Idealistically Caspan

Well as most of you know last week RIM suffered not 1 but 2 major outages to there NOC (Network Operations Center). This occurred due to the fact that by design BlackBerry’s are designed with security in mind and being paramount. BlackBerry’s are in my opinion one of the most secure devices to use when dealing with sensitive emails and data transmissions (The US government military use them so I am guessing they are secure enough for you and I). The reason BlackBerry’s are so secure is the design of RIMs security model that routes all traffic through RIMs NOC using encryption, this way all traffic is useless if intercepted and is only decipherable by RIMs servers and services. The problem with this is that if the NOC suffers an outage all services that are supplied by that server or services or NOC are down until the outage can be corrected.

How does this effect you? Well you can’t get email, Live Messenger, Facebook or whatever service went down until its been corrented and brought back online! What!!!! Are you kidding me? (reaction of some consumers to the outage last week). As RIM starts to draw in a larger consumer base that is not business oriented and care less about security this reaction is almost expected. Most business uses like myself will deal and dealt with the outage and continued when it was back up. I live, breath, and die (not yet) by my device. Like most of you I combined all my devices into one for convenience, I carry it with me at all times, so don’t get me wrong I feel your pain when these services go down.

So the question was proposed by Kyle at BlackBerry Cool (http://www.blackberrycool.com/2009/12/28/is-rim-in-need-of-more-redundancy-to-prevent-outages/) does RIM need more redundancy or more NOCs to prevent these outages? That got my brain turning and you all know what happens when my brain starts thinking (no smoke does not come from my ears) it comes up with an idea. So to that question from Kyle I answer….. it depends what caused the outage.

With the last 2 outages caused by a software programming issue with BlackBerry Messenger I would say that no matter how many distributed NOCs or redundant services or services you have it would not have stopped this issue (unless this is the story RIM gave the public because someone tripped over the cord to the network gear and didn’t see it for 8 hours). I believe from what I have read that no matter how many NOCs you have the same problem would have happened to all of them resulting in all of them being effected until it could be corrected.

Well what is the solution then? One of the best solutions…. Give the power to the people! Say what!?! Are you crazy, give people power over the NOC? Nope, give people the control as to how the BlackBerry communicates during an outage. If an outage occurred and consumers were given the choice to switch to an insecure network, most would say “hell yeah, like I care I’m just planning a movie with my wife over IM+”. This of course would be preceded with a “Are you sure you wan to switch to an insecure network?” just to make sure the user know what they are about to do. Users could then continue on there merry way but would not be able to use effected services of course in this case BlackBerry Messenger or anything else that requires the NOC to operate. Once the NOC corrected the problem a push update would go out to all BlackBerry’s and switch them back to the secure RIM NOC connection and notify them the services were back up. I know you business readers are screaming security in your mind right now, don’t worry you would be given the option through BES to block this feature on business devices. These users would be forced to wait for the outage to be corrected before using services again.

From working at major NOCs myself, outages can occur from upstream providers, network issues, failed servers or services on those server. I can assure you there is redundancy in RIMs infrastructure and services or else RIM could not of made it his far without them. I bet the farm on it!

© Caspan 2010

Well it’s Monday and I though I would post some more ideas to my Blog. This idea I have made some emails to people inside RIM but heard nothing back so far, Douglas Soltys I’m looking at you!! (BTW I’m poking fun at Douglas he has made a comment that something this big is not easy to distribute and get feedback from internally)  This idea has been born out of the new “distracted driving” law in Canada, Ontario (I’m sure were not the only place that has this law coming into law or already in place). Which basically gives any police officer the right to pull you over and ticket you if they feel like you are being distracted by anything in your car.. Yes this means you smoking guy, holding a Tim Hortons’ cup,  steering with your knee, shaving while talking on your cellphone in the rear view mirror!

I support this new law 100% percent, why? well because we have gotten away with it for such a long time and the excuse was always “well it’s not illegal!” I get it because I am one of those people I use my BlackBerry 100 times a day on the road and I have finally started to cut back my use (I only SMS while driving and email at stop lights) I’m kidding BTW…  The only part I actually don’t not agree with is not in the law itself but in the enforcement, the grey area of what is considered to be “distracted”? So to me this law says even if I am changing the radio station I am considered to be distracted, I don’t know about you but I can never figure out how to change radio stations on my car stereo. I am a tech whiz but when it comes to radios just give me the old tuner knob back… What can we do about that? well nothing I guess we have always been a victim of the system that says we get to tell you what is right and what is wrong and it is at our discretion to enforce it.

