“PIN,” “ping,” “IM,” “BBM” — these are just a few of the words that inhabit our vernacular these days, and all are used interchangeably, though they don’t technically mean the same thing. For instance, a BlackBerry user can directly PIN and BBM (BlackBerry Messenger) the user of another BlackBerry. The PIN in this case being the address tied to each BlackBerry device as opposed to a personal identification number that one might use to, say, unlock the device.
PIN to PIN messages are passed from the sending party’s device through Research In Motion Ltd.’s relay by way of the sending party’s wireless service provider (Bell, Rogers, or TELUS) to the receiving party’s wireless service provider and on to the receiving party’s device. In a nutshell, this means that this kind of message is transmitted without hitting a company or government department’s servers or security filters. And therein lies the rub.
Notwithstanding that the government itself has issued
warnings about the potential security risks associated with PIN to PIN messaging, many organizations, including at least some government agencies, do not collect or store PIN to PIN data — which might be fine if you are having an affair with an equally married colleague, but is not so fine if your employees or contractors are disclosing (for financial gain or otherwise) internal or client confidential, personal, or trade secret information to third parties.
This is not a new concern, and yet many organizations just aren’t doing anything about it. Which doesn’t necessarily mean it isn’t a problem. Take the government agency that responds to an access to information request saying it doesn’t store data relating to PIN to PIN communications. It doesn’t do much for government transparency, or e-discovery for that matter.
Now take the law firm that has no electronic device use-related policy, provides devices to its professional staff so that — in the office or not — they are plugged into the network, has the individual sign up to the contractual terms and pay the wireless service provider fees, recycles or shares the hardware (and the PIN with it) and most likely isn’t even aware that PIN messages aren’t being stored anywhere and may not be secure in any event. Can you guess what a disgruntled lawyer about to jump ship might do with the company PDA when they turn it in? It probably won’t be something good and it could involve some kind of mobile spyware.
In terms of emergency-related or personal use and the technical support perspective, the PIN (without data storage on the server) option may be optimal. Messages can be relayed even if servers are down, messaging is quick, free, and it doesn’t require much if any support. From a privacy/confidentiality/security standpoint, however, it may not be necessary or appropriate and could attract risk.
So what can organizations do to mitigate risk and potential liability with respect to PIN to PIN messaging? Disable PIN to PIN functionality for starters. Consider that unless you are working for CSIS, the Department of National Defence, or for some type of disaster recovery or emergency response team, you are using your government- or corporate-issued device strictly for work purposes as intended and have nothing to hide (except sensitive information received in the course of doing business). There is no real need to use PIN to PIN messaging versus e-mail (via a BlackBerry enterprise server for increased security), which would hit the server and be recorded.
Ultimately, regardless of the type of device used, the form of communication used — be it e-mail, messaging, or phone — or whether the device is employer-supplied or personal, it is essential to put employee and consultant acknowledgement policies and protocols in place that speak to the handling of sensitive information.
Whether PIN to PIN messaging is a security (from a technology standpoint) disaster waiting to happen has yet to be seen. Security was certainly not a topic that RIM founder Mike Lazaridis wanted to discuss during his recent
interview with Rory Cellan-Jones on the BBC. The bottom line is that PIN to PIN is widely used around the world and popular at least in part because of the perceived “privacy” it offers; however, there are risks associated with its use.
As an organization, if you supply work-related BlackBerrys you should be asking yourself whether your personnel are in roles that justify enabling PIN to PIN communication. If yes, set up the protocols necessary to store PIN messages on enterprise servers. If not, why wouldn’t you simply disable the PIN to PIN functionality and be done with it?
In view of the wide-ranging opinions on the subject of PIN to PIN and BBM messaging, any and all informative and educational thoughts on the subject are welcome. Leave your comments below.
