Hanno's blog

Yesterday I was at a talk at the FSFE Berlin about free software and GSM. It was an interesting talk and discussion.
Probably most of you know that GSM is the protocol that keeps the large majority of mobile phones running. In the past, only a handful of companies worked with the protocol and according to the talk, even most mobile phone companies don't know much of the internal details, as they usually buy ready-made chips.
Three free software projects work on GSM, OpenBTS and OpenBSC on the server side and OsmocomBB on the client side. What I didn't know yet and think is really remarkable: The Island State of Niue installed a GSM-network based on OpenBTS. The island found no commercial operator, so they installed a free software based and community supported GSM network.

Afterwards, we had a longer discussion about security and privacy implications of GSM. To sum it up, GSM is horribly broken on the security side. It offers no authentication between phones and cells. Also, it's encryption has been broken in the early 90s. There is not much progress in protocol improvements although this is known for a very long time. It's also well known that so-called IMSI-cachers are sold illegally for a few thousand dollars. The only reason GSM is still working at all is basically that those possibilities still cost a few thousands. But cheaper hardware and improvement in free GSM software makes it more likely that those possibilities will have a greater impact in the future (this is only a brief summary and I'm not really in that topic, see Wikipedia for some starting points for more info).

There was a bit of discussion about the question how realistic it is that some "normal user" is threatened by this due to the price of a few thousand dollars for the equipment. I didn't bring this up in the discussion any more, but I remember having seen a talk by a guy from Intel that the tendency is to design generic chips for various protocols that can be GSM, Bluetooth or WLAN purely by software control. Thinking about that, this raises the question of protocol security even more, as it might already be possible to use mainstream computer hardware to do mobile phone wiretapping by just replacing the firmware of a wireless lan card. It almost certainly will be possible within some years.

Another topic that was raised was frequency regulation. Even with free software you wouldn't be able to operate your own GSM network, because you couldn't afford buying a frequency (although it seems to be possible to get a testing license for a limited space, e. g. for technical workshops - the 27C3 will have a GSM test network). I mentioned that there's a chapter in the book "Code" from Lawrence Lessig (available in an updated version here, chapter is "The Regulators of Speech: Distribution" and starts on page 270 in the PDF). The thoughts from Lessing are that frequency regulation was neccessary in the beginning of radio technology, but today, it would be easily possible to design protocols that don't need regulation - they could be auto-regulating, e. g. with a prefix in front of every data package (the way wireless lan works). But the problem with that is that today, frequency usage generates large income for the state - that's completely against the original idea of it, as it's primarily purpose was to keep technology usable.

The weekend I was at the Wizards of OS conference in Berlin. I was so engaged that I didn't find time to blog from there (and the »freifunk« wasn't very stable, but they told me it's the fault of the Deutsche Telekom).

It was a very interesting conference, met a lot of cool people. I spent most of the time with the people of the Free Software Foundation at their booth.
I met people from the »Bayrischer Rundfunk« (german public television station) and discussed about abolishing the GEZ and free content licensing of public television materials. I talked to a free radio activist about historical copyright issues and we ended up in discussing the kyoto protocol and uranium mining in Kongo. Had some discussions about politics in latin america with one guy coming from argentinia. That may give you a short impression about the variety of interesting people I met there.

On the conference topics, it had the theme »Free Software, free culture, free infrastructure«. An interesting panel I want to mention was the discussion about open frequencies. It was basically that only a small number of the frequency spectrum are available to the public at the moment, but wireless lan is already creating some interesting things (freifunk), so the conclusion was that more open frequencies might lead to much more interesting technology. There was a guy from colt telecom talking about the political issues of this subject and the old telecommunication lobby (for example the ITU). Another guy was from Indonesia and talked about projects they did with public wireless technology and their efforts to build own antennas.

Lawrence Lessig helt the keynote, he is definitely a good speaker, while it was far to much »popstar«-like to me (book-signing session afterwarts). His topic was the «Read-Write-Society«, and for one thing I can fully agree with him: It's time to fight DRM.