Saudi Says RIM Deal Reached; BlackBerry OK, If We Can Read the Messages

crimeandpunishment writes "There's a deal on the table to avert a ban on Blackberry's messenger service in Saudi Arabia. A Saudi regulatory official, speaking on the condition of anonymity, told the Associated Press the deal involves placing a server in Saudi Arabia ... and letting the government monitor users' messages, easing Saudi concerns over security and criminal usage. The deal could have wide-ranging implications, given how many other countries have expressed similar concerns, or in the case of the United Arab Emirates, have threatened to block Blackberry email and messaging services." Perhaps the governments of UAE and India would be satisfied, too, if only they had access to the messages transmitted.

Comments

...and RIM capitulates.

[sethstorm]

Guess they don't have any backbone to just drop the country and let the end-users take action.

Re:...and RIM capitulates.

[couchslug]

End-users won't fix the problem. RIM would simply lose money.

The Middle East not only doesn't play by our customs, those customs are utterly alien.

They want the technology, but they remain tribalist, Jihadist, Wahabist in the case of KSA, and none of this is changing for the better.

Re:...and RIM capitulates.

[CdBee]

I posted on here in another thread a few days back that RIMs refusal to back down in the UAE stood them in very good stead as a company as their users would respect that. Its amazing how quickly one can lose confidence again....

Re:...and RIM capitulates.

[wiredlogic]

The NSA would prefer that didn't happen.

Re:...and RIM capitulates.

[Anonymous Coward]

Note: They never said they would not give a government access to private customers (BIS) as they will do in this case, they said they COULD not give anyone access to enterprise customers (BES) simply 'cause they don't have the keys...

Re:...and RIM capitulates.

[westlake]

Guess they don't have any backbone to just drop the country and let the end-users take action.

Just what action do you propose the users take - against the Islamic Saudi state and monarchy?

Re:...and RIM capitulates.

[Kilrah_il]

Just a word of caution before everyone here denounces RIM: We all remember the news a few days ago that Google made an agreement with Verizon for preferential access to their network. Everyone here was raising hell about how Google threw their "open Internet" stance out the window for profit. And then, after a few hours, we got an update: No such deal!
So, people, wait a few hours and let's see what's the real deal between RIM and the Saudi government. If this is the real deal - then shame on them!

Re:...and RIM capitulates.

[gandhi_2]

And all the moral relativists come out of the woodwork to suddenly embrace right and wrong.

Companies don't go to heaven. So companies get NO credit for doing what is right. They only get credit for doing what is necessary to survive.

Vote with your dollars...but people will still buy whatever product they like best.

Re:...and RIM capitulates.

[h4rr4r]

All morality is relative. The moral thing to do would be for the USA to have embargoed Saudi Arabia a long time ago.

Re:...and RIM capitulates.

[thePowerOfGrayskull]

Guess they don't have any backbone to just drop the country and let the end-users take action.

It's interesting how we keep seeing a conflation of two different issues.

BES (enterprise) cannot be monitored. All traffic is encrypted - while it travels through RIM servers, it is encrypted with a key owned by the companies running BES. This includes email and - if I recall correctly -- BlackBerry messenger messages. This means that only devices that have the appropriate keys can decrypt the traffic. No matter what deals are reached, this can't be changed by RIM.

BIS (consumer) is routed through BB servers, and is not encrypted (or in the case of BBM not unbreakably encrypted). This can be monitored and probably is in many places.

So in the past few days, we've seen RIM make an announcement over how BES is utterly secure. This has not changed at all - without the keys that companies own, BES traffic can't be decrypted -- RIM devices natively support TripleDES, AES128/192/256, and a host of other crypto algorithms. I don't think anyone's managed to break them so far, at least not in any practical sense...

Presumably what's happened is that RIM is providing access to monitor BIS (consumer) traffic -- which is something that they've done in other places as well and has prior precedent.

Re:...and RIM capitulates.

[Anonymous Coward]

Compared to the alternatives (Iranian/Syrian style government), the Saudi monarchy is not so bad, hence why the USA does not apply sanctions to them. The USA was fine dealing with dictators when the alternative was soviet style governments because we viewed them as a better alternative and the odds of replacing the government with something better just weren't that good - see Iraq for how hard it is to replace even deplorable dictatorships with stable regimes.

Re:...and RIM capitulates.

[Anonymous Coward]

500 kT of U-235 detonated 2,000 feet AGL at Mecca and Medina would do a lot of good. It would of course be necessary to warn their respective populations at least 30 days in advance, and it would be helpful to offer UN assistance with evacuation of the elderly and infirm.

Re:...and RIM capitulates.

[Idiomatick]

We shouldn't allow Evangelical Christians to use computers.

They don't play by nerd's rules and they have freaky traditions.

They want the technology but they want to remain ignorant and unthinking, and none of this is changing for the better.

Re:...and RIM capitulates.

[gandhi_2]

All morality is relative.

The moral thing to do...

Thanks for illustrating my first point.

Re:...and RIM capitulates.

[Local ID10T]

Also true... and completely irrelevant to this discussion.

Re:...and RIM capitulates.

[Zerth]

What prevents BB from pushing an OS update that copies all messages sent through BES? They do control the hardware.

Re:...and RIM capitulates.

[gad_zuki!]

>And then, after a few hours, we got an update: No such deal!

How do you know that's what happened? In my opinion, its more likely the NYTimes jumped on a rumor for ad impressions. They got their ads, attention, and Google had to drive its PR into overtime to fight the FUD. Its suicidal for google to embrace the tiered non-neutral net. The deal never made any sense to begin with and surprise surprise it turned out to be false. Prove me wrong. Show me proof that this deal was even in the orks.

RIM is just empowering these pre-enlightenment horrible theocracies and deserves our criticism.

Re:...and RIM capitulates.

[c0lo]

End-users won't fix the problem. RIM would simply lose money.

Vote with your money, if you fill so strong for the people of UEA...

The Middle East not only doesn't play by our customs, those customs are utterly alien.

... and stop using their oil too.

Re:...and RIM capitulates.

[Kilrah_il]

That was exactly my point, that there were rumors and everyone here was up in arms over them and later we heard that it was not true, that there was no such deal. I did not mean to imply that our rallying against supposed-deal made Google change its mind.
If you re-read my post, you will understand that what I am saying is that we need to wait a bit, and maybe we will find out that here we have the same thing - someone jumped on a rumor and actually RIM did not cave-in or that the agreement was somewhat different. For me it's strange to think that a company that had security and privacy as major selling points for its platform would change everything in less than a week. I am not saying this is definitely the case, only that it's possible and that we should keep that in mind while writing stuff like "RIM is just empowering these pre-enlightenment horrible theocracies and deserves our criticism".

Upon further reflection, I think you would agree that many, if not most, news stories sound much more shocking and sensational in the first headline than they do after a few days.

Re:...and RIM capitulates.

[Alcoholist]

The problem with freedom is that it never seems to involve corporations or governments.

The the solution to this particular problem is easy, simply let the users run their own encryption with their own software and own keys on their own hardware. I'm surprised such a thing doesn't exist now for the Blackberry. Oh wait, it does. All RIM has to do is tell these dumb governments that "yep, you can read the stuff on our servers," while at the same time paying bloggers under the table to spread word on how to install third party encryption.

If these governments are still really pissed off about it, they can start arresting users for having encryption software and they can keep on doing that until people finally get the notion they are living in a police state and maybe want to do something about it.

Re:...and RIM capitulates.

[gad_zuki!]

If you think this is a rumor then youre out of your mind. Its real, RIM is deploying a server in the UAE and handing over the encryption keys to their horrible theocratic government. Done and done. RIM's end-to-end encryption has been in the thorn in the side of several of these terrible governments, and now they finally pulled the nuclear option. I'm completely justified in criticizing them, you can keep making apologies for these horrible regimes if you like, but youre far from convincing.

Re:...and RIM capitulates.

[Kilrah_il]

Did you even read what I wrote? I didn't say that what the article says they're doing is ok. I'm not justifing RIM. I'm just saying that prior experience thought us that sometimes the first headline is alarming and sensational and later, when more details are revealed, you see that things are not that bad.
Again, I agree that if RIM decided to throw their encryption out for those regimes it is very, very (very xn) bad. I'm just suggesting we exercise some caution with our responses until all the details come out.
P.S. I used the word 'suggest'. So don't go all "If I want to bitch about RIM right now, I have the right to". You do. Do whatever you want. I just stated my opinion.

Re:...and RIM capitulates.

[zippthorne]

Indeed. If it is the case that the Saudis will be reading all the blackberry messages made within their country, it will be interesting to see if President Obama continues to use his Blackberry, deciding it's easier to just never visit Saudi Arabia..

Re:...and RIM capitulates.

[ShakaUVM]

No, no, no. Haven't you read the Slashdot summary?

Allowing Saudi Arabia to eavesdrop on everyone's communications has "eased their concern" about security issues.

Re:...and RIM capitulates.

[Anonymous Coward]

What prevents BB from pushing an OS update that copies all messages sent through BES?

You mean pushing an OS update to the handhelds? Not possible. RIM and the mobile network operator can't do that.

