Date: Thu, 7 Jan 1993 03:29:17 -0500
From: Monty Solomon <monty@proponent.com>
Newsgroups: comp.dcom.telecom
Subject: Motorola 'Secure-Clear' Cordless Telephones
Organization: TELECOM Digest
X-Submissions-To: telecom@eecs.nwu.edu
X-Administrivia-To: telecom-request@eecs.nwu.edu
X-Telecom-Digest: Volume 13, Issue 11, Message 1 of 4

[Moderator's Note: Monty passed this along to the group.  PAT]

 Newsgroups: sci.crypt
 From: tim@ais.org (Tim Tyler)
 Subject: Motorola 'Secure-Clear' Cordless Telephones
 Message-ID: <C05JAM.MJL@ais.org>
 Organization: UMCC
 Date: Fri, 1 Jan 1993 01:39:56 GMT

 
          "Why A Motorola Cordless Phone?"   

     "Cordless phone eavesdroppers are everywhere" says pro golfer Lee
Trevino, spokesman for Motorola.  "But with my Motorola Secure Clear
Cordless Phone, my private conversations stay private."
 
     So says a glossy brochure (# BA-81) that Motorola's Consumer
Products Division (telephone # 800/331-6456) distributes to promote
their new 'secure' cordless phone product line.  When I first read the
cover of the brochure, I said to myself, "Wow, I wonder what
sophisticated technology it must use?"  Motorola has been developing
and selling secure voice and data systems, from DVP and DES up to the
current 'FASCINATOR' algorithm for classified military and federal
government secure voice for many years.
 
 Page Two of the slick brochure provides some rhetorical questions
and answers:

          Why Motorola Cordless Phones?

     Q. What is meant by Secure Clear?

     Secure Clear is an exclusive technology that assures you no
eavesdroppers will be able to use another cordless phone, scanner or
baby monitor to listen in to your cordless conversations.

     Q. How difficult is it to eavesdrop on someone's cordless
conversation?

     It's not difficult at all. Simply by operating a cordless phone,
scanner or baby monitor on the same channel as you're on, an
eavesdropper can listen in.  Security codes alone DO NOT prevent
eavesdropping.
 
     Q. What are security codes and what do they do?
 
     Security codes allow the handset and base to communicate with
each other. With the Secure Clear cordless phone, one of 65,000
possible codes are randomly assigned every time you set the handset in
the base.  This means that a neighbor cannot use his handset to link
with your base and have phone calls charged to your phone number.
 
     Q. Describe the basic difference between Secure Clear and

    Secure Clear protects against eavesdropping.  Security codes
prevent the unauthorized use of your phone line. Usually all cordless
phones have security codes, but not both.
 
     Q. What is the purpose of the Secure Clear demo?
 
     The Secure Clear demo is a unique feature of Motorola phones that
allows you to actually experience what an eavesdropper would hear when
trying to listen to your conversation.  By pressing the SECURE DEMO
button on the Motorola phone, you and the person on the other end will
hear the same scrambled noise an eavesdropper would hear.
 
                       ----------
     

     Hmmm ... I went to the Motorola Secure Clear cordless phone
display at a Sears store, took a deep breath, and hit the demo button
in order to hear what the "scrambled noise" which would protect a
conversation from eavesdropping sounded like.

     White-noise like that of a digital data stream? Rapid analog
time-domain scrambling?  No, the scrambled "noise" sounded like
inverted analog voice.  That's right, they're using the 40 or 50 year
old (3kHz baseband) speech inversion system -- the same one which they
stopped marketing for their commercial two-way radio gear about a
decade ago -- to make Lee Trevino and other ignorant people's "private
conversations stay private."

     For those of you not familiar with speech inversion, it simply
flip-flops the voice spectrum so that high pitched sounds are low, and
vice versa.  It sounds a lot like Single Side Band (SSB)
transmissions, although an SSB receiver will not decode speech-
inversion scrambling.  Prior to 1986, several companies -- Don Nobles,
Capri Electronics, etc. sold inexpensive kits or scanner add-ons which
could be used to decode speech inversion.  Several electronics
magazines also published schematics for making your own from scratch,
at a cost of about $5.  

