8 ms·

How Obama’s BlackBerry got secured (2013)

220 points by lastdong 1y ago

gnabgib 1y ago
(2013) Discussion at the time (83 points, 32 comments) https://news.ycombinator.com/item?id=6615066 https://news.ycombinator.com/item?id=6615066
- Jaxkr 1y ago
  > This would mean the White House Communications Agency has to carry such a secure base station wherever the president goes. We used to take security so seriously.
  - deleted 1y ago
    [deleted]
  - Aloha 1y ago
    The reality is that modern (meaning LTE) public networks are more secure today, than they have been, its also trivial to bring an LTE base station with you now - with the hardware at this point being no more complex than a controller driven wifi network.
    - PaulDavisThe1st 1y ago
      Indeed, I have an LTE base station in my office, on perpetual "loan" from T-Mobile for US$25, providing us with LTE service in an area where they have no service. It's roughly the same volume, or a bit less, as our modem/router.
evanjrowley 1y ago
I remember encountering one of these secure gov blackberry setups approximately one decade ago. The contractor who managed it up had some deep institutional knowledge. He was probably going to do that one job for the rest of his career until retirement.
deleted 1y ago
[deleted]
Jaxkr 1y ago
And now we have our top defense officials using a fork of Signal which sends copies of messages to a third party. https://www.404media.co/mike-waltz-accidentally-reveals-obscure-app-the-government-is-using-to-archive-signal-messages/ https://www.404media.co/mike-waltz-accidentally-reveals-obsc... http://archive.today/LyWDy http://archive.today/LyWDy
- chme 1y ago
  Not only that, but the software also contained login information to the AWS backend archive servers: https://www.techspot.com/news/107792-hacker-breaches-telemessage-system-used-us-officials-raising.html https://www.techspot.com/news/107792-hacker-breaches-telemes...
- janice1999 1y ago
  ... the third party being run by a foreign 'former' spy whose country was being discussed in those messages.
bigfatkitten 1y ago
These days, NSA's Commercial Solutions for Classified program[1] addresses a lot of these sorts of secure mobility use cases. The underlying design principle behind CSfC is that the CNSA algorithms[2], when properly implemented are good enough to protect information classified up to TOP SECRET on their own. However, there's still a risk of exposure due to broken implementations, active exploitation or operational error. To mitigate this, CSfC's "capability packages" (reference architectures) typically use two or more cryptographic layers of different provenance to reduce the risk that a vulnerability in one layer could be used to compromise the whole solution. For a VPN for example, they will use two tunnels; an inner tunnel using a solution from one vendor, and an outer tunnel from another. There are other considerations apart from cryptography. They also specify the use of "retransmission devices" (mifi routers, basically) in favour of native cellular capability, presumably to mitigate the risk of a cellular baseband exploit being used to compromise a classified handset. [1] https://www.nsa.gov/Resources/Commercial-Solutions-for-Classified-Program/ https://www.nsa.gov/Resources/Commercial-Solutions-for-Class... [2] https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite https://en.wikipedia.org/wiki/Commercial_National_Security_A...
- NitpickLawyer 1y ago
  > They also specify the use of "retransmission devices" (mifi routers, basically) in favour of native cellular capability Yeah, this makes the most sense, there's no way they'd let a president's phone be connected to commercial networks. Tracking alone would be a huge issue, not to mention the plethora of ss7 abuses that can be done.
  - selkin 1y ago
    s/they’d let/would have let/ According to a recent interview[0], the president has an uncontrolled phone (maybe in addition to other, approved devices). [0] https://archive.ph/2025.05.07-050707/https://www.theatlantic.com/magazine/archive/2025/06/trump-second-term-comeback/682573/ https://archive.ph/2025.05.07-050707/https://www.theatlantic...
    - 1y ago
miki123211 1y ago
It's so strange to me how little information there is on the internet about how the BlackBerry really worked. Other phone OSes, both modern ones like iOS and Android, as well as ancient ones like Symbian or even the Nokia 3310 firmware, have their internals well described. All I could find about the BlackBerry was that it used some Java-based OS, but no detailed information about its architecture, conventions, file system layouts, security properties or technical capabilities seems to be available. The communications protocols are just as mysterious, especially on the phone-to-server side. I know it required some kind of carrier integration to work, which makes me think it wasn't just a bog-standard connection over TCP/IP, but I have no idea what it actually was. There's some information in BlackBerry programming books, which can still be found in the "usual places", some old BlackHat presentations, which seem to mostly focus on the enterprise server component, as well as some company history and brief descriptions of the technical choices made in "Losing the Signal", but that's about it. Even Nintendo's OS is understood much more widely, despite Nintendo being much more secretive and litigious.
- amaccuish 1y ago
  Quite agree, I find it really sad. The most that is out there was about the BlackBerry Enterprise Server, but the docs were always light on details. And yes that one BlackHat presentation about SRP. I'd love to know more about the GPRS side of things, how their NOCs were connected to carriers, etc.
- gjsman-1000 1y ago
  > despite Nintendo being much more secretive and litigious Eh, kind of? Nintendo has never interfered with solely modding your Switch, or the tools to do so, and will not ban you for loading CFW. Install CFW, overclock your Switch, even cheat in offline games, no interference. Their lines in the sand for years have been changing your profile image to something arbitrary (and possibly NSFW), installing a pirated game, cheating online, or tampering with system logs. That’s when the ban hammer hits; and the tools for doing those get targeted.
  - Nullabillity 1y ago
blamestross 1y ago
I'm increasingly of the belief that modern governments have lost all advantage in the space of security hardware and software. They only have OpSec and a monopoly on violence to leverage in order to have an improved security situation over the public sector. They don't seem to be using that OpSec superiority effectively right now. I work public-sector in supply chain security and I am terrified that the situation we currently have in the corporate world is actually the best there is.
