BYOD risks and minefields

I read the article in CIO Think_Deleted_Text_Messages_Are_Gone_Forever_Think_Again and the discussion that rumbles on about BYOD.

Firstly, a bit surprising the article suggests a "wow" factor associated with recovering deleted text messages. I would have thought it was common knowledge by now in business, generally, and particularly at CIO level.

Secondly, the notion and practice of companies getting employees to use their own devices (BYOD) to access company networks and company information seems to be an open invitation to allow a security breach (intentional or by accident) to happen. The corporate body and individual (at senior level) duty of care place encumbent obligations on both to conduct risk assessments, identify company assets, control dissemenation of company information in order to protect. It might be there are legal risks for companies demanding access to employees phones to go through their personal data.

There appears no persuasive technical/technological evidence to support BYOD propagation on the basis without it a company could not operate. Moreover, why require BYOD policies, practices and procedures that in essence generate further and continuing costs to maintain them anyway whereas in-house company devices (properly controlled) also means retention of company assets, devices have an asset value, depreciation allows for write down and tax relief etc.

BTW the points about assets and finance came from a specialist corporate accountant in this area where as accounting is not my forte. Mind you, brain surgery is not my forte either as I could not get any practice in the subject matter due to the patients; there was a shortage of volunteers.

Self Deleting Text Messages

Self Deleting Text Messages

How to send self deleting SMS according to a computer hacking website that reports "this technique is called SAFE-TEXT. It's a technique where a message destroys itself after being read."

Before proceeding further there are several matters worth mentioning.

Sent flash SMS text messages are not automatically saved and thus delete after opening and closing the message, irrespective of whether the receiving party actually peruses the content or not. It is a technical mechanism included in the technical realisation of GSM and WCDMA. A flash message is technically referred to as a Message Class: Class 0. For a further discussion of flash messages see: Disappearing Sms Text Messages

Fairly recently I wrote about automatic deletion of text message, An app that can be installed on certain mobile phones and attribute a timer to received messages set to the length of time the message can be stored.  That particular discussion though related to the fact of texts being stored inside the application and encrypted so would be outside of the scope to extract and harvest data by handset readers that generate evidence:  Mobile Telephone Evidence Newsletter MTE_Vol7_MTE02_2010

Another option for automatically deleting text messages and a common feature found on smart phones is 'validity period' (not to be confused with 'validity period' for transmission/reception of SMS text messages) where the smart phone user or controller of it sets a storage clear out time for saved text messages or a security policy is set or triggered deleting stored text messages.

In each of the cases above at no time is there any suggestion of something illegitmate occurring or the desire to generate something potentially illegal. Thus, full-circle, we return to SAFE-TEXT. Instead of the actual text being sent to the target user's handset and self deleting thereafter, the recipient is supplied with a mobile internet link and visiting the website clicks the message which can then disappear within seconds. It is not clear, because I haven't tested it out as I only learned of this matter yesterday, whether the web browsing cache in the handset caches the complete activity of the mobile viewed webpage, which may provide an option to replay the message. The full extent of anonymity with SAFE-TEXT is not clear either because a user must "register" for the service and "2. If you’re the sender, the message will show your name and number." No doubt we will learn of reports that will confirm if this is a menace service or not.

Deleted messages uncovers fake rape claim

Deleted messages uncovers fake rape claim

Having specialised in the UK for many years dealing with deleted data and having published many papers on 'deleted content', 'deleted text messages', 'deleted data mobiles' and 'deleted data may not amount to possession' when this subject raises its head it is worth making a record of it for later discussion.

There are many aspects about deleted data that require to be considered in detail before making an allegation (Prosecution/Defence, Plaintiff/Respondent etc) and simply finding deleted data and saying well it is here let's use it is not always a good idea.

The details of an Australian criminal case reported recently involving recovered deleted data showed the content of a text message imported an entirely different context about an allegation of rape.

------------------------------------------------------------
Rape charges dropped after deleted messages recovered from iPhone

A MAN'S business and reputation are tainted, a young woman's HSC and mental health are in tatters and prosecutors have been ordered to pay more than $30,000 in legal costs for a bungled rape investigation on Sydney's northern beaches.

http://www.smh.com.au/digital-life/mobiles/rape-charges-dropped-after-deleted-messages-recovered--from-iphone-20100727-10ueq.html
------------------------------------------------------------

This case shows an example where deleted data can be effective. Past cases I dealt with are illustrative of what can be found in deleted data such as a daughter who accused her father of rape when in fact she didn't want to admit to having sexual relations with a boyfriend her parents knew nothing about. Or the case of a man's body that was found where a family stated they had never visited them, only to find a deleted photo of the man in their living room.

For further information about deleted data contact:
trewmte@gmail.com

Deleted SMS text messages

Deleted SMS text messages

GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.

Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:

GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."

Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?

http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf

Deleted SMS text messages

Deleted SMS text messages

GSM 11.11 (ETSI TS 100 977) is a Standard containing mandatory and optional requirements relevant to Subscriber Identity Module (SIM) cards. An optional service that an Operator may provide to a subscriber of its services is Short Message Service (SMS) text messaging. The requirements relating to storing sent and received SMS text messages, in the user memory area of the SIM card, are identified at GSM 11.11 cl10.5.3. When a message that is received and is subsequently deleted by the user of the SIM, the user can no longer gain access to that data. The details about a particular SMS message that has been deleted are removed from the SIM's memory table thus the mobile telephone will no longer display the SIM details of that message to the user.

Although the details of the SMS text message are no longer accessible by the user, GSM 11.11 makes it clear the physical data relating to the entire text message may still be recorded on the card. GSM 11.11 procedure for "Erasure" of text messages states:

GSM 11.11 cl 11.5.2
"Erasure: The ME will select in the SIM the message area to be erased. Depending on the MMI, the message may be read before the area is marked as "free". After performing the updating procedure with EFSMS, the memory allocated to this short message in the SIM is made available for a new incoming message. The memory of the SIM may still contain the old message until a new message is stored in this area."

Using specialist examination tools it is therefore possible to recover erased (deleted) SMS text messages from a SIM card. Where a previously deleted message has been over-written by either new data allocated to the memory area previously occupied by the deleted data or the handset automatically over-writes as a function of its operating procedure (usually over-writes with 000000's) the erased (deleted) data in the SIM are no longer recoverable. Hopefully this
information will assist if you are asked is it possible can deleted text messages be recovered, and, if not recoverable, why not?

http://www.filebucket.net/files/1596_ooy39/SMS%20Text%20Messages.pdf