BlackBerry: We're Here To Kick Ass And Sell Out Users To Law Enforcement. And We're (Almost) All Out Of Users.

from the thank-you,-sir!-may-I-get-you-another?-and-another? dept

Back in mid-April, it was discovered that Canadian law enforcement (along with Dutch authorities) had the ability to intercept and decrypt BlackBerry messages. This level of access suggested the company had turned over its encryption key to the Royal Canadian Mounted Police. BlackBerry has only one encryption key for most customers -- which it maintains control of. Enterprise users, however, can set their own key, which cuts BlackBerry out of the loop completely.

BlackBerry CEO John Chen -- despite publicly criticizing Apple for locking law enforcement out of its phone with default encryption -- refused to provide specifics on this apparent breach of his customers' trust. Instead, he offered a non-denial denial, stating that BlackBerry stood by its "lawful access principles."

The matter was left unsettled… until now.

A specialized unit inside mobile firm BlackBerry has for years enthusiastically helped intercept user data — including BBM messages — to help in hundreds of police investigations in dozens of countries, a CBC News investigation reveals.

This unit, which cracks open BlackBerries for nearly anyone who comes asking, is very proud of its work.

One document obtained by CBC News reveals how the Waterloo, Ont.-based company handles requests for information and co-operates with foreign law enforcement and government agencies, in stark contrast with many other tech companies.

"We were helping law enforcement kick ass," said one of a number of sources who told CBC News that the company is swamped by requests that come directly from police in dozens of countries.

Go team! While these sources remain generally upbeat about throwing customer privacy and security to the wind, the official word from the company is less enthused. In fact, it's nonexistent.

In response to questions from CBC News, a BlackBerry spokesperson said it "will not address the questions given the extremely sensitive nature of this process."

This unadvertised service is apparently so popular BlackBerry has streamlined the process. It offers government agencies a list of boxes to check for what kind of information they'd like retrieved from a phone (including the ominously vague "other"), as well as the option to declare any request "exigent."

It also asks that the requesting party sign off on some boilerplate saying the request is legal in the requester's country and that it is not being done to "control, suppress or punish… political or religious opinion."

Of course, BlackBerry is not a government agency so it really can't do anything if someone "perjures" themselves by signing the form and moving directly towards suppression, punishment, etc. The best it can do is not allow that entity to make any more requests. I'm guessing this almost never happens because the quoted sources seem like a bunch of overly-cheery do-gooders. Policing the police would require BlackBerry to second-guess the government entities it seemingly can't wait to assist.

"Narco trafficking, human trafficking, money laundering, kidnapping, crime against children, knowing you are stopping those things … how do you not love doing something like that?" said the insider.

Yup. [Insert whatever the Canadian equivalent of "'Murica!" here.]

In its hurry to help supposed good guys track down alleged bad guys, the Canadian branch of BlackBerry's "full give" operations is skirting around statutes meant to protect locals from inappropriate demands made by foreign countries.

Christopher Parsons, a research associate at the University of Toronto's Citizen Lab, who has studied the privacy practices of tech companies, is worried by the secrecy of BlackBerry's process and its potential for abuse.

[...]

He said BlackBerry is allowing foreign police to bypass the Mutual Legal Assistance Treaty, a diplomatic agreement that allows Canadian officials to review requests from foreign police and consider whether they are legal under Canadian law.

But, as Parsons points out, law enforcement agencies are probably thrilled to have someone on the inside willing to violate treaties with the drop of pre-printed form. Adhering to MLAT may result in significant delays, whereas approaching BlackBerry directly sets its team of super-secret gofers in motion immediately.

Of course, the major downside here is that very few criminals are likely still using BlackBerries. Most of the company's customers are enterprise users and they have the ability to lock down their phones so tight not even BlackBerry can get into them. But for all the panicked talk about going dark, BlackBerry's special ops unit says it's still surprised at how many criminals are unaware the company is basically the local PD at this point.

The nails were already in the coffin for BlackBerry. Each new exposure of its highly-proactive law enforcement assistance is only going to hasten the dwindling of its user base.

