Sriram Prakash Econ 106T Research in Motion: Are BlackBerry’s too secure? Research in Motion – RIM, best known for it’s BlackBerry device, is currently facing increasing pressure from developing nations to grant governments access to BlackBerry encrypted data. This demand from RIM’s crucial future markets like India, China, Saudi Arabia, and the UAE poses several long-­‐term strategy questions for RIM and is a result of RIM’s product differentiation in the market place. Instead of simply offering a phone solution RIM goes one step further and provides servers essential for the encryption and security of data. The data governments are demanding access to compromise of BIS – BlackBerry Internet Service, the personal e-­‐mail service offered by RIM; BES – BlackBerry Enterprise Server, the enterprise e-­‐ mail service, and BBM – BlackBerry Messenger, which is an international messaging feature used for inter-­‐blackberry communications. BlackBerry must compromise with governments to ensure they have access to developing markets critical for both their enterprise and personal customers. Research in Motion is today known entirely for it’s prominent BlackBerry device, but its origins started in 1984 as a computer science consulting business whose first application enabled businesses to conduct credit card transactions. From there RIM branched out to developing video processing technologies and other services, until the founders had their billion dollar idea in 1992: to offer e-­‐mail on the belt’s of executives for free. The device initially started out as a two-­‐wage pager and in 1997 evolved into the cell-­‐phone, e-­‐mail combination device seen today. RIM built the original BlackBerry device with the enterprise market in mind, which resulted in a device with unprecedented levels of security. The complete inability to access any data transferred on BlackBerry’s three data channels – BES, BIS, and BBM, once the reason for its high growth rate, have resulted in many

foreign governments contemplating the complete ban of all BlackBerry devices. Every BlackBerry has a unique PIN, which is used to communicate with RIM’s servers located exclusively in Canada, which deliver all the devices capabilities. Thus foreign governments currently have no access to the servers, located in foreign countries, which data is stored on. The BlackBerry security design for enterprise customers is purposefully made to exclude the capability for any third party, including RIM, to read encrypted information under any circumstances. RIM has said numerous times that they simply do not possess a master key to decode BES information. A BES server is hosted by the corporation using it and allows the company to monitor and archive everything on all company BlackBerrys, which are gateways to company’s email systems. “Emails sent on BES are encrypted end-­‐to-­‐end, from sender to recipient, and notoriously difficult to intercept and decrypt—a main differentiator for RIM. Indeed, the White House uses BlackBerrys for its internal communications” (CNN Money). The security architecture for enterprise customers is based on a symmetric key system whereby customers create their own key and only the customer ever possesses a copy of their encryption key. "RIM does not possess a master key nor does any back door exists in the system that would allow RIM or any third party to gain an unauthorised access to the key or corporate data. It, therefore, would be unable to accommodate any request for a copy of a customer's encryption key since at no time does RIM, or any wireless network operator, ever possess a copy of the key” (India BusinessWorld). BlackBerry Internet Service (BIS), for consumers, is on the otherhand far less secure than it’s BES counterpart. BIS still uses RIM’s servers in Canada, which make it impossible for governments to currently tap, however the service does not use the symmetric key system for encryption present in BES. This means that messages sent over BIS are no more secure than messages on other smartphones. BlackBerry Messenger, which utilizes RIM’s PIN technology, is routed through the same less

secure BIS servers. While governments could theoretically intercept BBM and BIS data without the help of RIM, this data would still be encrypted and very difficult to crack. RIM’s long-­‐term strategy going forward will be to balance the needs of the enterprise with the demands it faces from governments leery of giving its citizens access to unmonitored communication. Balsillie and Lazaridis, the founders of RIM, think that their biggest growth opportunity may lie outside the U.S. Foreign consumers are only beginning to embrace smartphones in large numbers. And Finnish phone giant Nokia long the global powerhouse, has been losing share rapidly (CNN Money). So RIM has begun positioning itself in foreign markets, forming partnerships with 475 carriers in 160 countries in recent years. "The thought that Latin America and Western Europe could someday be like North America in terms of market penetration gets us very, very excited," says Balsillie. (CNN Money). RIM needs to address the way in which it deals with foreign governments and the solutions it can offer them to stay in the market place. Decrypted access to BES data, a demand made by India and Saudi Arabia, is impossible with the current security structure. These two markets have one million, and seven hundred thousand BlackBerry users respectively; with India already the world’s second-­‐largest wireless market after China (NY Times). RIM’s current solution, which is yet to accepted by the Indian authorities, is to not directly provide governments with the messages but would identify corporations whose servers hold readable or unencrypted versions of the messages. Indian authorities could then seek access to the messages from the corporation through a court order or other legal process (NY Times). “This approach, if accepted by India, would allow R.I.M. to live by its public commitment to not directly help governments decrypt corporate e-­‐mail messages sent over its devices and servers. Analysts say that the company has been successful in large part because corporate and government clients trust that it closely guards the security of their messages” (NY Times). Providing governments with the names of corporations implementing BES servers potentially exposes those firms to government pressure, and it questions whether

