Feeds

India: We DO have the BlackBerry encryption keys

RIM: Er, I think you'll find you don't

Beginner's guide to SSL certificates

Indian government officials have apparently claimed that Research in Motion has handed over the skeleton keys used to encrypt BlackBerry communications – once again ignoring the fact that such keys don't exist.

The Times of India has reported that RIM "agreed to hand over its encryption keys" to the Asian nation, and allowed lawful intercept of all email, messaging and other communications. The paper claims to have viewed internal government documents confirming this. According to the Times:

[RIM] has now handed over this infrastructure to Indian agencies, internal government documents reviewed by ET reveal.

Canada-based RIM has, as usual, not only denied handing over any keys but also reiterated that it couldn't hand over keys that it doesn't actually have.

BlackBerry users come in two varieties: corporate users connected to a BlackBerry Enterprise Server (BES), and consumers who connect to a RIM-managed BES. Corporate users create their encryption keys when setting up their BES, and communication between the handset and the BES is secured against all but the best-funded of governments. Consumers are issued a key by RIM, and connect to their geographically nearest – and RIM-managed – BlackBerry Enterprise Server (BES).

When BlackBerry Messenger (BBM - an instant-messaging service unique to RIM) was implicated in the 2011 riots, the UK police were able to wander along to the UK-based BES server and peruse all the messages and emails exchanged by rioters without breaking any encryption. The Data Protection Act provided all the power they need, with RIPA providing police with similar access to companies running their own BES – though in that case, the biz owners themselves hold the keys, hence the problem with the Indian government's claims.

The problem for India was that RIM had no local BES, so consumers were connected to one in Canada and subject to Canadian law. What seems likely, though RIM won’t confirm it, is that RIM now has a BES server located within India where the local authorities can browse communications just as easily as their UK counterparts.

But that's no help against companies, or groups, who run their own BES (the basic version of which is free). Where a local BES is used, RIM never has access to the encryption keys, and RIM has resolutely resisted informal requests to create a back-door in their software – rightly believing that if such a move became public (as it inevitably would) it would destroy the only area (security) within which RIM still has credibility.

The Times of India claims a government spokesman told them that RIM had provided such a back door, but it's not the first time we've heard a claim of this type. Back in 2010, the Indian government claimed RIM was providing access to communications, at least twice, then it made roughly the same claim in October 2011, and again in February this year, so these new claims have to be taken in that context.

The Indian government is trying to reassure its population (and voters) that no foreign company will prevent it from intercepting communications, but it risks its own credibility by repeatedly claiming to have access to encryption keys which simply don't exist. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
Broadband sellers in the UK are UP TO no good, says Which?
Speedy network claims only apply to 10% of customers
Virgin Media struck dumb by NATIONWIDE packet loss balls-up
Turning it off and on again fixes glitch 12 HOURS LATER
Fujitsu CTO: We'll be 3D-printing tech execs in 15 years
Fleshy techie disses network neutrality, helmet-less motorcyclists
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
Ofcom tackles complaint over Premier League footie TV rights
Virgin Media: UK fans pay the most for the fewest matches
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.