BBM Protected FAQ

Get answers to some of the most frequently asked questions
about BBM Protected: what it is, how it works, and how you
can purchase and deploy it.

1. How does BBM Protected work to add additional encryption to BBM messages?

BBM Protected works by adding an additional level of encryption to messages sent between BBM Protected users by exchanging a set of public keys that are unique to those two users. The first time two BBM Protected users attempt to message each other, a secret passphrase is shared by email, SMS, phone or in person. Once the secret passphrase is verified, public signing and encryption keys are exchanged between the two users allowing for this advanced encryption of messages.

2. Does this mean that regular or personal BBM Chats are not secure?

Not at all. The default level of security offered by BBM today is already very secure, offering two layers of encryption for messages sent between BBM contacts. First, BBM uses a TLS to establish a secure connection between the smartphone and the server. TLS is a common web standard that is used for online shopping and internet banking. Additionally, BBM messages are encrypted using a triple DES 168-bit BBM scrambling key which encrypts messages leaving the sender’s phone, and authenticates and decrypts messages on the recipient’s phone. These two layers working together mean that you have secure messages flowing through a secure pipe. BBM Protected adds an additional layer of advanced encryption to this security model helping to meet the needs of the most security conscious organizations.

3. Can a BBM Protected user only talk to BBM Protected users within the company?

When a company has enabled BBM Protected for a user, BBM messages sent to any other BBM Protected users will be secured at this higher level of encryption – these could be other BBM Protected users within the same organization, or BBM Protected users at another organization on a completely different BES. This is one of the advantages offered by BBM Protected; out of the box secure messaging between organizations without the need for any federation or configuration. Plus, BBM Protected users can continue to use the same app to chat and share with other BBM contacts
like family and friends.

4. Can BlackBerry read BBM Protected messages?

No, BlackBerry cannot read BBM Protected messages. The encryption keys used to secure messages sent between BBM protected users are generated by the phones and controlled by the BES server. BlackBerry is not the broker in this public key exchange.

5. Does BBM Protected mean that BBM messages are automatically logged?

No, BBM Protected is not a supervisory feature like logging or auditing. BBM Protected is a security feature separate from other supervisory features available with the Gold Tier of BES.

6. What version of BlackBerry software is required for BBM Protected?

a. For BlackBerry OS devices, BBM Protected will work with BlackBerry OS version 6.0, 7.0, or 7.1
b. For BlackBerry 10 devices, BBM Protected will work on BlackBerry 10 v 10.2, 10.2.1, or 10.3

7. What version of BBM is required for BBM Protected?

a. For BlackBerry OS devices, BBM Protected requires BBM version 8.5 or higher
b. For BlackBerry 10 devices, BBM Protected requires BBM version 10.3.30 or higher

8. What version of BlackBerry Enterprise Server is required for BBM Protected?

a. For BlackBerry Enterprise Server 5.0 or later (you need to apply the BBM Protected IT Policy pack; it can be applied to any BlackBerry Enterprise Server 5 version)
b. BlackBerry Enterprise Service 10 version 10.2.2 or higher

9. How do I purchase BBM Protected User licenses?

When you apply the Use BBM Protected rule to an IT Policy, you receive a message on the Administration Console advising that you must purchase licenses. The message includes a link to a knowledge base article. The article provides instructions on contacting a licensing distributor (for example, an ISV, VAR or BlackBerry Account Manager).

The following are the main steps to purchase and collect your licenses:
• Contact a licensing distributor and order your licenses.
• In the confirmation email that you receive, click the link to log in to the Account Center.
• Claim your licenses and accept the license agreements. After claiming the licenses, you receive an email that confirms the purchase of the licenses. The email also includes a link where you can download files. For example, if you are using BlackBerry Enterprise Server 5, you must download the IT policy pack. You can also download the .bar and .cod files for the BBM app. If the app is not currently installed on BlackBerry devices, you must install it.
• If you are using the licenses in a BlackBerry Enterprise Server 5 environment, download the BES5 IT policy pack and import the rules from the policy pack.
• Download the .bar and .cod files if you have not previously downloaded and installed the BBM app on devices.
• You will receive an invoice after claiming the licenses. Licenses expire after one year.

10. What is the cost of a BBM Protected User License?

BBM Protected User Licenses are available at a cost of $29.99 per user per year. Please contact your BlackBerry Account Manager or authorized BlackBerry reseller for more information on pricing and availability.

11. Is the price per user or per device (for example if a user has multiple devices)?

A BBM Protected User License is valid for 1 user on 1 device. If a user leaves the company, or an administrator wants to apply the BBM Protected User License to another user at the company, they can re-assign it at any time.

12. How do I enable BBM Protected for users at my organization?

BBM Protected is applied to a user or user group as a new IT policy through the BES console. When deploying BBM Protected, complete the following tasks after purchasing the licenses for BBM Protected:
• If the BBM app is not installed on the BlackBerry devices, install the app on the devices. You can push the .bar or .cod file for the BBM app to devices, or allow users to download the app.
• Add the Use BBM Protected rule to an IT Policy. When adding the rule, set it to Yes to enable signing and encryption. The default setting is No.
• Assign the IT policy to groups of BlackBerry device users. The BlackBerry Enterprise Service 10 Advanced Administration Guide and the BlackBerry Enterprise Server 5 Administration Guide explain how to manage apps and IT policies.

