Spying on BlackBerries
July 23rd, 2009 | by elisabeth | Published in Future of the Internet | 2 Comments
Prof. Zittrain has spent this week writing about the dangers of moving computing into the cloud. Another aspect of the same story is the danger of keeping computing on endpoints — PCs, smartphones — if those endpoints become tethered instead of generative. This story illustrates the potential problems. Etisalat, a telecom provider that serves much of the United Arab Emirates, recently sent its BlackBerry-using customers a software patch that it said was related to the transition “between 2G and 3G networks.” When the patch started sucking up the devices’ battery life, users protested. It turned out the patch had no useful functions, wasn’t approved by RIM, and would allow Etisalat — or someone working with Etisalat — to spy on users’ communications. RIM and Etisalat are currently finger-pointing about whose fault this is, and bloggers are speculating over whether Etisalat was operating on the government’s orders.
Chapter 5 of the book predicts situations just like this. Because of security concerns, we gravitate towards “information appliances like … TiVos, iPods, iPhones, and BlackBerries” that can be automatically updated and patched by the vendor or carrier. Meanwhile, also in the name of security, the vendors take away users’ ability to tinker with the devices. The threat of malicious hacker code is sometimes (not always) handled better under these strict regimes — but what about malicious code installed by the manufacturers, or the governments of the world?
Ironically, BlackBerries are considered relatively safe from government surveillance because all BlackBerry emails go through RIM’s servers, encrypted. So they’re harder for an authoritarian government to crack than PCs. What this episode shows, though, is that BlackBerries–like any other tethered device–are still very vulnerable to a few powerful players, like carriers or vendors. And, although the devices are vulnerable to fewer people with bad intentions, fewer people of goodwill can help spot and fix the problems. It’s notable that users only figured this patch was problematic out because the Trojan horse wasn’t well-written; it might have stayed forever if the phones hadn’t started crashing. Moreover, once the Trojan horse was there, it doesn’t look like users could fix the problem on their own. Instead, RIM had to issue a detailed solution. If the vendor and the carrier were both under injunction from the government, users would have no obvious recourse. (This isn’t pure paranoia; even the US government has used tethered devices for surveillance. Check out the story of EchoStar in Chapter 5.)
Putting just a few people in control of our data and computing seems safer, and sometimes it is. But when something goes wrong, we have to hope those people are inclined to help, and are able to do so. And that’s not always the case.
—By Elisabeth Oppenheimer
July 24th, 2009 at 8:01 am (#)
Isn’t RIM the company that shares a building with British secret services? — Anyway. . .
I don’t think the ability to patch is the problem: most of those are useful, dull and pretty technical to understand. If any user savvy enough can check on what is being done, and alert the public opinion when he sees a problem, then we can presume those patches will only be of the useful kind.
August 18th, 2009 at 8:17 pm (#)
[...] The Future of the Internet By Google’s account, Chrome will serve a single essential purpose: to get your computer up fef and running with a Web browser —confusingly also called Chrome—seconds after you’ve turned it on. Now you’ll be greeted each day by Google instead of … Netscape got the idea of bundling software called Java with its browser, which made it powerful enough to take on word processing, spreadsheets, and many other things. [...]