CISA Told Highly Targeted People to Treat Their Phones as Exposed
December 2024 guidance from CISA was blunt: for some people, every hop between a phone and the internet should be treated as hostile.
On December 4, 2024, CISA and partner agencies published hardening guidance for communications infrastructure. The same month, CISA published mobile best practices aimed at people who are highly targeted: senior government or political figures likely to hold information a state actor wants.
The mobile guide says PRC-affiliated actors had targeted commercial telecommunications infrastructure, enabling theft of customer call records and compromise of private communications for a limited number of individuals. CISA's instruction to those individuals is to assume communications between mobile devices, including government and personal devices, and internet services are at risk of interception or manipulation.
This is not only a carrier problem
Most companies are not telephone networks. They do issue the phones their executives, clinicians, and lawyers use for work. CISA's list is practical even when you are not the "highly targeted" person in the memo: use end-to-end encrypted messaging where the conversation requires it, turn on phishing-resistant multifactor authentication, and strip app permissions you do not need, especially location, camera, and microphone.
A company phone that is lost is a smaller version of the same exposure. Text threads, authenticator apps, and mail clients sit on hardware you no longer control. DriveStrike remote lock and remote wipe are the actions you can still take after the phone leaves. They do not harden a carrier router. They do limit what a lost handset continues to hold. Read the companion note on what the later joint advisory asked network defenders to hunt.
Put the guidance next to your device standard
- Decide which roles get a managed phone, and which roles are told not to put work mail on a personal one.
- Match CISA's permission advice in your mobile policy: location, camera, and microphone are off unless a named app requires them.
- Test wipe on a spare device before you promise it in an incident plan.
Spearstone's mobile work and DriveStrike sit in the same conversation. Try DriveStrike or ask Spearstone to review the device side of this guidance with you.
Keep reading
- After a Cloud Breach, Look for the Login Still Cached on the Laptop
- Change Healthcare Had Already Sent About 100 Million Notices
Questions worth answering directly
Who was the December 2024 mobile guidance written for?
CISA said it applies to all audiences and specifically addresses highly targeted individuals in senior government or senior political positions. The underlying telecom activity is described as theft of customer call records and compromise of private communications for a limited number of people.
Will remote wipe secure a telecommunications network?
No. Network hardening is the subject of the joint infrastructure guide. Remote wipe applies to phones and computers your organization enrolls.