Dutch investigators have confirmed to Motherboard that they are able to read encrypted messages sent on PGP BlackBerry phones—custom, security-focused BlackBerry devices that come complete with an encrypted email feature, and which reportedly may be used by organized criminal groups.
“We are capable of obtaining encrypted data from BlackBerry PGP devices,” Tuscha Essed, a press officer from the Netherlands Forensic Institute (NFI), told Motherboard in an email. The NFI is a body that assists law enforcement in forensic evidence retrieval, and which, according to its website, deals with most of the forensic investigations in criminal cases in the Netherlands.
Videos by VICE
The news first emerged when Dutch blog “misdaadnieuws.com,” or Crime News, published apparent documents sourced from the NFI in December last year. According to that report, deleted messages can be recovered and encrypted emails read on these devices. The process is carried out with a piece of forensics software made by private company Cellebrite.
PGP-encrypted BlackBerrys are sold by a number of online vendors, and are advertised as being particularly more suited for sensitive communications than the standard models on offer. “We use PGP encoding as protocol for sending and receiving messages,” the site of one vendor, TopPGP, reads. Another seller, called GhostPGP, says that the company “offers the only proven, time-tested means of communicating securely in total anonymity with PGP-encrypted email.”
It appears that organized criminal groups may make use of these sort of devices. In March 2014, Australian outlet ABC reported that encrypted BlackBerrys were linked to a series of killings, one of which was a murder of a Hells Angels biker. The Sydney Morning Herald added that police officers have traveled to BlackBerry’s headquarters seeking advice on how to access encrypted data on the phones.
The vendor of that device was Canada-based Phantom Secure, the brochure of which claims “no information is required with purchase” of one of the phones, and that “Your data connection and device are not registered to you.”
Very little information is available regarding the specific technique that the NFI use to access encrypted communications on custom BlackBerrys.
The Crime News report says that out of 325 encrypted emails recovered from a device, only 279 were deciphered, and that the workaround is only applicable when law enforcement have physical access to the device. Documents published by Crime News mention a BlackBerry 9720, a model of BlackBerry that was released in August 2013.
Essed from NFI would not elaborate on the capability against PGP BlackBerrys, nor when the body acquired it. When presented with a list of questions, Essed said, “by answering these we would provide criminals with exactly the information they would need in order to eventually get around our research method. We would like to prevent that and therefore have been very reserved with our explanation towards the press.”
When contacted by Motherboard, Jay Phillips, from encrypted BlackBerry seller SecureMobile.ME, pointed to a blog post on the SecureMobile site dated August 2014, which details two methods of obtaining data from a mobile device.
One of them, known as chip-off, involves removing a memory chip from the circuit board and making a dump of the data it contains. If “content protection” is turned on—BlackBerry’s feature for encrypting data—the analyst will extract the hash of the device’s password, and then attempt to brute force it, according to the blog post. The post claims that SecureMobile products are unaffected by chip-off because they have been paired with BlackBerry Enterprise Server (BES).
“We wrote about this years ago. This affects ALL mobile devices including Android offerings! Weak passwords will ALWAYS be the weak link,” Phillips said.
“Content protection is on by default for all our units,” Phillips continued. “This has been the case since day one. Without it, the devices are easily cracked. [BlackBerry] devices can still be brute forced via chip-off.”
“It could possibly be that Cellebrite has found a way to brute force without a chip-off: this I have not verified,” Phillips continued, who recommended using a strong password to secure data on the device. (Crime News writes that the length of the password used for sending and opening PGP messages is not relevant to the decryption process.)
A representative from GhostPGP wrote in an email, “We have not been affected. Our services are completely secure and have never been compromised.”
Meanwhile, TopPGP told Motherboard, “We use the latest PGP encryption at this moment that its almost impossible to be decrypted. Our customers are very happy with the level of security provided by TopPGP.com.” Requests for comment to Phantom Secure and Phantom Encrypt, two other PGP BlackBerry vendors, went unanswered.
It’s unclear whether other law enforcement bodies have the ability to obtain encrypted communications from custom BlackBerrys. A spokesperson for the UK’s National Crime Agency told Motherboard in an email that “To preserve the integrity of our investigations, we don’t routinely confirm or deny the use of specific tools or techniques.”
A spokesperson from the Federal Bureau of Investigation wrote in an email “I would not be able to comment on our capabilities in regards to specific companies or communications providers.” He then pointed to BlackBerry’s recent post entitled “The Encryption Debate: a Way Forward,” in which John Chen, the company’s CEO, writes that “privacy and security form the crux of everything we do. However, our privacy commitment does not extend to criminals.”
The Drug Enforcement Administration had much the same stance, and a representative told Motherboard via email, “I’m afraid I can’t comment on your question. As I’m sure you can appreciate, confirming or denying this capability provides information on tactics, techniques and procedures that we can’t discuss.”
The Royal Canadian Mounted Police did not respond to a request for comment.