If they did, then Eitisalat wouldn't have told all blackberry users to download & install their spyware last year.

They do control the hardware.

RIM does not control the hardware. The owner of the hardware controls it.

Unlike Apple, Android and some others, RIM does not control what software you install on your phone.

RIM does not have the ability to remove software that b>you install on your phone.

RIM has had a freely available SDK for years. You can sell software through blackberry app world, or sell it over the phone, a regular store, or any other method YOU decide.

Re:...and RIM capitulates.

[Zerth]

And yet, I own a blackberry that keeps popping up Verizon crapware that didn't exist when I bought it.

Re:...and RIM capitulates.

[Anonymous Coward]

more to the point, rim security feature was its strongest selling point on the enterprise market. without that, their phones are as featureful as nokia's, but with a larger price tag attached.

Re:...and RIM capitulates.

[awehttam]

July 13, 2009: UAE spying on citizens through an Etisalat BlackBerry update?

Re:...and RIM capitulates.

[badkarmadayaccount]

With pleasure. Where do I sign giving permission for building a new nuke plant?

Re:...and RIM capitulates.

[thePowerOfGrayskull]

To the best of my knowledge, they can't push an OS update down without your consent -- or even a new app. The exception might be is if a provider had pre-installed something which would allow them to do this (more likely they would permit pushing down of new web-page shortcut icons); but even such an app could be removed through the desktop manager.

Privacy

[ground.zero.612]

I'm glad I have it.

(At least for now... my fellow US citizens seem to be completely blind to the forces at work to destroy our privacy.)

Re:Privacy

[davester666]

You do realize that the US gov't knows it could not do the same thing without getting a big uproar, but they can just get all of RIM's traffic routed through Saudi Arabia, right... Who am I kidding, the US ALREADY can view everybody's BlackBerry messages.

Re:Privacy

[bcmm]

Uh... Where do you think the existing servers are?

Re:Privacy

[Anonymous Coward]

Who am I kidding, the US ALREADY can view everybody's BlackBerry messages.

Any evidence of that?

I recall my company's legal team doing a search for any instance where intercepted, decrypted messages from a Blackberry Enterprise Server were used in court. The lawyers weren't able to find any cases.

Now, that doesn't prove anything, but it's a good indicator.

Plus, you can use S/MIME and PGP with blackberry for additional encryption.

Re:Privacy

[Anonymous Coward]

Uh... Where do you think the existing servers are?

For the US, the servers are located in Soviet Canuckistan. Er, I mean, Waterloo, Ontario, Canada.

Re:Privacy

[Hognoxious]

I recall my company's legal team doing a search for any instance where intercepted, decrypted messages from a Blackberry Enterprise Server were used in court. The lawyers weren't able to find any cases.

Now, that doesn't prove anything

Well, you got that last bit right.

Do you think that when Tom Cruise cracked the Enigma code in WWI the result was a lawsuit against the Nazis?

Re:Privacy

[Anonymous Coward]

Well, you got that last bit right.
Do you think that when Tom Cruise cracked the Enigma code in WWI the result was a lawsuit against the Nazis?

There is quite a bit of evidence that organized crime are using blackberries and other mobile encrypted email platforms to communicate.

If the US government had the ability to routinely intercept & decrypt AES-encrypted messages from a Blackberry Enterprise Server, I think some evidence would have appeared in court cases against high-value criminal targets.

Re:Privacy

[Anonymous Coward]

There is quite a bit of evidence that organized crime are using blackberries and other mobile encrypted email platforms to communicate.

If the US government had the ability to routinely intercept & decrypt AES-encrypted messages from a Blackberry Enterprise Server, I think some evidence would have appeared in court cases against high-value criminal targets.

Heh...no. Never let them know you know about them unless there's more to gain from it than the loss of them not knowing. I'm sure somebody is glad to let Organized Crime and all sorts of spies think they're getting away with crap, when it's just easier to not use the evidence.

Re:Privacy

[TheTrueScotsman]

I haven't seen the Enigma movie (did Tom Cruise have a good English accent?), so I don't know if it covered this, but the Allies deliberately didn't use the information gathered by Enigma in direct tactical responses because they didn't want the Nazis to know that they'd cracked the code.

Re:Privacy

[couchslug]

Unless you use encryption, don't be so sure you have privacy.

Re:Privacy

[thePowerOfGrayskull]

You're right - BES can't be intercepted/decrypted. BIS/consumer-grade is a completely different matter. (Unless, as you say, S/MIME is used....)

Re:Privacy

[Anonymous Coward]

The government would have to be literally retarded to let on that they can read those messages. The obvious thing to do, if they can read them, is to monitor and obtain information like where drugs are stored, what phone numbers are used, where the money goes, where people meet, things that they can get legitimate evidence from - and then manufacture an informant to pass that information on and get a warrant/subpoena. Absolutely no need to show their cards.

They do this all the time with shit as inconsequential as weed busts. Fly illegal infrared sweeps over towns, flag houses that are suspiciously hot, then pay a crackhead $5 to "tip them off" that those houses are used for growing weed so they can do a no knock raid and shoot some dogs without having to worry about the Fourth Amendment and fruit of the poisonous tree. If the sheriffs in Podunk can manage this you'd have to be mad to believe the DEA and FBI can't.

Re:Privacy

[Jah-Wren Ryel]

If the US government had the ability to routinely intercept & decrypt AES-encrypted messages from a Blackberry Enterprise Server, I think some evidence would have appeared in court cases against high-value criminal targets.

If so they would either keep it sealed or, as in the case(s) where the FBI tapped into OnStar like systems in order to eavesdrop on passengers, they just didn't go into the full details of how it was accomplished. In the case of OnStar-like eavesdropping it only came to light when the companies started refusing to do it because it interfered with their business - so the DoJ took them to court to try and force it.

Re:Privacy

[selven]

Yeah, this idea that the government can actually break any encryption and is just hiding it from us is a myth. In fact, it's a myth that got refuted on Slashdot already

Re:Privacy

[mlts]

The minute people seriously suspect that AES is breakable in large numbers, will be the minute China proposes their own IETF draft of an algorithm and the whole banking sector, and essentially the Internet will change algorithms overnight.

I have seen this discussion in every major security program, be it PGP back in the 90s, TrueCrypt, BitLocker, or any other program that is relied upon to provide security. This can be reduced to three states:

1: Governments do not have an easy backdoor. Result: This won't be told to anyone to keep the blackhats from flocking to the program.

2: Governments have a backdoor that is known to the world: e.g., their country uses Clipper chips, all SSL traffic has to use an escrow key, or the originator and his family is put to death, security appliances are used to MITM all traffic and insert their own keys, or other items. The blackhats will find another mechanism like steganography [1], tunneling over various protocols, or even go back to dead drops with physical media. As always, there will be low hanging fruit nabbed to show that the backdoors are working to catch criminals, but people that mean real harm will be out of reach.

3: Governments have a backdoor that nobody outside their intel department knows about. This could consist of a hole in the encryption algorithm, a backdoor in x86 chips that allow certain microcode instructions to be executed in ring 0 if it uses a certain undocumented header, a hidden RSA override key, or just knowledge of a weak link (hashing to 40 bits, using the hash as the actual key.) Here, if a government had access to information (like a criminal case where it was presented that data was obtained due to an algorithm or key storage weakness), the minute people found out that this was possible, the whole world would immediately change their algorithm selection or create an add-on which used another encryption technology. For example, if AES was found to be the cause of leaked data, TDES [2] would be reused or another algorithm used in AES's stead. Other means of encryption would either replace the algorithm, or have another pass using the new algorithm if it couldn't be replaced to ensure security. If the weakness was in hardware, countries will be building/contracting chip fabs and seeing about multiple architectures [3]. So in reality, a government could not use the fact that they had a backdoor for anything but the largest of cases, because the game will change fast once the security issue is known.

The RIM deal will put KSA into category #2, which is what they want. The smart criminals will have to move to another means of communication while the dumb ones are easily scooped up and made examples of.

[1]: Real stego programs, not the antiquated ones from the '90s that the Russian spies used. There are a lot of data streams that can easily have random bits inserted in them and nobody notice/care.

[2]: TDES was a hack so solid encryption could be done without a major hardware revamp. But other than for the tiny block and key size, it proved to be remarkably secure over a long time.

[3]: I'm sure that China could easily use their knowledge gained from various sources, or just what is done in their country's chip fabs to create their own architecture with an embedded hypervisor that could virtualize x86 machines. UNIX based operating systems could be easily cross-compiled for the new architecture (probably something like the Itanium with a crapload of registers, lots and lots of cores, and maybe even FPGA-like functionality to make any core on the die act as a GPU, CPU, FPU, x86 core, POWER6 core, or dedicated AES cruncher. Since the government would throw big dollars to subsidize this, even if it cost significantly more than an x86 chip, it would be mandated.)

Re:Privacy

[ceoyoyo]

I'm not an American, but if the authorities wanted access to some blackberry messages, and could show probable cause, would they not just have to get a warrant? RIM, since they have significant assets in the US, would have to comply.

