RIM In Trouble For Not Violating Privacy

sufijazz writes "The US government is not alone in wanting to snoop on everything citizens do over email/phone. The Indian government wants that right too. RIM is stating they have no means to decrypt, no master key, and no back door to allow the government to access email." The article notes that 114,000 BlackBerries are in use on the Indian subcontinent. The government is concerned about attacks by militants and sees the BlackBerry as a security risk.

Comments

can't work even if they wanted it to

[gmack]

And there's the downside of governments trying to fight modern technology.

I bet if Blackberry did as they asked then people would start loading custom firmware on their phones to work around it.

Re:can't work even if they wanted it to

[Ren Hoak]

The BlackBerry has really lost its monopoly on the messaging device. If they were forced to comply with this, I would expect them to lose market share while people flocked to any of the myriad other devices that provide convenient messaging services.

Re:can't work even if they wanted it to

[unlametheweak]

It doesn't matter; allowing governments to spy on people does not stop terrorism, social injustice, crime, political unrest, famine or war. It's an irrational reaction to a problem. Deal with the cause not the effect. But I don't really think politicians are that stupid; I think they know this, but want the excuse to be in the best example of Orwellian arguments to tyranny, however subtly and slowly it creeps upon us.

Re:can't work even if they wanted it to

[Anonymous Coward]

The BlackBerry has really lost its monopoly on the messaging device.

Blackberry never had a monopoly on the messaging device.

What Blackberry does have is the best mobile messaging platform, by far. Great management tools, great encryption, great integration with existing IT infrastructure.

Re:can't work even if they wanted it to

[smclean]

Or just use encryption. To me, that's what is so baffling about the government privacy crackdowns. If anyone who was even remotely well informed wanted to communicate in private, they'd use strong encryption. I guess once someone uses encryption, they get an Indian military intelligence unit parked outside their door.

Re:can't work even if they wanted it to

[metlin]

Well, to play the devil's advocate, terrorism in India is a much more realistic threat than terrorism in the US is (a democracy surrounded by Pakistan, an Islamic dictatorship and China, an aggressive communist state).

Not that that gives the government the right to do what they are trying to do, but just that do not attribute to malice what can be attributed to idiocy, or desperation.

Just last week, there were several bomb blasts that killed over 80 people and injured hundreds more.

I don't necessarily think they are trying to fight modern technology, as much as try to prevent the bad guys from using it to their benefit. I do not necessarily agree with the way they are going about it, but I can certainly see where they are coming from.

Unlike the US where the state seems to use one incident as the bugaboo for massive invasion of privacy, countries like India and Israel face terrorism on a daily basis, and for them, this is a real, hard problem that needs to be addressed.

This is also a debate that has been going on for a long time, and it is too early to make a call.

Re:can't work even if they wanted it to

[Anonymous Coward]

Or just use encryption. To me, that's what is so baffling about the government privacy crackdowns. If anyone who was even remotely well informed wanted to communicate in private, they'd use strong encryption. I guess once someone uses encryption, they get an Indian military intelligence unit parked outside their door.

Yes, but blackberries make it easy to communicate securely. You don't have the hassle of a PKI infrastructure with S/MIME certificates, or using PGP.

Incidentally, blackberries support PGP and S/MIME on top of their existing security.

Re:can't work even if they wanted it to

[sm62704]

do not attribute to malice what can be attributed to idiocy, or desperation

I believe Hanlon's razor is dull and rusty and Hanlon was probably using his razor to shave his own malice. Not that I ever heard off Hanlon before looking the quote up.

I subscribe to the credo "Never attribute to stupidity that which can be adequately explained by malice". Call it mcgrew's razor if you wish, it cuts the opposite way as Hanlon's. Malice itself is usually stupid, and anger is almost always counterproductive in our world.

But it matters little whether the person you are making excuses for is stupid or evil, the result is the same, and the cure is often the same as well. Why do you think they say "wow, that smarts" when they are in pain?