Filed Under: blackberry, encryption, law enforcement, lawful access
Companies: blackberry

BlackBerry Offers Glomar, 'Bad Guys Got Caught,' In Non-Comment On Canadian Law Enforcement's Full Access To Encrypted Messages

from the 'in-conclusion,-Blackberry-is-a-land-of-contrasts' dept

BlackBerry has finally responded to Motherboard's story on the Royal Canadian Mounted Police's apparent full access to encrypted communications -- something that hinted the RCMP may have been given BlackBerry messaging's "Golden Key." Sort of. It's mostly an indirect Glomar followed by a statement that confirms something people already know.

BlackBerry still has not commented directly to Motherboard or VICE News on the specifics of the investigation, but CEO John Chen published a blog post on Monday addressing the report in broad strokes… very broad strokes.

[...]

“Regarding BlackBerry’s assistance,” Chen wrote instead, “I can reaffirm that we stood by our lawful access principles. Furthermore, at no point was BlackBerry’s BES server involved.”

BES is BlackBerry Enterprise Server -- the only option available where customers can lock BlackBerry out of access to communications. With BES, encryption keys are set by users, which means BlackBerry can no longer decrypt messages using its global PIN encryption key. Notably, this option is only available to corporate or government customers. Everyone else gets vanilla encryption, which can be decrypted by BlackBerry for law enforcement. Or, as appears to be the case in Canada, the key can be handed out to law enforcement agencies, allowing them to decrypt at will… because there's only one encryption key for all non-BES users.

According to BlackBerry CEO John Chen, the ends justify the means he pointedly won't be discussing in detail.

We have long been clear in our stance that tech companies as good corporate citizens should comply with reasonable lawful access requests.

[...]

This very belief was put to the test in an old case that recently resurfaced in the news, which speculated on and challenged BlackBerry’s corporate and ethical principles. In the end, the case resulted in a major criminal organization being dismantled.

BlackBerry continues to play both sides of the equation, providing "regular" users with less secure communications while claiming to be the "gold standard" in encrypted communications -- a privilege it only extends to some of its customers, unlike Apple or Google, which provide encryption to all of their customers.

The company has nothing to offer customers in the way of assurances, but it does seem to be going out of its way to soothe the nerves of law enforcement officials frustrated by smartphone encryption. It may make a big deal about its fight against Pakistan and its demands for access (Chen highlights this in his blog post), but it seems less than likely to go to bat for a majority of its users when faced with overreach by more "acceptable" governments.

Filed Under: backdoor, blackberry, canada, encryption, glomar, john chen, key, rcmp
Companies: blackberry

Canadian Law Enforcement Can Intercept, Decrypt Blackberry Messages

from the so-much-for-the-one-thing-Blackberry-used-to-have-going-for-it... dept

Blackberry's CEO, John Chen, didn't care for the fact that Apple was "locking" law enforcement out of its devices by providing customers with default encryption. As he saw it, Apple was placing profits ahead of Mom, Apple pie and American-made motorcars.

For years, government officials have pleaded to the technology industry for help yet have been met with disdain. In fact, one of the world's most powerful tech companies recently refused a lawful access request in an investigation of a known drug dealer because doing so would "substantially tarnish the brand" of the company. We are indeed in a dark place when companies put their reputations above the greater good.

Chen refused to "extend privacy to criminals." How he had any way of knowing who was or wasn't a criminal at the point of sale was not detailed in his rant.

Then news surfaced that Dutch law enforcement could bypass Blackberry encryption with seeming impunity. At that point, Blackberry became defensive about its new stature as the least secure smartphone option. It claimed in a blog post that its stock phones were not open books for the world's law enforcement agencies. Despite promising earlier that the company would not aid criminals in keeping their secrets from law enforcement, Blackberry heatedly claimed its devices were secure as ever -- even in the hands of criminals.

[T]here are no backdoors in any BlackBerry devices, and BlackBerry does not store and therefore cannot share BlackBerry device passwords with law enforcement or anyone else.

Ah, but there is a backdoor. A big one. And it's on the opposite side of the "house." Motherboard is reporting that the Royal Canadian Mounted Police are able to access unencrypted communications thanks to the Blackberry's built-in "feature."