- relaxing 1y ago
  Okay? What evidence do you base this on?
  - ceejayoz 1y ago
    Photos of them using Signal on iPhones?
    - throwanem 1y ago
      Is that because Signal is as good or because they refuse to listen to anyone telling them to stop using it? Not a serious question, I know it'll be a decade or three before it can be answered from open sources. But of course I forgot, it wasn't really even Signal they were using...
      - NickC25 1y ago
        > they refuse to listen to anyone telling them to stop using it That's one of the reasons, yes. Their whole MO is "we have power, we are not accountable to anyone, fuck you"
        throwanem 1y ago
        Is it? I know that's how they insist on being read.
        deleted 1y ago
        [deleted]
yapyap 1y ago
Someone listens to the 404media podcast
- deleted 1y ago
  [deleted]
mschuster91 1y ago
> On March 16, 2016, AP reported that in February 2009, secretary of state Hillary Clinton also wanted a secured BlackBerry like the one used by Obama, but that NSA denied that request. A month later, Clinton began using a private server, located in the basement of her home, to exchange e-mail messages with her top aides through her regular, non-secure BlackBerry. Later it came out that this rather risky solution was also used for sensitive messages. A good reminder how IT departments need to provide solutions that actually work and are accessible to everyone. If not, "shadow IT" will emerge, rather sooner than later. And Clinton was Secretary of State, not some low level clerk.
- bunabhucan 1y ago
  And the lesson every us pol seems to have learned is "use signal, use protonmail."
  - mschuster91 1y ago
    They're using Signal to circumvent the Presidential Records act - the US government nowadays has ample ways to officially and quickly communicate with each other, while being in compliance with recordkeeping and national secrets requirements.
    - dwood_dev 1y ago
      That is what I assumed as well. In both the current and previous admins. But as more details come out about the current admins use of signal, this appears to not be the case. They are using a shitty third party patched version of signal specifically designed to archive messages. Leaving aside the security issues with the version they are using and the lack of public facing policy, the use of a Signal variant that archives chats is a reasonable compromise. Instead of walling off users, creating a barrier to use and therefore extensive bypassing of the security standards, they have met users where they are and provided them with what the user cannot distinguish from official signal. This allows them to interface internally and externally through signal, preserving records and maintaining a much better level of security than the other options. This represents a huge breach of trust between external parties and government signal users, but most of the government signal users are probably completely unaware that it's being logged. My issue is not that they are using Signal. I think it's one of the better options. My issue is that they use a shitty version of it when there should be an in house maintained version for government use.
jabroni_salad 1y ago
this website also has some weirdly captivating articles about presidential desk phones in the sidebar.
traceroute66 1y ago
All seems rather cute when these days you can just chat about classified stuff with whoever you like on your presumably unsecured phone. And then have an unsecured internet line connected to an unsecured computer in your Pentagon office[1] [1] https://abcnews.go.com/Politics/hegseth-signal-app-connected-dirtly-line-computer-pentagon/story?id=121142551 https://abcnews.go.com/Politics/hegseth-signal-app-connected...
- tehjoker 1y ago
  in fairness, since these guys are just doing war crime after war crime, it's a good thing if it leaks
  - yubblegum 1y ago
    That does unfortunately add the element of incentive to win at all costs to the picture. c.f. PM of Israel.
    - tehjoker 1y ago
      it's true that the US-axis powers are extremely dangerous and short sighted, but they are also weakening. let's hope for victory over the empire.
      - yubblegum 1y ago
        which empire? the energy cartels or global finance? The national baton is passed on as cursory reading of Western history over the past few centuries [shows].
        tehjoker 1y ago
        let's hope it's reaching its endpoint friend. it seems like the natural country to pick up the baton is China, but they have a sufficiently different economic system that maybe there will be a break in the chain. it depends on the strength, rationality, and solidarity of the CPC.
VectorLock 1y ago
As a completely random aside the article mentions "This company was founded in October 2008 by W. Steven Garrett, who took the name from an item used in the 1986 computer game The Legend of Zelda." To my knowledge I don't think TLoZ had an item called a "genesis key." It has a "magic key" and the only references I could find for "the genesis key" on Google are a book that was published after the company was founded?
metadat 1y ago
Some dead linked content in TFA is resurrectable courtesy of archive.org (though I had to dig a bit, which is why I'm sharing): Dubya's Sectera Edge, a BlackBerry-esque Ultra Secure PDA phone: https://web.archive.org/web/20120922044930/http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html https://web.archive.org/web/20120922044930/http://www.gdc4s.... Product eventually deprecated in September, 2015: https://web.archive.org/web/20150926124453/http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html https://web.archive.org/web/20150926124453/http://www.gdc4s.... The link finally died with a site redesign in Jan 2016: https://web.archive.org/web/20160131082757/http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html https://web.archive.org/web/20160131082757/http://www.gdc4s.... Original (now deceased) link: http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html P.s. The device was somewhat comically proportioned, with thick antenna and bezels, haha: https://gdmissionsystems.com/-/media/general-dynamics/cyber-and-electronic-warfare-systems/images/secure-voice/edge-unclassified-2010-full-image.ashx?h=800&w=456&la=en&hash=3517E8C5E64D32A23423376CA5EAA1E2 https://gdmissionsystems.com/-/media/general-dynamics/cyber-... A teardown and chip analysis would be interesting! Though I imagine these devices aren't easy to come by?
curtisszmania 1y ago
[dead]
pipeline_peak 1y ago
Did anyone check out the crusty old comments on that page? >He should get a new BB10 BlackBerry
dcmatt 1y ago
Literally saw Obama's BlackBerries a week ago at the Crypto Museum! Great museum, worth going to if you're in the DC area and have access to a car.

