Juha Saarinen: Is 5G too secure for the law?

Vodafone CEO Jason Paris. Paris announced a 5G network launch in Auckland Wellington, Christchurch and Queenstown for December. Photo / Supplied

There's one aspect of the upcoming 5G upgrade that's definitely worth having, and it's the substantial security boost the new mobile technology promises to bring in.

Just about every week there's a hack, massive data breach, disruption of communications or other threat; despotic regimes track dissidents and spy on them through their mobile devices and have them incarcerated or killed.

Making 5G more secure than 3G and 4G is a good thing in an increasingly hostile environment, right?

You and I would say "yes", but police around the world are panicking that 5G will render their existing interception and surveillance tools that work with 2G, 3G and 4G networks and devices useless.

The 5G standard is almost hammered out, and expected to be ready in December this year which might explain why Vodafone New Zealand is starting its service then and why we didn't see any handsets at the recent pre-launch in Auckland.

As with internet-borne data it's encryption that the cops worry about. In December, end-to-end encryption between devices could become mandated for the 5G standard.

This would make lawful interception impossible, Europol said in a recent submission to the Council of the European Union.

Not only that, but 5G is likely to encrypt the fifteen digit international mobile subscriber identifier (IMSI) which is unique to every subscriber.

Police and intelligence agencies use IMSI catchers to identify and locate mobile subscribers, be they suspected criminals, spies or missing people.

IMSI catchers look like base stations to mobile devices and can be used to trick them into turning off or weaken encryption of communications for easy eavesdropping.

They can also be used to jam mobile phones in prisons; IMSI catchers can record if protesters were present at for example public demonstrations and if a journalist met with a whistleblower, should either party carry a mobile phone.

Even though IMSI catchers can be defeated and aren't always effective, their use by police is highly controversial from a privacy point of view.

Encrypted IMSI numbers and 5G not promiscuously hooking up with any old base station, even fake ones like older mobile tech does, kills off a great surveillance tool for police and anyone else who buys a catcher.

Add to that 5G's network slicing feature that allows operators securely to set up virtual channels over a physical network, and spooks won't even know where to look for their targets.

Low latency (the delay or lag between sending data and receiving a response) is another feature that will make 5G nicer to use and perform much quicker than 3G and 4G.

One way to achieve that is with the obscurely named multi-access edge computing (MEC) which means devices talk to each other directly using very high frequency millimetre wave 5G signals that reach maybe 100 metres and no further.

Nokia 5G millimetre wave equipment. Photo / Juha Saarinen

That is, there's no communication between a subscriber's mobile phone and a central network access point for police to intercept.

Police in Europe now intend to lobby the 3GPP industry organisation to ensure that lawful interception remains possible after 5G goes alive.

Where things get interesting from a local perspective is the Telecommunications (Interception Capability and Security) Act, in force since 2014.

TICSA compels telcos and internet providers to assist police and certain government agencies with interception under warrants. Operators are also required to have the Government Communications Security Bureau (GCSB) vet their network designs before they're implemented.

Vodafone New Zealand seemed taken by surprise when I asked chief executive Jason Paris and his team during the recent 5G launch if the interception demands would collide with tighter security of the new tech.

A spokesperson was dispatched to interrogate techies, and I am told that Vodafone has engaged with GCSB about the 5G deployment and that it meets "all current requirements under TICSA."

Vodafone network supplier Nokia's head of Oceania, Zoltán Losteiner, acknowledged the never-ending debate with a weary "it's an arms race" when I spoke to him at the Vodafone 5G launch.

As Losteiner pointed out, everything communicates with end to end encryption, and that includes the apps people use.

Even if law enforcement has network access, an app like Signal would still be difficult to intercept although there might be communications session metadata to capture.

Annoying as telcos can be, you can't but feel for them on this: on the one hand, they have to keep their network secure against increasingly advanced and complex attacks by criminals and nation-state actors.

This is what TICSA demands, and it's the reason why Huawei's on hold for local 5G deployments.

On the other hand, the likes of Nokia are asked to do the seemingly impossible, namely selectively breaking 5G's nearly unbreakable security without creating dangerous holes that can be abused by criminals and murderous regimes.

How Nokia managed to do this to remain compliant with TICSA would be a fascinating story that I suspect we won't be told any time soon.