Imagine for a moment that everybody's front door has the same key. Now imagine that the police have a copy of that key, and can saunter into your living room to poke around your belongings while you're out, and without your knowledge.

By way of metaphor, this is exactly how the Royal Canadian Mounted Police, Canada's federal police force, intercepted and decrypted "over one million" BlackBerry messages during an investigation into a mafia slaying, called “Project Clemenza," that ran between 2010 and 2012.

Citizen Lab privacy expert Christopher Parsons backs up Motherboard's analogy. [emphasis in the original]

In addition to routing and compressing data traffic, RIM's service offerings also include a measure of security in excess of the practices adopted by their competitors. BBM, as an example, is encrypted. However, it is encrypted using a global key. RIM has written that,

"The BlackBerry device scrambles PIN messages using the PIN encryption key. By default, each BlackBerry device uses a global PIN encryption key, which allows the BlackBerry device to decrypt every PIN message that the BlackBerry device receives."

This means that RIM can decrypt consumers' messages that are encrypted with the global key. Consumer devices include all RIM offerings that are not integrated with a BlackBerry Enterprise Server (BES). The BES lets administrators change the encryption key, which prevents RIM from using the global decryption key to get at the plaintext of BES-secured communication.

Blackberry may be technically correct when it asserts it has no access to user passwords. But that hardly matters when it holds the key that can decrypt any BBM communications that pass through its service (with the exception of administrator-level business accounts). This single key's access to unencrypted communications is likely what allowed (and possibly still allows) the RCMP to obtain plaintext messages.

According to the documents obtained by Motherboard, the RCMP appears to be using some sort of Stingray-but-for-BBM technology to intercept and decrypt messages.

[The RCMP maintains a server in Ottawa that "simulates a mobile device that receives a message intended for [the rightful recipient]." In an affidavit, RCMP sergeant Patrick Boismenu states that the server "performs the decryption of the message using the appropriate decryption key." The RCMP calls this the "BlackBerry interception and processing system."

By inserting itself into the middle of communications, the RCMP can intercept the messages. Access to the Golden Key ensures they can be read. The conclusion reached by both the defense team and the judge presiding over the case? The RCMP has Blackberry's global encryption key.

The defence in the case surmised that the RCMP must have used the "correct global encryption key," since any attempt to apply a key other than BlackBerry's own global encryption key would have resulted in a garbled mess. According to the judge, "all parties"—including the Crown—agree that "the RCMP would have had the correct global key when it decrypted messages during its investigation."

Unfortunately, there aren't many more details. Many of the documents related to this case remain under seal and the RCMP certainly isn't going to discuss its interception/decryption secrets if it doesn't have to. It could very well be that it demanded (and obtained) the key from Blackberry, much in the way the FBI demanded Lavabit's SSL key. If so, Blackberry was far more cooperative than Lavabit, which chose to shut down the service rather than allow the government to have total access. (And it has been hinted by the DOJ that this sort of request may be headed Apple's way if it continues to fight its All Writs orders.)

Somewhat ironically, the RCMP acknowledged in court that outing a cellphone provider as Junior G-Men would probably tarnish Blackberry's reputation -- basically the same thing Blackberry CEO John Chen claimed was the height of Apple impudence

RCMP inspector Mark Flynn testified in a heavily redacted transcript that BlackBerry "facilitated the interception process," however, Flynn also stated that facilitation could mean mere information sharing or a physical action to aid interception.

Flynn further testified that revealing the key would jeopardize the RCMP's working relationship with BlackBerry, and harm BlackBerry itself, since "it is not a good marketing thing to say we work with the police."

The question now is whether the RCMP still has this level of access. To cut off the RCMP, Blackberry would have needed to alter the global decryption key -- something that would have required "a massive update... on [a] per-handset basis," according to Citizen Lab's Christopher Parsons. And if Canada's law enforcement has it (or had it), odds are law enforcement agencies in other countries had similar access. Investigators may not be keen to expose techniques in court or in released documents, but they're usually pretty good about sharing this info with like-minded law enforcement agencies.

