From: tim@ais.org (Tim Tyler)
Subject: Motorola 'Secure-Clear' Cordless Telephones
Organization: UMCC
Distribution: na
Date: Fri, 1 Jan 1993 01:39:56 GMT

           "Why A Motorola Cordless Phone?"   
 
     "Cordless phone eavesdroppers are everywhere" says pro golfer
Lee Trevino, spokesman for Motorola.  "But with my Motorola Secure
Clear Cordless Phone, my private conversations stay private."
 
     So says a glossy brochure (# BA-81) that Motorola's Consumer
Products Division (telephone # 800/331-6456) distributes to promote
their new 'secure' cordless phone product line.   When I first read
the cover of the brochure, I said to myself, "Wow, I wonder what
sophisticated technology it must use?"   Motorola has been
developing and selling secure voice & data systems, from DVP & DES
up to the current 'FASCINATOR' algorithm for classified military &
federal government secure voice for many years.
 
 Page Two of the slick brochure provides some rhetorical questions
and answers:
 
*****************************************************************
          Why Motorola Cordless Phones?
 
     Q. What is meant by Secure Clear?
 
     Secure Clear is an exclusive technology that assures you no
eavesdroppers will be able to use another cordless phone, scanner
or baby monitor to listen in to your cordless conversations.
 
     Q. How difficult is it to eavesdrop on someone's cordless
conversation?
 
     It's not difficult at all. Simply by operating a cordless
phone, scanner or baby monitor on the same channel as you're on, an
eavesdropper can listen in.  Security codes alone DO NOT prevent
eavesdropping.
 
     Q. What are security codes and what do they do?
 
     Security codes allow the handset and base to communicate with
each other. With the Secure Clear cordless phone, one of 65,000
possible codes are randomly assigned every time you set the handset
in the base.  This means that a neighbor cannot use his handset to
link with your base and have phone calls charged to your phone
number.
 
     Q. Describe the basic difference between Secure Clear and
    Secure Clear protects against eavesdropping.  Security codes
prevent the unauthorized use of your phone line. Usually all
cordless phones have security codes, but not both.
 
     Q. What is the purpose of the Secure Clear demo?
 
     The Secure Clear demo is a unique feature of Motorola phones
that allows you to actually experience what an eavesdropper would
hear when trying to listen to your conversation.  By pressing the
SECURE DEMO button on the Motorola phone, you and the person on the
other end will hear the same scrambled noise an eavesdropper would
hear.
 
*****************************************************************
     
     Hmmm...  I went to the Motorola Secure Clear cordless phone
display at a Sears store, took a deep breath, & hit the demo button
in order to hear what the "scrambled noise" which would protect a
conversation from eavesdropping sounded like.  
     White-noise like that of a digital data stream? Rapid analog
time-domain scrambling?  No, the scrambled "noise" sounded like
inverted analog voice.  That's right, they're using the 40 or 50
year old (3kHz baseband) speech inversion system --the same one
which they stopped marketing for their commercial two-way radio
gear about a decade ago-- to make Lee Trevino & other ignorant
people's "private conversations stay private."
     
     For those of you not familiar with speech inversion, it simply
flip-flops the voice spectrum so that high pitched sounds are low,
& vice versa.  It sounds a lot like Single Side Band (SSB)
transmissions, although an SSB receiver will not decode speech-
inversion scrambling.  Prior to 1986, several companies -- Don
Nobles, Capri Electronics, etc. sold inexpensive kits or scanner
add-ons which could be used to decode speech inversion.  Several
electronics magazines also published schematics for making your own
from scratch, at a cost of about $5.    After the Electronic
Communications Privacy Act of 1986, it became illegal to decode or
decipher encrypted communications which you weren't a legitimate
party to, so the standard practice of selling these quasi-legal
products as 'experimental kits' or 'for educational purposes only'
became common.  Today, some companies will not specifically sell a
'speech-inversion descrambler,' but instead market a 'speech
inversion scrambling system' which means the kit will encode as
well as decode speech inversion, although most people buy them
simply to hook up to their scanners & monitor the few public safety
agencies and business that (still) use speech-inversion scrambling.
 
     Yes, technically, it is a felony for you to use a speech-
inversion descrambler to monitor these Motorola 'Secure Clear'
cordless. Or for that matter, the new Radio Shack DUoPHONE ET-499,
cordless phone which also depends on speech-inversion for privacy
protection.  The public utility of the ECPA has been argued about
ever since before it was enacted.  It is rather obvious that the
ECPA was pushed upon the ignorant, money-hungry Congress by the
powerful (& wealthy) Cellular Telephone Industry Association (so
the CTIA could propagate misinformation to the public, but that's
another story...).  I also realize that the 46/49MHz cordless phone
channels are apparently allocated for analog-voice only.
 
     Despite the ECPA, it is unconscionable to me that Motorola --
who surely knows better-- would produce the slick brochure &
specifically market the 'Secure Clear' line as being invulnerable
to eavesdropping.   Their wording unequivocally gives the
impression that the 'Secure Clear' conversations are secure, not
only from other cordless phone & baby monitors, which have several
common frequencies, but also against communications hobbyists with
scanner radios.
 
     It is bad enough that many public safety officers still think
that by using the 'PL' ('Private Line,' also known as CTCSS)
setting on their Motorola two-way radios, no one else can listen
in.  While the 'Private Line' fiasco might be attributable to
misconception on the part of the radio users, in my opinion,
Motorola's Consumer Products Division has to know that there are
thousands of scanner monitors who have the technical ability to
defeat the speech-inversion 'Secure Clear' system.  A Motorola
representative at the 1992 Summer Consumer Electronics Show in
Chicago confirmed this to me, with a smirk on his face.
 
     There's a big difference between Motorola's aforementioned
wording & that of Radio Shack's on page 3 of their 1993 catalog:
 
        New! Voice-Scrambling Cordless Telephone
        DUoFONE ET-499.  Cordless phones are great.
        But since they transmit over the airwaves, 
        your private conversations could be 
        monitored. Now you can enjoy cordless
        convenience with voice scrambling for
        added [emphasis theirs] privacy protection --
        frequency inversion makes transmissions 
        between the handset and base unintelligible...
 
 
     It's not "Motorola should know better."  Motorola DOES know
better.  Otherwise, they wouldn't be spending time or money on truly
'secure' (based on current technology, of course) communications
and transmission security systems.
 
     I sure am thankful that our federal government & military
users of secure-mode communications systems don't rely on  
Motorola's marketing department to provide factual information as
to the level of security provided by Motorola equipment.  Too bad
that for the most part, the public does.
 
 
 
     For anyone looking for a cordless telephone that offers a
decent level of privacy, take a look at some of the new cordless
phones which use 900MHz.  Most of the new ones not only use CVSD
digital voice for the RF link, but also direct-sequence spread
spectrum.  By no means are these phones secure ('encoded,' yes, but
'encrypted,' no), despite some of the wording in their owner's 
manuals.  The Tropez 900 actually seems to generate a very weak 
analog harmonic in the 440MHz spectrum, but you'll still be a
lot better off than poor old Lee Trevino.



-- 
 Tim Tyler      Internet: tim@ais.org  MCI Mail: 442-5735 
P.O. Box 443    C$erve: 72571,1005  DDN: Tyler@Dockmaster.ncsc.mil
Ypsilanti MI    Packet: KA8VIR @KA8UNZ.#SEMI.MI.USA.NA
48197
Newsgroups: sci.crypt