Q: US Congress passed a resolution decreeing in part that:
'"&brkbar;when Members use BlackBerry devices or cell phones while travelling overseas, especially in nations in which access to information is tightly controlled by the government, they are at risk of having their conversations or other personal information recorded or collected without authorization.'
Do BlackBerrys and other mobile devices put sensitive data at risk when taken overseas‾ Is it an issue and how can it be mitigated‾
A: I think it's best to start this discussion from the premise that any communication device can put sensitive data at risk.
Any wireless electronic device is subject to eavesdropping or infection, and this risk increases quite dramatically when traveling to countries where a device connects to a local service provider, which may be government-controlled.
As you specifically mention BlackBerrys, let's briefly examine how emails and other personal information management (PIM) data, such as appointment and calendar details, actually get to a BlackBerry.
BlackBerry uses push-based technology to provide users with continuous wireless access to their email and PIM data. This means that messages are automatically delivered to the user's BlackBerry simultaneously with their reception at their corporate servers, eliminating the need for a user to log in and check for new messages as with regular email. To achieve this, all data transmitted to or from a BlackBerry device passes through Research In Motion Ltd.'s (RIM) servers in Canada before being forwarded on to its final destination.
This routing raises certain problems relating to privacy and security, as the data is being transmitted via a central third party server and passing through Canadian jurisdiction.
For example, back in 2006, BlackBerry servers were found to be potentially vulnerable because they weren't encrypting user login data, and the database could be exploited through SQL injection via buffer overruns. Another problem is that although BlackBerry messages are encrypted, some countries prohibit or restrict the use of encrypted messaging. Canadian export laws actually prohibit their use in some countries.
As you can see, just the way in which a BlackBerry works means that you lose some control over your data.
But a bigger problem arises when the technology is used abroad, since it may be operating on a foreign network that could be 'government-controlled.' China, for example, has full control over its telecom and information systems. In fact, an Olympics fact sheet from the US State Department warns that visitors should be aware that they have no reasonable expectation of privacy in public or private locations.
Before employees are allowed to travel overseas with a BlackBerry, they should receive training on how to use its security features and made aware of company policies and procedures regarding data security requirements. Such policies must cover data classification so that you can state what types of data can be transferred or stored on mobile devices. Encryption features must be turned on, with all sensitive data being encrypted. BlackBerry devices should be set up to use the Advanced Encryption Standard (AES) as well.
Another key aspect of protecting data on a BlackBerry is ensuring its physical security.