——

DanM: CALEA? Yes, that’s exactly what I meant by administrators handing over the keys. Otherwise, without the server administrators’ cooperation, the regular security imparted by the encryption makes “tapping” or sniffing difficult to the point of being a practical impossibility. But anyway, the point is that it would take more than access to the network the mail server is on; you’d have to have access to the server itself. Which, reading what I can find on CALEA, is something that act allows for, but I’m not sure what the mechanism is to actually invoke that.

Anyway, that’s also why I mentioned PGP. If a message is encrypted by the Blackberry end user, it doesn’t matter to what degree the admins are in bed with the intelligence agents; cracking it is so difficult it becomes a practical impossibility, so an agent given complete administrative access to the message on the server is still screwed. That’s also why I’m amazed at the story; a simple, relatively inexpensive program solves the security problem, if en-route interception or coerced adminmistrator access is the worry.

The real security worry is the user’s Blackberry getting stolen. Forget encryption, packet sniffing, blah blah blah… if I really wanted someone’s email on their Blackberry, I’m picking their pocket for it.

LarryJ: Governments being hypocritical? Yeah, I laughed too; I was thinking “Pot, kettle, black” when I read that.

They say that this is for ‘security reasons’.

Maybe they’re only banned in countries that go out of their way to support the mullahs, and then get economic incentives in return? Strange that the UK and Germany allow people to use them, if that is indeed the case…

One Acronym – CALEA

“On top of that: PGP is available for Blackberrys (Link…). So while it’s possible to read mail if someone coerces a mail server administrator to let you into the server, if you PGP your message, you’ll still be unreadable.”

Change that to:

“On top of that: PGP is available for Blackberrys (Link…). So while it’s possible to read mail if someone coerces a mail server administrator to let them into the server, if you PGP your message, you’ll still be unreadable.”

Sorry… stream of consciousness composition there. Didn’t stop to think about the pronoun problems.

*China, Israel, and Japan were also mentioned as major offenders.

Can the NSA have access to the mail servers? I don’t know the *legal* aspects, but my opinion is that they’d need explicitly allowed access by the server owners (i.e. the server administrator creates an account for them to access the server, or logs them in, or does some conscious action to allow an NSA agent access). Why do I believe that? Because it’d be a stupidly huge challenge to force access (i.e. “hack” the server), that’s why. Mail servers nowadays can be very well secured, so while a compromise of a server is possible, the length of time it would take would be hideously prohibitive. So in short, due to security features available in just about any modern messaging system – like Microsoft Exchange, or Lotus’s products, which are the most likely ones in place when you’re talking Blackberries – make technical forcing problematic. You’re better off having the admins “hand over the keys”, so to speak, unless you don’t mind waiting on the order of years before being able to read the mail. And that’s if you can keep an email server administrator from taking deliberate actions when compromise attempts are detected.

On top of that: PGP is available for Blackberrys (Link…). So while it’s possible to read mail if someone coerces a mail server administrator to let you into the server, if you PGP your message, you’ll still be unreadable.

Is this story really being driven by a security concern? Or did some purchasing agent in the French government come across some other technology he or she liked better and tried to force a replacement with a security argument? I work for an entity that was hit by all sorts of wireless messaging companies marketing trying to fill the Blackberry niche, and they are agressive. I’d sooner believe this is a bureaucratic issue with the security aspect being a red herring than I’d believe that someone compromised technical security.

Of course, I have to admit: If agents are explicitly allowed access by the server owners, everything’s out the window. The question is, is that what the French government feared? That NSA agents were in bed with whomever ran the stateside and UK servers in question?