DEV Community: Manuel Spataro

Encrypted Phone: Securing Strategic Communications in Europe

Manuel Spataro — Tue, 22 Sep 2026 14:40:32 +0000

Four recent cases from Italy, Portugal, Spain and Germany show how data exposure, endpoint risk and communication failures can combine into a wider security problem. How prepared is Europe to protect sensitive communications and strategic information?

1. The attack surface starts before the message is sent

A smartphone sits at the intersection of identity, communications and personal information. A phone number alone does not prove espionage or device compromise. It can, however, become the first link in an information chain connecting a person to their role, organisation, contacts and, in some circumstances, their communications.
Recent European cases illustrate different parts of this problem. In Italy, Portugal and Spain, phone numbers and other personal data linked to institutional figures were exposed. In Germany, a confidential communication involving senior Bundeswehr officers was directly intercepted.
The four incidents do not necessarily share the same technique, nor do they automatically show that the smartphones involved were compromised. Taken together, they do show how exposed data, identification of individuals and interception of communications can become parts of a broader information-gathering chain.
The security question therefore goes beyond whether a particular phone is secure. It is whether the entire system used to communicate can withstand the threat model it faces.

2. Italy: when senior officials' phone numbers become intelligence

In April 2025, the disclosure of personal phone numbers associated with some of Italy's highest-ranking state officials attracted public attention. The names connected to the contacts included the President of the Republic and the President of the Council of Ministers.
The Rome Prosecutor's Office opened an investigation into the origin and legality of the data collection, while the Italian Data Protection Authority also opened an inquiry. According to ANSA's reporting on the disclosure of the phone numbers, the contacts may have been obtained through lead-generation platforms and data-enrichment services.
There is an important distinction, however: having a phone number does not demonstrate that the device was compromised or that its owner was intercepted.
Italy's National Cybersecurity Agency also clarified that no exfiltration resulting from a compromise of its systems had been identified. ANSA reported these clarifications as well.
The real risk appears at the next stage.
A phone number can act as an identifier to which other information is attached. When names, roles, organisations, email addresses and other contacts are correlated, they can produce a much more complete profile.
That ability to correlate apparently ordinary data is what can turn a basic identifier into a potential source of information for profiling, intelligence collection and cyber intelligence.

3. Portugal: contact data can increase the value of an identity

On 30 July 2026, Expresso reported the online exposure of mobile numbers, email addresses, private residences and other data relating to Portuguese state representatives.
Those affected reportedly included government members, the President of the Republic, judges, police personnel and the head of Portugal's intelligence services. According to the publication, intelligence services and the Judicial Police began investigations into the case.
The case is significant because it shows how the value of information increases when separate elements can be tied to the same person.
A phone number identifies a line. When combined with a name, email address, home address and institutional role, it can define the identity and professional context of its owner with much greater precision.
Again, exposure of this information does not automatically mean that devices were compromised or communications intercepted.
The issue is what can happen next. The more information available, the less effort may be required to identify a target, reconstruct relationships and prepare further information-gathering activity.
ECO also covered the case, reporting the exposure of contacts belonging to government members, the President of the Republic and the head of the intelligence services.

4. Spain: correlation can turn scattered data into a profile

In June 2025, RTVE reported that Spain's National Police was investigating the disclosure on Telegram of personal data belonging to seven government members and several former Partido Popular officials.
The exposed information included phone numbers, identity documents, home addresses and email addresses.
Once again, publication of a phone number or home address does not prove that a smartphone was compromised.
The risk comes from the combination.
Different types of information, when linked to the same individual, can create a far more detailed profile than any single data point. Such a collection can support social engineering, targeted phishing or preliminary intelligence gathering.
RTVE later reported on a new investigation concerning the disclosure of data belonging to ministers and senior officials through Telegram.
The Spanish case therefore adds an important point: the value of data depends not only on the sensitivity of each item, but also on how easily it can be connected to other information.

