Ex-NSA lawyer warns Google, Apple: IMPENETRABLE RIM ruined BlackBerry An ex-NSA lawyer believes BlackBerry's ongoing downfall stems from the company's use of strong encryption – and Apple and Google are next to wither on the vine. Nope, it makes no sense to us, either. Speaking at the Dublin Web Summit this week, Stewart Baker, a former NSA lawyer and assistant secretary for the Department of …
Either this guy has been smoking something his former employers would have strong policies against, or he is barking mad. Who wants to be spied upon, given the bad guys (for any preferred definition of "bad"), gain the same capability?
On the other hand, maybe he is sane and just revealed the existence of a behind-the-scenes campaign by the US gov to discredit RIM to a number of big businesses?
On the third hand, for those of you with special capabilities, maybe he is talking up the 'problem' knowing full well they already have to broken enough for business as usual?
> On the other hand, maybe he is sane and just revealed the existence of a behind-the-scenes campaign by the US gov to discredit RIM to a number of big businesses?
This is certainly what came to mind when I read the guy's comments.
He seems to be implying that governments instrumented their downfall as a result of their unwillingness to tow the line. I can't think of anything else that he could possibly mean unless he seriously believes that secure comms and devices are unpopular with customers. (?)
There were definite product problems, but it did seem too as though the US carriers became very RIM-averse, and even without tinfoil one could believe that they were leaned on by the US gov.
However, the NSA guy seems not to have noticed that the market is a lot bigger now than just the US.
...is the phrase you wanted there, as in a line painted on a floor or scratched in the dirt, behind which troops are supposed to assemble themselves with a proper air of humility and obedience.
No rope or pulling involved.
Didn't this place used to have a Python-esque foot icon, or was that Slashdot?
<Sigh> Why is it some people are always going with the tinfoil first? Blackberry's business was strong in commercial, weak in the consumer market. They took their eye off the ball in the commercial market chasing after the consumer one (especially with the silly tablet effort). That started their problems, but what killed them was the problems in the commercial sector not with encryption but the refusal to open up the Blackberry backend servers to governments other than the U.S. and Europeans.
Certain countries wanted the same access to the centralized Blackberry Internet Service (BIS) and backend Enterprise Service (BES) servers that the U.S. And Europe had (there are centralized Blackberry servers that control and provide services to individual BES and BIS systems). This was reported on here at El Reg - http://www.theregister.co.uk/2011/08/08/indian_blackberry_crackdown/ - and stymied Blackberry's attempts to grow into the booming Indian, Middle Eastern, Eurasian and Asian markets and outside of the saturated US and European markets. In short, Blackberry were penalized in their crucial commercial market by their dedication to security and customer privacy, not encryption.
Hopefully he's just been smoking something, it'd be silly to try and sink the company which at the time made the only phone that they trusted enough themselves to get work done on and also offered the best protection for US businesses.
But, after everything else that's been leaked, who knows?
Makes you wonder if gov't operatives are canvassing major vc's and shareholders to seed the idea that their investment will wither if they don't demand unencrypted data pipelines from their vested interests..
Certainly somewhere near the start of the CIA/NSA standard playbook, I'm sure. (And why do many US programs depict the CIA operating VERY domestically all the time?)
Fortunately we know Apple's attitude to shareholders: If you don't like what we are doing, sell your shares and buy something else. For example, that was what they told people when a small group of shareholders complained of the "wasted" money spent on going greener instead of using cheaper coal energy (cough cough) to run their data centres. That's what I think they will tell anyone who wants to get rid of security.
Fortunately we know Apple's attitude to shareholders: If you don't like what we are doing, sell your shares and buy something else.
I can't tell you how much that improved Apple's standing in my eyes. Really...I don't know why more companies tell troublesome shareholders to bugger off if they don't like how the company's being run. If the company's profitable, the share price will take care of itself, and if the greedy fat-asses don't like that, well...I don't remember seeing a law that says you have to by Company X's stock.
Makes you wonder if gov't operatives are canvassing major vc's and shareholders to seed the idea that their investment will wither if they don't demand unencrypted data pipelines from their vested interests..
