Date: Thu, 7 Jan 1993 03:29:17 -0500 From: Monty Solomon Subject: Motorola 'Secure-Clear' Cordless Telephones [Moderator's Note: Monty passed this along to the group. PAT] Newsgroups: sci.crypt From: tim@ais.org (Tim Tyler) Subject: Motorola 'Secure-Clear' Cordless Telephones Message-ID: Organization: UMCC Date: Fri, 1 Jan 1993 01:39:56 GMT "Why A Motorola Cordless Phone?" "Cordless phone eavesdroppers are everywhere" says pro golfer Lee Trevino, spokesman for Motorola. "But with my Motorola Secure Clear Cordless Phone, my private conversations stay private." So says a glossy brochure (# BA-81) that Motorola's Consumer Products Division (telephone # 800/331-6456) distributes to promote their new 'secure' cordless phone product line. When I first read the cover of the brochure, I said to myself, "Wow, I wonder what sophisticated technology it must use?" Motorola has been developing and selling secure voice and data systems, from DVP and DES up to the current 'FASCINATOR' algorithm for classified military and federal government secure voice for many years. Page Two of the slick brochure provides some rhetorical questions and answers: Why Motorola Cordless Phones? Q. What is meant by Secure Clear? Secure Clear is an exclusive technology that assures you no eavesdroppers will be able to use another cordless phone, scanner or baby monitor to listen in to your cordless conversations. Q. How difficult is it to eavesdrop on someone's cordless conversation? It's not difficult at all. Simply by operating a cordless phone, scanner or baby monitor on the same channel as you're on, an eavesdropper can listen in. Security codes alone DO NOT prevent eavesdropping. Q. What are security codes and what do they do? Security codes allow the handset and base to communicate with each other. With the Secure Clear cordless phone, one of 65,000 possible codes are randomly assigned every time you set the handset in the base. This means that a neighbor cannot use his handset to link with your base and have phone calls charged to your phone number. Q. Describe the basic difference between Secure Clear and Secure Clear protects against eavesdropping. Security codes prevent the unauthorized use of your phone line. Usually all cordless phones have security codes, but not both. Q. What is the purpose of the Secure Clear demo? The Secure Clear demo is a unique feature of Motorola phones that allows you to actually experience what an eavesdropper would hear when trying to listen to your conversation. By pressing the SECURE DEMO button on the Motorola phone, you and the person on the other end will hear the same scrambled noise an eavesdropper would hear. ---------- Hmmm ... I went to the Motorola Secure Clear cordless phone display at a Sears store, took a deep breath, and hit the demo button in order to hear what the "scrambled noise" which would protect a conversation from eavesdropping sounded like. White-noise like that of a digital data stream? Rapid analog time-domain scrambling? No, the scrambled "noise" sounded like inverted analog voice. That's right, they're using the 40 or 50 year old (3kHz baseband) speech inversion system -- the same one which they stopped marketing for their commercial two-way radio gear about a decade ago -- to make Lee Trevino and other ignorant people's "private conversations stay private." For those of you not familiar with speech inversion, it simply flip-flops the voice spectrum so that high pitched sounds are low, and vice versa. It sounds a lot like Single Side Band (SSB) transmissions, although an SSB receiver will not decode speech- inversion scrambling. Prior to 1986, several companies -- Don Nobles, Capri Electronics, etc. sold inexpensive kits or scanner add-ons which could be used to decode speech inversion. Several electronics magazines also published schematics for making your own from scratch, at a cost of about $5. After the Electronic Communications Privacy Act of 1986, it became illegal to decode or decipher encrypted communications which you weren't a legitimate party to, so the standard practice of selling these quasi-legal products as 'experimental kits' or 'for educational purposes only' became common. Today, some companies will not specifically sell a 'speech-inversion descrambler,' but instead market a 'speech inversion scrambling system' which means the kit will encode as well as decode speech inversion, although most people buy them simply to hook up to their scanners and monitor the few public safety agencies and business that (still) use speech-inversion scrambling. Yes, technically, it is a felony for you to use a speech- inversion descrambler to monitor these Motorola 'Secure Clear' cordless. Or for that matter, the new Radio Shack DUoPHONE ET-499, cordless phone which also depends on speech-inversion for privacy protection. The public utility of the ECPA has been argued about ever since before it was enacted. It is rather obvious that the ECPA was pushed upon the ignorant, money-hungry Congress by the powerful (& wealthy) Cellular Telephone Industry Association (so the CTIA could propagate misinformation to the public, but that's another story ...). I also realize that the 46/49MHz cordless phone channels are apparently allocated for analog-voice only. Despite the ECPA, it is unconscionable to me that Motorola -- who surely knows better -- would produce the slick brochure & specifically market the 'Secure Clear' line as being invulnerable to eavesdropping. Their wording unequivocally gives the impression that the 'Secure Clear' conversations are secure, not only from other cordless phone and baby monitors, which have several common frequencies, but also against communications hobbyists with scanner radios. It is bad enough that many public safety officers still think that by using the 'PL' ('Private Line,' also known as CTCSS) setting on their Motorola two-way radios, no one else can listen in. While the 'Private Line' fiasco might be attributable to misconception on the part of the radio users, in my opinion, Motorola's Consumer Products Division has to know that there are thousands of scanner monitors who have the technical ability to defeat the speech-inversion 'Secure Clear' system. A Motorola representative at the 1992 Summer Consumer Electronics Show in Chicago confirmed this to me, with a smirk on his face. There's a big difference between Motorola's aforementioned wording and that of Radio Shack's on page 3 of their 1993 catalog: New! Voice-Scrambling Cordless Telephone DUoFONE ET-499. Cordless phones are great. But since they transmit over the airwaves, your private conversations could be monitored. Now you can enjoy cordless convenience with voice scrambling for added [emphasis theirs] privacy protection -- frequency inversion makes transmissions between the handset and base unintelligible... It's not "Motorola should know better." Motorola DOES know better. Otherwise, they wouldn't be spending time or money on truly 'secure' (based on current technology, of course) communications and transmission security systems. I sure am thankful that our federal government and military users of secure-mode communications systems don't rely on Motorola's marketing department to provide factual information as to the level of security provided by Motorola equipment. Too bad that for the most part, the public does. For anyone looking for a cordless telephone that offers a decent level of privacy, take a look at some of the new cordless phones which use 900MHz. Most of the new ones not only use CVSD digital voice for the RF link, but also direct-sequence spread spectrum. By no means are these phones secure ('encoded,' yes, but 'encrypted,' no), despite some of the wording in their owner's manuals. The Tropez 900 actually seems to generate a very weak analog harmonic in the 440MHz spectrum, but you'll still be a lot better off than poor old Lee Trevino. Tim Tyler Internet: tim@ais.org MCI Mail: 442-5735 P.O. Box 443 C$erve: 72571,1005 DDN: Tyler@Dockmaster.ncsc.mil Ypsilanti MI Packet: KA8VIR @KA8UNZ.#SEMI.MI.USA.NA 48197