Gemalto is a manufacturer of mobile phone SIM cards based in the Netherlands. If you have a mobile phone, there is a good chance you have a SIM card manufactured by Gemalto. They also manufacture smart cards and identity validation solutions for financial services and government.
It has been revealed that Gemalto has been hacked by US and British intelligence agencies (GCHQ and NSA) and the encryption keys that encrypt the communication between your phone and the mobile phone network have been taken. This means that messages and calls can be intercepted and decrypted with ease by intelligence agencies. And anyone else who has these keys.
This arguably (in my view definitely) represents a particular risk of a breach of the security of the public telecommunications network.
In Ireland, Section 4(4) of SI336, the legislation that enacted the 2009 ePrivacy Directive (the “cookies law” as it has incorrectly become known) places a specific requirement on telecommunications companies to inform their customers of the issue without delay and, where the phone company isn’t in a position to fix the issue themselves they have to advise on steps that can be taken to minimise risk.
(4) In the case of a particular risk of a breach of the security of the public communications network, the undertaking providing the publicly available electronic communications service shall inform its subscribers concerning such risk without delay and, where the risk lies outside the scope of the measures to be taken by the relevant service provider, any possible remedies including an indication of the likely costs involved.
That Section enacts verbatim the text of Article 4.2 of the original 2002 ePrivacy Directive.
Irish telcos have been required by the Data Protection Commissioner in the past to provide blanket notification on their website regarding smishing (SMS-based phishing) threats and similar risks to the security of data on their networks. This is a whole level of complexity higher again.
The threat of unauthorised interception of GSM calls was perceived as relatively low risk due to the calls being encrypted between device and the network. Some threat vectors were identified, but in general the view was the encryption on any call would need to be cracked on a case by case basis. Now that encryption cannot be relied on. There is a particular risk.
My view is that telcos in Ireland, and potentially other EU countries, would need to inform their customers, and telcos should ideally be looking for a solution to reinstate the security of the SIM-to-Network link and issue new SIM cards to their subscribers. While National Security is outside the remit of the Data Protection laws and ePrivacy directives, that should be interpreted narrowly to relate to the actions of the Intelligence services in their spying. Hacking Gemalto may have been just on the right side of the line (I’m not saying that it is). However, it creates a problem for Telecoms companies in that the day to day operation of their networks is not a National Security or Intelligence service activity and the networks are now compromised if the telecoms company uses Gemalto SIM cards.
That will be costly and complex and, inevitably, telecoms companies will pass the cost on to their customers (it’s a tight margin business at the best of times, and reinstating a chunk of your customers with new SIMs is not to be undertaken lightly).
Of course, it requires EU Data Protection Authorities to engage with the companies in their jurisdictions to ensure they are acting in compliance with the relevant legislation. And that means ALL EU Data Protection Authorities, not just the one that everyones likes to beat up on for being “light touch”.
[Update: What about National Security and Criminal investigation exemptions?]
The Data Protection Acts in Ireland, and equivalent legislation across EU, has limited exemptions for activities of law enforcement and intelligence services relating to National Security and the investigation of criminal offences. This is being relied on by the UK ICO in relation to the Gemalto hack (see https://twitter.com/lisafleisher/status/569482404521496576/photo/1)
And I agree. In the context of the specific action of an intelligence service, the Data Protection Authorities have little authority due to the exemptions given under current legislation (Note: the exemptions are still subject to the Article 8 ECHR provision around a right to personal data privacy, which has been ruled on by the CJEU in the context of mass surveillance). So, in relation to the actual accessing of a company network and taking encryption keys, there is no role for a Data Protection Authority. In the conduct of intelligence service and law enforcement activities, Data Protection Authorities have very limited roles.
However, the fact that the keys are no longer under the control of Gemalto creates a “particular risk of a breach of security” in a communications network. So, telcos would still, in my view, need to give serious consideration to their obligations under Article 4.2 of the ePrivacy Directive. Yes, it is an intelligence agency (or two) that has the keys. Yes, they may have, in certain circumstances, a legitimate national security or criminal investigation purpose and associated exemption. But a risk to security of a public telecommunications network exists, and telcos are required to do something about it under Article 4.2. And that is something that national Data Protection Authorities are entitled to enforce.
In effect, the action that a telco needs to take should be no different than if a criminal organisation had executed a similar attack on a SIM card manufacturer. Because Article 4.2 doesn’t include a “… unless the particular risk arises from an action of an authorised intelligence agency or law enforcement body”. And, as I’ve said earlier in this post, the Irish DPC has previously required telecommunications companies to provide blanket notifications about the risk of Smishing as a security issue in the public telecommunications network.
I believe that telcos need to have some alert to customers about the risk that has been created.
For example, any telco that uses Gemalto SIMS could use a notice like this on their website:
It has been reported that the encryption keys for SIM cards manufactured by our supplier Gemalto have been taken by intelligence services acting, as we understand it, within their legal remit. These keys keep your calls and messages private and secure in our network in the normal course of activities, and this action creates a risk that calls and messages which would otherwise be encrypted between your device and our network can now be intercepted by anyone in possession of the correct encryption key without our knowledge. While we have no reason to believe the keys will be misused by the intelligence agencies in question or any other entities, a risk to security in the network does exist. We continually examine our options to keep your data safe and secure in our network and will provide updates on this situation as they arise.
Wording along these lines would meet the requirement of Article 4.2, and doesn’t take away from the legitimate access to telecoms network traffic and call data by intelligence services and law enforcement for the investigation of crimes or national security purposes. It has the added bonus of showing that the telco takes data security seriously enough to at least try to comply with the letter of the law.
It doesn’t get around the mass surveillance issues that arise when any call from any device using a Gemalto SIM can be decrypted, which almost certainly raises issues under Article 8 of the Charter of Fundamental Rights. But that is not the telecommunications companies’ issue to address, nor is it a matter for Data Protection Authorities. It’s one for Governments.