This article was published in Scientific American’s former blog network and reflects the views of the author, not necessarily those of Scientific American
The scandal that helped shutter Rupert Murdoch's News of the World tabloid and left at least nine News International journalists facing possible criminal charges has brought phone hacking into the spotlight as a means of subversively gathering information for news articles. As investigators study the scope of the problem, including the role phone hacking played in News of the World's coverage of the disappearance and death of teen Milly Dowler in 2002, it's become clear that breaking into someone else's voice mail isn't very difficult.
This, of course, doesn't make phone hacking legal. In England, where the alleged offenses took place, it is a crime to intercept phone calls unless you're a police officer or intelligence agent with an official warrant, which can be granted only to protect national security. News International may also face legal problems in the U.S. under the Foreign Corrupt Practices Act (FCPA) based on allegations that News of the World reporters offered to pay a New York police officer to retrieve the private phone records of victims of the September 11 attacks.
On supporting science journalism
If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.
The key to breaking into someone's voice mail is to access that person's voice mail prompt and/or management systems, says Jim Broome, practice manager for enterprise consulting with Accuvant LABS, the security assessment and research division of Denver-based Accuvant, Inc. This can be done in several basic ways particularly if a person's voice mail account has no password or PIN, uses the default password that came with his account (typically 0000 or 1234, or something along those lines), or uses a simple password that's easy to guess, Broome says.
Voice mail prompts can also be accessed via caller ID spoofing. With the advent of caller ID, many voice mail systems have been created that simply check the number calling in and base authentication on that match, Broome says. Caller ID spoofing services like Spoofcard.com allow people to make it appear that their phone number is the same as the digits they are dialing. When the receiving phone recognizes its own phone number, it will often dump the caller directly into voice mail.
Apple apparently isn't amused by SpoofCard and has removed the app from its App Store, although it's still available through Spoofcard.com.
Obviously, setting a strong password (one that is not obvious, such as a birthday) is the primary measure for securing a voice mail account. It's also a good idea to change your PIN every few months. Of course, good luck remembering it.
Image courtesy of Slavoljub Pantelic, via iStockphoto.com