13. I am on BES 5 – where do I get the IT Policy Pack to enable BBM Protected?

After purchasing your BBM Protected User Licenses, you will be provided with a Welcome email which will include a link to the download site to get the IT Policy Pack.

14. Where would I get the source files for the BBM app in order to push this application to my users?

After purchasing your BBM Protected User Licenses, you will be provided with a Welcome email which will include a link to the download site to get the BBM Source Files in order to push the BBM applications to the users who have been set-up for BBM Protected.

15. How can I cancel my purchase of BBM Protected if I decide we no longer require it?

BBM Protected User Licenses cannot be refunded or exchanged.

16. When will BBM Protected be available for Balance regulated?

BBM Protected will be available for BlackBerry 10 smartphones running in work / personal regulated mode with BlackBerry Balance in the fall of 2014. Please fill out this form to be contacted by BlackBerry about your interested in BBM Protected for Balance regulated devices.
Click to collect information >

17. When will BBM Protected be available for iOS and Android?

BBM Protected for iPhone and Android will be available in the fall of 2014. Please fill out this form to be contacted by BlackBerry about your interest in BBM Protected for iOS and Android.
Click to collect information >

18. Does the added encryption offered by BBM Protected apply to BBM Voice and BBM Video calls?

BBM Protected encryption applies to BBM messages, attachments and files sent between BBM Protected users. It also applies to multi-person BBM chats where all participants are BBM Protected users and BBM Groups that have been established as Protected BBM Groups. It does not apply to BBM Voice and BBM Video calls at this time. More information on the security model used for BBM Voice and BBM Video calls can be found in the BBM Security Note available here >

19. Can I add BBM Protected to my Silver License?

BBM Protected User Licenses are sold separately from Silver and Gold CALs. At this time, BBM Protected will only work for users who are in Regulated Mode, which would require a Gold CAL or Gold or Advanced SRV.

20. Can I track my BBM Protected user licenses in the BESC?

BBM Protected User Licenses can be tracked and viewed within Account Centre. You can access Account Centre through the BESC.

21. How long is a BBM Protected user license valid for? How do I renew it?

BBM Protected User Licenses will be valid for 1 year from the date of purchase. A new BBM Protected User License will be required at the end of the 12 month term.

22. My company already uses Microsoft Lync, why would I want BBM Protected?

While many organizations have invested in UCC solutions like Microsoft Lync, mobile adoption of these solutions is often low. These desktop based enterprise IM solutions often deliver a poor mobile user experience and frequently limit employees to communicating with other employees inside the organization. As a result, employees are going outside their corporate deployed IM apps, communicating through unsanctioned 3rd party applications. BBM Protected allows users to use a single app to securely message contacts inside the company as well family and friends outside the company. Plus, it offers a user experience built from the ground up for mobile. Lastly, BBM Protected is a cloud based solution, deployed, managed and controlled from BES but residing in BlackBerry’s secure, scalable and reliable infrastructure. BBM Protected will continue to work if an organizations own IT infrastructure has experienced a server outage or a full on catastrophic crash. By comparison, Microsoft Lync and Lotus Sametime are on premise IM platforms that rely on licensed client / server software that is deployed, managed and controlled from within the firewall of the organization.

23. How do I know if I am in a BBM Protected chat?

While the aim is to make BBM Protected as seamless and transparent as possible for BBM users, there are a few ways to tell when you are having a BBM Protected chat. In the field where you type your message you will see that it says ‘Protected. Enter a message’. You will also find that as you type your message, it appears in blue whereas text in a chat using default BBM encryption will appear in black. When you’re in a BBM Protected Group, you will see a small lock symbol that appears at the top of the group lobby next to the BBM Group name. This serves as a reminder that this is a BBM Protected Group meaning that all messages between all participants are encrypted using the advanced public / private key and only other BBM Protected users will be permitted to join the group.

24. How do you know which of your BBM contacts are also using BBM Protected?

BBM Protected aims to make chatting with other BBM Protected users seamless by moving the security to the background so that it doesn’t get in the way of the user – therefore we don’t put a lot of emphasis on who is and isn’t a BBM Protected user. That said, when you go to start a new BBM chat, you will see that a small lock appears next to the names of other BBM Protected users on your BBM Contact list.

25. Can I cut and paste copy in to a BBM Protected chat from another application?

Yes, BBM users can cut and paste freely in to a BBM Protected conversation. BBM Protected offers enhanced encryption of the chat without limiting in any way what kind of content can be shared. For instance, a BBM user can copy a phone number from a BBM Protected chat in to a chat with a non-BBM Protected user. This is yet another example of the seamless user experience plays an important role in the BBM Protected offering.