5. Germany: when a strategic military call is intercepted

In March 2024, the problem took a different form.
An online meeting involving four senior German Luftwaffe officers, during which the possible use and supply of Taurus missiles to Ukraine was discussed, was intercepted. The recording was subsequently circulated by Russian media.
Germany's Ministry of Defence confirmed the incident, later examined by Tagesschau in its reporting on the Bundeswehr interception.
According to Defence Minister Boris Pistorius, one participant, connecting from Singapore during the Singapore Airshow, had used a non-secure line. The initial investigation did not identify a compromise of Bundeswehr communications systems; the incident was reportedly enabled by an operational error in how the meeting was accessed.
Reuters also reported that the interception was connected to this method of connection.
This case differs from the previous examples.
In Italy, Portugal and Spain, the starting point was primarily exposure of personal data. In Germany, the target was a communication containing sensitive military information.
Tagesschau later examined the operational error identified by Pistorius, while another analysis addressed the security of Webex video conferences used by the Bundeswehr. See also Tagesschau's analysis of Webex conference security.
The lesson is broader than the application itself: when information has high value, it is not enough to ask whether an application uses encryption. The communication method, devices, access mechanisms and operating context all have to be assessed.

6. How an identifier can become cyber intelligence

The four cases involve different ways of acquiring information, but they reveal a common progression.
A phone number can be the starting point. Linked to an identity, role, organisation and other personal data, it can help reconstruct a person's network of relationships.
That network may reveal further elements: interlocutors, organisations, contact patterns, communication methods and operational context.
This does not mean that one data point automatically leads to espionage. The critical factor is correlation.
Information from different sources can be associated with the same person until it creates a much more complete picture than any individual data point provides on its own.
At that point, information stops being merely personal data and can become knowledge useful for information gathering and cyber-intelligence activities.
The European cases therefore illustrate a progression that can start with identifying a person, continue with mapping their relationships and, in the German case, reach the direct acquisition of a communication containing strategic information.

7. End-to-end encryption is only one security layer

The security of a communication cannot be judged solely by the presence of end-to-end encryption.
Encryption is essential for protecting content in transit, but it is only one security layer.
A secure messaging platform should be assessed as a system that includes the application, device, digital identity, authentication, key management, infrastructure, metadata and operating procedures.
The right question is not simply “Is the message encrypted?” It is also whether the entire ecosystem through which the communication is created, transmitted and received is secure.
An attacker may not need to break the encryption. They may instead obtain information about participants, exploit a device vulnerability, compromise an application or take advantage of an inadequate access method.
For institutional, military or strategic information, security therefore has to cover the entire communication lifecycle.

8. The smartphone is part of the security boundary

The smartphone is the endpoint where a message is written, received and displayed.
If the device is compromised, an attacker can obtain information before it is encrypted or after it has been decrypted. At that point, protecting the communication channel alone is no longer enough.
Endpoint security should be able to look for spyware, trojans, malware and other indicators of compromise. Higher-criticality environments require broader detection, analysis and response capabilities.
It is important, however, to avoid false certainty. An unusual behaviour, an unknown number or abnormal battery consumption is not, by itself, proof of surveillance.
For a practical overview of warning signs and ways to check a device, see how can I tell if my phone is being tracked.
Device protection therefore has to work together with communication security.

9. Why consumer messaging is not the whole answer

Consumer messaging applications can provide strong protection for many everyday scenarios.
That does not necessarily mean they were designed for the same threat model as government, military or strategic communications.
The required level of protection should be proportional to the value of the information and the capabilities of a potential adversary.
In high-criticality environments, the device, operating system, user identity, authentication, access management, infrastructure, metadata and operational procedures all need to be considered.
A weakness at any one of these layers can undermine overall security.
Using a messaging application with strong security features should therefore be treated as one part of an architecture, not as an isolated guarantee.
Different users may also require different configurations depending on their role, the information they handle and the environment in which communication takes place.