Filed Under: blackberry, canada, encryption, interception, law enforcement, master key, rcmp
Companies: blackberry

Former NSA Lawyer Says Reason Blackberry Failed Was 'Too Much Encryption' Warns Google/Apple Not To Make Same Mistake

from the give-it-a-rest,-stew dept

There are times that I wonder if former NSA General Counsel Stewart Baker is just trolling with his various comments, because they're so frequently out of touch with reality, even though he's clearly an intelligent guy. His latest is to join in with the misguided attacks on Apple and Google making mobile encryption the default on iOS and Android devices, with an especially bizarre argument: protecting the privacy of your users is bad for business. Oh really? Specifically, Baker engages in some hysterically wrong historical revisionism concerning the rise and fall of RIM/Blackberry:

Baker said encrypting user data had been a bad business model for Blackberry, which has had to dramatically downsize its business and refocus on business customers. “Blackberry pioneered the same business model that Google and Apple are doing now - that has not ended well for Blackberry,” said Baker.

He claimed that by encrypting user data Blackberry had limited its business in countries that demand oversight of communication data, such as India and the UAE and got a bad reception in China and Russia. “They restricted their own ability to sell. We have a tendency to think that once the cyberwar is won in the US that that is the end of it - but that is the easiest war to swim.”

While it's true that some countries, like India, demanded the right to spy on Blackberry devices, the idea that this was the reason for the company's downfall is ludicrous. First of all, RIM gave in to some of those demands anyway. But, more importantly, the reason that Blackberry failed was because the company just couldn't keep up from an innovation standpoint -- and that's because early on it made the decision to focus onenforcing patents, rather than truly innovating. RIM got fat and lazy by getting an early lead and then focusing on protecting it, rather than keeping up with the market. And... one of the reasons it got that early lead was because companies were willing to buy into the Blackberry in part because of its strong encryption.

The idea that encryption was bad for business because China and Russia couldn't spy on people is not only ridiculous and silly, but it appears to be Baker supporting authoritarian states spying on its citizenry. What the hell, Stewart?

Beyond that, Baker insists that, really, the public doesn't want encryption anyway, and if people only knew what was really going on with the "bad guys," we'd all be willing to give up our privacy:

Baker said the market for absolute encryption was very small, and that few companies wanted all their employees’ data to be completely protected. “There’s a very comfortable techno-libertarian culture where you think you’re doing the right thing,” said Baker.

“But I’ve worked with these companies and as soon as they get a law enforcement request no matter how liberal or enlightened they think they are, sooner to later they find some crime that is so loathsome they will do anything to find that person and identify them so they can be punished.

Right. And that's what basic police and detective work is for. It doesn't mean that you need to weaken the security and privacy of everyone else. Anyway, let's see if Baker goes out and shorts Apple and Google's stock now that he believes encryption and protecting the privacy of their users is really so bad for business.

Filed Under: blackberry, china, cryptowars, encryption, india, nsa, russia, stewart baker, surveillance
Companies: apple, blackberry, google, rim

Ryan Seacrest's Typo Blows Off Injunction, Sells Thousands Of Possibly-Infringing Keyboards

from the lots-of-ways-to-be-wrong-and-Typo-found-most-of-them dept

Ryan Seacrest's Typo (because it is never to be referred to simply as "Typo" in headlines or opening paragraphs), maker of physical keyboard accessories for iPhones, was sued by RIM (maker of formerly-popular Blackberry phones) for patent infringement earlier this year. The ailing phone manufacturer took issue with the keyboards made by Ryan Seacrest's Typo, which it felt veered a bit too close to "looking damn near like a Blackberry keyboard."

The fact that most keyboards look like other keyboards notwithstanding (although the Ryan Seacrest's Typo keyboard did seem to cop a lot of the "look," if not the "feel" of Blackberry's vertically-aligned and contoured keys), the judge found RIM's claims substantial enough to grant a preliminary injunction barring the sale of keyboards. Ryan Seacrest's Typo apparently thought an injunction was nothing more than a fancy way of saying, "do whatever the hell you want to." (Court order PDF)

On Thursday, U.S. District Judge William Orrick agreed to let BlackBerry proceed with contempt of court proceedings after the Canadian phone maker showed that Typo has been selling keyboards in violation of the earlier order.

