President Trump Thinks Basic Phone Security Is Simply Too Inconvenient
from the who-needs-updates dept
For the past year much has been made of the President's unwillingness to adhere to anything close to reasonable security when using his mobile phones. Whereas the Defense Information Systems Agency (DISA) and the National Security Agency usually work in concert providing state leaders with "hardened" devices that are heavily encrypted, routinely updated, and frequently swapped out, Trump has refused to use these more secure DMCC-S devices (effectively a Samsung Galaxy S4 device utilizing Samsung's Knox security architecture) because they apparently infringe on his ability to Tweet.
Just a few months ago, Senators sent a letter expressing concern that Trump's mobile phone practices were leaving the President open to potential hacking by foreign entities:
"The President of the United States stands alone as the single-most valuable intelligence target on the planet. Given the apparent lack of progress the Administration has made since initial reports in 2016 of the President’s poor operational security, it appears the only thing standing between the Office of the President and the next national security nightmare is a combination of President Trump’s personal restraint and sheer luck."
Eventually, the President was convinced to use two iPhones: one locked down specifically for Twitter, and the other specifically tasked with making phone calls. Even here reports have suggested that Trump has struggled to adhere to these restrictions, often making personal calls on his unsecured Samsung Galaxy III. This week a report from Politico highlights again how White House and IT security staff have recommended that these devices be routinely swapped out, an idea the President continues to resist:
"While aides have urged the president to swap out the Twitter phone on a monthly basis, Trump has resisted their entreaties, telling them it was “too inconvenient,” the same administration official said.
The president has gone as long as five months without having the phone checked by security experts. It is unclear how often Trump’s call-capable phones, which are essentially used as burner phones, are swapped out."
And yeah, that's a serious problem. While these devices appear to be the equivalent of burner phones, five months is forever in security world, giving attackers ample opportunities to compromise the microphone, camera, or other hardware embedded in Trump's devices. It's a particularly notable problem in the wake of things like the SS7 vulnerablity -- a flaw mobile carriers routinely try to downplay that opens the door to remote surveillance and a wide variety of attacks on most modern smartphones and mobile networks.
Dear @realDonaldTrump: The #SS7 flaw allows foreign governments to listen in on your unsecured cell phone.
If you're not concerned about that, how about this: that same flaw gives US intelligence the capability to listen in on your phone.
Will you please change your behavior? https://t.co/luuqymFHY9
— Ted Lieu (@tedlieu) May 22, 2018
Needless to say, the President's abysmal privacy and security practices likely make a delicious potential target for hostile foreign powers, something you'd think Trump would realize given his breathless hyperventilation regarding a certain home e-mail server. Meanwhile, the President's disdain for routine security comes incongruently as his FCC moves to block many Chinese hardware vendors from doing business in the States, a protectionist move the administration insists is exclusively focused on protecting national security.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: disa, donald trump, secure phone, security, tweeting
Reader Comments
Subscribe: RSS
View by: Time | Thread
Nice priorities there
"While aides have urged the president to swap out the Twitter phone on a monthly basis, Trump has resisted their entreaties, telling them it was “too inconvenient,” the same administration official said.
'Yeah, I present a huge target, and my utter brilliance(read: colossal stupidity) means I'm also a very easy target, but swapping phones on a monthly basis to mitigate that risk somewhat would be hard.'
Oh yeah, this is absolutely someone who gets security and should be involved in making decisions relating to it on a national level.
(As an aside, just bask in the fact that the US president is so obsessed with Twitter that he has a phone specifically for it, because that's not all sorts of crazy at all.)
Dear @realDonaldTrump: The #SS7 flaw allows foreign governments to listen in on your unsecured cell phone.
If you're not concerned about that, how about this: that same flaw gives US intelligence the capability to listen in on your phone.
And this is just hilarious. 'Hey, so I know having foreign governments listening in to your calls may not be a big deal to you, but that same flaw allow US intelligence to listen in too if they care to'. Talk about knowing which buttons to push and tweak his nose at the same time.
[ link to this | view in chronology ]
Re: Nice priorities there
[ link to this | view in chronology ]
Re: Nice priorities there
I'm not terribly concerned about Trump's use of an unsecured phone dedicated to Twitter use. That stuff is way too public for his own good anyway. Heck, having Putin write his tweets for him would probably only help his popularity with his base.