220 points by lastdong 1y ago

(2013) Discussion at the time (83 points, 32 comments) https://news.ycombinator.com/item?id=6615066 https://news.ycombinator.com/item?id=6615066

Jaxkr 1y ago
> This would mean the White House Communications Agency has to carry such a secure base station wherever the president goes. We used to take security so seriously.
- deleted 1y ago
  [deleted]
- Aloha 1y ago
  The reality is that modern (meaning LTE) public networks are more secure today, than they have been, its also trivial to bring an LTE base station with you now - with the hardware at this point being no more complex than a controller driven wifi network.
  - PaulDavisThe1st 1y ago
    Indeed, I have an LTE base station in my office, on perpetual "loan" from T-Mobile for US$25, providing us with LTE service in an area where they have no service. It's roughly the same volume, or a bit less, as our modem/router.

evanjrowley 1y ago

I remember encountering one of these secure gov blackberry setups approximately one decade ago. The contractor who managed it up had some deep institutional knowledge. He was probably going to do that one job for the rest of his career until retirement.

deleted 1y ago

[deleted]

Jaxkr 1y ago

And now we have our top defense officials using a fork of Signal which sends copies of messages to a third party. https://www.404media.co/mike-waltz-accidentally-reveals-obscure-app-the-government-is-using-to-archive-signal-messages/ https://www.404media.co/mike-waltz-accidentally-reveals-obsc... http://archive.today/LyWDy http://archive.today/LyWDy

chme 1y ago
Not only that, but the software also contained login information to the AWS backend archive servers: https://www.techspot.com/news/107792-hacker-breaches-telemessage-system-used-us-officials-raising.html https://www.techspot.com/news/107792-hacker-breaches-telemes...
janice1999 1y ago
... the third party being run by a foreign 'former' spy whose country was being discussed in those messages.

bigfatkitten 1y ago

These days, NSA's Commercial Solutions for Classified program[1] addresses a lot of these sorts of secure mobility use cases. The underlying design principle behind CSfC is that the CNSA algorithms[2], when properly implemented are good enough to protect information classified up to TOP SECRET on their own. However, there's still a risk of exposure due to broken implementations, active exploitation or operational error. To mitigate this, CSfC's "capability packages" (reference architectures) typically use two or more cryptographic layers of different provenance to reduce the risk that a vulnerability in one layer could be used to compromise the whole solution. For a VPN for example, they will use two tunnels; an inner tunnel using a solution from one vendor, and an outer tunnel from another. There are other considerations apart from cryptography. They also specify the use of "retransmission devices" (mifi routers, basically) in favour of native cellular capability, presumably to mitigate the risk of a cellular baseband exploit being used to compromise a classified handset. [1] https://www.nsa.gov/Resources/Commercial-Solutions-for-Classified-Program/ https://www.nsa.gov/Resources/Commercial-Solutions-for-Class... [2] https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite https://en.wikipedia.org/wiki/Commercial_National_Security_A...