I guess when it comes right down to it we believe driving is a right but it truly is a privilege that we have all slacked on the rules. There is no excuse you could ever give if you took a life while driving and using a distracting device. The same as no one could every give you an excuse good enough if someone took the life of one of your family members. Hind sight is 20/20 and only after would you see how stupid or unimportant it was to make that call or send that message. My one rule of thumb that I always use in security, parenting and every day life is “If you ever had to explain what happened to someone else, Wife, Boss, Police, Judge without lying would they understand and think you make the right decisions?” if the answer is no then you are taking a risk and you must be ready to deal with consequences of those risks.

Well enough seriousness.. being a gadget geek and loving to try all the new technology coming out about 2 years ago I decided to buy an after market stereo for my Mazda Protegé 5. I did a lot of hands on research at my local car stereo dealership Autosonics to see all the head units that they had on display and how well they worked with the Bluetooth that was built into the Curve 8310. You would be surprised with the amount of device that say they are Bluetooth compatible but were just painful or impossible to pair. I finally settled on a Pioneer single Din unit. The stereo worked great with my iPod with Bluetooth streaming audio until I started to use it for hands free and I had quite the problems with it. Needless to say Pioneer stepped upto the plate and admited to an issue that could not be changed and replaced my unit with a different model FH-P800BT. The unit resolved my hands free issues and I was happy again and faith was restored in companies that go the distance to help you.

Now! I make some job changes and some device changes over to the Bold. With the new job comes BES and security polices. One of these new polices on my device is that the device must auto lock after 10 minutes. As a security conscious person I agree with this. One downside to this policy is that you are not allowed to make outgoing calls when the device is locked. This options can be changed but most companies would not want to allow unauthorized use of a cell phone that was lost. So here births the problem which is the reason for this episode. When my BlackBerry is locked in my pocket or in its holster I am not allowed to make outgoing calls. So now to use my hands free I need to first retrieve my device and unlock it, then I can make a hands free call. Kind of defeats the purpose of hands free I think!

Okay so what our our options? Turn off security and don’t lock the device? Nope not going to happen! Allow outgoing calls when the device is locked? Well this would work but again not ideal for security. So what are we left with for options? Well nothing really, if you want to be safe you have to sacrifice security and vice versa. The only other option I can think is invent something!! Now we’re talking my language.

The following is how I believe we can solve this issue on all BlackBerry devices currently out. It would require some work by RIM but I’m sure they are up to it.

My idea involves the need for a verbal password to be spoken to use hands free when the device is locked. What would happen is that when a security policy is pushed or a user sets a policy that involves the device to not allowing outgoing calls when locked and the device is set to lock after X minutes and no verbal password is set. The device would warn the user on the save of these setting as follows “Warning you have chosen to not allow outgoing calls when the device is locked. This will prevent the use of hands free devices! Would you like to set a verbal password to still be able to ensure the use of hands free?” to this question the user could respond Yes or No.. we need to give them and option because to be honest not everyone uses hands free non could they care about touching their device while driving.

If the user chose No then the device would operate as it does now. If the user chose yes it would open a very small application that would ask you to please speak a phrase to use hands free while the device is locked. To which the user would say then repeat 2 times to ensure correctness a pass phrase. The device would then store that data that is unique to that user.

When the user goes to use hands free the next time you will hear the familiar female voice but instead of “Say a command” you will be prompted “Please say your hands free pass phrase!” to this the user can just speak their pass phrase they set earlier. This would unlock only the phone functions of the device and next you would hear the “Say a command!” and you can proceed with your hands free call without ever touching the device.

Once the call is finished the device would lock up again as normal. If you require to make another call you would need to speak your pass phrase again. I’m sure if it became a real problem to people that make a lot of calls in the car to unlock outgoing calls for x minutes so this would allow for some grace period of being unlocked.

As you could imagine the security people out their are saying “Well now everyone in the car knows the pass phrase!” To this I would calm the question with the fact that the pass phrase is tied to the voice of the person that set it and even if someone could record it and play it back to trick the device… they can only make phone calls. Yes it sucks but it is a level of defense to stop the other side of the coin which is unsecured full access to placing calls.

Also another option could be the ability to have multiple people be able to store a password should you and your wife use the same phone while on the road.

Sorry I don’t have a video or pictures to show you this one like my other episodes. This is more vapor ware that does not exist yet but would love to see on all RIM devices.

© Caspan 2010