Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Apple, Google Diss the DoD Over Mobile Security

Soulskill posted more than 3 years ago | from the who-wears-the-pants dept.

Iphone 150

Julie188 writes "The Defense Information Systems Agency (DISA) has long supported the use of BlackBerry smartphones for soldiers. It built a system called Go Mobile to provide secure communications, training, and collaboration applications to mobile soldiers. DISA recently decided to add Android and iPhone to the list of approved devices because of high demand from users. Unfortunately, this choice has become a giant pain in the flank. Why? Because both Apple and Google refuse to give DISA access to their security APIs."

cancel ×

150 comments

Sorry! There are no comments related to the filter you selected.

Unpatriotic? (4, Funny)

fey000 (1374173) | more than 3 years ago | (#34523732)

Queue the Palin. Might be time for Apple and Google to be hunted down like Al-Qaeda. Is there any room left in the Assange bunker?

Re:Unpatriotic? (2)

Myrimos (1495513) | more than 3 years ago | (#34523770)

Queue the Palin.

I saw this a few days ago. Is this a meme? Pedantically speaking, Palin is is a queue of one (at least!) wherever she is. Cue the responses. Might be time for Grammar Nazis and pendants to be hunted down like Apple and Google. Is there any room left in the Assange bunker?

Re:Unpatriotic? (0)

Anonymous Coward | more than 3 years ago | (#34524020)

Palin is is a queue of one (at least!) wherever she is.

Cue the responses. Might be time for Grammar Nazis and pendants to be hunted down like Apple and Google.

Is is there a meme for the Nazi-grammar-pedants that screw up their own temper tantrums? Yes ... I see what I did there.

Re:Unpatriotic? (0)

Anonymous Coward | more than 3 years ago | (#34524356)

who screw up his or her own temper tantrums

Re:Unpatriotic? (0)

Anonymous Coward | more than 3 years ago | (#34524612)

The who is right, but "pedants" is plural, so it should be "their", not "his or her". Even though this will probably get modded off-topic, I just can't let a bad grammar correction like that go because other people might start believing it.

A bigger problem, though, is that more than forty minutes after my last logged-in post, this *^&@!$ board still won't let me post anonymously without completely logging out first. They've cranked up the post timers to something like five minutes for logged in users and half an hour for anonymous posts. That's very uncool.

It has gotten so bad that on more than one occasion, I've actually given up and not posted USEFUL posts because I just don't have that long to wait. These ridiculous new delays are a net loss for slashdot, not a win. Trolls are still trolls, but it's starting to have a negative impact on real users who are regular posters. And the thirty minute timer has basically made it so that those of us who want to occasionally express unpopular (but valuable) views can no longer do so unless we go find a separate machine with a separate IP to post from anonymously. The net effect of that is actual censorship, a stifling of the free flow of ideas and opinions that Slashdot is known for.

Slashdot users' time is valuable. I'm rapidly approaching the point where I'm considering stopping posting on Slashdot simply because the penalty for participation has gotten too high, and I've been posting on Slashdot for over a decade. Taco and friends, TEAR DOWN THAT TIMER.

Re:Unpatriotic? (0)

Anonymous Coward | more than 3 years ago | (#34525326)

Palin is is a queue of one (at least!) wherever she is

Being a bit pedantic here, but doesn't she have to be all there to count as one?

Of course pregnancy would help. As would multiple personalities.

- -
Bringing out the vote in 2016! - Me, Myself, and I

Re:Unpatriotic? (1, Insightful)

Anonymous Coward | more than 3 years ago | (#34523878)

It's not possible for big $$$ corporation to be unpatriotic.

Re:Unpatriotic? (1)

mr100percent (57156) | more than 3 years ago | (#34523930)

Well according to Senator Joe Lieberman, Amazon was being a "good corporate citizen" when it kicked WikiLeaks out of its cloud

Re:Unpatriotic? (1)

Anonymous Coward | more than 3 years ago | (#34524032)

It's not possible for big $$$ corporation to be unpatriotic.

Not true. A big $$$ corporation is unpatriotic if it refuses to invest enough money in purchasing lawmakers.

Re:Unpatriotic? (2, Informative)

netsharc (195805) | more than 3 years ago | (#34523948)

It'll be convenient of Palin to forget that RIM is a Canadian company. Or are they the obedient little Labradors anyway (since the UK is the poodle).

Also, Sergey Brin is Russian! Aaaaaa, he's a red commie!!!! But then again, Palin is neighbors with him, with she being able to see his childhood home front her front porch and what not.

For my more serious contribution to this discussion, iPhone security is "trust that the app reviewer catches anything malicious that the developer is trying to do.". Android security is "You are going to install $APP. This app wants access to these features: [read/write SD card, see call status, read/write address book, read/send SMSes, use GPS location]. Do you want to allow all and install?", while BlackBerry security is, "This application wants these features. Choose which of them you want to allow, and which you want to deny."

Or to be more detailed about it, for corporate BlackBerrys the admin can even do the allowing/denying, globally as well as individually for all apps, including denying the permission to the end-users to install all sorts of random apps.

So which do you think offers more security?

Re:Unpatriotic? (1)

Anonymous Coward | more than 3 years ago | (#34524226)

So checkboxes == more security?

Or more ways for there to be back doors...

Re:Unpatriotic? (2, Insightful)

Anonymous Coward | more than 3 years ago | (#34524342)

For my more serious contribution to this discussion...

So which do you think offers more security?

Oh dear.

As well as the app review process the iPhone does prompt when an app wants to first use location services, notification, push services, etc. and then allows you to manage and subsequently revoke those permissions. The apps are also sandboxed.
I am not in a position to comment on any of the Android flavours or BlackBerry security, so I won't.

