NSA can easily decrypt private cell calls

A document from the seemingly inexhaustible trove delivered by former NSA contractor Edward Snowden shows that the NSA can easily break the old and weak algorithm still used to encrypt billions of calls and text messages all over the world.

Developed in 1987, the A5/1 privacy algorithm – more commonly known as the GSM algorithm – has been cracked repeatedly by researchers, the last time in late 2009 by Karsten Nohl, chief scientist at Security Research Labs, and his team.

Despite that fact, it is still widely used by cellphones relying on the second-generation (2G) GSM technology. Sometimes even if the phone shows that a 3G or 4G network is used for the call, a 2G network is used in the background – especially where the connection is of inadequate quality.

More than 80 percent of cellphones worldwide use weak or no encryption for at least some of their calls, Nohl commented for The Washington Post. Finally, hackers can trick phones into using the less-secure 2G netwoks.

This NSA capability would not be such an important piece of news were it not for its recently revealed ability and propensity to collect phone call data and intercept phone calls around the world – most notably those made by high-ranking foreign government officials such as the German Chancellor Angela Merkel.

“The extent of the NSA’s collection of cellphone signals and its use of tools to decode encryption are not clear from a top-secret document provided by former contractor Edward Snowden. But it states that the agency ‘can process encrypted A5/1’ even when the agency has not acquired an encryption key, which unscrambles communications so that they are readable,” noted WaPo’s reporter Craig Timberg and independent security researcher Ashkan Soltani.

“Experts say the agency may also be able to decode newer forms of encryption, but only with a much heavier investment in time and computing power, making mass surveillance of cellphone conversations less practical.”

But implementing better forms of encryption is pricy, and that is likely the main reason why cellphone service providers haven’t jumped on the wagon before. Since the revelation of the tapping of Merkel’s phone, two leading German have stated that they will be implementing (still breakable, but stronger) A5/3 encryption for their 2G networks.

Let’s hope other providers – in Germany and in the rest of the world – will follow suit.