Re:can't work even if they wanted it to

[Tikkun]

You can't fight murder by banning knives, you can't fight hate by burning books and you can't fight conspiracy by banning privacy. Giving up your rights does not make you in any way safer.

Deal with the problem, not with the tools.

Re:can't work even if they wanted it to

[Anonymous Coward]

Blackberry has been available in India for the last 3 years without the government or DOT raising a single issue about terrorists.

Its just when Tata Teleservices offered to provide the service that this suddenly became a 'terrorism' issue. Airtel and Hutch now Vodaphone have been providing blackberry since 2004.

This is not about terrorism but corporate politics and influence peddling which is the way of business in India. RIM just has to pay some money to the right people and this will die a natural death or ask Airtel/Vodaphone to stop their lobbying against Tata Tele.

Terrorism is fast becoming a favoured excuse and people should be a tad more skeptical before jumping to conclusions about threats that may not exist. Terrorists have many ways of communicating without resorting to blackberry. You can't stop technology because it can be abused.

Re:can't work even if they wanted it to

[Anonymous Coward]

The others support SSL-encrypted IMAP and SMTP. I just don't see the appeal of the way BB does this stuff....

What? You didn't drink the kool-aid? Seriously, I used to wonder the same thing, but the blackberry is a far better platform.

You're right, lots of mobile devices can do POP/IMAP/SMTP with SSL. So, you've got your mobile device, and you want to see if you've got email. You click the "check email" function, or it runs in the background all the time, checking every five minutes for new mail. That's called "pull" email, and it means you run up a considerable data bill, even when you're not sending email. There was some poor guy bought an iphone immediately when it came out, activated it with AT&T, then took his shiny new iPhone to Europe on a trip. The default for the iPhone is to check for new email every 5-10 minutes, even if the phone is not "on". So this poor sucker gets a huge international roaming data bill even if he didn't send/receive a single email.

By comparison, the blackberry is "push" email. There is no need to check for new messages. If your email account gets a new message, the server pushes it to your device. Unless you are sending/receiving a message, your data usage is zero. If the guy had a blackberry instead of the iphone, his international data bill would have been zero. Lots of people & companies like that, especially those of us who live in countries with ridiculously high data rates (like Canada - we are in the dark ages when it comes to mobile phones & services).

Does your nokia/treo/ericsson sync your todo list, calendar and address book in real time with your desktop?

In a large company with 50,000 employees, a blackberry can look up email addresses in active directory or notes.

RIM also realized the limitations of the handheld form factor. Even with a big screen handheld, you don't want or need the full html-ized email that most people send these days - it's not going to display well. So, why send all this data that doesn't display well? When the email arrives at the blackberry server, the server strips out most of the html fluff (which can reduce the size by 50%-90%), then compresses the message with a conventional compression algorithm, then encrypts the message with AES, then sends it to the blackberry device. That reduces the data bill even further. Beancounters like that.

Since big attachments aren't going to display well on a small handheld screen, the blackberry server compresses & modifies the attachment to a form that will display well on a small screen. Does your nokia/treo/ericsson do that?

What about device security? Does your nokia/treo/ericsson store the pop/imap email securely on the device in encrypted form? Nope. Blackberries can do that.

Does your nokia/treo/ericsson support PGP and S/MIME for extreme paranoia? No, but blackberries do.

RIM provides full documentation and a developer kit to build your own applications. You don't have to beg apple please pretty please can I write an application and put it on my own phone.

What if you lose your blackberry with all your important company secrets on it? The blackberry server can remotely lock the handheld, or even wipe the entire thing with a single command. Does your nokia/treo/ericsson do that?

Some companies are required by law (like investment banks) to track all communications that staff have with clients. Does your nokia/treo/ericsson do that? Blackberries can track every phone call, email, SMS, IM and PIN message.

Can you prevent your staff from installing software on a nokia/treo/ericsson? You can with blackberries.