10. Security has to be designed before communication

The cases show that risk can emerge at three different stages: before communication, through data exposure; during communication, through interception; or on the device itself, through endpoint compromise.
Security therefore cannot depend on a single component.
An exposed identity can make profiling a target easier. A vulnerable device can reveal information before encryption or after decryption. An inadequate access method can directly expose a confidential communication, as the German case demonstrated.
Security has to be designed before the communication takes place.
Endpoint, identity, application, authentication, infrastructure, networks and operational procedures have to be considered together.
The objective is not only to make an intercepted message harder to read, but to reduce the opportunities through which an adversary can reach the communication or the information surrounding it.
The risks associated with smartphone interception and surveillance sit squarely within this broader architectural problem.

11. The security perimeter extends to networks, servers and devices

Security does not end at the smartphone.
The servers, networks and data centres supporting communication are also part of the attack surface.
In higher-criticality environments, an organisation may need greater control over the components used to process and protect communications.
The same principle applies to how users and different sites communicate. The more control an organisation needs over its infrastructure, the more important it becomes to assess every point at which a communication could be exposed.
For organisations handling sensitive information, architecture should be designed around the threat model rather than around the convenience of the technology being used.
In some scenarios, this can mean using an encrypted phone or dedicated devices, controlled networks or privately managed infrastructure.

12. Data minimization reduces the blast radius

Security also depends on what remains available after a communication has taken place.
Not every piece of information needs to remain stored indefinitely on a device or inside a conversation.
In some operational scenarios, temporary messages can reduce the amount of stored information and therefore limit potential exposure if a device is compromised later.
This does not remove risk or replace other protective measures, but it can reduce the amount of information available after an incident.
The principle is straightforward: the less unnecessary information remains accessible, the smaller the volume of data that can potentially be exposed in a compromise.

13. What technologies are needed for high-criticality environments?

The answer depends on the scenario.
For everyday communication, a messaging application with strong encryption may provide sufficient protection against many common risks.
For an organisation handling high-value institutional, military, strategic or commercial information, the requirements are different.
In this context, phone antivirus can provide an additional defensive layer, particularly when it combines anomaly detection with the identification of activity potentially associated with spyware or trojans.
The questions should include whether the device is protected, whether identity is under control, whether access is appropriate, whether the infrastructure is trustworthy, whether networks are protected and whether operating procedures reduce the possibility of human error.
No technology can eliminate risk completely.
Claims of “uncompromisable” systems should therefore be understood as an architectural objective, not an absolute guarantee of invulnerability.
It is nevertheless possible to build systems in which compromise of a single component does not automatically result in the loss of the entire communication or information asset.
That ability to create multiple layers of protection is what should be sought when the value of information justifies a higher level of security.

14. Four cases, one European risk surface

The four cases examined do not demonstrate that a single coordinated operation exists against European institutions.
It would be wrong to draw that conclusion from these incidents alone.
They do show, however, that different types of information can be exposed or intercepted and that European institutions face a risk surface combining personal data, devices, applications, networks, infrastructure and human behaviour.
Italy, Portugal and Spain illustrate how personal data can expand the information available about a target.
Germany shows that a strategic communication can be intercepted directly when there is an error in how it is conducted.
The common factor is not necessarily the technique used, but the need to protect the entire communication chain.
The question is no longer simply whether a message is encrypted.
It is who controls the device, who controls the infrastructure, how the communication is established, what information remains available and what happens if one component is compromised.

15. From channel protection to system security

The cases show that exposure of data relating to political, government and military figures is not merely a privacy issue or a collection of isolated incidents. Information about people in sensitive roles can be obtained, combined and correlated through commercial sources and data-brokerage services, creating increasingly detailed profiles of individuals and organisations.
Last week, I personally investigated data-brokerage services and found that contacts belonging to legislators, government officials, government members, senior military officers and intelligence personnel across the West can be obtained relatively easily and at low cost. This highlights a structural weakness in protecting the identity and contact data of people holding sensitive positions.
As new cases continue to emerge, the issue goes beyond technology: does Europe have a sufficiently robust structural response to this problem, rather than reacting only to individual incidents?
When sensitive communications are involved, protecting the channel is necessary; protecting the entire system is indispensable.

Consumer Smartphone or Encrypted Phone? Why Endpoint Security Matters

Manuel Spataro — Wed, 09 Sep 2026 14:39:56 +0000

The security of sensitive communications is often reduced to a simple question:

Is the communication encrypted?