Re:Unpatriotic? (0)

Anonymous Coward | more than 3 years ago | (#34525492)

Well the thing about the iPhone is that it's been shown to have bad/low security. Issues ranging from ease to add a malicious app to the market, [techeye.net] to the iPhones security being easy to bypass, [mobilitydigest.com] to even the fact that the iPhone's encryption is easy to crack. [wired.com]

It does sadden me that with these problems that were easy to find on google were ignored when the DoD thought about allowing the iPhone to be an approved device (demand should have been one of the lowest factors in allowing it). While certain Android's might not be a good idea to allow, the whole concept of a custom ROM I feel would be a safe answer that would have been great middle ground.

Re:Unpatriotic? (0)

Anonymous Coward | more than 3 years ago | (#34524470)

So which do you think offers more security?

None? What does that have to do with security. More informative? Perhaps, but secure? Both users and reviewers are humans and prone to mistakes, I don't see your point.

Re:Unpatriotic? (0)

Anonymous Coward | more than 3 years ago | (#34524140)

Palin must be doing something right.....she's pissing off all the Eurotrash wannabees.

Umm something is fishy (4, Interesting)

JonySuede (1908576) | more than 3 years ago | (#34523798)

Android is open source, how hard could it be to download the code and look into it to find those elusives security apis ?
I have rolled custom firmware onto an android device using the instruction on some forums, and it worked great, if a dude with is budgies can do it, why can't they ?

Re:Umm something is fishy (1)

l0ungeb0y (442022) | more than 3 years ago | (#34523976)

As much as I am afraid to ask...
WTF is a budgie? /please don't be a rule 34

Re:Umm something is fishy (3, Informative)

JonySuede (1908576) | more than 3 years ago | (#34523994)

first google link for budgies:
http://www.freewebs.com/budgierisa/appearance.htm [freewebs.com]

Re:Umm something is fishy (1)

davester666 (731373) | more than 3 years ago | (#34524514)

And you can get one free if you visit Tex and Edna Boil's Organ Emporium.

Re:Umm something is hurting my eyes! (1)

alienzed (732782) | more than 3 years ago | (#34524944)

Giant colored font batman!

Re:Umm something is fishy (0)

Anonymous Coward | more than 3 years ago | (#34524280)

As much as I am afraid to ask...
WTF is a budgie? /please don't be a rule 34

Aint it some bird?

I altered ANDROID recently (was easy) (-1)

Anonymous Coward | more than 3 years ago | (#34524136)

Per my subject-line above: When my nephew & I were attempting to put a custom HOSTS file (24.5mb in size) onto ANDROID, it complained with a message along the lines of this:

"This operation is not allowed on the production model of ANDROID OS"

So, we whipped out the SDK tools for it, ADB, & mounted the system mount point as Read + Write... then, we did an ADB "PULL" command to get the file onto the ANDROID device, then we overwrote the "stock-oem" HOSTS file with ADB's "PUSH" command... & guess what?

It worked.

Now, because it did? Here are the results he enjoys from this "modification" on ANDROID phones:

I.E. #1 -> He NOW surfs the web on his ANDROID, minus ad banners (which HAVE been "bushwhacked" with malicious code before -> MICROSOFT APOLOGIZES FOR SERVING MALWARE: http://apcmag.com/microsoft_apologises_for_serving_malware.htm [apcmag.com] - happens to the "best of them"!)

I.E. #2 -> He now surfs the web, FAR more protected vs. known bad sites also (which I update, daily here & from reputable + reliable sources online for that very purpose)

I.E. #3 -> Additionally, my nephew (RIT CIS major w/ specialization in security) now also gets to his favorite websites faster (like engadget.com or wired.com), also (by not doing DNS roundtrip lookups for IPAddress - to - Hosts/Domain names resolution)...

I.E. #4 -> PLUS, IF his DNS "goes down", or is "redirected/dns-poisoned"? He still gets to his fav. sites anyhow, reliably (since HOSTS are the 1st thing a BSD IP Stack looks to for this, by default).

APK

P.S.=> No, it's not "STRICTLY" doing a 'hack/crack' to the OS, but it shows you CAN "alter" the stock setup, + the datafiles it uses for operation, fairly easily, & HOW to do so, easily... apk

Re:I altered ANDROID recently (was easy) (0)

Anonymous Coward | more than 3 years ago | (#34524460)

hey, it's Hosts File Guy! I wondered when you would show up.

EXPLAIN THE -1 DOWNMOD PLEASE... apk (-1)

Anonymous Coward | more than 3 years ago | (#34524530)

On my initial post -> http://mobile.slashdot.org/comments.pl?sid=1906520&cid=34524136 [slashdot.org] here in this thread...

See my subject-line above, & that URL here I posted directly above this...

(Please - DO explain the technical grounds on which you "down modded" my posting here unjustly & with NO EXPLANATION why: "Somehow" (not, sarcasm), I don't think I'll get a valid reply in response here, just b.s. from trolls etc./et al, as-per-usual...).

APK

P.S.=> "All the King's Trolls, & all the king's 'p.r. men', couldn't put your trolling down mod selves together again..." because I don't see ANY VALID TECHNICAL JUSTIFICATION for the down moderation of my 1st post in the URL above!