Can you prevent your staff from using the internet, bluetooth, memory cards, cameras, GPS, or long-distance calls with a nokia/treo/ericsson? You can with blackberries.

Don't get me wrong, blackberries aren't needed by everyone. But they are very handy, and the best mobile messaging platform, by far.

Re:can't work even if they wanted it to

[BoberFett]

Does terrorism need to be solved? Of all the causes of death in the world, terrorism is pretty low on the totem pole. And when you look at the cost of fighting different causes of death, terrorism is way overblown.

How many people have died in the US due to terrorism compared to what we've spent on it?

How many people have died due to heart disease and cancer compared to what we've spent on them?

People's fears of scary muslims behind every corner are the stuff of Saturday morning cartoons.

Re:can't work even if they wanted it to

[lena_10326]

I don't really agree with everything you said, but the Troll modifier was completely unwarranted.

I know. Jesus H. Christ. WTF. The idiots mod'ding on here are getting rather out of hand. My post was so NOT troll.

Anyway. Back to business and on to your your reply.

Personally, I will accept ZERO losses of freedom for even real gains in security. Not perceived gains mind you, REAL tangible gains.

It's too late. In 2008, you can be stopped, required to show your 'papers' (driver's license), questioned and interrogated, threatened with guns, shot, arrested, and taken into custody without committing any crime. How? By police. There are so many laws on the books that at any given moment in time you are guilty of something, even if it's a matter of interpretation and you eventually get off, it can still happen causing you grief, humiliation, financial loss, and wasted time. The depressing part is it's worsening by the month.

I am PERFECTLY willing to go and KILL absolutely every one and everything affecting my freedom. Just point the direction. If a politician says to me that I have to lose freedom, privacy, and anonymity due to some enemy out there, I will respond with this question, "Can we just go kill them instead?".

My stance would not be so aggressive. I would draw the line at our borders. Inside our borders, yes, but outside no. I don't feel invading other countries to root out 'tarrists' and thus create new 'tarrists' is a wise plan of action, nor is losing our moral ground.

Whatever happened to fighting for your freedom? I thought that was the American Way right?

We all have different definitions of fighting though.

This could set a precedent

[Beryllium Sphere(tm)]

Phone companies in the US, maybe elsewhere, are legally required to facilitate eavesdropping under CALEA. End to end encrypted data services such as Skype and Hushmail have escaped this so far.

Will they be faced with the dilemma of changing their architecture versus being banned? Will they lose confidence no matter what? Hushmail at least used to publish their source code, but Skype is closed source and the binary is heavily obfuscated.

Re:This could set a precedent

[unlametheweak]

Phone companies in the US, maybe elsewhere, are legally required to facilitate eavesdropping under CALEA. End to end encrypted data services such as Skype and Hushmail have escaped this so far. So has TOR and Freenet so far. The German built JAP proxy technology was forced to put in a backdoor for the German police; all completely unannounced until a programmer looked at the (open) source code. Wikipedia has a slightly different interpretation (no back doors, but warrants issued to log IP addresses). To this day there are some very stupid people who believe that "anonymous" services should have backdoors in place to make these services un-anonymous.

I can remember when the PGP creator was put on trial in the US for his subversive software. The American government was smart in dropping the case and thus not setting a possible legal precedent (against themselves), but that was pre-9/11. As Bob Dylan once said "The times they are ah changin'"

Re:This could set a precedent

[74nova]

I knew there had to be a way to slam America in this, nice work.

Re:This could set a precedent

[Anonymous Coward]

I can remember when the PGP creator was put on trial in the US for his subversive software.

He wasn't on trial for his subversive software, it was for exporting munitions without a license.

Most countries (including the USA) have rules on the exportation of military technology. They don't want John Doe to export 100,000 artillery shells to a war zone (or an enemy) without approval.

Encrypted communications technology was classified as a munition, so you need a license.

However, the mathematics for strong encryption had been known for years, and free available around the world, so the US wasn't accomplishing anything by blocking the export of PGP.

