Sorry you are wrong, kinda. BIS ain't BES. BIS service connects you to your Gmail or HOtmail or whatever POP/IMAP account through your service provider.
BES service uses higher encryption, and connects your device via the carrier to your own corporate BlackBerry Server which expands and decrypts the email and forwards it to your messaging server (Exchange, Domino, or GroupWise)or compresses and encrypts from the message server and forwards off to the HH.
At no point is are those messagesx decryptable by RIM or anyone else (without spending way to many CRAY-years per message). There is a header that RIMs NOC uses to determine which carrier to hand off the encrypted data to, and which HH the carrier should send it to.
BlackBerry's are capable of AES and 3DES encryption.