Better still, in closing here? Well - I'll let Mr. Bruce Perens speak for me (in regards to unjustified down mods of posts here & elsewhere online + WHY they happen):

"I have been offered the online-perception-management services I'm talking about while managing at HP and Sourcelabs. If you are not aware of companys concern for their online perception and what they do about it, and won't take my word for it, there isn't much point in arguing about it with you." - by Bruce Perens (3872) on Friday July 30, @09:27PM (#33092398) Homepage Journal

FROM -> http://linux.slashdot.org/comments.pl?sid=1738364&cid=33092398 [slashdot.org]

and

"It just takes one Ubuntu sympathizer or PR flack to minus-moderate any comment. Unfortunately, once PR agencies and so on started paying people to moderate online communities, and to have hundreds of accounts each, things changed." - by Bruce Perens (3872) on Friday July 30, @03:55PM (#33089192) Homepage Journal

FROM -> http://linux.slashdot.org/comments.pl?sid=1738364&cid=33089192 [slashdot.org]

That says it all for me... apk

Re:Umm something is fishy (1)

perlchild (582235) | more than 3 years ago | (#34524574)

If they phone home, where they phone home doesn't have to be open source, next question.

Re:Umm something is fishy (0)

Anonymous Coward | more than 3 years ago | (#34524756)

I don't understand what you meant, you reply does not even attempt to answer the rhetorical questions that the parent asked and yet you seems to believe that you are in fact doing so.

Re:Umm something is fishy (0)

Anonymous Coward | more than 3 years ago | (#34525266)

Thats a funny joke

Use the souce. (2, Insightful)

VortexCortex (1117377) | more than 3 years ago | (#34523808)

Want to access the "security" APIs? Use the Source.

Why not just offer a custom DoD firmware for Android phones?

Seriously, there's no way for an application to be "secure" if the platform the application runs on is itself untrusted.

IMO, My device is not "secure" unless I can control the device's OS & inspect the device's hardware. My phone, my router, my PCs, my GPS, all have firmware I've compiled myself. If an average coder like myself can do this, the DoD shouldn't have any problems either.

Note: Android works on iPhones too, it's still buggy, but the DoD could help with that if they desired, or just use phones that support custom, open source firmware.

Re:Use the souce. (0)

Anonymous Coward | more than 3 years ago | (#34523866)

This article smells of shenanigans.

Re:Use the souce. (1)

Myrimos (1495513) | more than 3 years ago | (#34523884)

Note: Android works on iPhones too, it's still buggy, but the DoD could help with that if they desired.

A smooth Android install on an iPhone? It seems like you've found something Apple would like even less than the DoD having access to the iPhone security stack.

Re:Use the souce. (1)

aliquis (678370) | more than 3 years ago | (#34523940)

Why? Apples margins of the iPhone4 is probably huge.

Re:Use the souce. (1)

Myrimos (1495513) | more than 3 years ago | (#34524000)

A different OS "duplicates functionality."

Re:Use the souce. (0)

Anonymous Coward | more than 3 years ago | (#34525174)

A smooth Android install on an iPhone?

Here's a how-to that doesn't mention problems:

http://www.redmondpie.com/install-android-2.2.1-froyo-on-iphone-3g-2g-using-bootlace-in-cydia-no-computer-required/ [redmondpie.com]

Some other articles say it is a work in progress with issues, but perhaps those are out of date?

http://www.pcworld.com/article/196595/how_to_install_android_on_your_iphone.html [pcworld.com]

Perhaps you're braver than I would be. Have fun!

Re:Use the souce. (5, Interesting)

mercury83 (759116) | more than 3 years ago | (#34523936)

I know this is Slashdot and all, but still:

IMO, My device is not "secure" unless I can control the device's OS & inspect the device's hardware. My phone, my router, my PCs, my GPS, all have firmware I've compiled myself.

This doesn't make it secure. It just means that if someone's made a mistake, or inserted a backdoor, you've missed it. Control != Security -- sometimes it just creates a poor illusion of security. If you don't have control, you have to trust someone to provide security. Depending on who it is and what their experience is, I often prefer to trust.

Regardless, one of the big issues that I've seen in this area is that although yes, you CAN jailbreak iPhone or install custom firmware on whatever device you want, you want the ability to deploy commercial-off-the-shelf stuff to users in the field with a 10 second install from the app store. They want to leverage the existing distribution network for the product and application distribution for software packages. They want to piggyback off the commercial world with minimal development effort and cost. What you're proposing a better model from a secure perspective, but is massively more expensive.

Re:Use the souce. (5, Informative)

VortexCortex (1117377) | more than 3 years ago | (#34524090)

I know this is Slashdot and all, but still:

IMO, My device is not "secure" unless I can control the device's OS & inspect the device's hardware. My phone, my router, my PCs, my GPS, all have firmware I've compiled myself.

This doesn't make it secure. It just means that if someone's made a mistake, or inserted a backdoor, you've missed it. Control != Security -- sometimes it just creates a poor illusion of security. If you don't have control, you have to trust someone to provide security.

I write code. I read code. Yes someone can make a mistake, I can miss the mistake, but I can also fix said mistakes as soon as the mistake is discovered. You can't do that unless you can compile your own OS / Firmware. Faster Fixes == Less Vulnerability Window == More Secure. I'm not arguing that open source makes something secure, but using the source can give you more security than otherwise.

If you argue that control != security, I will put it to you that the inability to Control = No Provable Security. Thus, Control = infinitely times more secure than uncontrollable. How secure is a device that can auto-update it's firmware without your consent?

Depending on who it is and what their experience is, I often prefer to trust.

Let us not forget that I am compiling the same sources that those you "often prefer to trust" are compiling; Except that I am also sure that no additional closed source code has been included in my build.

Binary_Blob == !Trust;

Re:Use the souce. (1)

Anonymous Coward | more than 3 years ago | (#34524324)

It is not possible to prove security in a modern computer system for any plausible level of control.