     After the Electronic Communications Privacy Act of 1986, it
became illegal to decode or decipher encrypted communications which
you weren't a legitimate party to, so the standard practice of selling
these quasi-legal products as 'experimental kits' or 'for educational
purposes only' became common.  Today, some companies will not
specifically sell a 'speech-inversion descrambler,' but instead market
a 'speech inversion scrambling system' which means the kit will encode
as well as decode speech inversion, although most people buy them
simply to hook up to their scanners and monitor the few public safety
agencies and business that (still) use speech-inversion scrambling.
 
     Yes, technically, it is a felony for you to use a speech-
inversion descrambler to monitor these Motorola 'Secure Clear'
cordless. Or for that matter, the new Radio Shack DUoPHONE ET-499,
cordless phone which also depends on speech-inversion for privacy
protection.  The public utility of the ECPA has been argued about ever
since before it was enacted.  It is rather obvious that the ECPA was
pushed upon the ignorant, money-hungry Congress by the powerful (&
wealthy) Cellular Telephone Industry Association (so the CTIA could
propagate misinformation to the public, but that's another story ...).
I also realize that the 46/49MHz cordless phone channels are
apparently allocated for analog-voice only.

     Despite the ECPA, it is unconscionable to me that Motorola -- who
surely knows better -- would produce the slick brochure & specifically
market the 'Secure Clear' line as being invulnerable to eavesdropping.
Their wording unequivocally gives the impression that the 'Secure
Clear' conversations are secure, not only from other cordless phone
and baby monitors, which have several common frequencies, but also
against communications hobbyists with scanner radios.
 
     It is bad enough that many public safety officers still think
that by using the 'PL' ('Private Line,' also known as CTCSS) setting
on their Motorola two-way radios, no one else can listen in.  While
the 'Private Line' fiasco might be attributable to misconception on
the part of the radio users, in my opinion, Motorola's Consumer
Products Division has to know that there are thousands of scanner
monitors who have the technical ability to defeat the speech-inversion
'Secure Clear' system.  A Motorola representative at the 1992 Summer
Consumer Electronics Show in Chicago confirmed this to me, with a
smirk on his face.

     There's a big difference between Motorola's aforementioned
wording and that of Radio Shack's on page 3 of their 1993 catalog:

        New! Voice-Scrambling Cordless Telephone
        DUoFONE ET-499.  Cordless phones are great.
        But since they transmit over the airwaves, 
        your private conversations could be 
        monitored. Now you can enjoy cordless
        convenience with voice scrambling for
        added [emphasis theirs] privacy protection --
        frequency inversion makes transmissions 
        between the handset and base unintelligible...

     It's not "Motorola should know better."  Motorola DOES know
better.  Otherwise, they wouldn't be spending time or money on truly
'secure' (based on current technology, of course) communications and
transmission security systems.
 
     I sure am thankful that our federal government and military users
of secure-mode communications systems don't rely on Motorola's
marketing department to provide factual information as to the level of
security provided by Motorola equipment.  Too bad that for the most
part, the public does.

     For anyone looking for a cordless telephone that offers a decent
level of privacy, take a look at some of the new cordless phones which
use 900MHz.  Most of the new ones not only use CVSD digital voice for
the RF link, but also direct-sequence spread spectrum.  By no means
are these phones secure ('encoded,' yes, but 'encrypted,' no), despite
some of the wording in their owner's manuals.  The Tropez 900 actually
seems to generate a very weak analog harmonic in the 440MHz spectrum,
but you'll still be a lot better off than poor old Lee Trevino.


Tim Tyler      Internet: tim@ais.org  MCI Mail: 442-5735 
P.O. Box 443    C$erve: 72571,1005  DDN: Tyler@Dockmaster.ncsc.mil
Ypsilanti MI    Packet: KA8VIR @KA8UNZ.#SEMI.MI.USA.NA
48197