Re:Privacy

[russotto]

Yeah, this idea that the government can actually break any encryption and is just hiding it from us is a myth.

Maybe. Maybe not; it's really impossible to disprove. If they do, they have to be very careful about using it, lest it be discovered. It would only be worth risking at all for nuke-in-NY-harbor level stuff, and even then they'd have to be damn careful lest they fall for a fake plot designed specifically to reveal their capabilities.

On the other hand, if they're sloppy, they could be detected by planning and executing a series of serious crimes which were designed to be detectable in advance in two ways -- one, breaking of encryption, and two, a small but quantifiable matter of random chance. If the random chance happens more often than it should, there's a strong indication they've broken encryption. I wouldn't be at all surprised if some intelligence agencies haven't already done just that... but they wouldn't reveal the results to the public at large either.

Re:Privacy

[Hotawa Hawk-eye]

I recall my company's legal team doing a search for any instance where intercepted, decrypted messages from a Blackberry Enterprise Server were used in court. The lawyers weren't able to find any cases.

Of course not. If the government was the one who intercepted the messages and any such cases went close to a judge, they would quickly get hit with the "state secret" hammer and put under wraps. If a company had done the intercepting, I'm sure they would have received a nastygram from RIM's lawyers (threatening a lawsuit for contract violations or DMCA or something.)

Re:Privacy

[Anonymous Coward]

But.. legally, they could look at it, right? If they wanted to?

Re:Privacy

[Anonymous Coward]

I'm not an American, but if the authorities wanted access to some blackberry messages, and could show probable cause, would they not just have to get a warrant? RIM, since they have significant assets in the US, would have to comply.

No, they couldn't, because RIM doesn't have the decryption keys for the messages.

It would be as useful as a judge issuing a warrant to you to produce my decrypted blackberry messages.

You don't have the keys to decrypt my messages, no matter what the US, Saudi or Indian governments believe.

I have the keys, and my company does. No one else does: not RIM, not the mobile carrier.

Re:Privacy

[awehttam]

I dunno. BIS via Wifi uses an https connection to rim's servers.

Re:Privacy

[thePowerOfGrayskull]

True, but in the case of BIS, RIM's servers sees the content unencrypted after it's off the wire. (Note not the same as BIS-B -- I'm not as familiar with how that is/isn't encrypted)

money talks, freedom walks

[TheGratefulNet]

really, that's all that needs to be said.

fwiw, I have lost all respect for RIM and will not buy their products for my own personal use. they were on the high moral ground for a while but now that they've caved in, they are no different than the other 'carriers'.

their security is now rendered 'untrustable'. what a shame.

another one bites the dust.

Re:money talks, freedom walks

[shawn(at)fsu]

Aren't you being a little over dramatic? Exactly how did you think the world worked? You really weren't naïve enough tho think that they cared about anything besides profits for the shareholders did you?

Re:money talks, freedom walks

[Anonymous Coward]

You're pretty naive if you think they hadn't done this for other countries already.

I'm telling you guys, the tinfoil hats work!

Re:money talks, freedom walks

[TheGratefulNet]

what exactly is RIM selling? confidence and trust.

they just threw all that out the door.

yes, I think its a HUGE deal. when their whole stock and trade is privacy and then they turn around and sign a 'smiling deal' with our arch enemies (...), yes, I consider that an about-face in the harshest of ways.

we all suspected the almighty looney was king, here; but I was hoping for a ray of sunlight. hoping; but apparently not getting.

no corporation, today, can continue the 'do no evil' for very long. how very sad for us all.

Re:money talks, freedom walks

[CdBee]

I would have thought their profits were critically dependent on trust

Re:money talks, freedom walks

[tomhudson]

P,P. Just a fw points:

Yes, it's disappointing (to say the least) that RIM is enabling other countries to do what is illegal in Canada - such as making sure women don't date.

All that's going to happen is that people will find other ways, same as they have always done. The Saudi leadership wants this because they are very unpopular - world-wide, not just at home.

Re:money talks, freedom walks

[shawn(at)fsu]

no corporation, today, can continue the 'do no evil'...
"hehehe. Oh wait you were serious, let me laugh even harder HAHAHAHAHA!" ~Bender

I was looking at RIMs product line and yeah I didn't see anything about Confidence and Trust probably because you can't patent them. I'm really shocked you've made it so far in life and hadn't learned this lesson yet.

Re:money talks, freedom walks

[Anonymous Coward]

what exactly is RIM selling? confidence and trust.

they just threw all that out the door.

yes, I think its a HUGE deal. when their whole stock and trade is privacy

Absolutely agree. Research in Motion (RIM) has signed the equivalent of a declaration of war against the organizations and persons who chose a BlackBerry device due to its high-level of security and end-to-end security over the network operated by RIM. Once the data reaches the customers messaging servers the data comes under the control and responsibility of the customer, but during transmission through the RIM network is solely the responsibility of RIM. In my opinion, Research in Motion is in breach of contract on a massive scale.

Re:money talks, freedom walks

[Anonymous Coward]

Absolutely agree. Research in Motion (RIM) has signed the equivalent of a declaration of war against the organizations and persons who chose a BlackBerry device due to its high-level of security and end-to-end security over the network operated by RIM.

Absolutely not. You don't understand how the blackberry enterprise server (BES) platform works.

The BES is a software program that you install on your server in your office, and talks to your exchange/notes/groupwise server.

1. The BES and the handheld negotiate & exchange keys. This can be done by direct USB cable for additional paranoia.
2. When the BES wants to transmit an email to the handheld, the BES encrypts the email using the handheld's negotiated key.
3. The BES transmits the encrypted message to RIM.
4. RIM transmits the encrypted message to the mobile network operator.
5. The mobile network operator transmits the encrypted message to the device.
6. The device decrypts the message.

Neither RIM nor the mobile network operator have the decryption keys. Even if you show up with a court order, RIM and the mobile network operator can't help you read the message.

The decrypted messages are only located in 2 places: on the handheld, and on your email server.

Of course, the encrypted messages can be intercepted by governments/criminals/hackers, but then they have to decrypt AES. Good luck with the brute-force. Unless you know something I don't, it is going to take a very long time.

Once the data reaches the customers messaging servers the data comes under the control and responsibility of the customer, but during transmission through the RIM network is solely the responsibility of RIM.

RIM is only the conduit of the message, like the mobile network operator. RIM only promises to transmit your encrypted messages to their destination and confirm delivery.

In my opinion, Research in Motion is in breach of contract on a massive scale.

Not at all. For one thing, go read your contract with RIM. Secondly, RIM and the Saudi mobile network operators are continuing to transmit encrypted messages.

Further, I don't see what the fuss is about. This is Saudi Arabia - you have no rights. If the Saudi government wants to see what is on your blackberry, they will arrest you, throw you in jail, and torture you until you show them. And this would be real torture, not like the mild version the USA is accused of.

Re:money talks, freedom walks

[Anonymous Coward]

I am really shocked you've made it so far in life being the sort of easily dislikable jerk that uses phrases like "I am really shocked you've made it so far in life".

PS: It's "hasn't" not "hadn't".

Re:money talks, freedom walks

[cacba]

sign a 'smiling deal' with our arch enemies

Someone should really get the word out, there is ~10 billion dollars of trade. I'll update wikipedia then we can get this war started.

I have lost all respect for RIM

Rockefeller advanced medicine, RIM built perimeter. A little perspective please, the world has enough drama.

Re:money talks, freedom walks

[couchslug]

"their security is now rendered 'untrustable'. what a shame."

Unless you encrypt your own traffic, why would you trust any carrier?

Re:money talks, freedom walks

[Blue Stone]

You really ever believed that the US authorities never had access to blackberry data as and when they wanted it?

Why do you hold the US government to any higher degree of respect than that of the UAE? It's not like either of them believes that strongly in freedom, liberty or human rights.

Re:money talks, freedom walks

[Idiomatick]

Canadian* not that he mentioned either country besides the looney reference.

Re:money talks, freedom walks

[Anonymous Coward]

Making sure women don't date? Where is this country where only gay men can date? :D

Re:money talks, freedom walks

[Pharmboy]

Making sure women don't date? Where is this country where only gay men can date? :D

No, it is a country where a woman is expected to simply marry who her father says to marry, no dating necessary, and isn't considered part of their culture. Dating is an evil "western" concept. And being gay gets you the death penalty, every time. Keep in mind that it is illegal for a woman to DRIVE in Saudi Arabia, or be out in public without a male member of the family present. I wish I was making this up, but I'm not. Even American women visiting are warned to not be alone and keep their hair covered, to keep from being accosted by the (minority) extremist, vigilante types.

They are basically 1/2 notch less evil than the Taliban, but fund 1/2 the terrorism that happens in the world. (Remember how most of the 9/11 highjackers were from Saudi Arabia?). But, they have the oil so we play ball. Personally, I would rather pay $10 a gallon for gas than support their corrupt, inbred government.

Re:money talks, freedom walks

[JohnWiney]

The reason various governments complained is that RIM is/was more secure than any other company. Now they are no worse than anyone else, better in some situations. The only way to guarantee security is to provide your own encryption (using standard methods, of course). And since we are now being shepherded into closed platforms (thanks, Steve Jobs), that is virtually impossible.