Shirley, said vc's and shareholders aren't that brain-dead stupid, are they?
Oh, wait....
It's a sign of desperation.
Weakening crypto will basically have the same effect as the police recommending you install easy to pick locks in your backdoor so they can check any time that you're not committing any crimes.
There are two main problems with that approach:
1 - it makes it easier for the bad guys (and certainly for their current favourite, the terrible terrorist) to defraud people. Or, let me translate that in Daily Mail speak: we would be HELPING the terrorists to finance what they do because we'd make regular crime so much easier.
2 - the mainstay approach for these people to hide is to steal identities. Now, what gets easier when you make it easy to hack stuff? Err, well, umm,.. Yes, exactly.
Especially in the US it appears all sanity has gone out of the window. What I find particularly galling is that US companies are attempting to solve the problem that they cannot protect privacy to EU levels (which costs them a LOT in sales already) by weakening EU laws to the same broken level - that's in reality what Safe Harbor does.
So, enough already. Stop the bad PSYOPS because it's no longer working. I guess it would have if you had not so grandly abused it, but now you're facing at least a decade of trying to rebuild some trust. I'd be surprised if you manage this in 10 years, actually.
One more thing: if you stopped focusing on approaches that are wrong, you could maybe develop the mental bandwidth to come up with new ideas that do NOT involve ignoring people's right to privacy.
In my humble opinion it was MS that hastened Blackberry's corporate departure due to Blackberry's inability to provide a competitor to Apple iOS/Android in a timely manner (see Playbook - RIM provides a "corporate" tablet with no e-mail integration demonstrating their knowledge of their corporate customers).
If MS hadn't released the full ActiveSync client specs, Apple/Android would have struggled to integrate with large companies Exchange infrastructure. My suspicion was MS did it to try and avoid Google being the de facto e-mail standard for mobiles, but that is speculation.
Crypto ruined RIM? No, crypto gave RIM their 15 minutes of fame - being unwilling or unable to adapt to changes in the mobile marketplace killed them.
P.s. the corpse may still be walking around but RIM is dead without all those new licence fees keeping them in the black.
This post has been deleted by its author
Ladies and gentlemen of this supposed jury, why would an 8-foot-tall Wookiee want to live on Endor, with a bunch of 2-foot-tall Ewoks? That does not make sense!
But more important, you have to ask yourself: What does this have to do with this case? Nothing. Ladies and gentlemen, it has nothing to do with this case! It does not make sense!
Look at me. I'm an NSA lawyer attacking a Canadian tech company, and I'm talkin' about Chewbacca! Does that make sense?
Ladies and gentlemen, I am not making any sense! None of this makes sense! And so you have to remember, when you're in that jury room deliberatin' and conjugatin' the Emancipation Proclamation, does it make sense? No! Ladies and gentlemen of this supposed jury, it does not make sense! If Chewbacca lives on Endor, you must acquit!
"Is Big Business bigger than the Government?"
Well, Google never seemed to mind abusing their monopoly.
... and don't forget - a company's board of directors is not elected by the general public!
If you think the general public has any say in the purchase of the majority of shares, I have the usual stash of gold bricks for sale to you at an unbelievably low price. Most shares are traded and held by large institutions whose directors themselves have close links to Government.
"The public" in the US buys phones like this: they go into a store and a sales clerk tries to sell them the contract that he gets the most commission on. So when, say, the BB Z10 is at the back of the shop, powered down, the sales person has not been trained on it and gets no commission, and the front of the shop has an iPhone display and a Samsung display, what does the general public buy?
I don't know the extent to which WP has had the same treatment, but I suspect that in their case it is more likely that the carriers deeply fear Microsoft rather than the NSA.
No, I'm sorry william.
This is where the NSA "necessity of the surveillance society" argument skips merrily down the road to Heck. There is no evil twin Board of Directors who do not want you to buy the company's stock or products.
That said, I am surprised Apple, Google don't have both Dr. Jekyll and Mr. Hyde on the Board. His services must be in great demand in Silicon Valley.
I used to stand in for an IT director for many years in an SME. Crypto and security is the sole reason why we tolerated BES and RIM (we hated it with passion).
