Original URL: https://www.theregister.com/2007/09/26/bt_secure_tin_cups/

BT cranks VoIP & BlackBerry Enigma machine

UK spooks don't believe the hype

By Christopher Williams and Lewis Page

Posted in Networks, 26th September 2007 13:22 GMT

BT is crowing for the second time in two weeks about how its products have been security certified by GCHQ, the government's main listening station.

Snag is, they've been certified for "restricted" communications, which are only slightly more secure - in military terms - than shouting in a crowded pub.

Today's announcement from BT is of a pre-existing hosted and "highly secure" VoIP product developed with Nortel aimed at public and private sector organisations. It's being made available to more customers after successful trials with a single client.

Investigations by GCHQ's "Information Assurance" arm, the Communications Electronics Security Group (CESG) have led to the kit winning approval for Restricted traffic.

The basic UK military "protective marking" scheme for communications runs as follows:

We suspect the single Restricted-VoIP customer so far isn't GCHQ, then. We're closer to "protective marketing" territory than protective marking.

A couple of weeks ago BT also made heavy media play around its new BlackBerry Enterprise Server offering for defence types, which is also deemed suitable only for Restricted traffic by CESG. This despite the fact that in commercial terms the device is solidly secure, using encryption validated by the American NSA and allowing admins to remotely shut down or wipe lost handsets.

The Reg spoke to Jon Stoker, director of BT Defence at the DSEi mayhemware expo in London. Stoker felt that the Restricted BlackBerry would still be useful to the Ministry of Defence, despite the low level of information which can be passed on it.

"At the moment you have to be at your desk to handle almost all official information," he said. "The new BlackBerry changes that."

Asked who might use it, he felt that senior managers such as Army colonels in charge of operational regiments might find it useful, as they need to be away from the office a lot.

In fact, the reality of the Ministry of Defence is that frustrated officers with no access to approved channels frequently break security rules and discuss Secret or even Top Secret matters on ordinary cellphones, send such information using unencrypted email, etc.

In an environment like this, the takeup of a device which isn't even rated for Confidential traffic could be limited. Stoker was reluctant to comment on internal MoD security-vs-useability issues - despite an extensive background in Army communications. Nor would he admit to any frustration at the low level of clearance accorded to his product. He said the BlackBerry's rating "could go higher in future," and that even a Restricted clearance for a mobile device indicated "a willingness to move forward" on the part of CESG.

At first, the Restricted BlackBerrys will be used only in the UK. There isn't any plan at present for rugged hardware, which makes a certain amount of sense as soldiers in the field - not to mention sailors in coastal waters - have been known to rely on their personal mobiles when official gear has a bad day. If they can keep an ordinary Nokia and a paper map functional, they'll be able to preserve a regular BlackBerry too.

All in all, it's fair to say that private mobile devices - or ones bought with local budgets - have already penetrated the MoD: but Stoker and BT may have a hard road ahead in persuading the security types to give approval to what's already happened. CESG's reluctance to clear commercial platforms for use may not be unrelated to their GCHQ Sigint parentage. When you know just how easy it is to listen in on mobile comms - even mobile comms that many would consider secure, perhaps - you prefer to put your head in the sand and pretend that nobody on your own side is using them. ®