RICHARD FEYNMAN, a brilliant physicist, developed a reputation for being able to crack safes when he was working at Los Alamos on the Manhattan Project. One of his tricks for opening safes that contained the secrets of the wartime atomic bomb project was to try the default factory code for the safe. Trying the factory code, it turns out, is also one of the tried and tested tricks used by reporters and private investigators in what has become known as the British phone-hacking scandal. It turns out that it is frighteningly simple to listen to the mobile voicemail messages of the rich, famous or interesting, as long as you have their mobile number. You can either call a central number and key in the mobile phone number, or you can tie up the mobile phone on one call while a second call is diverted to voicemail. The four-digit personal identification number (PIN) is then easy to guess, or trick out of the phone companies.
The New York Timesreports that often, all it took was a simple four-digit PIN, such as 1111 or 4444, which many users did not bother to change after buying their mobiles. But even if PINs were changed, there is a short list of very frequently used codes which are easy enough to guess. Users prefer numeric passwords such as 1234, 4321, 2345, 3456 (etc), 0000, 1111, 2222 (etc), 369 or 741 (which form vertical lines on a telephone keypad).
It is easy to blame users for such laxity but this misses the point, which is about the design of technology. Those who design buildings or furniture know they must take human biology and psychology into account. For example, doors that open into corridors will injure and uneven footways will make people trip. Yet companies constantly design consumer technology that does precisely the equivalent of tripping up their customers. The correct reaction is not to blame users for not paying more attention to where they treading. We've known for decades that users don't change default codes. So why didn't mobile phone companies have a policy of forcing people to change their voicemail PIN on first use? Or sending out a random PIN code the way that banks do? Or asking users to opt in to allow their voicemail to be picked up remotely?
Nick Davies, the Guardian journalist who helped break the phone-hacking story (see also this story), says that the mobile-phone companies have now set up systems so that if anyone attempts to change your PIN you get a text message, which is some improvement. Some have dropped default PIN codes. But it is all very patchy. And as Mr Davies explains, it doesn't deal with the problem of private investigators "blagging" PINs out of mobile phone companies (a technique known in the trade as "social engineering").
The websites of mobile-phone companies are also far from informative about the risks involved and how customers can protect themselves. Customers who call up and express concern that their phone has been tapped will simply be brushed off and told that this is unlikely. Britain's telecoms regulator, Ofcom, has been asleep at the wheel. But concerns about mobile-phone hacking are not restricted to Britain. In America it appears it is trivially easy for anyone who knows a little about phone systems to access someone else's voicemail by "spoofing" the caller ID.
What all this suggests is that the problem of phone hacking is likely to be far more widespread than anyone has acknowledged. Many corporate telephone systems and answering machines allow for the remote collection of voicemail. Voicemail passwords are often set to match the voicemail extension, or are set to the easy-to-guess codes. And brute-force attacks to reveal a PIN may also be possible in some circumstances.
Phone companies need to do far more to protect the security of their customers, even if most of them are protecting nothing more serious than affairs or domestic issues from nosy ex-partners. If they don't, stories like this will do little to inspire confidence in the idea that one's mobile can also be trusted to act as a front-door key, or an electronic wallet that can be used to make payments.