End to End Encryption - independent of location

[Gat0r30y]

So.... the Indian government wants RIM to figure out a way to decrypt every email - from all those CrackBerries, without any keys (RIM doesn't have the keys) and store them all on a local server - and somehow RIM is also supposed to magically know that the hardware is in India (they operate independent of location). India, I have bad news. It isn't going to happen. On the upside, this may set a precedent for other companies to reject a governments calls for access to emails without warrants (US companies, take note, you could learn from your neighbor to the north).

Re:To quote the immortal Dick Cheney...

[Anarke_Incarnate]

He's only immortal until a ring of garlic is put around his neck, a stake driven into his heart and holy water sprinkled over the earth were he lays.

Come on, folks. This guy has a "Man Sized" safe in his office. What do you think he has in there? He has a man....to feed off of.

Summary is indicative of the problem

[hassanchop]

The Indian government wants that right too

This shit infuriates me.

GOVERNMENTS DO NOT HAVE RIGHTS OF ANY KIND.

Governments have powers. This IS NOT a simple semantic argument.

This message contains proprietary information...

[pha7boy]

... and is protected from disclosure.

So, what happens when trade secrets leak because some gov employee got bribed to access them and pass them to a competitor?... I would assume RIM could also be held liable for loss. And its harder to sue (and win) against a government, esp. somewhere like India. A lot easier to drag RIM in front of a jury in the US.

Wait a second...

[AutopsyReport]

The US government is not alone in wanting to snoop on everything citizens do over email/phone.

Hold on a second there.

I believe the reason the US government uses the BlackBerry is because the service cannot be decrypted. If it could be, then they wouldn't be able to rely on it due to security and privacy considerations, etc.

As much as that statement is kindle for a fire I'm quite certain that at least in the context of using BlackBerry's, the US government has no interest on being able to decrypt communications. I think it's safe to assume the government is content with the fact that there is no backdoor to RIM's services.

Re:Security Risk?

[spikexyz]

The pen has always been a risk. The american (canadian) dream is financial and not ethical or intellectual. People writing dangerous ideas have always been a threat and doing so has been tolerated as far as it doesn't pose and significant threat to making money. The difference now is that the government can now eavesdrop on the pen and they want to do so to better ensure that there aren't too many dangerous ideas.

Blackberry privacy is only for large enterprises

[Animats]

Blackberry privacy is only for large enterprises. If you have a corporate Blackberry server, the keys are between the client units and the server, and RIM doesn't have them. If you use Blackberry's public servers, RIM has your E-mail. India only wants "non-corporate emails".

Re:Just to be a little bit paranoid

[zacronos]

Seriously, loosen the tin foil hats [...] AHA! Clearly, you have a vested interest in whether I wear my tin foil hat or not!

Since you want me to take it off, it must work! That is, unless that's what you want me to think, and it actually acts as a locator so you can more easily trace my position. Or perhaps it's all a ruse to distract me from noticing something else even MORE sinister....

Yes, it's all becoming clear to me now. I'm on to you!

Re:They can take a lesson from the USA

[hansraj]

I suppose you have little knowledge about India. Perhaps the situation is not as bad as some other countries but the indian police and indian jails are scary enough to begin with. If you tell an indian that the police tortured someone or that some guy in prison got thrashed pretty nasty, I doubt s/he will be surprised. At least I won't. The situation is even worse if you don't live in a big city where situation is perhaps better. I come from a small village/town and you have to bribe the police even to file a report and even then they are pretty nasty to you. And it is pretty common that if a policeman stops someone who doesn't appear to have a "good background", a slap precedes any question.

Perhaps if one is suave enough to be using PGP or "rich" enough to have a blackberry things are different but for most people *any* involvement with law-enforecement agencies is bad news already. Gitmo is perhaps tame. Of course that doesn't make gitmo right, but a statement like "they need their own gitmo" is humorous in a dark sort of way.