But see how the Neo900 guys have worked this out. They isolate the baseband chip, and handle it as a threat, which is a very good model I think.

It's a good model to limit the damage a hijacked baseband chip can do, yes. But it is still not "free".

If someone were to develop an open-source replacement firmware for a baseband chip, the hardware project could use that chip but ship with the manufacturers firmware. It would then be on the users to reflash if desired. I doubt the FCC can do anything about that, people are already doing this with the TI Calypso replacement firmware.

Here are a few possibilities I've come across:

* OsmocomBB (http://bb.osmocom.org/trac/)

* An old HN discussion: https://news.ycombinator.com/item?id=7064187

* OKL4, a hypervisor, is used widely in basebands. AFAICT It was developed by Open Kernel Labs and was open. It seems to have been acquired by General Dynamics and I don't know it's current status (does anyone know more about it?) (https://gdmissionsystems.com/cyber/products/trusted-computin...)

Oh, they cannot prevent you from installing the firmware… but if anyone catches you using it in the wild, you're in deep REDACTED.

E.g., If you're worried about the police monitoring your communications, giving them a perfectly legal reason to detain you is likely not your preferred course of action.

In this case we're not really worried about police monitoring. The police aren't magical, yet. If they're trying to surveil without the target's knowledge, and the first attempt fails, they'll try something else. If no electronic surveillance works, they'll find another way to investigate, or they'll prioritize other investigations. They really have no way to catch random people with unauthorized firmware, so long as that firmware generally follows FCC guidelines.

However it may be that other, less Constitutionally-constrained parties would have the ability to dragnet for nonstandard firmware to highlight people for more intense scrutiny. The police could use a parallel construction based on that. Then they could say that unauthorized firmware on a seized phone establishes some sort of criminal intent.

Sure, but assuming there isn't a serious bug in the baseband causing other spectrum users grief, how likely is it that someone will check your phone's baseband for tampering?

If you're a person of interest, the police can come up with a better reason to detain you than this.

The FreeCalypso project is working on free baseband firmware with an older TI Chipset. If I recall from their mailing list, which is fairly active, they have voice calls working now. It will of course not be a smartphone, and it'll be GSM only.

https://www.freecalypso.org/

How do they plan to get it FCC certified? Without FCC certification, it may not be legally used outside shielded testing environments.

I'm actually not sure, recently joined the mailing list and have been passively monitoring.

Would it make a difference if the chipset being used was already used for a cellphone that was FCC certified? If I put DD-WRT on my router, do I need to re-apply for FCC certification? (Wondering)

I'm not sure whether the certification guidelines for wifi and cell devices are the same.

For Wifi it's surprisingly strict:

• Every antenna+transmitter configuration has to be certified separately (that's why Lenovo and other laptop vendors have Wifi card whitelists and refuse booting with uncertified chips installed).

• The software that directly drives the hardware must be certified to conform to the transmission power limits etc.

For DD-WRT and others neither is a problem, because the hardware combination has been certified by the router vendor, and DD-WRT uses the wifi chip vendor's firmware blob to drive the hardware, which is certified by the vendor.

> Every antenna+transmitter configuration has to be certified separately (that's why Lenovo and other laptop vendors have Wifi card whitelists and refuse booting with uncertified chips installed).

Are you sure about that? The fact that not every vendor has such a lock suggests to me that there is no legal requirement for it.

>DD-WRT uses the wifi chip vendor's firmware blob to drive the hardware, which is certified by the vendor.

At least for many Atheros-based chipsets they use ath9k instead of the vendor blobs.

what's the story on OpenMoko? I have a hard time seeing the FCC directly saying something like that, and google isn't showing anything...

Some follow-on and related projects:

* GTA04 by OpenPhoenux (http://projects.goldelico.com/p/gta04-main/)

* Neo900 (http://neo900.org/)

* QTMoko (http://qtmoko.sourceforge.net/)

* SHR (http://shr-project.org/)

The OpenMoko project sort of fizzog'ed, but you can get a good kick out of the OpenPandora (and new: OpenPyra) projects, which the GTA04/neo guys have helped along a bit, I think ..

http://openpandora.org/

That was an attempt at a Linux-based phone before Android. It is very old (close to 10 years?).

Was more wondering about the accusation that the FCC shot down the effort. Google seems to show that it launched something, can't find any trace of controversy

The project itself didn't fail because it – that was just due to Android being more attractive by the time it was working –, but they never managed to opensource the baseband firmware for that reason.