UAE, Saudi Arabia To Block BlackBerries

[TampaYankee]

United Arab Emirates, Saudi Arabia To Block BlackBerry Over Security Fears

ADAM SCHRECK | 08/ 1/10 01:45 PM | AP

http://www.huffingtonpost.com/2010/08/01/uae-saudi-arabia-blackberry-ban_n_666581.html

DUBAI, United Arab Emirates — The UAE said Sunday it will block key features on BlackBerry smart phones, citing national security concerns because the devices operate beyond the government's ability to monitor their use. Officials in neighboring Saudi Arabia indicated it planned to follow suit.

The decision could prevent hundreds of thousands of users in the Mideast country from accessing e-mail and the Web on the handsets starting in October, putting the federation's reputation as a business-friendly commercial and tourism hub at risk.

BlackBerry data is encrypted and routed overseas, and the measure could be motivated in part by government fears that the messaging system might be exploited by terrorists or other criminals who cannot be monitored by the local authorities.

However, analysts and activists also see it as an attempt to more tightly control the flow of information in the conservative country, a U.S. ally that is home to the Gulf business capital Dubai and the oil-rich emirate of Abu Dhabi.

This isn't the first time BlackBerry and Emirati officials have had run-ins over security and the popular handsets, a fixture in professionals' pockets and purses the world over.

Just over a year ago, BlackBerry maker Research in Motion criticized a directive by UAE state-owned mobile operator Etisalat telling the company's more than 145,000 BlackBerry users to install software described as an "upgrade ... required for service enhancements."

RIM said tests showed the update was in fact spy software that could allow outsiders to access private information stored on the phones. It strongly distanced itself from Etisalat's decision, and provided details instructing users how to remove the software.

Within hours of the Emirati decision to block BlackBerry services, a telecommunications official in neighboring Saudi Arabia said the desert kingdom would begin blocking the BlackBerry messaging service starting later this month. The Saudi official, who spoke on condition of anonymity because he is not authorized to talk to the media, said the country's telecommunications regulator would issue a statement on the move soon.

Ali Mohammed of Saudi Telecom, however, said the company had "not received any instructions about BlackBerry from the ministry."

Like in Saudi Arabia, government censors in the UAE already routinely block access to websites and other media deemed to carry content that runs contrary to the nation's conservative Islamic values or could stoke political unrest.

In announcing the ban, the UAE telecommunications watchdog said it will suspend BlackBerry messaging, e-mail and Web browsing services starting October 11. It was unclear if the ban would affect only local users or foreign visitors with roaming services as well.

Regulators say the devices operate outside of laws put in place after their introduction in the country, and that the lack of compliance with local laws raises "judicial, social and national security concerns for the UAE."

The government said it is singling out the BlackBerry, and not other phones that can access e-mail and the Web, because the devices are the only phones in the country that automatically send users' data to servers overseas.

Unlike many other smart phones, BlackBerry devices use a system that updates a user's inbox by sending encrypted messages through company servers abroad, including RIM's home nation of Canada.

Users like the system because it is seen as more secure, but it also makes BlackBerry messages far harder to monitor than ones sent through domestic servers that authorities could tap into, analysts say.

"This is the irony, that it's the device with the highest security features," said Simon Simonian, an analyst at Dubai-based investment bank Shuaa Capital who follows telecommunications. "These same security features corporations like have become an issue of national security for the government."

Emirati authorities are eager to portray an image of the country as a safe, stable society free from the extremism found elsewhere in the region. They have taken steps to crack down on terror financing and efforts by neighbor Iran to sidestep international sanctions over its nuclear program.

Regulators said they have sought compromises with RIM on their concerns, but failed to reach an agreement on the issue.

"With no solution available and in the public interest ... BlackBerry Messenger, BlackBerry E-mail and BlackBerry Web-browsing services will be suspended until an acceptable solution can be developed and applied," Telecommunications Regulatory Authority director-general Mohamed al-Ghanim said in a statement carried on state news agency WAM.

"The TRA notes that BlackBerry appears to be compliant in similar regulatory environments of other countries, which makes noncompliance in the UAE both disappointing and of great concern," he added.

A spokeswoman for Research in Motion said the Canadian company had no immediate comment.