As funny as that sounds, it's a far more consequential issue. If, as been alleged, US intelligence is caught as politically corrupt and serving just one master there will be a far, far larger crisis of confidence in government and very deep damage to our political system. I say caught only because the instances that have come before have been minimized by bipartisan agreement. Trump and his supporters are no fans of the established order and I doubt they'll be willing to give the intelligence community cover to escape the community's corruption. And a victory by Trump over the IC after an attack by the IC would give him the ability to reform the IC, which I doubt many folks will like on either side of the aisle.
[ link to this | view in chronology ]
Something is lacking in that phrase.
[ link to this | view in chronology ]
Much like Bill O'Reilly, Alex Jones and Glen Beck
Donald J. Trump is known for a lot of outrageous opinions for a lot of things, and its only because he got elected president that his opinion is considered at all.
Maybe we should consider instead listening to other experts?
[ link to this | view in chronology ]
Re: Much like Hillary ?
[ link to this | view in chronology ]
Ah the classics...
[ link to this | view in chronology ]
Re: Ah the classics...
[ link to this | view in chronology ]
Re: Re: Much like Hillary ?
http://www.slate.com/blogs/lexicon_valley/2015/07/31/donald_trump_this_run_on_sentence_from _a_speech_in_sun_city_south_carolina.html
[ link to this | view in chronology ]
Living in the past, much?
E
P.S. Feel free to whine about Obama also. Last I heard he hasn't been President in a while either.
[ link to this | view in chronology ]
Re: Re: Much like Hillary ?
It must be a troublesome position, voting for someone who you know is objectively terrible, and being unable to defend a single one of his actions?
[ link to this | view in chronology ]
Re: Re: Much like Hillary ?
[ link to this | view in chronology ]
Re: Re: Re: Much like Hillary ?
Trump has gotten a pass for practically everything he and his minions complained about regarding Obama and Clinton.
Remember when Trump was calling the US the laughing stock of the international community?
[ link to this | view in chronology ]
Chip?
[ link to this | view in chronology ]
Re: Chip?
Oh, Gary! You are not going to last here much longer!
Hate ME all you want (that's part of why I'm here!), but since you are actually wondering why this trivial clickbait is up, then clearly Techdirt's reality-warp has failed to engulf you. I didn't believe in that at first, either, but once noticed, it becomes unbearable. Even I have had to FLEE for more than year at a time.
[ link to this | view in chronology ]
Re: Re: Chip?
[ link to this | view in chronology ]
Re: Re: Chip?
[ link to this | view in chronology ]
Re: Chip?
Every Nation eats the Pain thips it Deserves!
[ link to this | view in chronology ]
Obviously the response to this is to hack the phones
Record the president's conversations and online traffic and then post them publicly.
Some kids are only swayed by the natural consequences of their actions.
[ link to this | view in chronology ]
Re: Obviously the response to this is to hack the phones
[ link to this | view in chronology ]
Re: Re: Obviously the response to this is to hack the phones
Instead, use the wiretapping loophole the feds and multiple states have created by their claims that operation of a Stingray device is neither interception of electronic communications nor an unauthorized access to a computer.
The government exemption built into wiretapping, eavesdropping, interception and the Computer Fraud and Abuse Act all require that the government have a warrant to qualify for the exemption -- no warrant means no exemption. So either there are an awful lot of unindicted people guilty of MANY felonies and conspiracies to commit felonies throughout the state and federal governments (raising equal enforcement clause issues) or such actions are not illegal.
[ link to this | view in chronology ]
Re: Obviously the response to this is to hack the phones
Given his utter indifference towards security, if his phones aren't already compromised by at least one(and more likely several) foreign intel agencies and other large groups I would be extremely surprised.
[ link to this | view in chronology ]
Re: Re: Obviously the response to this is to hack the phones
[ link to this | view in chronology ]
Re: Re: Obviously the response to this is to hack the phones
So, anyone listening in on his private conversations will just be *even more confused* as to what his real priorities and positions are.
Wait, maybe there is something to this 4d chess ting after all.
[ link to this | view in chronology ]
The President's real priorities and positions
I'm pretty sure he wears his priorities and positions on his sleeve. He just changes his mind very frenetically. And he keeps close advisor that redirect him if he veers too hard from their agenda.
I suspect if the President's conversations were published daily we'd have few surprises, but mostly confirmations of what we've already determined.
But it might embarrass the President, the White House and the GOP. And then they might actually take communication security seriously.
After the Zimmerman telegram, the German Republic took communication security very seriously. I'd like to avoid the misfortune of their misstep of being in a war at the time.