What if your compiler has a "backdoor" that introduces vulnerabilities when certain code is produced, and propogates it to new versions of the compiler? You going to write your own compiler in machine code?

What if your processor intentionally misinterprets certain sequences in order to introduce a vulnerability?

Re:Use the souce. (0)

Anonymous Coward | more than 3 years ago | (#34524618)

So you can read and write code but you can't fix anyone else's code? How does this work?

Re:Use the souce. (1)

mercury83 (759116) | more than 3 years ago | (#34525240)

I think we're mostly agreed... I prefer open-source for the reasons you outlined. I feel that closed-source, proprietary releases can be a little scary and I wish that more commonly used software was truly open. You say "Inability to Control = No Provable Security". I agree completely. Trust isn't about proof, you're simply BELIEVING that the controller of the source knows what they're doing, has your security in mind, and is on your side. If you a trust a source completely, you don't need provable security. If you've been burned before and are unlikely to trust, you'll want more control because you he no confidence in the "security" that they say it has. Sometimes you can't afford to control, and you're willing to trust someone, even if it's only a little bit of trust. By the way, I definitely used to trust Apple more than I do now -- I now trust them with few things.

Re:Use the souce. (0)

Anonymous Coward | more than 3 years ago | (#34524428)

This doesn't make it secure. This doesn't make it secure.

That's not what he said. If the code is open, then it can still be insecure. But, if the code is proprietary, then it is ALWAYS insecure.

Re:Use the souce. (1)

aristotle-dude (626586) | more than 3 years ago | (#34524776)

This doesn't make it secure. This doesn't make it secure.

That's not what he said. If the code is open, then it can still be insecure. But, if the code is proprietary, then it is ALWAYS insecure.

What utter nonsense. How secure code is depends on the quality of the code and whether it has been analyzed by tools and/or other people to uncover flaws. You do not have to have outsiders looking at the code. Code review by peers can improve code quality by finding mistakes the original author may have missed.

Outsiders do not have some magical quality in finding bugs in code.

Re:Use the souce. (-1)

Anonymous Coward | more than 3 years ago | (#34525022)

How secure code is depends on the quality of the code and whether it has been analyzed by tools and/or other people to uncover flaws.

This is deeply wrong. How secure the code is, depends on whether or not it does what the people doing the job described above want it to do, without side-effects that they don't want. Security is about enforcing a particular allegiance onto the computer.

The allegiance of proprietary software is to its authors. If those authors want different things than the user, then from the user's point of view, it isn't secure. For example, if an iPhone will take orders from Apple when it receives a packet with a certain Apple signing key, then it would be preposterously silly for DOD to consider it secure, even though Apple's people did an utterly flawless job of keeping bugs (from their point of view) out of the software.

Re:Use the souce. (3, Insightful)

Anonymous Coward | more than 3 years ago | (#34524480)

Sometimes control isn't security, but lack of control is always insecurity. Any solution that results in security will necessarily require control.

you want the ability to deploy commercial-off-the-shelf stuff to users in the field with a 10 second install from the app store.

If you need security, then this simply isn't going to be one of your goals. Instead, you're going to want 10 second install from your repository, which consists solely of software that you have audited. As a compromise, it might be software that someone else that you trust has audited, but that'll be someone like Theo deRaadt or maybe (stretching a little, but there are degrees of security) the Debian team. But it sure as hell won't be Apple or Google, because while those parties might be competent, their goals are at cross purposes with yours.

And it's those cross purposes that this story is really about. Apple doesn't have a "Security API"; they have a "Apple Security API" which is intended to protect Apple's interests, not the interests of the users or the owners.

Re:Use the souce. (1)

isilrion (814117) | more than 3 years ago | (#34524728)

If you don't have control, you have to trust someone to provide security. Depending on who it is and what their experience is, I often prefer to trust.

Exactly. I also prefer to trust. But not blindly: I must be reasonably certain that I can control who I am trusting, and that person/entity has the capacity review the item under consideration.

That rules out non-free software, as only the author has the capacity to review, and the Apple model, as even with open source apps, I have no control. Quoting an Anon comment in this thread,

It is not possible to prove security in a modern computer system for any plausible level of control.

it is obvious that no one person or entity can guarantee the security, so the only sensible option is to not trust any single entity, and instead, distribute that trust among as many people you can, for as much of the toolchain as you can, and be ready to replace the offending part when a problem is detected.

Re:Use the souce. (0)

Anonymous Coward | more than 3 years ago | (#34524154)

My phone, my router, my PCs, my GPS, all have firmware I've compiled myself.

But do you trust your compiler?

Re:Use the souce. (2, Insightful)

Timmmm (636430) | more than 3 years ago | (#34524164)

My phone, my router, my PCs, my GPS, all have firmware I've compiled myself.

Who modded this insightful?

Do you even have the source code for your GPS firmware, the baseband in your phone, your PC's BIOS and so on? No. Even if you did, are you seriously saying that you've perfectly audited hundreds of thousands of lines of code?

Where's the "-1 this is really stupid" option?

Re:Use the souce. (0)

VortexCortex (1117377) | more than 3 years ago | (#34524626)

My phone, my router, my PCs, my GPS, all have firmware I've compiled myself.

Who modded this insightful?

Do you even have the source code for your GPS firmware, the baseband in your phone, your PC's BIOS and so on?

::Sigh:: Yes, yes I do. You may not, but I do. Modding your GPS hardware, your phone, etc may not be your thing, but you can get started with modding your PC's BIOS [coreboot.org] , and/or Router [polarcloud.com] pretty easily.

It also helps if you research the mod-ability of your device before purchasing them.