Other countries, including India and the Gulf state of Bahrain, have also raised concerns about BlackBerry messaging features, but have not decided to block them outright.

"The UAE doesn't want to take any chances and they want to monitor what is going on in the country," Simonian said.

Research in Motion said in a statement last week it "respects both the regulatory requirements of government and the security and privacy needs of corporations and consumers."

The company declined to disclose details of talks it has had with regulators in the more than 175 countries where it operates, but defended its phones' security features as "widely accepted" by customers and governments.

Etisalat and Du, the UAE's two state-run phone companies, said they would comply with the directive and are working on alternative services for their BlackBerry customers.

RIM does not disclose the number of BlackBerry users in the country.

Simonian, the Shuaa analyst, estimated that there are "hundreds of thousands" of BlackBerry users in the country, but likely fewer than the half million users cited by local media.

[JKane]

I'd heard something about this when announced, I guess I don't understand why the BB would be singled out... because any smartphone can send and receive encrypted messages. I guess maybe it's because that's apparently the default for BBs, preventing those mideast governments from keeping their populations in check with casual spying by their secret police.

[KYTOP]

It was reported today that India is also jumping on the Blackberry ban.

Modern means of communication is starting to scare alot of countries it seems.

[Guest restless]

It was reported today that India is also jumping on the Blackberry ban.

Modern means of communication is starting to scare alot of countries it seems.

I'm surprised Iran didn't crack down after last year.

[JKane]

India?? Granted, they have some strife, but this really surprises me.

It was reported today that India is also jumping on the Blackberry ban.

Modern means of communication is starting to scare alot of countries it seems.

[TampaYankee]

India?? Granted, they have some strife, but this really surprises me.

Why should this or any of the rest of it be surprising?

After the greatest paragon of freedom and individual liberties in history, America, decides it has a greater need to spy on its citizens communications (Patriot Act), why should anybody be surprised that other countries would follow suit as brazenly. Just because they don't have the equivalent of our NSA, they have to be a little more public about it. In addition to our NSA we also coopted telecoms too to spy for us -- to break our laws; and then Congress passes expost facto legislation to get them off the hook.

So... why is it that anybody is suprised?

It is worthy of lament but not surprise IMO.

[JKane]

Why should this or any of the rest of it be surprising?

After the greatest paragon of freedom and individual liberties in history, America, decides it has a greater need to spy on its citizens communications (Patriot Act), why should anybody be surprised that other countries would follow suit as brazenly. Just because they don't have the equivalent of our NSA, they have to be a little more public about it. In addition to our NSA we also coopted telecoms too to spy for us -- to break our laws; and then Congress passes expost facto legislation to get them off the hook.

So... why is it that anybody is suprised?

It is worthy of lament but not surprise IMO.

Damn, I suppose you're right. My assumption that 'free and democratic' countries weren't doing this was probably very naive! They either have an NSA/Mi5 (and/or a backdoor into the telcos) or are very worried about citizens carrying around instant encrypted communicators at all times.

Of course they could also probably be more subtle and shut them down in specific areas for certain emergencies/threats, as I'm sure would happen here... and most would assume the network was overloaded. It's like it's a good thing the BB network's gone down several times and ATT is crap in general, sure works for them!

Did the protests in Iran with the dead woman and all the green kickstart this?

[lookin]

UPDATE 1 - Q+A - BlackBerry technology explained

http://www.reuters.com/article/idCAN1213222020100812?rpc=44

Thu Aug 12, 2010 4:55pm EDT

By Jim Finkle and Alastair Sharp

Aug 12 (Reuters) - Research In Motion (RIMM.O) (RIM.TO) is at standstill with the Indian government over demands that the company provide authorities a way to read encrypted email messages that travel across BlackBerry's network.

The government said it will shut down RIM's email and messaging services in India if the company doesn't comply with its demands by Aug. 31.

India -- and several other countries -- say their inability to monitor BlackBerry traffic undermines efforts to protect national security.

Here are questions and answers that explain how the BlackBerry system works and why governments consider it so threatening:

Q. What steps does RIM take to make sure that the email of its business customers cannot be intercepted by third parties?