or not corporations will continue to use the service. Bruce Schneier, chief security technology officer at BT, told the Associated Press that RIM’s Saudi arrangement is similar to deals struck in Russia and China. He also warned that every time RIM strikes such a deal, it undermines its claims about its security system’s integrity. (Cnet). RIM is taking a different approach to BIS and BBM data, as these messages can be decrypted by BlackBerry servers. According to a Saudi Communication and Information Technology Commission (CITC) official, RIM has agreed to install a relay server in Saudi Arabia, effectively allowing authorities to observe messages sent by BIS from and within the country (NY Times). This relay server will also enable real-­‐time monitoring of BBM messages. RIM has fulfilled the requests of India, China, Saudi Arabia, and Russia to provide access to BIS and BBM data to avoid banning its services. Addressing these security concerns are not only crucial for BlackBerry’s enterprise customers, but also for ensuring their continued success in the consumer market. RIM will see it’s future growth stem from the consumer market, and not the enterprise, which RIM has a stranglehold on. In 2008 Apple had a paltry 6% of the enterprise market, a year later this figure jumped to 20%. Looking at simply this data would indeed by bad news for RIM, however it’s market share went from 76 to 74 percent. Apple’s main gain came at the expense of the Palm Treo (CNet). This can be attributed to two things, first is the extremely high switching costs of moving from RIM to another platform. When RIM penetrated the enterprise market they had to use proprietary servers and systems with high initial fixed costs. This makes it extremely costly to move to another system, but also the second reason: BlackBerry’s are still the gold security standard. A Forrester Research report concluded, “the iPhone and iPad are secure enough with the right policies and technical controls. Overall, the iPhone can be an approved second smartphone in the enterprise … However, the inability to close jailbreaks will give enterprises an excuse to avoid Apple’s platform” said Forrester. Apple’s iPhone and iPad are increasingly being adopted in the enterprise and secure enough for most firms, but

high-­‐security companies are likely to stick with Research in Motion’s BlackBerry platform. John Herrema, senior vice president of corporate strategy at Good Technology said, “(RIM) will have a lot more competition. The market opportunity for Android and Apple in the enterprise is not in getting existing, company-­‐issued BlackBerry users to migrate to a different smartphone. RIM may see its overall market share decline, but the entire pie for smartphones is growing, which means it may actually be able to grow sales. The exciting trend right now is not fighting over the 30 percent of a company that has company-­‐ issued phones and service, but to address the rest of the employees who already are buying a smartphone and want to use it for work" (CNet). For BlackBerry to continue to grow while losing part of its enterprise customer base requires them to focus more on the consumer market. Most people see Apple as RIM’s biggest threat, however there is no single event that has done more for Rim’s business than the iPhone launch. Since the iPhone's introduction in June 2007, BlackBerry quarterly sales have more than tripled, from $1.1 billion to $3.4 billion. Three of the five top-­‐selling mobile phones in the U.S. are now BlackBerrys (CNet). RIM launched its first television ad campaign targeting a mass audience in 2008, and last quarter 80% of its new subscribers came from the nonbusiness crowd (CNN Money). The key to RIM’s future growth will be to capture the consumer market, especially in developing markets. RIM already has strategies in place, such as its extremely popular BBM service. “Teens, for instance, love BlackBerry Messenger, RIM's proprietary instant messaging feature” (CNN Money). Since the messages use RIM’s Pin technology and are routed through RIM’s Servers, the system is seen as offering better security, latency and bandwidth efficiency than carrier-­‐operated text messaging (SMS) servicers and other mobile instant messaging platforms. Scotia Capital’s Gus Papageorgiou said “BlackBerry Messenger (BBM) is now likely the #1 reason for adopting BlackBerry in developing markets and is increasingly relevant in developed markets” (Financial

