'Merkelphone'
December 3, 2013The German telecommunications company says its Simko phones offer the same level of security to government and corporate clients as the Simko device that Telekom made for German Chancellor Angela Merkel. It hopes its platform will become a standard that other European Union governments - and perhaps the EU itself - can use to thwart spying.
Secure connection
"The idea behind Simko is to project your own infrastructure," said Michael Bartsch, head of mobile security at Deutsche Telekom. The company is making its network secure, Bartsch said. The phones then link up to the secure network through an encrypted gateway, he explained.
Bartsch said that Simko should allow, for example, a German businessman in Africa and his colleague in Paris to talk, email, and chat securely.
The Simko phones do this via an encrypted connection to a company's network. That network then connects the calls by means of a server in Germany. This is intended to assure that only trusted devices can interact with one another.
Previous versions of the Simko platform used iterations of the Android or Windows Mobile operating systems. Telekom's newest release, SiMKo 3, uses Samsung Galaxy S3 phones, and allows encrypted voice calls through over Wi-Fi and 3G.
Bartsch said only militaries or governments sought encrypted voice communications, until about three or four years ago.
"It's new for the consumer market," Bartsch said. While the service works in cities, where mobile networks are robust, the connection is not as good in the countryside, he conceded.
Modified Galaxy
SiMKo 3 (pictured below on a Samsung) is based on Samsung's Knox platform, which allows two operating systems - a secure Linux OS, and an open Android OS - to run concurrently on the same device. Telekom has described one of the main selling points of Knox that employees will no longer have to carry around two separate devices for work and personal use.
Samsung's Knox phone is essentially a Galaxy 3 with a few key modifications - most important among them including a chip that constantly monitors the heart of the phone, and a Linux kernel that assures that the two operating systems and their respective data remain separate.
The kernel (a small software program that is difficult to hack into) alerts either Samsung or a government's IT desk when malicious code has compromised the phone, and then preemptively locks the phone.
Telekom says European governments and companies approached it in search of non-US secure mobile communications services. The company says one of Simko's biggest selling points is anonymity - it says it doesn't store any user data on its servers.
The company doesn't even know who is using the devices, Bartsch added: "It could be the CEO or it could be the porter. We don't know."
Overpriced and hackable?
But critics of Telekom's platform point out that it is extremely expensive: each device costs about 1,700 euros ($2,310). A company would have to buy more than one, plus pay thousands in consulting and hosting services from Telekom, to use Simko3.
A German tech industry CEO contacted by DW said he thought Simko had its merits, but felt that app-based secure chat and voice programs - like RedPhone or SilentCircle - were more cost-effective alternatives.
"Microphone logging could be an issue through a backdoor in the Android or Apple iOS - in that case, Silent Circle wouldn't help you. But most business people will never have to worry about this problem," the CEO said.
Privacy advocates in Germany and the U.S. also faulted Telekom for not using encryption technology that has been subjected to peer analysis.
Christopher Soghoian of the American Civil Liberties Union said that in the wake of the NSA scandal, and allegations of government backdoors in some encryption techniques, the only systems that users should trust are those that are open source.
"Think of it this way: seeing backdoors and seeing mistakes are two different things," Soghoian said. "No one can write 50,000 lines of perfect code. The NSA and other intelligence agencies employ sophisticated hackers to find these mistakes."