Re:money talks, freedom walks

[Macrat]

fwiw, I have lost all respect for RIM

You had respect for them in the first place?

Re:money talks, freedom walks

[EdIII]

The biggest problem you have with most other people's reactions to your post is that they value pragmatism above principles. They will reward your sacrifice and adherence to your own principles with mockery and incredulity about your alleged naivety about the world.

There is only one way we can reward RIM's behavior. We vote with our wallet and let them know they are losing $30-$60 dollars a month from their customer solely because they refused to stand up for privacy. The fact it is happening in Saudi Arabia, UAE, or India is irrelevant. The behavior is unacceptable and we must act in accordance with our principles.

I don't know you, but what I find absolutely crazy is how quickly people can set aside their principles when it is inconvenient to keep them. When that is true, was it ever really their principles to begin with? My opinion? That is a disgusting weakness in humanity.

Re:money talks, freedom walks

[drinkypoo]

I don't know you, but what I find absolutely crazy is how quickly people can set aside their principles when it is inconvenient to keep them. When that is true, was it ever really their principles to begin with? My opinion? That is a disgusting weakness in humanity.

Humans have weaknesses. But it's clear that any principles you will compromise are principles you never really had to begin with. You were just lying to yourself about having them.

Re:money talks, freedom walks

[roystgnr]

You really weren't naïve enough tho think that they cared about anything besides profits for the shareholders did you?

It's a myth that shareholders only care about short term profits (e.g. revenue from a subset of their customers held hostage by a privacy-invading government) at the expense of long-term profits (e.g. revenue from the entire set of their customers who are now more worried about their data security). People who are uncomfortable with delayed gratification don't put their money in stocks, they put it in retailers' cash registers.

Re:money talks, freedom walks

[gd2shoe]

Uh... Whoosh?

You do realize you're responding to AC?

Re:money talks, freedom walks

[Anonymous Coward]

I hope that was just a joke (and not a very good one).

I'm really shocked [you have] made it so far in life and [had not] learned this lesson yet.
I'm really shocked [you have] made it so far in life and [has not] learned this lesson yet.
I'm really shocked [you have] made it so far in life and [have not] learned this lesson yet.

The word is haven't. You're either a terrible spelling nazi, or a terrible comedian. I can't figure out which.

Re:money talks, freedom walks

[Pharmboy]

Um, yes I do. I generally reply no differently to AC's than reg'ed users. Most people are ignorant of how oppressive Saudi Arabia is because they are our "friend", and it shows.

Travellers?

[JSBiff]

I see how this solution would work for customers of Saudi mobile operators, whose phones would be pre-configured to use the 'local' BB server. What about travellers from other countries - would they have to go into their phone and manually re-configure it to contact the Saudi BB Server? Would that basically be the same steps as if you were setting up to use a corporate-owned BB Server? What if you already use a corporate BB Server? Will your messages be blocked? If the email account you are trying to check is your company email account, and the only way to access it is through the company-owned Enterprise BB Server, are you S.O.L.?

Re:Travellers?

[SheeEttin]

I'm not familiar with BlackBerries (or really most cell phones; I don't have one), but I assume that your transmissions would be picked up at the tower and intercepted soon after (and, of course, forwarded on to their destination).
So you'd see no difference in service (except maybe latency).

Re:Travellers?

[NevDull]

It might actually be Blackberry Messenger that they're up in arms about more than e-mail, with its more real-time nature being perceived as an imminent threat in a terrorism situation.

Re:Travellers?

[Fjandr]

So SSH to a secure server outside Saudi Arabia and send/receive email through a CLI mail program. Yeah, it's more of a PITA, but it allows you to still have unreadable communication. Unless they block all SSH traffic...

Re:Travellers?

[h4rr4r]

Why a CLI mail program? Just setup the SSH tunnel and use whatever program you want.

Re:Travellers?

[Anonymous Coward]

In theory (/ as I've been told) the messages are end (Blackberry) to end (Blackberry Enterprise Server, possessed by the corporation) encrypted.

Re:Travellers?

[Fjandr]

The SSH client on a Blackberry doesn't lend itself well to that application, at least not as far as I'm aware. Would be interested in hearing about if someone has set something like that up.

Re:Travellers?

[Zerth]

Stuff sent through the blackberry network is encrypted on the device, sent to Canada and then either decrypted and forwarded to the open internet, sent on to a BES at some other company, or forwarded to another blackberry.

travel is optional

[OrangeTide]

You give up certain rights when you travel to a foreign country.

Re:travel is optional

[couchslug]

"You give up certain rights when you travel to a foreign country."

And you give them ALL up (well, unless you are military) when you travel in the Middle East. That isn't a troll or a joke.

Don't like how they roll? Do not go there, you don't need to be there, end of story.

Re:travel is optional

[vertinox]

You give up certain rights when you travel to a foreign country

Rights are inherent and not given or allowed by any government. Nor are laws enumerations on these rights.

I thought that was the whole point of the Magna Carta and the American Revolution.

But if you want to be pragmatic about it, it is in the moral and political best interest of any nation who does respect those rights to put pressure on countries that do not.

Or is it ok to be nice with people who allow repression and torture in their countries?

It doesn't matter if it is their law in that country or not, if you are an individual or a corporation that plays nice with those rules, it means you support those policies. There are no ifs, ands, or buts about that.

Re:travel is optional

[KahabutDieDrake]

I agree that allowing repression and torture violate what amount to basic human rights. But how are we supposed to stop the USA from doing it?

Re:travel is optional

[Macrat]

I thought that was the whole point of the Magna Carta and the American Revolution.

The American Revolution was about rich land owners wanting to skip out on paying taxes.

Re:travel is optional

[dryeo]

I thought it was about rich land speculators wanting to steal (or cheat) land from its rightful owners and sell it at a massive profit.
What with the evil powerless King wanting to protect all his subjects, not just the white protestant ones.

Re:travel is optional

[ceoyoyo]

Rights are inherent and not given or allowed by any government. Nor are laws enumerations on these rights.

I thought that was the whole point of the Magna Carta and the American Revolution.

Haven't travelled much, hey? Rights are a uniquely human invention, and they are given by whoever is in charge and can be taken away by the same entity. In a democracy citizens nominally decide what rights they want to grant themselves and what rights to grant non-citizens (usually not exactly the same list). Sometimes they decide some rights are important enough to try and get other people to agree to as well.

Note that the Magna Carta was basically an agreement giving the English aristocracy some ability (rights, if you like) to limit the king's power. The commoners didn't really get any rights. Ditto with the US bill of rights - it gave citizens certain rights, but did squat for non-citizens (such as slaves). And neither of those apply to any society (such as Saudi Arabia) that isn't descended from the UK.

The idea of "inalienable" rights is ridiculous. No society has ever granted the same rights to all people, and certainly not at all times. The US itself only grants many rights to citizens or legal residents, and sometimes doesn't even respect the ones the UN says are basic human rights.

Re:travel is optional

[gfreeman]

Wish I had mod points

but is corporate willing to give them up?

[Joe The Dragon]

but is corporate willing to give them up? maybe not and they will need to find away around it or say no e-mail for workers that are in that country.

Re:but is corporate willing to give them up?

[CdBee]

This question has occurred before regarding the USA - some companies banned employees from taking email devices and laptops into the USA, to prevent border searches accessing confidential data, in the light of the new US security arrangements after the terrorist attacks of the last decade

Re:but is corporate willing to give them up?

[Thing 1]

[...] after the terrorist attacks of the last decade [...]

Don't you really mean "after the terrorist attacks that happened over a decade ago, which the authorities keep reminding us of to keep us in fear? What color is the threat level today?"

Re:but is corporate willing to give them up?

[Anonymous Coward]

2010 - 2001 = 9

9 > 10

Perhaps you meant "nearly a decade ago" rather than "over a decade ago".

Re:but is corporate willing to give them up?

[DickeyP]

The threat level color for today, and every day since that serious act of war, is "necessary". And if you have to be reminded, that means you forgot.

Re:but is corporate willing to give them up?

[russotto]

Don't you really mean "after the terrorist attacks that happened over a decade ago, which the authorities keep reminding us of to keep us in fear? What color is the threat level today?"

Err, no on that first part. I counted on my fingers to be sure, but a decade after September 11, 2001 appears to be September 11, 2011, which we have not reached yet.

As for the reminder... yeah, maybe that's the reason they haven't gotten around to filling in the great mucking hole in the ground. It took only seven years to build the twin towers in the first place, and here we are almost 9 years later and there's still just a hole in the ground.

Re:but is corporate willing to give them up?

[makomk]

The interesting thing is that the US actually kinda supported terrorist attacks here in the UK, and in a sense still does. A lot of the IRA terrorism was funded and armed by US supporters, and it had enough support within the important Irish-American voting group that no-one really dared do anything about it. Even now, Congress is still refusing to ratify an extradition treaty with the UK because it might lead to IRA supporters being extradited and imprisoned.

