I’ve resisted too much comment about this, feeling that my specialty is really mobile development, rather than IT infrastructure and BlackBerry security, but the latest ’suggestion’ from the government of India has pushed the whole BlackBerry security story from a sort of badly-managed PR problem for RIM into an absurd Orwellian/Gibsonian alternate reality.
The problem that UAE and Saudi Arabia (and now India) have had with BlackBerry email is that it’s too secure. Understandable, these are strong centralist regimes who like to regulate many aspects of their citizens’ lives. Now somewhere the press started reporting that the US Government actually has access to encrypted BlackBerry email, and other governments - such as India - started to say: “Hey, we want that too!”
There are at least 3 problems with this story:
Problem 1:
The US Government does not have the ability to spy on encrypted BlackBerry email.
First, look at this BlackBerry architecture diagram. BlackBerry is a very secure system, when used with a BlackBerry Enterprise Server (BES). The entire content of every packet exchanged between a BlackBerry device and its BES is encrypted with a symmetric key (usually AES, sometimes Triple DES) that’s only known to the device and the BES. Each device has a separate key. Keys can be created and exchanged entirely within the corporate firewall, without ever being sent over the public internet (there’s also an exchange mechanism using PKI - a method that’s widely used and secure even outside of BlackBerry) . Both AES and TDES are secure enough that the NIST has approved them for use by the US government in sending classified information. There are no known substantive attacks to AES. There are no known backdoors. Maybe the NSA or someone has discovered a way to crack AES, but that would mean the end of pretty much all digital security everywhere, and anyway if I had actual proof of that I probably wouldn’t be in a position to write this article.
Problem 2:
National Governments can already look at the encrypted packets sent and received from BlackBerry devices in their countries
Let me emphasize this first - I don’t mean that governments can see the content of packets: as I stated above, the content is encrypted, what I mean is that there’s a tiny bit of non-encrypted information that you can get even from an encrypted packet - information about where the packet came from and where it’s going. Check out that security diagram from RIM again. Notice that while AES/TDES encryption applies to the whole path, there’s still a point where those (fully encrypted) packets flow from the wireless service provider’s infrastructure over the internet to the corporate BES. Actually there’s an additional hop through RIM’s infrastructure, but the point is: at some point those packets are flowing on internet infrastructure within your national borders!. You can look at them, do whatever you want with them (we know China has pretty much their entire vast country behind a firewall). It doesn’t matter that they have to go outside the country to get through RIM’s servers, they’re encrypted. RIM can’t read them anymore than anyone else can. In fact arguing that sending them through RIM’s servers is a security risk would be to argue the exact opposite of the ‘too secure’ problem (up is down, black is white?).
Problem 3:
Asking RIM to give access to unencrypted email sitting on the BES is insane
So after discovering problem 1, Indian authorities decided that a reasonable solution would be to get access to BlackBerry email before it’s encrypted (or after it’s decrypted).
Yes it is true that email before being sent (and after being received) sits unencrypted in part of the BES. However, it is also true that that same email at some point sits unencrypted on the corporate Exchange or Lotus Domino server. Also that it sits unencrypted on millions of mail clients on desktops. It’s also true that the unencrypted email in the BES is only a subset of all that other unencrypted email. It seems that the Indian government’s spat with RIM is really a proxy battle to get access to all corporate email. RIM looks like the weak link. Well, call it what it is, you’re asking a technology vendor to smash a hole in the corporate firewall and give access to internal information. Essentially to turn the BES into a giant piece of spyware. Whatever faults RIM has, it would be insane to comply with something like that.
Now think about it from another point of view. Given that access to BES email is essentially the same as access to all corporate email, another way of phrasing the request is that India, a liberal, largely prosperous, largely capitalist, democracy wants to spy on its (corporate) citizens. I think that’s a much bigger and much more important story than BlackBerry vs the government of India.






