(AP) PARIS - BlackBerry handhelds have been called addictive, invasive, wonderful - and now, a threat to French state secrets.
That, at least, is the fear of French government defense experts, who have advised against their use by officials in France's corridors of power, reportedly to avoid snooping by U.S. intelligence agencies.
"It's not a question of trust," French lawmaker Pierre Lasbordes told The Associated Press. "We are friends with the Americans, the Anglo-Saxons, but it's economic war."
Le Monde newspaper, which broke the story, described BlackBerry withdrawal among those who have given them up. "We feel that we are wasting huge amounts of time, having to relearn how to work in the old way," the daily quoted a ministry office director as saying.
E-mails sent from "Le BlackBerry" pass through servers in the United States and Britain, and France fears that makes the system vulnerable to snooping by the U.S. National Security Agency, Le Monde reported. The company that makes BlackBerrys, however, denies such spying is possible.
Lasbordes, who was commissioned in 2005 by then-Prime Minister Dominique de Villepin to look into such issues, said he alerted the government to this "weakness" months ago. He said he met with BlackBerry maker Research In Motion Ltd. to discuss the problem in the course of preparing his report on the security of French information systems.
The Canadian company "admitted that there was a certain fragility in the protection of information when you use the e-mail system" and promised it would be resolved, said Lasbordes, adding: "That was more than a year ago."
BlackBerrys pose "a problem with the protection of information" and "the risks of interception are real," Alain Juillet, in charge of economic intelligence for the government, told Le Monde.
Research In Motion insisted that BlackBerry e-mails cannot be read by the NSA or other organizations. The e-mails are more heavily encrypted than online banking Web sites, Research In Motion said in a statement.
"No one, including RIM, has the ability to view the content of any data communication sent using the BlackBerry Enterprise Solution," the company said.
The BlackBerry system has been accredited by security agencies in the United States, Australia, New Zealand, Austria and Canada, Research in Motion said, adding that a certification process is under way in the Netherlands and Germany.
In France, the circular on BlackBerries from the General Secretariat for National Defense applies in theory to all ministries, and "it's up to everyone to be responsible," Lasbordes said.
Another official in a major ministry who got rid of his BlackBerry following the order said authorities are looking at other types of hand-held computers to use instead.
The prime minister's office would not confirm that it and the presidential palace were included in the circular, as Le Monde reported. But a spokesman, Severin Naudet, cited the General Secretariat for National Defense as saying that no type of hand-held computer is risk-free.
"It's not a problem if you're writing to your mother-in-law," Lasbordes said. But "one can imagine a minister coming from a meeting of the G-8 or G-7, et cetera, or a meeting in Brussels, and he sends information to his colleagues. It goes via Canada and the United States and that's it, game over."
Suspicion goes both ways. At a Group of Eight summit in Germany this month, White House aides were instructed to leave their wireless e-mail devices behind, apparently for fear of Russian eavesdropping.
(Cross-posted at Military.com)
A BES (Blackberry enterprise server) has encrypted end-to end communications to the Blackberry.
So mort larger organizations will have this.
The BES is inside the organizations network.
The Blackberry itself uses 128bit encryption on its traffic, and can optionally encrypt all data
on the blackberry with a different 128 bit key,
and will erase itself rather than allow repeated
password attempts.
The only weakness there is a hypothetical trapdoor to allow password recovery from inside a snatched blackberry.
Judging from the security policy Australia's DSD promulgate which turns OFF content encryption, I guess that if such a thing exists only US agencies know about it.
The blackberry hardware has built-in anti-tamper and won't run a doctored system image.
Organizations can impose security policies that enforce any or all of these features.
Posted by: Tim at June 24, 2007 06:55 PM