The latest revelations from the NSA files have shown that US and UK surveillance agencies could have the ability to listen in on billions of mobile phone calls from around the world. But how can they do that, and what does it mean for the general public? And should you be worried?
What’s happened?
The biggest manufacturer of Sim cards in the world has reportedly been hacked into by the US NSA and UK GCHQ.
The security agencies stole the encryption keys that are built into every one of the Sim cards made by the Dutch firm Gemalto.
What is a Sim card?
The Subscriber Identity Module (Sim) card is the small chip placed into almost every mobile phone in the world that allows the phone to connect securely to the mobile phone service provider. It is essentially the key that logs the user into the mobile phone network allowing calls, text and data access.
The secure handshake between the network and the sim encrypts all communications going between the mobile phone and the network.
What does this mean?
With the encryption keys for Gemalto Sim cards, the US and UK security services can potentially listen in on any conversation across any network that uses the compromised Sim cards.
How could they listen in?
The keys allow the security services to decrypt voice communications sent between a mobile phone and a mobile mast, which carries the call to the recipient. To pick up the call they can use an aerial placed in the vicinity of the caller. They will have to be relatively close to the mobile phone user, but an aerial could be placed anywhere and would not have to be visible.
Is this legal?
There is no doubt that the security firms would have breached Dutch law. If the keys are used to listen into conversations, it is likely to be a violation of data protection laws in most countries.
Where has this information come from?
The revelations of the hack come from the NSA files supplied by Edward Snowden and reported on by Glen Greenwald’s The Intercept. The files reveal the extent of the breach and that Gemalto was targeted by the Mobile Handset Exploitation Team (MHET), a unit formed by the NSA and GCHQ in April 2010 to target vulnerabilities in mobile phones.
Who is affected?
Gemalto supplies 2bn Sim cards annually to 450 mobile phone providers globally across 85 countries. In the UK they are used by Vodafone, EE, O2 and Three, in the US by AT&T, Sprint, T-Mobile and Verizon.
Most mobile phone providers will have used Gemalto sim cards at some point, meaning anyone with a Sim in their mobile phone could be affected.
What can be done?
There is very little that can be done to stop the US and UK security services using the encryption keys to listen in on mobile phone communications. That means someone could be listening in on any conversation had via the mobile phone network.
Users can separately encrypt their voice and text communications using messaging services such as Apple’s iMessage, Facebook’s WhatsApp or secure chat services such as Chatsecure or
Users of Silent Circle’s Blackphone or similar secure services, which encrypt voice communications by default, will also protect phone calls.
Do I need to do something about it in the UK?
While the revelations show that GCHQ or the NSA have the keys to your phone calls, in practice UK law enforcement already has access to that level of data through the Regulation of Investigatory Powers Act (Ripa). Law enforcement agencies can request historical data on a user’s phone use between explicit dates, or request live access to a user’s phone use.
The UK mobile phone companies are compelled to comply with proper requests by law. Live access is generally used in immediate danger scenarios such as a kidnapping, where rapid access to communications data can aid an investigation in real time.
What about the rest of the world?
The encryption keys give the US and UK security agencies powers to circumvent resistance by other countries. If they wanted to spy on German president Angela Merkel, for instance, they could using the keys without the knowledge of German security forces, something that would not be possible through other legal means.
What are the networks doing?
In the UK, all of the major networks were only given the information on the breach at the same time the Intercept published the details.
They are currently investigating the security implications, although there is little that can be done without replacing the affected sim cards, as the encryption keys are hardwired into the sim cards and cannot be changed.
EE, O2, Three and Vodafone said that they were speaking to suppliers of Sim cards about the implications of the revelations.
Comments (…)
Sign in or create your Guardian account to join the discussion