Even if you did, are you seriously saying that you've perfectly audited hundreds of thousands of lines of code?

No, I haven't audited it all, perfectly, but really, no one has with any large project -- perfect is a goal, and as I've previously stated, the goal is to provide more security via quickly patching my own hardware's firmware if any issues are discovered (smaller vulnerability window = more secure).

Where's the "-1 this is really stupid" option?

Are you seriously saying that educating myself about my own hardware/software that is essential to my security is stupid?

I'd offer even more info, but I'm not going to waste any more time since you were such a dick. Perhaps just try asking, "How can I compile my own firmware for my devices," next time instead of being so caustic. Good luck with Google.

Re:Use the souce. (1)

Reaperducer (871695) | more than 3 years ago | (#34525774)

I envy the amount of free time you have to accomplish all of this. Sometimes I wish I didn't have friends, family, a job, or a life, too.

Re:Use the souce. (1)

tapehands (943962) | more than 3 years ago | (#34524308)

Wait...are you advocating that the Government do something (semi)competent with their money?! Although, I guess it would just get contracted out to someone, and still run the chance of being insecure/buggy/overbudget/not on time...

Regardless, a third party company rolling their own DoD-approved secure ROMs for common Android phones sounds like a pretty good business plan (though I'm not sure how the licensing would play out)...

....brb, off to become a patent troll.

Re:Use the souce. (0)

Anonymous Coward | more than 3 years ago | (#34524608)

From dealing with carriers at my day-to-day, it's been quite clear that if the DoD can do anything they can't deny, the phone makers would be in the doo-doo. TFA quoted the phone makers giving out the right approach, bring all those (nice, flag-carrying, American) carriers and threaten them, and fix the problem.

Re:Use the souce. (1)

sumdumass (711423) | more than 3 years ago | (#34525836)

If this is a bunch of users saying "I want an Iphone issued by the government instead of a blackberry" then the obvious answer is "no, sit down and shut up, we waste enough tax payer monies on you already".

If this is as I suspect like in the corporate world, where someone sees a commercial of a phone doing all sorts of "cool things", then without any interaction with IT or even coworkers to see if they had problems doing work related tasks with them, buys one, then complains because their 5-10 year old messaging system or their 10 year old productivity/time management sweet cannot communicate with the brand new technology properly and the apps that worked on the old stuff no longer work with the new, and that the company isn't willing to invest $25k top fix this every time they change their personal phones in some attempt to continually remain compliant on the whim of an employee, or purchase some account on someone else' server in order to relay all the information to you through a third party first, the answer is a "personal phones expected to be used for work related activities must be approved by IT before they are purchased or they will not be allowed access to company data".

The later simply makes sure the end user knows that they have to ask if it will work first. If it doesn't, there is no expectation that it ever will. I think the DOD is attempting to branch out a little and not put all their eggs in one basket, but the obvious answer to this is not ban all Android and Iphone phones (or all unapproved phones that the gov can't install it's own security software on) from government campus by employees if this doesn't happen and you will probably be able to watch Google and Apple trip over each other to give the government what they want. This is because the DOD employees not only use government phones, but also use their own phones and leaving their Iphone or Android at home (if they take public transportation) or in the car in the parking lot would likely translate into the hundreds of thousands if not millions of employees simply buying something that is allowed on campus instead. I think the government has more leverage here then google or Apple realizes.

DoD should not support the Foxconn iPhone (3, Insightful)

Animats (122034) | more than 3 years ago | (#34523838)

The iPhone is made by the Foxconn division of Hon Hai Precision Industry Company Ltd, in Shenzen, China. Apple is just the design and sales firm. That's not a reliable source for secure DoD communications.

There are still some non-China cell phone manufacturing facilities. DoD needs to look hard at sourcing.

Re:DoD should not support the Foxconn iPhone (0)

Anonymous Coward | more than 3 years ago | (#34523904)

Considering the freakout that the DoD has had with fake/malware-injected CPUs, I'm surprised anything non-domesticly built is considered. Even then, building it within the USA's borders doesn't mean a lot without tight cradle-to-grave security.

Re:DoD should not support the Foxconn iPhone (2, Informative)

arogier (1250960) | more than 3 years ago | (#34524008)

I don't see why the DoD can't contract Texas Instruments to make them a custom Android phone entirely in the US.

Re:DoD should not support the Foxconn iPhone (0)

Anonymous Coward | more than 3 years ago | (#34524868)

I don't see why the DoD can't contract Texas Instruments to make them a custom Android phone entirely in the US.

Because even the DoD can't afford a seventy-thousand-dollar-each cellular phone with every component made in the USA.

Heck, considering that you'd have to open new fabs for some of the parts, it'd probably run more like $170,000 each.

Re:DoD should not support the Foxconn iPhone (1)

arogier (1250960) | more than 3 years ago | (#34524892)

But if you consider what they pay for missile parts... and the fact that missiles only get used once...

Re:DoD should not support the Foxconn iPhone (1)

gtall (79522) | more than 3 years ago | (#34525686)

Yes, and how many of them missiles are actually fired off every year? I'm guessing not a lot.

Re:DoD should not support the Foxconn iPhone (1)

sumdumass (711423) | more than 3 years ago | (#34525858)

The strategic value of a missile is quite a bit more/different then that of a phone that can already be replaced by another phone already on the market.

comparing a missile's value to a phone is much like comparing the value a working car presents to you with the value of a toy matchbox car. You can justify spending a larger sum of money on one of those 1967 mustangs, but not the other.

Re:DoD should not support the Foxconn iPhone (1, Insightful)

frosty_tsm (933163) | more than 3 years ago | (#34525386)

I don't see why the DoD can't contract Texas Instruments to make them a custom Android phone entirely in the US.