Now the fact that quite a few governments tried to push BES and RIM out of business is a different matter. One should not mistake customers and adversaries.
Absolutely this. They only lasted as long as they did because of security. Many IT departments advised of the risks of moving to BYOD policies, and needing to license a new product for mobile device management is NOT something you want to do... Until you realize that the C-Level execs are all toting iPhones and Androids around and they'll have your head if you don't "make it work!"
Sad, as BB is the only one that is actually secure by default.
WAS secure by default. The rot set in when certain nations asked publicly for the keys, which AFAIK revealed something that was already known at government level: if you want to secure it, you need to own the keys. Government approved BB devices always relied on separate keys to what the public got their hands on, but that wasn't really publicly known until some nations decided to go public with their demands.
The second ab-so-lu-te-ly stupid thing RIM did was to make it possible to load up Android apps. Even if they run in a separate segment, it still amounts to inviting burglars for tea.
They dropped the ball there, which is IMHO a shame because the QNX based OS they came up with is otherwise a heck of a lot better than what they had before.
This post has been deleted by its author
Do these guys think the public is that dumb to believe a line like that?
I mean seriously; the growth of the Blackberry was almost entirely based on them taking phone security seriously; enterprises and government agencies that were squeamish about using any handheld device for communications went for Blackberrys. This security didn't contribute to their decline either, I think they simply didn't expect Android and IPhone to drink their milkshake to the extent they did. I would say their security is largely what is keeping their market share at the level it is at. Of course, RIM's not bankrupt yet, it's always possible they could make at least some rebound.
The public was dumb enough to let them turn the Mujahadeen into the Taliban and Al Qaeda, dumb enough to let them invade Iraq once and not finish the job and then to make good/bad on that, let them invent WMDs to invade again and fuck up a country.
Invade Libya and fuck up a country with the highest literacy, one of the best life expectancys,and a working health service, etc etc . So yes they think the world is dumb enough.
Not just the USians all of us!
we could help the NSA & GCHQ grow their roses - and smell sweeter?
I don't know whether http://www.shitexpress.com/ is the right place for gifts, I mean that's getting on for half a million parcels..
RIM ran their 'secure servers' in such places as Bracknell/Reading & Canada (deep 5*eyes) and caused outrage with users when they went offline, unsuccessful 'tap' patches? There was a succession of (mildly repressive) governments (deep 5*eyes friends) who started demanding local servers, India, UAE, France, etc if I recall correctly. I'm sure that RIM delivered local access. VERIFIED
NEW DELHI, Aug 3 2010 (Reuters) - Research in Motion RIM has agreed to allow Indian security agencies to monitor its BlackBerry services, The Economic Times newspaper reported on Tuesday, after pressure from governments worried about national security. RIM has offered to share with Indian security agencies its technical codes for corporate email services, open up access to all consumer emails within 15 days and also develop tools in six to eight months to allow monitoring of chats, the paper said, citing internal government documents.
I suspect RIM now have problems because BBM was 'fashionable' with the teens for ten minutes, (same as popular beat combo OneDirection in 2014, but in 5 years time 1D will be...) if RIM built all their markets on fashion + secure crypto, then handed out the keys to all & sundry, not just NSA, then how could that possibly fail as a business model?
Frankly, I have recently been wondering just why the ecosystem is such a powerful idea.
Most apps are a pile of smelly steaming unmentionable from the unfashionable end of the average dog.
The Apple and Google app stores are essentially slush piles, if you allow me to borrow a phrase from the book publishing industry. Yes, there are a few rare gems inside, but most of it is slush of the worst order.
Still, for some people there is money in muck.
I always heard blackberry could not be trusted because its servers were located in foreign countries were data could be decrypted by, among others, the NSA.
A French article: http://pro.01net.com/editorial/520963/peut-on-faire-confiance-au-blackberry/
"they fear the data could be decrypted by intelligence services affiliated to the Echelon network. In France, Blackberries are forbidden in ministries since 2007."
The main problem with blackberry, is that you don't know if you can trust them, and the suspicion is high enough to not to (trust them).
