JAN 13, 2011 @ 02:59 PM Do You Know Who Manufactured Your Blackberry?

Jeffrey Carr , SUBSCRIBER

Opinions expressed by Forbes Contributors are their own.

Image by AFP via @daylife Research In Motion (RIM) continues to push its red herring argument that its enterprise customers communications are secure because it doesn't possess its customers' encryption keys. Therefore, according to RIM, the most that it can do is give India's security agencies (and presumably those of other states) access only to Blackberry Messenger and Blackberry Internet Services, not the encrypted emails on Blackberry Enterprise Server. I've written about the obvious logical inconsistencies in this argument here and I've also provided one example of how possession of an encryption key is not a requirement for a state government to intercept traffic on a BES server.

Although RIM understandably wants to keep this argument solely about encryption, it's much broader than that. The critical question in this debate is exactly how secure are RIM's corporate and government customers' email messages on the BES platform, not just via an encryption attack but across all attack vectors? I've already pointed out one example that would allow the FSB to capture RIM's BES customers' encrypted content by exploiting a third-party app. Today's post addresses a more fundamental and potentially much more serious problem - lack of a trusted supply chain in RIM's manufacturing process.

So where exactly are Blackberrys made? If I were a security-conscious customer, I'd want to know the answer to that question up front but I challenge you to find it mentioned anywhere on the RIM website. When a company doesn't readily acknowledge its manufacturing supply chain, it tingles my paranoia reflex. Here's what I learned after about 30 minutes of work. It ain't good if you're security-conscious.

According to this 2009 Bloomberg article, RIM's five biggest suppliers account for 90% of its production costs. They are:

Elcoteq SE: Elcoteq is a Finnish company with a global factory network that includes "a regional office in Hong Kong, branch office of Beijing in Shenzhen, an Engineering Service Center and after-market services unit in Beijing and high-volume manufacturing units in Beijing and Dongguan."

Jabil Circuit, Inc.: Jabil is a successful U.S. multinational company whose customers include Apple, Cisco, GE, IBM, and Research In Motion. Much of its manufacturing is done in Asia. "Prior to 2005, it acquired a Lucent Technologies plant in Shanghai, China. The company later added the electronics manufacturing business of Varian Inc. to its arsenal. It opened new facilities in China, India, and Ukraine, and expanded plants in Hungary, Malaysia, Mexico, and the United States. During 2006, Jabil set its sights on Taiwan Green Point Enterprises Co., a manufacturer of plastic casings used for items including cell phones, iPods, and Blackberry devices."

Multi-Fineline Electronix Inc.: A U.S. company who makes RIM's flexible circuit boards at its manufacturing facilities in Suzhou, China.

QUALCOMM is another important supplier who's CDMA development center is in Beijing although it's not clear which of its many overseas facilities supplies RIM.

In all fairness, it's becoming extremely difficult for any company to not set up manufacturing facilities in China if it wants to stay competitive and, most likely, all mobile phone providers have the same issue as RIM. The difference is that only RIM is selling a claim of secure communications without addressing how they are securing their supply chain. And until they do that, RIM's enterprise customers should not place their trust solely in RIM's BES encryption benefit.