NitpickLawyer 1y ago
> They also specify the use of "retransmission devices" (mifi routers, basically) in favour of native cellular capability Yeah, this makes the most sense, there's no way they'd let a president's phone be connected to commercial networks. Tracking alone would be a huge issue, not to mention the plethora of ss7 abuses that can be done.
- selkin 1y ago
  s/they’d let/would have let/ According to a recent interview[0], the president has an uncontrolled phone (maybe in addition to other, approved devices). [0] https://archive.ph/2025.05.07-050707/https://www.theatlantic.com/magazine/archive/2025/06/trump-second-term-comeback/682573/ https://archive.ph/2025.05.07-050707/https://www.theatlantic...
  - 1y ago

miki123211 1y ago

It's so strange to me how little information there is on the internet about how the BlackBerry really worked. Other phone OSes, both modern ones like iOS and Android, as well as ancient ones like Symbian or even the Nokia 3310 firmware, have their internals well described. All I could find about the BlackBerry was that it used some Java-based OS, but no detailed information about its architecture, conventions, file system layouts, security properties or technical capabilities seems to be available. The communications protocols are just as mysterious, especially on the phone-to-server side. I know it required some kind of carrier integration to work, which makes me think it wasn't just a bog-standard connection over TCP/IP, but I have no idea what it actually was. There's some information in BlackBerry programming books, which can still be found in the "usual places", some old BlackHat presentations, which seem to mostly focus on the enterprise server component, as well as some company history and brief descriptions of the technical choices made in "Losing the Signal", but that's about it. Even Nintendo's OS is understood much more widely, despite Nintendo being much more secretive and litigious.

amaccuish 1y ago
Quite agree, I find it really sad. The most that is out there was about the BlackBerry Enterprise Server, but the docs were always light on details. And yes that one BlackHat presentation about SRP. I'd love to know more about the GPRS side of things, how their NOCs were connected to carriers, etc.
gjsman-1000 1y ago
> despite Nintendo being much more secretive and litigious Eh, kind of? Nintendo has never interfered with solely modding your Switch, or the tools to do so, and will not ban you for loading CFW. Install CFW, overclock your Switch, even cheat in offline games, no interference. Their lines in the sand for years have been changing your profile image to something arbitrary (and possibly NSFW), installing a pirated game, cheating online, or tampering with system logs. That’s when the ban hammer hits; and the tools for doing those get targeted.
- Nullabillity 1y ago

blamestross 1y ago

I'm increasingly of the belief that modern governments have lost all advantage in the space of security hardware and software. They only have OpSec and a monopoly on violence to leverage in order to have an improved security situation over the public sector. They don't seem to be using that OpSec superiority effectively right now. I work public-sector in supply chain security and I am terrified that the situation we currently have in the corporate world is actually the best there is.

relaxing 1y ago
Okay? What evidence do you base this on?
- ceejayoz 1y ago
  Photos of them using Signal on iPhones?
  - throwanem 1y ago
    Is that because Signal is as good or because they refuse to listen to anyone telling them to stop using it? Not a serious question, I know it'll be a decade or three before it can be answered from open sources. But of course I forgot, it wasn't really even Signal they were using...
    - NickC25 1y ago
      > they refuse to listen to anyone telling them to stop using it That's one of the reasons, yes. Their whole MO is "we have power, we are not accountable to anyone, fuck you"
      - throwanem 1y ago
        Is it? I know that's how they insist on being read.
      - deleted 1y ago
        [deleted]

yapyap 1y ago

Someone listens to the 404media podcast

deleted 1y ago
[deleted]

mschuster91 1y ago

> On March 16, 2016, AP reported that in February 2009, secretary of state Hillary Clinton also wanted a secured BlackBerry like the one used by Obama, but that NSA denied that request. A month later, Clinton began using a private server, located in the basement of her home, to exchange e-mail messages with her top aides through her regular, non-secure BlackBerry. Later it came out that this rather risky solution was also used for sensitive messages. A good reminder how IT departments need to provide solutions that actually work and are accessible to everyone. If not, "shadow IT" will emerge, rather sooner than later. And Clinton was Secretary of State, not some low level clerk.