“I am very concerned with what appears to be deliberate contempt of the preliminary injunction by Typo,” wrote Orrick, pointing out that the company shipped around 15,000 keyboards despite the ban.

The court order touches on a lot of seeming wrongdoing by Seacrest's Typo, including multiple shipments being sent to Canada, the Middle East and Asia (Typo claimed these foreign sales weren't bound by the injunction) and a large sale to a reseller (4,000 keyboards to SMI Investments -- a company that Typo seems to be intertwined with) that occurred after the injunction was ordered but before it went into effect.

Seacrest's keyboard company also went out of turn by asking the court to find that its modified keyboard does not infringe on RIM's patents.

According to [Judge] Orrick, the existence of a “supposedly non-infringing design” was not relevant to the existing injunction. The judge added that Typo would have to bring a separate court proceeding to get an order related to the new designs.

Whether or not you agree that RIM's patent infringement case has merit, Typo seems to have completely botched its response. Sure, all the cool kids and their acts of civil disobedience have netted them contempt charges over the years, but blowing off a preliminary injunction in this sort of case is hardly sticking it to The Man.

As for RIM, this lawsuit may be going its way, but it doesn't really change the fact that a competitor saw a market niche and filled it. People still like physical keyboards, but they don't seem to care much for Blackberries. If RIM wasn't so stuck on the "you only get the keyboard if you buy the phone" strategy, it might have been able to capture this market before anyone else got to it, rather than just play spoiler by suing anyone veering too close to its look-and-feel.

Filed Under: blackberry, keyboards, patents, ryan seacrest
Companies: blackberry, rim, typo

Desperate RIM Gives In And Lets Indian Gov't Spy On Blackberry Communications

from the impossible-doesn't-mean-what-it-used-to dept

Back in 2008, we wrote about how the Indian government was demanding that RIM let it snoop on encrypted messages from Blackberry users. RIM's response was that it was simply impossible to snoop on its enterprise customers' messages, since they set their own encryption keys. A few months later, the government claimed to have cracked RIM's encryption, though the whole claim was sketchy. In 2010, the government again demanded the right to spy on Blackberry users (raising more questions about that encryption cracking claim). RIM apparently offered up a "solution" that the Indian government rejected, because it didn't let them snoop enough (basically it allowed snooping on consumers, but not corporate accounts).

Now, however, there are reports that RIM has come up with a "solution" to let the Indian government spy on enterprise users as well:

RIM recently demonstrated a solution developed by a firm called Verint that can intercept messages and emails exchanged between BlackBerry handsets, and make these encrypted communications available in a readable format to Indian security agencies, according to an exchange of communications between the Canadian company and the Indian government.

If you're a RIM Blackberry customer, and you bought into it because of the security features, now would be the point where you get pretty pissed off and start seeking alternatives. The report from the Economic Times suggests RIM did this because of the "importance" of the Indian market. RIM is clearly in trouble. Its failure to keep up on the innovation front means that the company is clearly struggling. But kowtowing to a government by allowing it to spy on users is hardly the sort of thing that's likely to get you more customers. It seems like it should do exactly the opposite.

Filed Under: blackberry, encryption, india, snooping
Companies: rim

ITC Rejects Key Kodak Patent As Invalid

from the bye-bye dept

A couple years ago, a massively struggling Kodak decided that perhaps it could cash in by suing more innovative companies for patent infringement. It filed suits against Apple and RIM for patent infringement both in the courts and using the ITC loophole. It appears that going to the ITC may have been a mistake on Kodak's part, as the administrative law judge there has said that the patent is invalid, so it doesn't even matter that some iPhones and Blackberries technically infringe. Of course, this has to hurt even more, considering that Kodak's trying to sell off its patents. If one of the key ones is found to be invalid, that can't be helpful in selling the bundle...

Filed Under: blackberry, iphone, itc loophole
Companies: apple, kodak, rim