How do spies bug phones?

AMERICA'S spooks are under attack from all sides. Leaks from Edward Snowden, a systems administrator turned whistleblower at the National Security Agency (NSA), America's signals-intelligence agency, have confirmed what the professionally paranoid long suspected: that the internet is insecure, and that modern spy agencies can—and do, on an industrial scale—tap virtually any form of online communication. But perhaps the most acute embarassment so far has been caused by the revelation that the NSA may have been listening to phone calls made by the leaders of America's allies, most notably those of the German chancellor, Angela Merkel. That it is possible to intercept mobile-phone calls will not surprise anyone who has watched a modern crime drama. 

But how exactly is it done?

A mobile phone is essentially a telephone with a radio attached. Anyone can listen in on the radio waves travelling between a handset and the base station to which it is connected. To prevent casual eavesdropping, phones often (although not always) use encryption, which scrambles the data so that only the intended recipient can make sense of it. But not all encryption is created equal. The encryption used in second-generation (2G) phones—a technology that dates back to 1991—is weak, and readily cracked by modern computers. The 3G standard includes stronger scrambling, although it is still not perfect. 4G, the newest standard, currently being deployed around the world, likewise offers more competent encryption—although documents leaked by Edward Snowden suggest that the spies are pressuring manufacturers to put secret "back doors" into their products.

But tangling with cryptography isn't always necessary. Spy agencies can obtain details from telephone companies, either by asking them to cooperate or forcing them to. Another option is to impersonate the mobile network itself, by setting up a fake base-station and persuading the target's phone to connect to it. At a hacker conference in 2010, a security researcher called Chris Paget gave a detailed demonstration of how this works, using less than $2,000 of off-the-shelf equipment (a rogue base-station can instruct phones that connect to it to do all sorts of things, such as turn off their encryption). Police forces around the world use similar gear to silently listen in on calls made by their targets. A recent book describes how the FBI has quietly removed several such fake base-stations—run by foreign embassies—from around Washington, DC.

Nor is it just calls. Text messages can also be snatched. Modern smartphones are general-purpose computers. Users store e-mails on them, fix their position with satellite navigation systems, and even use them for banking, making them very juicy targets indeed. Even if the phones themselves are secure, it is far from clear how secure the behind-the-scenes servers run by Google and Apple, which control the Android and iOS platforms respectively, really are. For the non-spooks, there are cheaper, simpler options that often work, too. This week several journalists in Britain are standing trial for hacking the voicemail messages of everyone from serving politicians to murdered schoolchildren. Their methods were low-tech but effective: they smooth-talked employees of mobile-phone companies into handing over the four-digit passcodes that protect their customers' voicemail accounts. Or else they simply guessed them, betting that the phone owners either hadn't changed them from default settings or had chosen easy to remember ones, such as 1-2-3-4. Whether the NSA used low- or high-tech methods to tap Mrs Merkel's phone remains a mystery—for now, at least.”The Economist”