NTC requires wireless firms to report on network security

By Erwin Lemuel Oliva INQ7.net

THE National Telecommunications Commission (NTC) has asked Philippine mobile phone operators in a closed-door meeting on Wednesday to submit a report on how they secure their networks.

This is in the wake of the current exposé on alleged wiretapping of President Gloria Macapagal-Arroyo's mobile phone conversations, supposedly with a poll body official, an NTC official told INQ7.net.

The report will be used as additional information in a joint investigation of the wiretapping incident by the NTC and the Department of Transportation and Communication, according to NTC Deputy Commissioner Jorge Sarmiento in a telephone interview.

For two hours, Sarmiento and NTC Commissioner Ronald Solis met with legal and technical representatives of Globe Telecom, Smart Communications, Bayantel, and Sun Cellular to solicit information on

how they secure their GSM networks from eavesdropping or interception.

The NTC official said the operators assured the NTC that they have internal measures in place to ensure the security of their communications networks. The operators admitted however, that they “have no way of preventing eavesdroppers from intercepting GSM calls,” Sarmiento said, quoting local mobile phone operators.

“But they assured us that the calls [are] all encrypted," he added, saying that it’s the job of the operators to ensure that mobile phone calls are not vulnerable to eavesdroppers or interception.

"If they say that they had no way of detecting external attacks, then we think they're not doing their job to protect their subscribers," the NTC official added. "I believe the operators should not wash their hands [of] the possibility of such external attacks from happening."

The NTC deputy commissioned appealed to Malacañang and the National Bureau of Investigation to provide them the necessary information to aid their investigation.

"In the first place, we still have to establish if the wiretapped call was intercepted over the air. We need to know this first because right now we're just working on what we read in the newspapers," he added.

In separate interviews, spokespersons of Globe Telecom and Smart Communications had stressed earlier that intercepting GSM calls were impossible. "Our supplier guarantees that our network cannot be tapped. This has been the case for the past 10 years. But in any case, we still have to establish if those taped conversations were indeed intercepted over the air," said Jones Campos, Globe Telecom’s assistant vice president for public relations.

"They are now asking us to report on how secure is our networks but they’re not considering that this can affect our business," he said, adding, “Neither is it clear whether the wiretapped conversations were from a mobile phone call or a landline call.”

Ramon Isberto, head of public affairs of Smart Communications, for his part said that the mobile phone operators are "as much the victims here." "This is something that we don't want to happen to our subscribers, especially to that special subscriber [Macapagal-Arroyo]," he quipped.

Former Alcatel executive Jun Lozada, for one, believes that, “Mobile phone calls using the GSM network can be scanned and intercepted using a special equipment. Operators use scanning equipment to test their network. But in the matter of intercepting calls, this is a different matter," he told INQ7. net in a telephone interview.

"If a testing equipment can scan GSM calls, then it is also possible to intercept it. But only law enforcement agencies can avail of such equipment," said Lozada, a certified electronics and communications engineer who worked for Alcatel for 10 years.

"There's no doubt that a law enforcement agency agent from the present or past administration intercepted those calls. So it's possible to eavesdrop on the existing GSM network," he observed.

He revealed that law enforcement agencies, past and present, have been using such special eavesdropping equipment - worth about half a million dollars - for anti-terrorism and anti-kidnapping activities in the Philippines the past years.

"So there is really good use for this technology. Marami nang na-resolve na cases sa Pilipinas using this technology (A lot of cases have been resolved in the Philippines using this technology). So let's not put the jobs of these good people in law enforcement [in] jeopardy due to some political interest of some people," Lozada added.

Eavesdropping on GSM calls is not really a technical issue because it is now possible if you have the money buy such equipment, he stressed.

What GSM is all about

Philippine mobile phone networks are currently using a technology called GSM, short for global system for mobile communications. It is a digital mobile telephone system now widely used in Europe and other parts of the world.

A mobile phone is essentially a radio. Whenever a phone call takes place, a call (audio signal) is encrypted into a digital signal and transmitted over the air using a specific frequency. This encrypted digital signal is transmitted by so-called base stations to the intended receiver. The digital signal is then decrypted and assembled back into an audio signal that you can decipher. It works like a walkie-talkie, albeit a more sophisticated one.

A ZDNet article on May 2005 however quoted a Melbourne-based firm on the possibility of intercepting and decrypting GSM network calls using special scanning devices.

"There are devices available for interception and decoding [GSM calls] in real time? Although they are strictly speaking illegal in most countries, you can buy them," Roman Korolik, managing director of SecureGSM was quoted as saying in a ZDNet article. Krolick believes these scanners are already being used to intercept sensitive GSM calls.

In 1999, Finnish professor Lauri Pesonen of the Department of Computer Science and Engineering at Helsinki University of Technology exposed the security risks of GSM networks He wrote in a paper that the "GSM security model is broken on many levels and is thus vulnerable to numerous attacks targeted at different parts of an operator's network? If somebody wants to intercept a GSM call, he can do so. It cannot be assumed that the GSM security model provides any kind of security against a dedicated attacker."