I gave the article a quick read and from what I undertood the problem that worries them most is that the data is encrypted/decrypted, ie controlled, by a third party, in this case RIM. The servers/switches/routers are located in other countres and they are unsure about what actually happens behind the scenes.
The fact that they, the French companies, do not have control of the entire End to End process puts doubts into their heads about the security, which is completely understandable.
They have not actually demonstrated any problems or possible hacks, they simply do not have 100% faith and therefore prefer not to use BBs. As mentioned in the article they have their own methods of which they control one end to the other.
The same is true of any security process which uses a third party. If you do not control the entire process you can never garauntee the security.
"I always heard blackberry could not be trusted because its servers were located in foreign countries"
Where your local government could not get at them. That was India's problem when the servers were in Canada and they could not get at peoples data so they forced BB to put servers in India so they could.
But if you are a company with your own server, then no one can get in without showing up at the door with a warrant. Blackberry could not give them back door access, and NSA types hated it.
Bullshit, most of the big contracts BlackBerry got were *because* of the encryption, not in spite of it. Hell, even the US government authorised it for high security individuals. The only way this could damage their reputation is if he's suggesting the NSA was actively trying to damage a US company to prevent that feature succeeding
This person is not a nutter exactly, but rather an individual who has been institutionalised by government bureaucracy. Government bureaucracies the world over encourage an internal group think that makes outsiders wonder whether to laugh or cry. There is an urban legend that the American IRS were once working on the problem of how to tax home owners who paint their own houses with the help of their friends. The logic being that the home owner was benefiting from free labour and hence a taxable benefit should be levied against the home owner.
Government bureaucracies have a tendency to stop thinking themselves as servants of the people but rather a new class of feudal lord or landed gentry where the people are beholden to them, with the people there to service them.
So while this person is not a nutter, he is an idiot still suffering from NSA group-think after being institutionalised from the real world for too long.
It seems that this former NSA lawyer falls into a common trap: Believing what you want to be true. Obviously encrypted phones are not good for the NSA. They want phones to be not encrypted, which is entirely reasonable if you are the NSA.
And somehow their mind twists that entirely reasonable wish into something that is entirely unreasonable: That encryption is bad for the companies making phones, and (not mentioned here) that it is bad for the people using those phones. I think the guy isn't even lying, except to himself.
This trait is more commonly seen amongst marketing people. They have some reasonable ideas what they would like people to want (usually the product they sell and its features), and somehow they believe that people will therefore want the product and features, just because it is what the marketing person wants.
He is obviously just coming out with controversial nonsense to get a little coverage. Just like all his former colleagues and bosses, he knows perfectly well what the truth is, in regards to this and their other pronouncements. They know we know what the truth is. Its all just a thin veneer of bullshit that keeps the pork rolling in, just like here in the UK with "security" services.
to me this is just in line with the other recent pronouncements from security heidjins.
They want the bad guys to think that the encryption techniques used by these companies is so impenetrable that aforesaid security organisations can no long snoop on them.
Does anyone here believe GCHQ and NSA are unable to crack Apple or Google security?
What it _does_ do is obscure any encrypted communication in amongst our own inane, innocent communications. It was easy before to find the interesting stuff by ignoring the mass of unencrypted messages.
Whatever happened to good old fashioned detective work and obtaining REAL search warrants? Furthermore, who's to say that a government won't abuse the backdoor, once they've been given access? <seething sarcasm> I mean we can all trust them, cant we? </seething sarcasm>
Meanwhile at the NSA:
"OK guys, 'Think of the terrorists & children' is no longer working, what now?"
Or
Spook-A: "Everyone's avoiding US companies, how can we convince them we're not using them to spy on everyone?"
Spook-B: "Make a big show that they're no longer co-operating?"
Spook-B: "Also, if we pretend we're a bunch of incompetent idiots everyone will believe we're incapable of gaining access again!"
Spook-A: "Nice. That should fix it!"
Well, first of all to that despicable little NSA shit - go boil your head.