Wait...we are in a war, if not three or four. Dangit.
[ link to this | view in chronology ]
Mountain or molehill?
[ link to this | view in chronology ]
Re: Mountain or molehill?
[ link to this | view in chronology ]
Re: Re: Mountain or molehill?
[ link to this | view in chronology ]
Re: Re: Re: Mountain or molehill?
[ link to this | view in chronology ]
Re: Re: Re: Mountain or molehill?
[ link to this | view in chronology ]
Re: Re: Re: Mountain or molehill?
[ link to this | view in chronology ]
Re: Mountain or molehill?
[ link to this | view in chronology ]
Re: Mountain or molehill?
[ link to this | view in chronology ]
Re: Re: Mountain or molehill?
No need for anything else after that really.
[ link to this | view in chronology ]
Re: Re: Mountain or molehill?
There is also the other issue, how long it takes to upgrade things. I seem to remember Obama using an outdated Blackberry, because they couldn't "secure" an Android or iPhone. Trump would see having to wait, as ridiculous. I would agree with him on that.
[ link to this | view in chronology ]
Re: Re: Re: Mountain or molehill?
Well, given the president's history of discussing sensitive information in public, you may have a point.
[ link to this | view in chronology ]
CIA: Collect It All
Last chance! Campaign ends at midnight! Get your copy of the CIA's declassified training game by backing CIA: Collect It All on Kickstarter.
https://www.kickstarter.com/projects/mmasnick/cia-collect-it-all
[ link to this | view in chronology ]
Re: CIA: Collect It All
[ link to this | view in chronology ]
Re: CIA: Collect It All
[ link to this | view in chronology ]
Re: CIA: Collect It All
But, uh, you spelled "promo" with a hyphen.
[ link to this | view in chronology ]
You-Re so jelly it’s funny.
[ link to this | view in chronology ]
Besides, given reports that there are multiple fake cell towers around the DC area, not sure the risk of a twitter phone being compromised is high on the list of things to worry about.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Hah! The real reason that nobody is hacking him is that they all know there is nothing of intelligence on that mans phone (or anywhere else).
[ link to this | view in chronology ]
"...the single-most valuable intelligence target on the planet"
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Wait a sec.....
[ link to this | view in chronology ]
"Intelligence" target
They do realise who they're talking about, right?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
This is why every phone needs to be secure
Swapping out one's phone every few months, using separate phones for voice and Twitter... Karl, if you think that's "basic" security you're the most paranoid one here.
Anyhow, it's a good example of why we shouldn't want phone-makers to reduce their security to enable surveillance. Consumer devices always manage to migrate into "inappropriate" areas—not usually the President's office, but places like hospitals and military bases where data should be kept confidential. The US Government's "solution" to security problems is to give some weird outdated hacked-up phone, and replace it frequently in some way that's obviously disruptive (come on, this is the President's office, why can't someone just show up and say "here's your new phone, we've transferred all your shit over"?). So if we want usable security, we're not going to get it from them. Apple and Google might be able to do it if the government doesn't stand in the way.
And what's this about a flaw so old that companies are "routinely" downplaying it? We've got some flaw affecting the entire country's privacy, and the solution is to give the President a magic phone and leave the rest of us out to dry? Don't we have groups like CERT to fix shit like this? Does the government really think they can identify a small subset of people such that, as long as those people don't get hacked, they'll get no blowback from the bug? The phone companies should be getting called into Congressional hearings and getting fined every day it's not fixed.
[ link to this | view in chronology ]
I find it particularly amusing
[ link to this | view in chronology ]
'Security for me, but not for thee.'
Of course. National security is under dire threat if the public can't be spied on with minimal effort, but when it comes to the nobility then it's exactly the opposite, where national security is under dire threat if they can be spied on with minimal effort.
[ link to this | view in chronology ]
Re: 'Security for me, but not for thee.'
[ link to this | view in chronology ]
Re: I find it particularly amusing
The security in that case comes from the inability to access a locked, confiscated phone.
This issue is about unsecured communications.
[ link to this | view in chronology ]
Re: Re: I find it particularly amusing
https://arstechnica.com/information-technology/2018/05/trump-feels-presidential-smart phone-security-is-too-inconvenient/
[ link to this | view in chronology ]
Re: Re: Re: I find it particularly amusing
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Sorry, I couldn't get past the headline. "Trump thinks"... Who knew?
[ link to this | view in chronology ]