Apple, RIM deny claims of data backdoor for Indian government
Symantec hackers claim intelligence memo shows secret deal
Cloud storage: Lower cost and increase uptime
Updated Apple and RIM have denied providing the Indian government with backdoor access to customers' data, after the release of a memo that appears to suggest that they and Nokia did a deal in exchange for access to the Indian smartphone market.
The document purportedly comes from the Indian Directorate General of Military Intelligence, and was released by the hacking group the Lords of Dharmaraja, who posted up outdated Norton security source code last week. Dated October 2011, it states that a "decision was made earlier this year to sign an agreement with mobile manufacturers (MM) in exchange for the Indian market presence."
It claims that an agreement was signed with all major vendors, including domestic supplier Micromax, and that a CYCADA data intercept team are in operation on the networks using backdoors supplied by RIM, Nokia, and Apple (RINOA). Symantec is mentioned as the system used to transfer data to mobile platforms.
Western firms fingered in purported memo
Also contained are details of recent intercepts from the CYCADA team, including conversations between members of the US-China Economic and Security Review Commission (USCC) on currency issues and discussions on the actions of Western firms helping the Chinese aircraft industry improve its avionics and engine manufacturing.
An Apple spokesman told The Register that the company denied giving any access to the Indian government to its systems, although he couldn't comment on the veracity of the memos themselves. RIM told us that it "does not typically comment on rumors or speculation," and pointed out that it has no ability to provide its customers' encryption keys and doesn't do deals with specific countries.
Rumors of governments getting backdoor access to software are as old as the hills - the NSA getting access to Windows 95 in exchange for monopoly control of PCs story lasted until the DOJ case started - and on the face of it there's nothing to suggest that this isn't merely a ruse. There would be considerable technical problems with using Symantec as a distribution system, for example.
The subject matter also seems just a little too juicy for this El Reg hack. As Professor Marcello Truzzi used to say, "Extraordinary claims require extraordinary proof." ®
Update
A Symantec spokesman has told The Register that the company is investigating the documents, but issued an unequivocal statement on the matter:
"We would never develop or help distribute a backdoor program regarding anyone’s programs, mobile or otherwise. Ever."
He also pointed out that the hacking group claimed to have got the Norton source code that was leaked from Indian government servers. There are no records of the Indian government ever being given access to Symantec's source code. The code is however genuine.
COMMENTS
Two words
Court order.
As long as the company has presence in the country, the data is within reach of the government.
What they don't deny may be significant.
You have to watch out for tricksy wordings in denials issued by corporate spokesmen and read between the line sometimes; they are PR, not unambiguous statements of fact. For example, Symantec's supposedly "unequivocal" statement is really no such thing:
>"We would never develop or help distribute a backdoor program regarding anyone’s programs, mobile or otherwise. Ever."
That of course does not for one second say that they wouln't develop or help distribute an entirely legitimate lawful access program, does it? Because that's not quite the same thing as a "backdoor". None of those companies would usually deny for a second that they do co-operate with lawful access requests from governments and courts, so whatever they're denying here, it's not that, and if they regard the system discussed in the documents as lawful rather than backdoor, then I'm sure that's all the wriggle room they need to convince themselves that they can just issue denials.
Some say they do, some say they don't
but we will never know for sure. That's one side benefit of the proprietary, closed source software.
It is not that big corporations would do such horible thing to their paying customers, God forbid!
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Customer Success Testimonial: Recovery is Everything
Data control in the cloud