These people have lost touch with reality. I wouldn't normally be concerned, except that they are doing it on our tax dollars to the tune of billions, and are seemingly immune from being axed as an institution. Where are the politicians with the balls to toss the NSA on the garbage heap? We did fine without them before. NASA or the health care system could use that money.
The thesis of this idiot appears to be that if there's data that they cannot snoop, then it's a terrorist network. That way lies a 1984 society. It is a price most of us are unwilling to pay.
"Where are the politicians with the balls to toss the NSA on the garbage heap? "
Given the likelihood that the NSA is listening to every call, cataloguing their web browsing history, and reading every email ever sent by any US politician? On the NSA's blackmail list, I should think. If they have dirty little secrets (and what pol doesn't?) it's difficult to destroy an organisation that can end their career in a heartbeat.
All you French, German, Aussie, Brit folks who don't like BB and its ilk...
Kindly develop your own open source secure reviewable O/S to run on a phone and release to the public.
All you French, German, Aussie, Brit government snoopers who don't like secure phones; ODFO.
The Fourth Amendment To The US Constitution
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
Traitorous surveillance zealots are now a dime a dozen. Cheap fools.
"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety." - Benjamin Franklin, Historical Review of Pennsylvania, 1759
So is the CIA... Q= what does the IG do ?? it seems to be everywhere... budget ?? (black).
Skunk Works... Aera 51...Hughes Tool n Die...DARPA.
The list goes on if anyone cares, seems us Americans like Black Ops when they do stuff (SR-71, yea !!), no one ever complained about the USD $30B black agencies of the 1960's that are now USD $50B black agencies of the new millenium (possibly good value for the money)... BTW= the black agencies HAVE oversight, unfortunately the US Congress is not privy to it (IG's report only to the POTUS) and no one can do anything about that without rewriting how US gov is structured.
(end of USA)...
IMHO= when the Boeing Space Plane takes us to whatever will be up there in a cloud of plasma to allow the external combustion engine enable the electrostatic steering control systems we just smile and think= Black built that, yea !! When the POTUS gets tired of the NSA, he can pull the fuses any time, until then= rocky ride ?? depends on what side you are on.
caveiat= this has been discussed several times b/4 the whistle blower NSA contractor started copying everything he could get his hands on... got severely downvoted then, still believe i'm right, gotta post this for the good of everything here on this little blue ball...RS.
. . . and will continue to work as long as enough of the general population buy into the premise that perception is reality.
The perception that handing those who govern the keys to intrude our private lives at will and without accountability enhances anyone's security is utter nonsense.
Recent successes of hackers (i'm in my second reissued credit card in the last few months) point up that institutions and private individuals need the best practical security measures. That includes the right to employ strong encryption.
The last two paragraphs* of this story understate the matter. BlackBerry's security policies are not simply a less important factor contributing to BlackBerry's downfall. They did not contribute to BlackBerry's downfall at all. They were a positive factor greatly enhancing BlackBerry's appeal, and BlackBerry faltered despite them, not because of them.
.
* It is no secret that BlackBerry has in the past run afoul of some state governments for BES' security, but most would say that secrecy was pretty far down on the list of reasons why BlackBerry is in the toilet.
[In fact the security that BlackBerrys provide their owners was not on that list at all.]
We'd humbly suggest to Baker that a number of other cock-ups – including falling behind Apple and Android in smartphones, flopping with a tablet rollout and having a disastrous comeback effort – had much more to do with BlackBerry's downfall than its security policies.
[The security that BlackBerrys provide their owners did not merely have less to do with BlackBerry's downfall than all the various cock-ups; it had nothing to do with that downfall.]
Actually, there is some truth to the claim, incredible though it may sound.
The BlackBerry phones owed part of their security to communicating with BlackBerry's own servers. And the downfall of the company started when corporate users perceived BlackBerry phones as unreliable when it was victimized by a major DDoS attack.
The problem with their comeback was that individual cell phone users want a major apps platform like Android or the iPhone for their money - and, again, their maverick software is an element in their enhanced security.
So, while the encryption itself was a plus, not a minus, features of their phones that made it possible did contribute to their problems. Note, of course, that Apple and Google have no such problems, though, however much they upgrade their security.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