Post). Once users have organized their social contacts on BBM it becomes an effective switching cost. Furthermore, with many companies requiring employees to use BlackBerrys, RIM can take advantage of the network effect. Consumer’s will be more inclined to purchase a BlackBerry to take advantage of the BBM service which many of their friend’s are locked into. Research in Motion has grown in excess of 50% every year for the last decade, however for that growth to continue it must expand it’s customer base especially in developing nations. To do this, the company must compromise it’s security features to gain access to these lucrative markets. RIM has already shown that it is ready to compromise with countries in regards to its security protocols. Both BBM and BIS data in many nations is open for real-­‐time monitoring due to the installation of relay servers. The last obstacle left is to provide access to corporate BES data, for which RIM has said is impossible. RIM’s proposed solution is to provide governments with a list and locations of companies utilizing it’s BES service. This compromise keeps RIM’s promise of data security to corporations while still retaining the government’s ability to access secured data. However, arguing over access to data may be pointless, as governments are fighting a losing battle trying to read the world’s e-­‐mail. The Radicati Group estimated that in 2009, 247 billion email messages were sent every day—more than 2.8 million a second—by 1.4 billion email users. The sheer volume of online information may already be too much for any government to monitor, adding yet another challenge to sovereignty in an increasingly interconnected world. What concerns RIM is how enterprise customers will react to being exposed to their governments and how corporations in other countries will look at BlackBerry’s diminished security. The consumer market, BlackBerry’s most important future market may not react adversely at all to RIM’s new security policies. The majority of RIM’s new subscriptions are from individual customers, and RIM will subject users to lock-­‐in with its global BBM service. BlackBerry’s other advantage in the consumer market,

particularly in developing countries where bandwidth is both scare and expensive, comes in the form of its low data usage, approximately 1/10 of Apple’s iPhone. Besides BBM and low-­‐data usage. RIM has to continue to differentiate the BlackBerry in the consumer market. The company already offers subsidized BlackBerry’s on almost every major carrier, unlike its Apple competitor, which offer’s a one-­‐carrier approach. It must also further develop its App store, responsible for much of Apple’s success, to capture more of the consumer market. Simply going global and addressing security concerns will not be enough for RIM to succeed. Balsillie, RIM’s co-­‐founder sums up the future of RIM best, “But the act of going global alone won't be enough for RIM to succeed in the long run. Just as it once made e-­‐mail in a phone into its Killer App, the company must adapt to a world with thousands of killer apps. "What you carry on your belt is now your MP3 player, will be your plasma TV, is your social-­‐networking machine, is your Internet terminal, your camera, your personal navigation device” (CNN Money). RIM must evolve into another device that does more than just e-­‐mail and messaging while making sure they do not create security concerns for their biggest markets.

Sources: CNN Money, http://money.cnn.com/2009/08/12/technology/blackberry_research_in_motion.fo rtune/, accessed 1st Dec 2010. Financial Post, http://money.cnn.com/2009/08/12/technology/blackberry_research_in_motion.fo rtune/, accessed 1st Dec 2010 New York Times http://www.nytimes.com/2010/08/18/business/global/18rim.html?_r=2&src=un &feedurl=http%3A%2F%2Fjson8.nytimes.com%2Fpages%2Ftechnology%2Findex. jsonp, accessed 1st Dec 2010 India BusinessWorld http://www.businessworld.in/bw/2010_08_03_RIM_Express_Inability_To_Provide_ Access_To_Data.html, accessed 1st Dec 2010 CNet Networks http://news.cnet.com/8301-­‐1035_3-­‐20023904-­‐94.html#ixzz16jccKwkR, accessed 1st Dec 2010 http://news.cnet.com/8301-­‐30686_3-­‐20019573-­‐266.html#ixzz16jfFlVMl, accessed 1st Dec 2010 http://news.cnet.com/8301-­‐30686_3-­‐20019573-­‐266.html?tag=mncol;txt, accessed 1st Dec 2010 ZDNet http://www.zdnet.com/blog/btl/forrester-­‐apples-­‐iphone-­‐ipad-­‐secure-­‐enough-­‐for-­‐ enterprises-­‐but-­‐rim-­‐rules-­‐security-­‐roost/37467?tag=mncol;txt, accessed 1st Dec 2010