Because even the DoD can't afford a seventy-thousand-dollar-each cellular phone with every component made in the USA.

Heck, considering that you'd have to open new fabs for some of the parts, it'd probably run more like $170,000 each.

Even with the defense contractor mark-up, 170k is not how much it would cost to make an iPhone or Android in the US. Well, unless the plants were run like a unionized auto-plant...

Re:DoD should not support the Foxconn iPhone (1)

Requia (1734466) | more than 3 years ago | (#34525564)

If you factor in that they could easily use up a million phones before they became obsolete (depending on how serious they are about them being used by everybody) economy of scale would drive that price way way way down.

Re:DoD should not support the Foxconn iPhone (0)

Anonymous Coward | more than 3 years ago | (#34523956)

And to your children, you're just the sperm donor I suppose.

Re:DoD should not support the Foxconn iPhone (0)

Locutus (9039) | more than 3 years ago | (#34524026)

yes but you're talking about the US DoD and aren't they not the same ones who have no way to secure data being removed from their secure computers via USB or CD/DVD? I thought I read recently that they are now going back to eliminating those interfaces on some of their systems but not all and still have no way to secure using those devices on their secure network. So I would not look for logic here.

LoB

Re:DoD should not support the Foxconn iPhone (1)

gtall (79522) | more than 3 years ago | (#34525700)

It only takes one mole to compromise your security. At that point, it isn't strictly a technological issue, although technology can ameliorate it.

Re:DoD should not support the Foxconn iPhone (1)

Anonymous Coward | more than 3 years ago | (#34524028)

Except that Foxconn is actually headquartered in the Republic of China on Taiwan, a US ally.

Re:DoD should not support the Foxconn iPhone (2)

hedwards (940851) | more than 3 years ago | (#34524144)

Because it's not like our allies spy on us.

Re:DoD should not support the Foxconn iPhone (1)

Suki I (1546431) | more than 3 years ago | (#34524066)

As soon as they give one of these things to Bradley Manning it won't matter any more anyway.

Re:DoD should not support the Foxconn iPhone (1)

aristotle-dude (626586) | more than 3 years ago | (#34524800)

The iPhone is made by the Foxconn division of Hon Hai Precision Industry Company Ltd, in Shenzen, China. Apple is just the design and sales firm. That's not a reliable source for secure DoD communications.

There are still some non-China cell phone manufacturing facilities. DoD needs to look hard at sourcing.

Right, because American citizens never, ever are criminals or terrorists? Didn't the 9/11 terrorists live in the US for a long time?

Re:DoD should not support the Foxconn iPhone (0)

xnpu (963139) | more than 3 years ago | (#34524878)

Ah yes.. and then complain that the DoD-special-phone is hopelessly delayed, incredibly be over budget and not as secure as it was supposed to be. Doing everything from scratch is a lot more work than you may think. You can't simply trust a non-China manufacturer because it's not in China. It's not like US companies don't employ immigrants or that local citizens can't be bribed. No matter what, the DoD will have to do it's due diligence.

Security APIs? (0)

Anonymous Coward | more than 3 years ago | (#34523842)

lol wut?
This article goes so far as to call the two companies unpatriotic for not supporting the DoD.
Rubbish.

I would do the same (0)

Anonymous Coward | more than 3 years ago | (#34523850)

It sounds as if the government is effectively asking for a backdoor. With lack of oversight already, why should Google or Apple expect them to do right by their customers?

Besides, there's a reasonable amount of IP in any security stack. Why should any for-profit organization just hand it over?

Access to what? (5, Insightful)

beakerMeep (716990) | more than 3 years ago | (#34523854)

TFA is very light on technical details. What security API are they looking to access? To do what? They have access to AOSP/Linux, and could even cook up custom ROMs if they needed. Is there some cryptographic hardware driver they need or something?

Also, From the 'article'

It seems to me that Apple and Google are making self-centered bad decisions here that won't play well with the American public. Clearly, Apple and Google should re-think these myopic and selfish policies

WTF? Maybe this journalist should re-think his self-centered trite opinion fluff pieces. Oh wait, it's NetworkWorld. Not much chance of that happening I guess.

Re:Access to what? (4, Insightful)

UnknowingFool (672806) | more than 3 years ago | (#34525376)

One person I spoke with from DOD said that Apple flat out refused to play ball, telling DOD to "talk to our integrators and carriers."

I don't have any more details than the author but he seems to be making assumptions based on conversations that he wasn't involved with. Maybe the simple fact of the matter is that Apple doesn't have any security APIs that would meet the DoD standards. Frankly Apple has designed their phone for the consumer space; Blackberries are more designed for security. Also it may be that Apple simply doesn't want to share any source code with the government. If they did, someone here on slashdot would espouse some conspiracy theory that Apple was helping the federal government track and mind-control you through your iPhone.

As for Android, it is open source so the DoD can make their own modifications like the NSA did with SELinux.

Dont Be Fooled (0)

Anonymous Coward | more than 3 years ago | (#34523856)

Look, it's all fine and dandy. iPhone is great, android is great. It's all setup by microsoft. While they sit back and watch apple and google run into the wildy arrogant ways of thier past, they're quitely selling tons of software to enterprises AND home users. When apple and google get the DOJ hammer, it'll even out the market share ofmobile, therefore, provide an enormous boost to microsoft and probably palm too. Look at this way, Balmer is Dooku and google is clone army.

Re:Dont Be Fooled (1)

ScrewMaster (602015) | more than 3 years ago | (#34523874)

Look at this way, Balmer is Dooku and google is clone army.