Re:but is corporate willing to give them up?

[Thing 1]

Yeah, I blew that; my mind said "nearly" but my fingers insisted "over". Oh well. Agreed with the time scale on replacement.

they are a business, why should they care?

[fantomas]

Why should RIM care if they make sales? Businesses only worry about ethics when they might cause a reduction in profits. NGOs and individuals I expect to have ethics, but not corporations. Where does "backbone" come into running a business?

Canada and USA and a lot of other countries trade with Saudia Arabia, I haven't seen them declaring trade embargoes over Saudia Arabia's human rights issues either.

Personally I'd prefer it if companies (and countries) behaved ethically but from I've read over the last couple of decades this doesn't seem to be something they voluntarily indulge in.

Re:they are a business, why should they care?

[ushering05401]

RIM is handing over the trade secrets and strategies of anyone who uses their product to a country that laid out the modern framework for capitalizing on connections to terrorists as leverage in dealing with the West. The Saudis are the model for Pakistan.

There will be blowback on this, but given the current state of world affairs it is just another straw on the camel's broken back.

Re:they are a business, why should they care?

[SanityInAnarchy]

Why should RIM care if they make sales?

Because it's the right thing to do.

Businesses only worry about ethics when they might cause a reduction in profits.

I have yet to hear a good argument that this should be the case.

Canada and USA and a lot of other countries trade with Saudia Arabia, I haven't seen them declaring trade embargoes over Saudia Arabia's human rights issues either.

None of which has anything to do with whether RIM is doing the right thing here.

Re:they are a business, why should they care?

[commodore64_love]

>>>NGOs and individuals I expect to have ethics, but not corporations.

Revoke corporate licenses.

Re:they are a business, why should they care?

[Anonymous Coward]

Because their sales depend on business people going to Saudi Arabia and using their products. How do you think their customers will react now that the Saudi government can eavesdrop on confidential business communications, trade secrets, corporate strategy, etc... ???

Re:they are a business, why should they care?

[ushering05401]

Ronnie Dugger was working with Jim Hightower back in the nineties on a project to educate voters about corporate charters and how to revoke them.

I attended a meeting in Los Angeles and was interested in their efforts but couldn't get any interest among local activists who were too busy inserting themselves into veteran/holiday parades with subversive signs, picketing rodeos for cruelty, and furiously jerking each other off to care.

Different players are mentioned in the same context here. The blurb section at the end is nice.

Re:they are a business, why should they care?

[Anonymous Coward]

the same way their other customers react when us border guards go thru their laptops, blackberries etc. they will either ban the carrying of devices to hostile countries like the usa or saudi or not give a shit.

Re:they are a business, why should they care?

[ewanm89]

Has it increased, or has it changed? Is it even just your perception of it that has changed? Consider IRA and Britain, Israel and Palestine, these things go back centuries.

Re:they are a business, why should they care?

[ewanm89]

An early recorded piece of attempted modern terrorism would be "Remember, remember the fifth of November." An event that dates back to 1605 and now is actually celebrated now in the UK.

Re:they are a business, why should they care?

[PopeRatzo]

Businesses only worry about ethics when they might cause a reduction in profits.

Well, RIM joins the list of companies I won't ever do business with.

My Blackberry is getting a little old anyway. My contract was up back in March, so I guess it's time for a new, non-RIM phone.

It's not that I think my buying decision will have any effect on RIM. It's just that when I do business with a company that does scummy stuff, it bothers me. I feel better when I stop.

I stopped shopping at Whole Foods last year because the CEO was acting like a dick. Other people must have done the same because the CEO eventually got fired and Whole Foods profits are way down while some other companies in that same industry space are doing well.

Re:they are a business, why should they care?

[Anonymous Coward]

Haha, what? No, seriously. What? Hahahaha

It's funny enough when people think competent terrorists exist, let alone thinking that their numbers have "massively increased". Unless you mean state-sponsored terrorism? Because THAT's certainly on the up.

Re:they are a business, why should they care?

[ushering05401]

As someone that once caused a Brit pee blood because he was a Brit I can tell you it has changed. Once upon a time terrorism was an end point for practitioners. Anyone that knew what had transpired between the Brit and myself, the types of materials to which I had access, and the political views that I espoused would have been mostly correct in identifying me as an individual likely to find my way into association with politically motivated civilian actors, possibly real terrorists.

But then the world got bigger overnight. The ability to reflect upon oneself after exposure to the whole wide world changes the entire game. Terrorism is only one application for a set of tools upon which modern society is based, and many people that don't even know they are hacking have used these tools in anger.

Any time you fuck with the medium via which your peers are experiencing life, whether through innovation or malice, you are using the terrorist skill set.

Coming up with the next killer app and coming up with the next 9-11 are both inherited from the same theory of thought. Both require the thinker to tread a line between what is and what can be. Both may be aided by obtaining privileged information about the organization, focus, capabilities, and expectations of the opposition. Anyone with half a brain that goes through the process will realize at some point that the dark side does have cookies, and you can smell them quite clearly from the intellectual vista where you commune with the muse.

There may be many reasons to choose the path of light, instead of choosing to pull a Fiorina or worse. Maybe you want to be able to eat without directly ensuring the production and safety of your food supply? How about being an artist? How about just being an art lover? The dark siders cannot do these things except through a) ignorance of the reality that their own indiscretions are particles to the waves of chaos that threaten us all or b) failing to recognize the power inherent in the existence of value systems that coexist with their own and have survived longer than any single practitioner of any single value system.

It is like there is a trough that you have to help keep filled or eat from - plenty of folk do both simultaneously. The definition of terrorist has gradually expanded in America to include everyone with the skills capable of building and filling a different trough.

I went on to join a punk band with the Brit, I played bass and let him heckle me for being so sensitive about my dead ancestors and his living ones. It was just a matter of adjusting the theory by reflection upon application, and smoking a lot of pot.

Re:they are a business, why should they care?

[Anonymous Coward]

but mostly smoking a lot of pot

Re:they are a business, why should they care?

[Anonymous Coward]

Sometimes it is worth writing a novella just for the last line. ;)

Re:they are a business, why should they care?

[RCL]

Lenin said: they will sell us the rope with which we will hang them.

Business should not only care about profits, which implies short-term policy. There should be some more general idea behind the business which will help it to avoid "local extrema".

Re:they are a business, why should they care?

[OeLeWaPpErKe]

Do you even find that terrorism requires competence ? Are failed attacks really that much less effective (as long as at least some succeed - even with little casualties) ?

Re:they are a business, why should they care?

[c0lo]

C'mon people, mod parent funny and forgive the poster for the lack of a <sarcasm> notice - not everybody knows how to edit a post to make /. accept a custom pseudo-HTML tag.

Re:they are a business, why should they care?

[Clandestine_Blaze]

I have to agree with you here, even failed attacks cause mass hysteria. Just look at the security theater at airports in the US. (I can only speak for the country I live in.) With every failed attack, they tack on another ridiculous "security procedure" that does nothing but make us think that they're doing something useful. To make things worse, then the US requires airports abroad to have similar procedures and regulations to even be allowed within US airspace.

Though you didn't pose your question to me, I do not find that terrorism requires any competence. Terrorism is simply a desperate way to achieve a political goal. Because they do not have the resources that a government with a standing army has, they choose whatever method that they can get away with, and that's usually hijackings or suicide bombings. Even unsuccessful attacks cause enough of a panic within a general population to change government policy and disrupt everyday life.

Any idiot with homemade bombs can do this. 9/11, on the other hand, did require competence. The plot was hatched around 1996, though some of it was also luck because the FBI, CIA, and local law enforcement did not talk to each other. (I believe at least one of the would-be hijackers was pulled over before 9/11, for example.)

But would we feel any different about groups such as al-Qaeda if they were a real government and had a standing army, and sent battalions and regiments into battle ? Do we hate their tactics, or their goals?

Re:they are a business, why should they care?

[Anonymous Coward]

I don't know that it's a "good" argument, but for American corporations, it is literally against the law for them to be ethical when they could make more money being unethical.

Re:they are a business, why should they care?

[Anonymous Coward]

I have yet to hear a good argument that this should be the case.

Then you are one of the lucky few on the internet who has never argued with an overpriveleged 13-year-old objectivist.

Wait, you said good argument, nm.

Re:they are a business, why should they care?

[OeLeWaPpErKe]

Terrorism is simply a desperate way to achieve a political goal.

It's an effective way. That probably means it's not nearly as desperate as you'd think. Quite frankly, islam is built on terror. It started with terror, and all of it's large advances always coincided with massive terrorism (much, much worse than what we see today).

Any idiot with homemade bombs can do this. 9/11, on the other hand, did require competence.

I doubt it, they got lucky. American policy simply was based on everyone being a "good christian" and not even trying this (which was a very good assumption right up till 2001).

Do we hate their tactics, or their goals?

