How Obama’s BlackBerry got secured (2013)

According to a recent interview[0], the president has an uncontrolled phone (maybe in addition to other, approved devices).

[0] https://archive.ph/2025.05.07-050707/https://www.theatlantic...

I believe this has been the case for him and all of his senior staff since the beginning of his first presidency

See for example this from 2017:

> Despite universal warnings from security experts in and out of government, Donald Trump is apparently continuing to use an insecure, off-the-shelf Android phone

http://lieu.house.gov/media-center/in-the-news/congressman-c...

I remember reading news articles on the topic at the time, and finding it egregious how relatively little attention it got, compared to the massive and coordinated ”lock her up” campaign against Hillary Clinton

> It was basically Nextel DirectConnect for texting / “the wire” for corporate people

What does "without user assignment" mean here. Not an American and not that familiar with the American telecoms environment of the early 2000s, so while those names ring a bell (no pun intended), I think the comparisons escape me.

The Secretary of State should have a secure mobile communication device, as should most everyone else in national security positions (and other jobs). It's absurd that they didn't. Just think of the productivity hit and the capability hit - imagine how it interferes with responses to crises.

Who here would tolerate it at their workplace?

She was a neocon warhawk who was shrill and unlikable. There were a lot of reasons she lost. The blackberry was the smallest part of it.

It's also distinctly possible that if the government had enacted appropriate oversight over it's cabinet level secretaries that the illegal configuration would have been detected and remediated before it became an embarrassment.

It could be ego. It could just be the hold of the crackberry. I didn't know many people that were full on in thrall to the Temple of Blackberry, but those few were willing to do what it takes to keep using them (until eventually they gave in and accepted the inevitable loss and usually moved to iPhone)

I had to spend about a week to figure out how to get a Blackberry to send DKIM compliant email before I could turn on DKIM. One of the acceptable alternatives for the CEO was just enabling anyone with a blackberry to send email from our domain.

When a was in grad-school, "state level actors" were the boogeyman. You were told to just assume that everything would be compromised to them.

I ended up specializing in p2p systems (distributed hash tables, overlay networks, communication systems) and "State Level Actors" become "in scope" for me. Modern cryptography is focused on the capabilities of hypothetical computers and making radically more computational power required than is reasonable to expect of current human economies. Backdoors in the codebases for encryption is a fun hypothetical, but the level of scrutiny they are under would require a conspiracy beyond any i could imagine to hide.

Eclipse and Sybil attacks were the real threats. Those are Operational attacks, not Signals.

Now that I have spend a decade in the security industry in larger corporations. "State Level Actors" are entirely in the threat model. We don't talk about it explicitly, but these companies stand to loose globally if any one government compromised them. Government funded actors are assumed to be the primary threat. Supply chain attacks like XZ are the ones that scare us, the ones we might have missed. That came from superiority in operations not technical superiority. They actively pay me and a bunch of other people a LOT of money to actively detect and prevent issues like this.

The other side of the argument is a human organizational one. The story of this decade of military spending is outsourcing. Biden's Supply Chain Security EO and the new DoD software procurement requirements are bandaids on gaping wounds.

Even with it's massive defence spending budget, the TLAs couldn't keep up with the industry while also securing all its software. They have 3rd party dependencies too. Assuming that they don't just allways directly outsource.

And why bother? These companies have the entirety of human communications MITMed. Why bother with a complex secret system when a FISA warrant is cheaper and more efficient. PRISM(For attack) and TOR(For defense) stand out as successes of operational attacks. They don't need technological superiority.

I fully expect TLAs maintain an android fork and linux forks, but that is opsec for dependency management, not adding special sauce. The industry simply has more resources and more eyes on the problem than the government could ever afford.

The last part is simple "Brain Drain". The people who are really good at this generally don't want to work for the government and have done too many drugs to ever get clearance. Unless they have a lot of security engineer salaries in classified budgets they also can't afford us. Governments have direct agents that are underpaid and underskilled and they have working relationships with criminal organizations who work deniable offense for them.

Opsec is clearly their leverage-able resource, why not lean into it almost exclusively?

The way governments can have an advantage is in where and how those services are managed. Events like "signalgate" scare me because it means we are not leveraging that effectively due to bad managers.

Irrelevant. One, we’re no longer in an era of international rules-based order. All the great powers agree on this.

Two, the definition of war crimes has expanded so broadly as to include any collateral damage. This overinclusiveness has rendered the term meaningless, with everyone calling everything they don’t like a war crime.

There will be consequences for this administration. But not because they bombed a terrorist commander.