move to boost internal spying in Venezuela.
• Chavez spy laws 'creating society of informers'.
• Update! Chavez changes his mind. No new spy law.

India’s government has reiterated to BlackBerry manufacturer Research in Motion, and other companies providing encryption in their products, that they will have to be open to internal security and intelligence services if they wish to continue operating in the region.

Under this premise, Google and Skype could also be forced to shut down in the country if it cannot provide keys to its services...

To explain the difficulty of allowing a government to access Skype’s communications, one of the worlds leading intelligence organizations, the US National Security Agency, is still offering ‘billions’ for a solution to their eavesdropping needs on the peer-to-peer voice network. (more)

FutureWatch "...corporate parent eBay, having had to write down $1.4bn already following its $2.6bn purchase of Skype back in the bubble-2.0 days of 2005, might see an opportunity here. A billion or two from the NSA for a backdoor into Skype might make the acquisition seem like a sensible idea." (more)

Cell Phone Warning from India

Any smart phone - including Blackberry, Windows Mobile, iPhone and Symbian phones - can be hacked by a nerd with a little bit of code and some cunning.

And they don't stop at data and identity theft alone. Nor are they content with unleashing viruses on the operating system of your mobile. (Even Bluetooth makes your phone a potential target here.)

New Age mischief makers have learnt how to bug your phone and remote-control it. They can steal your bank information, send out a mischievous SMS to your girlfriend (who might just dump you!), copy your top-secret files or simply spy on every call/SMS you make from your phone. In fact, they can even 'modify' your SMSes before these are sent out to your contacts - and you wouldn't even know it.

That's not all. Hackers can also use your phone to spy on you by switching it on. They can activate the camera and eavesdrop on your discussions during a business meeting, or while you are secretly negotiating a lucrative job offer with a rival company. What's more, they can even do an audio/video recording by sending an SMS command...

So what should a user do? A few simple steps could go a long way. Adopt a multi-layered security approach. Protect mobile devices with antivirus, firewall, anti-SMS spam, and data encryption technologies and install regular security updates to protect phones from viruses and other malware. And yes, don't click blindly on any SMS, for someone may just be spying on you on the sly. (more)

Is your Blackberry a National Security Threat?

Perhaps, if you live in these countries...

According to the BBC, the United Arab Emirates (UAE) has described RIM’s device as a threat posing “serious social, judicial and national security repercussions” due to the country’s inability to successfully eavesdrop on users, and the fact that transmitted data is stored offshore.

The same concerns have also been expressed by India, Kuwait and Saudi Arabia, with market analysts contributing the timing of these comments to yesterday’s decline in RIMM shares...

When discussing UAE’s obsession with RIM’s device, it’s worth emphasizing on the fact that the country unsuccessfully attempted to install spyware application on the devices of Etisalat users in 2009, pitching it as a “performance-enhancement patch”. Instead, the SS8 Interceptor drained the batteries of the users who installed to the point where they became suspicious about its true nature...

The bottom line - are BlackBerries a threat to the national security of any country? They are, but only to the country that’s attempting to decrypt the data itself, instead of targeting the weakest link - in this case the user who now more than ever has to be aware that he’s become the primary target, not the encryption protocol itself. (more) 

"The bottom line" is worth noting. The more you protect one info-conduit, the more your adversary will be forced into attacking your lesser protected conduits. Hence, businesses need a counterespionage consultant on-board who has a holistic view of the espionage possibilities. The days of "they swept, they left" TSCM teams are long gone. 

If you have read this far, you the foresight to see why this story is a valuable cautionary tale. Good consultants are only as far away as the websites which bring you Kevin's Security Scrapbook.