Yes, but Count Dooku got his hands chopped off and died.

I don't think this is the full picture... (5, Interesting)

EnglishTim (9662) | more than 3 years ago | (#34523880)

Shenanigans! There's got to be more to it than this.

The entire source for Android is available; what could Google be holding back? It's not as if they manufacture the phones.

What are these 'Security APIs'? It doesn't make any sense.

I think it's more likely that the DoD asked for some of Google / Apple's signing keys and the companies rightly refused.

Patriotism? (5, Insightful)

SuperSlacker64 (1918650) | more than 3 years ago | (#34523886)

According to the article, practically the only reason given as for why Google and Apple should give access to these APIs is to be patriotic. But as a few other people have pointed out, Google and Apple, though based in the US, are no longer solely US companies. What would this article's opinion have been had Russia or China or some other countries equivalent Department of Defense had asked for access to these APIs I wonder?

Apple, Google Diss the DoD (0)

multipartmixed (163409) | more than 3 years ago | (#34523924)

Dissing the DoD - or, as the article says, "thumbing their noses at" the DoD is not a wise move.

The Denizens of Doom are a group of hacker-biker crossbreeds. A true Ubermensch, if you will. Piss them off sufficiently, and they will kick your digital ass!

security, the ultimate pretext (3, Interesting)

bzipitidoo (647217) | more than 3 years ago | (#34523988)

The military's security evaluations are heavily biased. Any technology the military does not want to use can be declared insecure, whether or not it is, and vice versa. One can always find a reason something is not secure.

For example, they wanted to use Windows, and not any flavor of UNIX. The fact that Windows is produced by an American company was trotted out as a reason it was more secure. Code written by foreigners might have back doors, etc. Also, open source software development was shot down as fundamentally less secure than proprietary ways. Anyone might slip malware into open source. So, no Linux or FreeBSD. But then, why not a proprietary UNIX? They also prefer dealing with big companies, which informally disqualifies many UNIX vendors. They just have to come up with good sounding excuses, and security ones are great.

For the other side of the issue, they'll lean on their evaluators to rubber stamp tech that they like. Often it seems that what they really want out of their evaluators is creative reasoning that gives them the cover they need to use what they want, not impartial evaluations. Or they'll bypass them. They can get approval on an interim basis when there is nothing secure enough, and they have to have something. They're accustomed to Windows, and they like it, so they found ways to get it on board.

However, they can't do absolutely anything. Often there are ways that though extremely inconvenient, do increase apparent security, and which cannot be worked around. A big one is the "air gap". Need a separate computer for each network, to prevent information leakage across the boundaries.

Re:security, the ultimate pretext (2)

AF_Cheddar_Head (1186601) | more than 3 years ago | (#34524152)

WTF are you talking about. Unix and Linux are used extensively on mission systems with in the DoD. You think they use Windows to manage the Missile systems you need to think again.

You are correct in thinking that if a general wants something then he can probably get it secure on not but you are an idiot to think that Open Source is not used in the DoD. The politics can overrule the evaluators. Many times I have seen the evaluators say something is not a good idea and get overruled by the bosses.

Re:security, the ultimate pretext (0)

OzPeter (195038) | more than 3 years ago | (#34524360)

WTF are you talking about. Unix and Linux are used extensively on mission systems with in the DoD. You think they use Windows to manage the Missile systems you need to think again.

of course a rebuttal of this is simply to point you at the USS Yorktown [wikipedia.org] . True that the "missile"systems were not controlled by NT, but being dead in the water would not have helped firing any weapon at all.

Re:security, the ultimate pretext (1)

Registered Coward v2 (447531) | more than 3 years ago | (#34524558)

WTF are you talking about. Unix and Linux are used extensively on mission systems with in the DoD. You think they use Windows to manage the Missile systems you need to think again.

of course a rebuttal of this is simply to point you at the USS Yorktown [wikipedia.org] . True that the "missile"systems were not controlled by NT, but being dead in the water would not have helped firing any weapon at all.

The failure appears not to be an OS issue but an application issue; something that can happen with any OS.

Re:security, the ultimate pretext (1)

OzPeter (195038) | more than 3 years ago | (#34525140)

The failure appears not to be an OS issue but an application issue; something that can happen with any OS.

The point was that the DOD is/was using Windows technology in critical applications.

Re:security, the ultimate pretext (0)

Anonymous Coward | more than 3 years ago | (#34524748)

Yep Cheddar is correct. The parent is doesn't know what he is talking about.
One example , most classified systems are UNIX boxes , not windows. The lower level folks your talking about is for systems that are not classified systems. When you got higher up the classification level you don't see many windows boxes at all. And I was in the military and also now I work for defense contractor. No windows boxes are only the primary choice for none classified systems. As a contractor it is much easier to STIG(http://iase.disa.mil/stigs/index.html) a Linux or UNIX box, my god windows boxes are a complete pain in the ass. Anything windows just causes pain when you try to go classified.
Also final shot, I can see why google and apple refused, the people I have worked with at DISA about 20. Only one would I consider technically competent, and I am pretty sure he left DISA for another job.

Re:security, the ultimate pretext (1)

Anonymous Coward | more than 3 years ago | (#34524312)

The military's security evaluations are heavily biased. Any technology the military does not want to use can be declared insecure, whether or not it is, and vice versa. One can always find a reason something is not secure.

BS. There may be some grey areas, but there are all sorts of actual, real documented standards. The blackberry platform has been audited & certified from end-to-end:

http://us.blackberry.com/ataglance/security/certifications.jsp [blackberry.com]

Blackberry has been approved by the governments of Canada, United Kingdom, Austria, Australia, New Zealand, United States, Turkey, and NATO.