A. RIM uses powerful codes to scramble, or encrypt, email messages as they travel between a BlackBerry device and a computer known as a BlackBerry Enterprise Server (BES) that is designed to secure those emails. Governments in India and elsewhere say criminals use BlackBerrys to conduct their business because they know the government cannot monitor their chatter. The encrypted messages can only be unlocked with software "keys" that are located either on the BlackBerry device itself, or at a particular customer's BlackBerry Enterprise Server. RIM says it does not have a master key that controls every system in its network.

Q. Do RIM's consumer customers get the same level of email security as businesses?

A. No. Email for consumers and small businesses is not protected by the same system of keys that encrypts corporate messages. BlackBerry's consumer service runs on a system known as BlackBerry Internet Service (BIS), which is less daunting for authorities to crack.

Q. Is BlackBerry's security different from other smartphone vendors?

A. Yes. All BlackBerry traffic runs through RIM data centers, which help manage the devices and traffic, identifying anomalies that might present security concerns. Traffic on products from rivals such as Apple Inc (AAPL.O), Google Inc (GOOG.O), Nokia (NOK1V.HE) and Microsoft Corp (MSFT.O) does not go through centralized data centers.

Yet those devices do offer powerful encryption technology for scrambling messages. Unlike BlackBerry, which provides its own security software, its rivals generally provide encryption technology through partners including units of EMC Corp (EMC.N), Symantec Corp (SYMC.O) and McAfee Inc (MFE.N).

Q. Can RIM unscramble a message encrypted by one of its business customer's BlackBerrys?

A. RIM says it cannot unscramble data of its enterprise customers because it does not possess the keys needed to do so. RIM can likely identify the senders and recipients of emails and log items such as when they were sent or whether they had attachments.

Q. Saudi Arabia, India and the UAE have complained that RIM won't give them the same kind of access to tap into BlackBerry networks that other countries, including the United States, get. What level of access does the U.S. government enjoy?

A. Authorities in the United States and in European countries such as Britain and Germany can seek a court order to tap BlackBerry traffic, giving them access to messages sent over the network. Officials at Research In Motion declined to talk about how they provide such access. It is possible that governments make such requests directly to RIM's customers.

Q. If the data is encrypted, how is it possible for the government or RIM to install a wire tap?

A. Bruce Schneier, an expert in encryption who is chief security technology officer for BT, said that it is relatively simple. Authorities just need to put an eavesdropping box on the BlackBerry Enterprise Server, which decrypts the data to gather a reconstituted message. Another alternative would be to install spyware on the handheld device itself.

Q. How strong is the BlackBerry encryption? Is it possible for government code crackers to break the encryption on their own, without help from RIM?

A. Some analysts speculate that may be the case. But breaking encrypted code is no easy task - it is a slow process that requires tremendous skill and powerful computers. RIM's enterprise system offers two transport encryption options, Advanced Encryption Standard (AES) and Triple Data Encryption Standard (Triple DES). A BlackBerry device will by default choose the 256-bit encryption of AES for transport layer encryption. Triple DES is a two-key algorithm that generates message and device transport keys.

Q. Has RIM made any concessions to India ahead of the Aug 31 deadline?

A. Yes. RIM has offered to track email message feeds for the Indian government, which could include providing services such as compiling detailed logs of a particular user's correspondence. But RIM still has not agreed to India's key demand - that they hand over unencrypted messages. RIM officials did not respond to requests for comment on how they plan to address this obstacle.

Q. Has RIM made any concessions elsewhere?

A. Yes. In Saudi Arabia the firm has agreed to hand over codes used to encrypt traffic of its BlackBerry Messenger instant messaging service. RIM was also delayed from entering Russia and China for several years while intelligence agencies worked through their concerns. Little is known about any compromises reached, but Russia has tight rules on where RIM can locate BES servers for corporate clients in that country.

Q. BlackBerry Messenger is offered to both corporate and consumer clients. Do corporate customers get a more secure version of the service?

A. The service is a form of instant messaging that bypasses the BlackBerry Enterprise Server and corporate networks. It runs on a proprietary system known as PIN encryption that is not as powerful as the options available on the BES email system. By default, all BlackBerrys ship with a global PIN encryption key that allows users to unscramble messages sent from any BlackBerry. But corporate customers can choose to install their own key that allows them to restrict access to users within their enterprise. (Reporting by Jim Finkle in Boston and Alastair Sharp in Toronto; editing by Peter Galloway)