bunabhucan 1y ago
And the lesson every us pol seems to have learned is "use signal, use protonmail."
- mschuster91 1y ago
  They're using Signal to circumvent the Presidential Records act - the US government nowadays has ample ways to officially and quickly communicate with each other, while being in compliance with recordkeeping and national secrets requirements.
  - dwood_dev 1y ago
    That is what I assumed as well. In both the current and previous admins. But as more details come out about the current admins use of signal, this appears to not be the case. They are using a shitty third party patched version of signal specifically designed to archive messages. Leaving aside the security issues with the version they are using and the lack of public facing policy, the use of a Signal variant that archives chats is a reasonable compromise. Instead of walling off users, creating a barrier to use and therefore extensive bypassing of the security standards, they have met users where they are and provided them with what the user cannot distinguish from official signal. This allows them to interface internally and externally through signal, preserving records and maintaining a much better level of security than the other options. This represents a huge breach of trust between external parties and government signal users, but most of the government signal users are probably completely unaware that it's being logged. My issue is not that they are using Signal. I think it's one of the better options. My issue is that they use a shitty version of it when there should be an in house maintained version for government use.

jabroni_salad 1y ago

this website also has some weirdly captivating articles about presidential desk phones in the sidebar.

traceroute66 1y ago

All seems rather cute when these days you can just chat about classified stuff with whoever you like on your presumably unsecured phone. And then have an unsecured internet line connected to an unsecured computer in your Pentagon office[1] [1] https://abcnews.go.com/Politics/hegseth-signal-app-connected-dirtly-line-computer-pentagon/story?id=121142551 https://abcnews.go.com/Politics/hegseth-signal-app-connected...

tehjoker 1y ago
in fairness, since these guys are just doing war crime after war crime, it's a good thing if it leaks
- yubblegum 1y ago
  That does unfortunately add the element of incentive to win at all costs to the picture. c.f. PM of Israel.
  - tehjoker 1y ago
    it's true that the US-axis powers are extremely dangerous and short sighted, but they are also weakening. let's hope for victory over the empire.
    - yubblegum 1y ago
      which empire? the energy cartels or global finance? The national baton is passed on as cursory reading of Western history over the past few centuries [shows].
      - tehjoker 1y ago
        let's hope it's reaching its endpoint friend. it seems like the natural country to pick up the baton is China, but they have a sufficiently different economic system that maybe there will be a break in the chain. it depends on the strength, rationality, and solidarity of the CPC.

VectorLock 1y ago

As a completely random aside the article mentions "This company was founded in October 2008 by W. Steven Garrett, who took the name from an item used in the 1986 computer game The Legend of Zelda." To my knowledge I don't think TLoZ had an item called a "genesis key." It has a "magic key" and the only references I could find for "the genesis key" on Google are a book that was published after the company was founded?

metadat 1y ago

Some dead linked content in TFA is resurrectable courtesy of archive.org (though I had to dig a bit, which is why I'm sharing): Dubya's Sectera Edge, a BlackBerry-esque Ultra Secure PDA phone: https://web.archive.org/web/20120922044930/http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html https://web.archive.org/web/20120922044930/http://www.gdc4s.... Product eventually deprecated in September, 2015: https://web.archive.org/web/20150926124453/http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html https://web.archive.org/web/20150926124453/http://www.gdc4s.... The link finally died with a site redesign in Jan 2016: https://web.archive.org/web/20160131082757/http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html https://web.archive.org/web/20160131082757/http://www.gdc4s.... Original (now deceased) link: http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html http://www.gdc4s.com/sectera-edge-(sme-ped)-proddetail.html P.s. The device was somewhat comically proportioned, with thick antenna and bezels, haha: https://gdmissionsystems.com/-/media/general-dynamics/cyber-and-electronic-warfare-systems/images/secure-voice/edge-unclassified-2010-full-image.ashx?h=800&w=456&la=en&hash=3517E8C5E64D32A23423376CA5EAA1E2 https://gdmissionsystems.com/-/media/general-dynamics/cyber-... A teardown and chip analysis would be interesting! Though I imagine these devices aren't easy to come by?

curtisszmania 1y ago

[dead]

pipeline_peak 1y ago

Did anyone check out the crusty old comments on that page? >He should get a new BB10 BlackBerry

dcmatt 1y ago

Literally saw Obama's BlackBerries a week ago at the Crypto Museum! Great museum, worth going to if you're in the DC area and have access to a car.