Blackberry has gone through the Cryptographic Module Validation Program (CMVP) that governs the conformance testing of cryptographic modules to Federal Information Processing Standard (FIPS) 140-2, "Security Requirements for Cryptographic Modules."

The Common Criteria is an international evaluation scheme of IT security products and systems. Common Criteria evaluation results are recognized by 26 countries. Many Blackberry products have been certified for Common Criteria EAL 2+ or EAL 4+ certification.

Apple and Android have been tested, audited & certified by... nobody.

Re:security, the ultimate pretext (2)

gandhi_2 (1108023) | more than 3 years ago | (#34524486)

FBCB2 runs on Solaris and can be found in almost every Stryker since 2001.

It can be found almost every US platoon of wheeled vehicles in Iraq or Afghanistan. Probably in all the Brads and Abrams too.

Re:security, the ultimate pretext (1)

xnpu (963139) | more than 3 years ago | (#34524896)

What a non argument. It's not like Microsoft doesn't employ foreigners.

Re:security, the ultimate pretext (1)

gtall (79522) | more than 3 years ago | (#34525718)

yes, and you are full of shit, DoD is filthy with Unix, Linux, Mac OS, and other assorted systems. Go back under your rock.

You know what annoys me? (0)

Anonymous Coward | more than 3 years ago | (#34524024)

I'll tell you what annoys me. Are you ready? Summaries that ask a question, and then answer it. Why is that annoying? I believe this post answers that.

Bad summary (2)

zigfreed (1441541) | more than 3 years ago | (#34524086)

Google and Apple just told the DISA to talk to the integrators. They aren't getting special treatment which makes sense: as big as the DoD is, they are still smaller and more specialized than the general public which the devices were meant to serve.

This is a job for a small, tight-knit development company developing under NDA, i.e. integrator.

Cryptograms (1)

xsxixmx (1945474) | more than 3 years ago | (#34524120)

They ought just make an app with some serious cryptography. It should be easy enough to just text instead, idk the security level differences, whatever works better though. For test they can change the letter codes (binary/ascii) with random cycling syncable layouts (keys). And I saw something in the book: "Blink" regards just going back to 'word of mouth'... And regards the API, it should already be in there pocket if you ask me. "many hands make the work load light"

Poor Article (1)

dcollins (135727) | more than 3 years ago | (#34524126)

FTA: "Providing API access to DOD is the patriotic and morale thing to do, especially since DOD is opening the door to lots of sales opportunities for both companies. "

Yeah, that's a well-written article. I'm convinced.

Google and Apple know all too well (1)

gilesjuk (604902) | more than 3 years ago | (#34524132)

If you give access or information about APIs that this information can leak out and be used for the wrong purposes.

The military should buy something that does what they want, not buy a consumer product then try to get the manufacturer to change it for them.

seems fair enough (1)

cenobyte40k (831687) | more than 3 years ago | (#34524348)

The DOD can take it multi-million dollar contract and go somewhere else. It's not up to the DOD to force companies to make smart business transactions, but if I was a stock holder at Google or Apple I might be a little pissed.

Re:seems fair enough (0)

Anonymous Coward | more than 3 years ago | (#34524560)

Google knows that dealing with governments costs a lot of time and is only worth the effort (and bad publicity) if they get payed very well for it.
Both Google and Apple should know exactly how profitable it was for RIM, so if they reply with "just get a BlackBerry" it just isn't worth it.

Apple's iPad needs a CAC reader... (or a USB slot) (1)

(H)elix1 (231155) | more than 3 years ago | (#34524378)

This is going to get even worse for Apple's iPad and other USB free devices. Without a smart card reader, or at least a USB slot to add one, these devices are going to have very limited usability in the DoD as things move forward.

Re:Apple's iPad needs a CAC reader... (or a USB sl (1, Troll)

gandhi_2 (1108023) | more than 3 years ago | (#34524502)

They gay ban hasn't been overturned yet.

Re:Apple's iPad needs a CAC reader... (or a USB sl (0)

Anonymous Coward | more than 3 years ago | (#34524720)

Actually, iPad 2 may very well have a USB port [theinquirer.net] .

Re:Apple's iPad needs a CAC reader... (or a USB sl (1)

WiseWeasel (92224) | more than 3 years ago | (#34525944)

Seriously, how is a disgruntled private supposed to suck down the contents of the DoD document store without a USB port?

Sorry I don't see government as the gate keeper (1)

Ruler4You (1957242) | more than 3 years ago | (#34525058)

I just can't see the justification for the government to have and hold proprietary information it has no rights to. If it should some day be determined that some corporate irresponsibility or collaboration in a criminal or treasonous context fell on the shoulders of corporate officers, I'd favor prosecution. But not release of the proprietary information itself. As it is government information and citizen information in the governments cognizance is considerably compromised by their "security". Only in the context of socialist nationalization (even then it's hard to justify) does this make the slightest bit of sense.

Why I'm getting a Blackberry (0)

Logic Worshipper (1518487) | more than 3 years ago | (#34525260)

iPhone and Android make money by spying on you. DOD wants to reprogram their OS to make that impossible, and they said no. They won't even let the DOD have a secure version of their OS, because their OS are inherently insecure.

Re:Why I'm getting a Blackberry (1)

Reaperducer (871695) | more than 3 years ago | (#34525950)

iPhone and Android make money by spying on you [citation needed]. DOD wants to reprogram their OS [citation needed] to make that impossible [citation needed], and they said no [citation needed]. They won't even let the DOD have a secure version of their OS [citation needed], because their OS are inherently insecure [citation needed].

FTFY.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>