They kill to get their way. The problem is what was the repeating feature of muslim history. Terror starts out more-or-less what you might call "advancing the (military intrests of) islam" (then again islam is a verb, it literally means 'submission', but note that it is not the passive form of the verb. A better translation would perhaps be "submitting", which would be an english verb that, like the arab one, calls subtle attention to the fact that it is the submission of others (ie. everyone) that is the target) (note also that it is not "submission to god" that is meant, as god is only used as an unspoken subject, never as an unspoken object (that's why "incha'allah" means 'leave it to god' while "incha'" simply means 'leave it to me'. "allah" really is required there. Likewise islam(a') means "submit (everyone) (to me)"). The point being that islam's stated goals are of military nature.

But terrorism soon starts choosing all sorts of sides in political battles, even trade disputes. (such as the enmity between the saudi state and al qaeda, resulting in a de-facto alliance between israel and mecca alliance that is aimed, not at Jews, but at islam).

The end result, if terrorism is not totally eradicated, is total and complete destruction of everything, but mostly, of everyone.

What we *should* hate is where terrorism leads, if it takes off (and it has "taken off" many times in history).

Re:they are a business, why should they care?

[simpz]

Another thing pointed out by the The Guardian today:

As has been shown in the past, terrorists and insurgents tend to communicate using quick, cheap and untraceable technology. The BlackBerry is not really any of these things, since the handset's entire function is to weave its way into its owner's professional (often corporate) and personal life, so as to be an extremely efficient means to trace and reach them.

I think that seems pretty true

Re:they are a business, why should they care?

[gfreeman]

An early recorded piece of attempted modern terrorism would be "Remember, remember the fifth of November." An event that dates back to 1605 and now is actually celebrated now in the UK.

We don't celebrate the attempt at terrorism - we celebrate the fact he (Fawkes) was caught and punished.

In other news, talks with OpenSSH

[Statecraftsman]

reached a virtual standstill when the maintainers told Saudi Arabia to "stick it".

On the one hand....

[Anonymous Coward]

RIM is probably one of the few companies who can make that claim, that they don't even have access to messages.

But on the other hand, in Saudi Arabia, "driving while female" is "criminal', so their claims are suspect at best.

But they already have access to the messages!

[Anonymous Coward]

Saudi Arabia controls the telecom infrastructure, and can tap it easily.

Oh, you mean the unencrypted messages - that's something else.

But of course

[BangaIorean]

Perhaps the governments of UAE and India would be satisfied, too, if only they had access to the messages transmitted.

But of course. Like this guy has mentioned here. It's all about getting a server established in India.

At least they admid of having a deal

[houghi]

Are you sure your country doesn't have such a deal? I can imagine how the talks went:
"We are going to ban your hardware, because we can't listen in."
"Why did you not say that earlier. Here is a server so you can listen in on everything. Oh and here are the keys for the backdoors, so you don't need to call us again."

It is becoming scary how we all start to accept how easy and normal it is to gather information and listen in on people. Some people would call it privacy, I call it personal freedom and I will try to defend it as much as I can.

Clever, if evil.

[fuzzyfuzzyfungus]

Architecturally, it looks like this deal will affect only BIS users, the ones that just walk up to the Phones-r-us kiosk and buy a blackberry and service plan. It won't have any effect on corporate customers running BES servers, since those have their own keys, and devices talking to them won't be dealing with the BIS servers being set up in Saudi Arabia.

Thus, the customers most likely to complain, and make their complaints felt in the pocketbook, are unaffected, while the little people are ever more transparent.

What does this say about secrets?

[NevDull]

All of this hubbub comes around the time of the big Wikileaks document release.

What does it say about us that not only do our governments want to keep secrets "safe" from us, but that for us to be able to keep secrets is dangerous.

The only difference is that they presume themselves innocent, and presume us guilty.

Re:What does this say about secrets?

[ldconfig]

1984 was a warning but sadly its turned into a how-to manual.

Re:What does this say about secrets?

[Thing 1]

1984 was a warning but sadly its turned into a how-to manual.

"Wake up!" sings Danny Elfman, in my sig. That was 27 years ago, and it has gotten much worse since.

not really

[yyxx]

There are some universal rights. Among them should be that no government should have the right to go on fishing expeditions through private communications. That isn't universally recognized, but hopefully we can get there.

Of course, the nations of the Middle East (Saudi Arabia, Egypt, Israel, Jordan, etc.) all commit far more serious human rights violations than merely digging through people's Blackberry messages, but still...

Re:not really

[CrimsonAvenger]

There are some universal rights.

I'm curious, which ones are those? Off the top of my head, I can't think of any universally recognized rights. Some governments recognize some, others don't. Just depends on the country and the "right"...

Re:not really

[Anonymous Coward]

Here you go:

http://en.wikipedia.org/wiki/Universal_Declaration_of_Human_Rights

I agree but it's unlikely to happen

[fantomas]

I wholeheartedly agree with you that companies should behave ethically but it appears from experience that they rarely do this voluntarily.

Hence my noting that there is no governmental embargo in place over Saudia Arabia's privacy / tapping position or other human rights records. Governments could provide the lead, but the message they are sending out is "no problem, do as you will". RIM could argue that they are behaving within the law, and their government is not either providing direct advice, legal restrictions or leading by an example which suggests they should behave other than are doing.

Re:I agree but it's unlikely to happen

[OeLeWaPpErKe]

That's because the government is merely the biggest corporation around. Why would you expect any different behavior from them ?

Also, quite frankly, would you be willing to live with the consequences of giving America 1/3rd less energy ? (knowing that energy cannot be taken away from most things without ghastly consequences. It can be taken away from your private home (from your always-on computer), from your car (or from your wallet if you use public transportation), basically, it can be taken away from the common American. Because most types of production and transportation just can't operate on less cash, that means private persons would have to give up 75% or more of the energy they use to accomodate this. That would literally mean no heating in winter, nor cooling in summer. It'd be a return to the times when a bodycount was made after winter in every city.

Until we have a good option, we can't do without the Saudi's.

Re:I agree but it's unlikely to happen

[cacba]

it appears from experience that they rarely do this voluntarily.

From watching the news, I would never have thought crime was decreasing. People are generally good, let that be the assumption till proven otherwise.

Re:I agree but it's unlikely to happen

[timeOday]

wholeheartedly agree with you that companies should behave ethically but it appears from experience that they rarely do this voluntarily.

I would argue it's worse than that - if the marketplace simply allows unethical behavior, and if there is a competitive advantage in being unethical, then natural selection will actually weed out all the ethical companies as inefficient. Thus your options are 1) play dirty or 2) don't play at all. (Same as how you can't get elected without making unrealistic campaign promises.)

Re:I agree but it's unlikely to happen

[PopeRatzo]

From watching the news, I would never have thought crime was decreasing.

Amazing, isn't it? You'd think that crime was completely out of control.

Even crime along the US/Mexican border has decreased for each of the last 5 years. From all the hollering in Arizona, you'd think that it was completely lawless, when in fact, crime rates are significantly down.

Re:I agree but it's unlikely to happen

[PopeRatzo]

Thus your options are 1) play dirty or 2) don't play at all.

To the extent that I'm able, when it comes to unethical companies, I do my best not to play at all. I'm sure there are plenty of customers who don't mind what a company does as long as their products are shiny and the price is right. But once in a while, boycotts have a very positive effect.

if the marketplace simply allows unethical behavior, and if there is a competitive advantage in being unethical, then natural selection will actually weed out all the ethical companies as inefficient.

You've just described one of the biggest arguments against the notion that "free markets" are good things. In a truly "free market" the result would inevitably a few huge companies, a few very rich people and a lot of poor people who work very hard and have very big debts. That's just the way corporations like it because it limits their workers' choices. When you're poor and have lots of debt, you'll take any job and work for almost nothing and you don't have choice in the matter. You keep buying with the credit card and having fewer and fewer choices. In a free market, everybody "owes their soul to the company store".

Re:I agree but it's unlikely to happen

[couchslug]

"From all the hollering in Arizona, you'd think that it was completely lawless, when in fact, crime rates are significantly down."

"down" /= "good", especially when it's in one's own neighborhood.

Re:I agree but it's unlikely to happen

[c0lo]

RIM could argue that they are behaving within the law, and their government is not either providing direct advice, legal restrictions or leading by an example which suggests they should behave other than are doing.

When in Rome, do as Romans do - seems to me as valid today as it was 2000 years ago.
To exemplify: I don't like software patents, however I have no problems with the idea of USA keeping it for themselves (I do have some issues when they try to export it to other countries).

Re:I agree but it's unlikely to happen

[Rich0]

Even crime along the US/Mexican border has decreased for each of the last 5 years.

I'm a bit skeptical of that. Citation?

Perhaps you mean violentcrime? If somebody sneaks into the country without stabbing anybody, a crime has still been committed.

From all the hollering in Arizona, you'd think that it was completely lawless, when in fact, crime rates are significantly down.

I think their main concern is the impact on the economy and social services, and not just on direct crime. Also, crime associated with illegal immigration is not limited to the border region itself, which is how you phrased your argument. If illegal immigrants commit a crime in Kansas, they're going to want to try to change that even though they are not near a border.

Re:I agree but it's unlikely to happen

[PopeRatzo]

Perhaps you mean violentcrime?

Wait, I thought the whole "invasion on the Arizona border" was about violent crime. You mean we're sending National Guard and building an electronic fence and using drones to stop jaywalking?

I think their main concern is the impact on the economy and social services, and not just on direct crime.

No, their main concern is brown people are gonna take all the good busboy jobs. Next thing you know, they'll be dating their daughters!

Re:I agree but it's unlikely to happen

[badkarmadayaccount]

We have. It's called lot o nukes. Not the exploding kind.

Re:I agree but it's unlikely to happen

[Rich0]

See my last paragraph. The Arizona law isn't intended to only lower violent crime near the border - it is intended to lower violent crime in general (both near and away from the border).

When you think about it, crimes committed during the actual border crossing can't be prevented by the Arizona law. It deals with deporting people who have already gotten past the border area.

The part of your post I most objected to was your talk of crime rates near the border region.

Also, somebody has to do the busboy jobs. There are plenty of unemployed people who could be doing them. If we really don't have enough, then the solution is to increase immigration quotas, not to let people sneak over the border.

blackberry server?

[EricX2]

Maybe I should do research, but if I have a blackberry with enterprise activation syncing with my work email, is that using a RIM owned server or a server with my company? If it is a private owned server, how can RIM give anybody access to the messages?

Also, if I use activesync on my iphone does apple have access to my messages?

Why India would want this

[kuthkameen]

I don't know about Saudi and UAE, but India is primarily concerned about this because of terrorism. Many of the recent bomb blasts were triggered by cell phones, all of which were registered under fake identities. Hence the concern. Look at how many attacks have happened in India: http://en.wikipedia.org/wiki/Chronology_of_major_terrorist_incidents_in_India

Re:Why India would want this

[Anonymous Coward]

lol. those who give up liberty for security deserve neither.

Re:Why India would want this

[DaveAtFraud]

From what I have read in various sources, most of the terrorists' communication is in code. That is, plain language words and phrases have a specific meaning. They don't use encryption since the very act of encrypting their communication draws attention to it. Something like, "My cousin's wedding is Wednesday," could mean that their planned attack will happen on Wednesday... or this guy's cousin really is getting married on Wednesday. Encrypting such a message just draws attention to it.

Getting access to something like a Blackberry server won't stop the terrorists from communicating. It might give local companies an advantage if the government makes what should be proprietary information available.

Cheers,
Dave

Re:Why India would want this

[mjwx]

I don't know about Saudi and UAE, but India is primarily concerned about this because of terrorism. Many of the recent bomb blasts were triggered by cell phones

Bad excuse, bad action.

They aren't going to stop making bombs if it by some miracle becomes impossible to detonate them by phone. If India wants to stop terror attacks it needs to look for the source of the attacks (the leadership and the underlying reason) and neutralise them. Banning phones will just make them use wrist watches as timers or CB/HAM radio's or some guy with a long bit of string. Will India ban the sale of string? Meanwhile India turns into the oppressive state the terrorists complain about, whilst the average Indian suffers more under the state then from the terrorists. In the end, the terrorists win and barely had to lift a finger

And I like Indians, for the most part they are kind, friendly and humble people (obviously not the telemarketers, but they are working under the direction of foreign companies anyway).

Re:Why India would want this

[kuthkameen]

If India wants to stop terror attacks it needs to look for the source of the attacks (the leadership and the underlying reason) and neutralise them. Banning phones will just make them use wrist watches as timers or CB/HAM radio's or some guy with a long bit of string. Will India ban the sale of string? Meanwhile India turns into the oppressive state the terrorists complain about, whilst the average Indian suffers more under the state then from the terrorists. In the end, the terrorists win and barely had to lift a finger

You are right, but often the source of many of the terrorist organizations are in Pakistan...what can India do then?

Tweet Mohammed

[Anonymous Coward]

Tell the Saudis the servers are chock full of pictures of Mohammed. That should keep them out.

Re:Tweet Mohammed

[Anonymous Coward]

If they're not, I think it's our duty to make it happen.

Just give me a data connection

[Anonymous Coward]

just give me a way to move my bits where I want, and I'll take care of my own encryption, thank you very much. trusting any vendor to provide secure encryption is truly naive.

Ethics can be profitable

[Anonymous Coward]

Since RIM has built its reputation on secure communications, the ethical choice may also be the profitable choice. It is possible that by standing by their principles, RIM could acquire new customers that may offset any loss in customers that a ban in Saudi Arabia might cause.

Also, the Blackberry is a mature product that is quite pervasive in the business community and corporations are generally slow to migrate away from such integrated technologies. I think that it is more likely that companies will stop doing business IN Saudi Arabia. This does not mean that they stop doing business WITH Saudi Arabia, but I can see Saudi Arabia's hotel and tourist industry taking more of hit than RIM. I think that it will be easier for most to stay away from Saudi Arabia than to give up their Blackberry's.

As a Canadian, I sincerely hope that RIM stands up to these Bullies. After all, this is just another example where, for the sake of "national security", the rights of the average person are trampled on. Meanwhile, those who are intent on doing harm have an entire arsenal of free and open source tools that are just as secure as the Blackberry (if not more so). This kind of invasion of privacy does nothing to stop, or even curtail, those who have evil intentions (and have half a brain).

On a final note, I can't believe that the headline has been "RIM banned in Saudi Arabia" . The headline should have been "Saudi Arabia monitoring all communications".

People deserve the freedom they get

[cecom]

People deserve the freedom they get. Have you read the comments on BBC's article.
http://www.bbc.co.uk/news/technology-10899338
Let me quite a few:

Abu Mohd, Riyadh, Saudi Arabia

I am an expat living in Saudi Arabia. For me the Blackberry is key to staying in contact with my family and friends in a way that I cannot do with other messaging services. I hope Saudi Arabia and RIM solve this situation. There are many people that work here who are away from their families that use this service. This ban would be one more reason to not come here, it does not help to the development of this country.

Suresh Haridas, Al khobar, Saudi Arabia

BlackBerry made our life much easier, whether we are using e-mail, internet, or BBM. A lot of people/students such as myself who live thousands of miles away from their family and friends really depend on BBM as a convenient medium to communicate. There is nothing compared to BBM in terms of quickness, convenience, and cost. On the other hand, I understand why governments such as Saudi Arabia, UAE, and others feel threatened. However, I am wondering why BlackBerry does not help these countries in terms of monitoring data and using their own servers to get to encrypted information.

Rakan H, Riyadh, Saudi Arabia

I am one of the youths who owns a BlackBerry and I completely agree that it is a major step in my country to protect it against any terrorist or anything that might affect our security. Also I believe all countries like the US should consider the same thing, because it is a tool that can be used among those people who can get access to national security and cause terror to communities. It is a perfect tool for them, cutting it off worldwide will definitely reduce the amount of global issues occurring. If it is necessary to protect the country then why not!

Jim, Singapore

I am a Canadian, living in Dubai and dreading losing my Blackberry. Most people I know are aware of the high level of security in the UAE and appreciate the benefits it provides. I would much rather lose some personal freedoms than take a chance with security. RIM has to understand that Dubai is a transit point for trade and potentially terrorism. Its population is continuously changing as over 80% of its residents are foreigners. UAE's high level of security is in the interests of the West. I am hopeful for a positive resolution but am not brave enough to buy up all the handsets that are selling cheap.

Ara, Dubai, UAE

Whilst it's perfectly true that any invasion of personal privacy in the name of national security is usually resented, I don't really understand the sense of outrage on this one. After all, don't the western intelligence agencies have extensive gathering facilities for the same sort of thing? I don't see the Gulf states doing anything more than our own governments, like it or not.

Re:People deserve the freedom they get

[Whatanut]

This wins as the most depressing comment of the year, for me. It would seem that the "terrorists" are winning this little game.

https?

[cecom]

One would assume that this is all pointless, since anybody could just use a web service via https.

However one would also assume that these governments control at least one trusted signing authority, so they can freely intercept any https.

Re:https?

[TheGratefulNet]

httpS is also not trustable. MITM attacks are not hard (buy the right piece of 'security appliance' and it will fool both ends of the SSL attack. I interviewed at various bay area companies (networking field) and they ALL are trying/doing this, now. very sad and very eye-opening.

I will never trust the 's' in https again now that I've seen how bad the end-to-end 'authentication' is.

Re:https?

[cecom]

I am pretty sure no security appliance can fool anything unless it can present a security certificate that my browser trusts. That can work in a corporate environment, a school, etc, but definitely not in general.

In any case, you can trust https only to the extent you can trust the CAs. If there are any CAs in China, UAE, etc, then you can be sure the respective governments can issue a certificate for *.com :-)

they have excellent reason to care

[alizard]

A very large part of the sales appeal of a phone with an aging UI and an "uncool" form factor and a proprietary OS and limited app capability (why yes, I do have one) is precisely because it's "secure". That's why President Obama carries one.

Government and big business sales of the RIM phones are largely driven by "secure", more modern phones with more features and better UIs are available at the same price or cheaper.

Having "just" Saudi Arabia able to read Blackberry messages is like being "just" a little bit pregnant. RIM's product differentiation just disappeared... and by the time two more nations have built in wiretap capabilities thanks to RIM, their major customers will be switching to something else. IOW, they'll have destroyed their basic market for sales of a few thousand SKUs.

This is great news for Apple and Google and everyone making Android phones. If anyone wants to compete in the "secure" government and enterprise market, it's a matter of simply bundling crypto apps into the UI and making the setup easy and automatic.

As for RIM. I hope a smarter vendor picks up the touchpad when RIM goes down... IMO, it's superior to touch screen for small form-factor platforms. With a touchpad, you don't have to try to guess what's under your finger when you push the button.

Kettle meets pot

[Mubarmij]

FWIW, Saudi Arabia, UAE and India were all asking RIM for the same level of access to the underlying network that RIM already gave to USA and UK (and probably others).

Saudi monitoring

[Animats]

Will the Committee for the Promotion of Virtue and the Prevention of Vice have access?

This makes a Blackberry useless for business purposes. In most of the countries involved, the Government itself owns major businesses. Nobody in the oil business would want to discuss anything related to a Government deal (which is most of them) over a Blackberry now.

Halliburton?

[martin-boundary]

I guess Dubai doesn't trust Halliburton anymore, then? Poor Dick Cheney, I hope he gets over it.

Sorry...just walked in...

[mrchilly0]

who got the RIM job?

BES service more secure than direct SSL?

[swb]

Assuming you have a BES server in your organization...

Blackberries, AFAIK, send their data encrypted via the cell provider (RIM has servers on site?), then to RIM's central hub, and then to your BES server at your office, with high-grade end-to-end encryption.

"We're more secure" I think is their selling point.

How is that more secure, than say, an iPhone/Android communicating to an Exchange server directly over the internet but using quality SSL (ie, 2048 bit key, 128 bit AES, etc)?

Is direct, over the Internet communication with SSL encryption somehow not an issue for the Saudis or the other Arab nations? Is it somehow less secure against eavesdropping?

I can imagine there are some tertiary security issues (ie, with BES you wouldn't expose Exchange's SSL port to the internet), but I'm thinking the basic encryption between the handheld and the server.

Re:BES service more secure than direct SSL?

[Sabriel]

If the SSL keys came from a certificate store which has made a silent agreement with a state, that state can decrypt any of your communications that pass through that state's infrastructure (or are otherwise obtainable).

Furthermore, if I've been following things correctly, RIM's "selling point" is that (a) your corporate keys aren't known even by RIM, and consumer keys are known only by RIM and not anyone else, and (b) the Blackberry hardware is designed/certified to resist tampering to a degree that your typical iPhone/Android consumer phone can't match.

Presumably this means that (a) the machine the Saudis are getting from RIM can only decrypt consumer-level berries, and/or (b) corp berries in Saudi will have their security forcibly dumbed to consumer-grade (I also seriously have to wonder how long it would take any decent TLA to root the machine once it's in their hands, so there may well be some dancing around what exactly constitutes "having" the machine).

The alternative is to roll your own certificates and install them on client and server. Of course, if a state can and does notice you aren't using "their" keys, and considers you of interest, they can always decide on various, less silent, approaches. Which is pretty much what has happened here between Saudi and RIM.

Re:BES service more secure than direct SSL?

[AHuxley]

Yes its a interesting thought experiment. Do the locals get 24/7 spyware, something at the back end server pump out plain text as needed? If the devices are hand held encrypt at A send, decrypt at at B, whats the solution to get plain text? World wide a lot of smart people should be thinking ummmm????

Re:BES service more secure than direct SSL?

[swb]

Cert vendors can play games, but don't they just sign public keys? AFAIK, SSL certificate request doesn't include the private key, so a CA doesn't have it. Don't they just sign it for validity and provide some authentication that the cert buyer is who they claim to be?

Even if SSL cert vendors *did* get private keys, there's nothing stopping the paranoid from using self-signed certs which with the right encryption would be highly resistant to tampering or interception.

I can see where hardening the device would help, but I don't see UAE or the Saudis hacking hardware at the same time.

It sounds like Blackberry's security advantage is really limited and it's more about corporate control, provisioning, etc. than security as "interception of communications" versus SSL-equipped handhelds.

Depends on how you mean

[Sycraft-fu]

I believe they can get a wiretap warrant and monitor what is going on with a given number. That is not surprising (or secret). However I don't believe they have any secret back door in to the handsets, or private BES units. They seem to use strong, FIPS validated, encryption which to the best of anyone's knowledge is not breakable. In fact the security of the handsets is one of the things the government loves to much about BB and why they are the biggest customer (the US government loves them some BlackBerrys).

It is one thing to say "Of course RIM cooperates with all lawful investigations." I'd expect nothing else, they don't really have a choice. However it is a different one to say "RIM has built in special back doors for a government can freely monitor what is going on."

Same kind of thing with your PC. The US government (I'm presuming you like in the US here) can monitor your Internet traffic with a warrant. They can have your ISP mirror everything you do so they can see it. Also, they can seize your PC with a warrant and sift through the data on it. However they can't have your PC spy on you automatically. Your PC does not have some built in back door that lets them get in to it remotely when they like. It does not give them any special monitoring access.

To put an analogy to a house, the government can get a warrant to survey your house (actually for most kinds they don't need a warrant), and they can get a warrant to search the house itself, and can require you to let them in when presented with this warrant. However they do not have a master key that lets them in to your house when they feel like, and do not have the right to just waltz in when they want with no reason.

The cure for high prices is high prices

[Anonymous Coward]

The economy cannot sustain $10 per gallon fuel, thus would find other means of energy or oil extraction. That, or our taxes would be so much lower that it the $10 per gallon wouldn't bother us.

Except

[Anonymous Coward]

Anyone planning anything the Saudi's didn't like are not going to get caught using unencrypted or spyware infested RIM products or any other similar products. It's all cat and mouse where regular people are confused with criminals and terrorists.

Does that enable a replay attack?

[Anonymous Coward]

Can that server be used in a replay attack against messages from U.S. blackberries?

the only way to reply to your idealism

[circletimessquare]

is with winston churchill:

"No folly is more costly than the folly of intolerant idealism"

you have absolute truth apparently on your side, be damned everything else

what are you, some sort humanist taliban?

dude: you are as bad, if not worse, than whatever you hate in this world, because you think exactly the same way they do

you hate repression and torture? well, the guys doing the repression and torture are empowered with the same haughty arrogance about their beliefs as you have

get over your fucking self

Obama's Blackberry

[ljhiller]

If anybody didn't understand why the secret service took away Obama's crackberry, it should be pretty clear now.

Re:Obama's Blackberry

[gfreeman]

When did they take it away? He was using it a couple of weeks ago ...

http://blogs.reuters.com/frontrow/2010/07/29/washington-extra-obamas-blackberry-10/

Homophones... sort of

[Anonymous Coward]

fill != feel

They're not even proper homophones. Either you speak with a strong accent, or you're phonetically sloppy.

Your logic is ignored when your language is faulty. It's unfortunate, but true.

Patents and new kids on the block

[Anonymous Coward]

OK, RIM by means of its actions is 'not secure'.
Lets not forget once the 'read' the message, somebody is helping them find out the 'owners' details.
More co-operation. The Stasi would be proud of RIM.
Whatever patents are worthless, and someone else can jump into the hole.

I hope an 'app' comes along to send pseudo random scrambled messages with a frequency distribution with a fake 's' box signature that convinces someone it is a valid message, and wastes a whole lot of time to decrypt rubbish.

human rights versus reality

[OrangeTide]

There are some universal rights.

But if they don't exist in many countries are they really that universal? What can you do about it beside bitch on the internet?

Re:human rights versus reality

[yyxx]

But if they don't exist in many countries are they really that universal?

They are recognized by most nations.

What can you do about it beside bitch on the internet?

There is an international court of human rights, there are sanctions, and you can sue in the US, UK, and other nations for violations anywhere. Enforcement of universal rights is, of course, still difficult, but it's not impossible.

Technically not feasible

[Anonymous Coward]

As a developer familiar with the Blackberry API and devices, I don't believe this "anonymous source" at all. Messages are encrypted on the device before they enter the network channel. It would be impossible for RIM to provide the Saudis or any other entity the ability to read these messages (outside of some hidden heretofore unknown backdoor which RIM has denied since its creation exists). It doesn't matter where in the world the server is (co)located.

Now, it is possible to turn off the cryptographic capabilities of the device via an IT policy. About every facet of the Blackberry device can be controlled upstream by carrier/owner installed policies, which is why it is so attractive in the enterprise. But this would be a "deal" between the Saudis and the telecos providing the devices and service. RIM doesn't control the carriers in the least, in fact, some of the stupid business descions made by RIM the last couple of years can be attributed to certain carriers, imho.

This whole story is rubbish from a technical standpoint.

Re:Technically not feasible

[wiedzmin]

Google "MITM", if Saudis have a server through which *all* messages are required to travel - you can encrypt it on the end devices until you're blue in the face... they will have no idea that the messages are decrypted by the server, then re-encrypted again. That's how bad guys steal your banking information on unsecured wireless networks.