That question is important—but it is no longer enough.

A message can be protected while travelling across a network and still become vulnerable once it reaches the smartphone of an authorized user. The endpoint may be compromised, applications may have excessive permissions, data may be synchronized with cloud services, or an authorized recipient may simply copy, photograph, or forward what they see.

This distinction becomes particularly important when smartphones are used for government, military, political, corporate, or other sensitive communications.

The real question is therefore not only how securely information is transmitted, but how much control an organization retains over the information after it reaches the endpoint.

From encrypted messaging to endpoint security

Modern messaging applications can provide strong end-to-end encryption. This protects the communication channel from unauthorized interception while the message is being transmitted.

But eventually the message has to be decrypted.

And that happens on a device.

The smartphone therefore becomes part of the security architecture.

A consumer smartphone is a general-purpose computing platform. Users can install applications, grant permissions, synchronize data, use cloud services, take screenshots, copy content, and share information with other applications.

An encrypted phone follows a different philosophy.

The device itself becomes part of the security model.

This means that security must extend beyond the communication protocol and include:

the operating system;
installed applications;
application permissions;
stored data;
user credentials;
device integrity;
malware and spyware detection;
network infrastructure;
server infrastructure;
and the ability to respond when a device is compromised.

In other words:

Encryption protects the communication. Endpoint security protects the device that ultimately contains the information.

A secure messaging platform is not the same as a secure device

Consider a simple example.

Two users communicate through a secure messaging platform using end-to-end encryption.

During transmission, the message is protected.

But once the recipient receives it, the message exists in readable form on the recipient's smartphone.

If that smartphone has been compromised, an attacker does not necessarily need to break the encryption.

They may simply access the information after it has been decrypted.

This is one reason why phone security cannot be reduced to the choice of a messaging application.

A secure communication app can protect the communication channel. It cannot automatically guarantee the integrity of the smartphone on which the application is running.

For sensitive environments, this distinction is fundamental.

What happens when the endpoint is compromised?

A compromised smartphone can become an extremely valuable target.

It may contain:

private messages;
emails;
documents;
photographs;
contacts;
authentication tokens;
credentials;
location information;
corporate data;
and information about the user's activities.

An attacker does not necessarily need to compromise the communication infrastructure.

The endpoint may provide a much easier path.

This is particularly relevant to spyware.

Mobile spyware and other forms of malware can move the attack surface away from the network and directly onto the user's device.

That is why virus protection for phone and anti-spyware technology should not be viewed merely as optional consumer features when a smartphone is used to handle sensitive information.

The ability to detect a compromised device can become part of the communication security architecture itself.

Technologies for Android spyware detection can therefore be considered alongside encryption and secure communications when designing a broader mobile-security architecture.

The smartphone is now an organizational endpoint

For many organizations, the traditional security perimeter used to end at the corporate network, firewall, data center, or server.

Mobile computing changed that model.

The security perimeter now reaches the device carried by the user.

CISA's Mobile Device Cybersecurity Checklist for Organizations recommends, among other measures, keeping devices updated, configuring them according to organizational requirements, avoiding root or jailbreak configurations, and continuously monitoring device security. CISA states that a device that does not meet these trust conditions should be treated as untrusted and denied access to enterprise resources.

The underlying principle is simple:

An endpoint that cannot be trusted should not automatically be treated as a trusted endpoint.

This becomes particularly important when the smartphone belongs to someone who has access to strategic information.

A minister, government official, military officer, executive, engineer, or other authorized user may legitimately access sensitive information from a mobile device.

That does not make the device itself trustworthy.

Consumer smartphone vs. encrypted phone

The difference between a consumer smartphone and an encrypted phone is therefore not simply a matter of having "more encryption."

They represent two different security models.

Consumer smartphone

A consumer smartphone is designed as a general-purpose device.

The user normally has broad freedom to:

install applications;
use cloud services;
synchronize information;
communicate through multiple platforms;
share files;
capture screenshots;
copy messages;
and interact with many other services.

Even when an encrypted messaging application is used, the underlying environment remains a general-purpose consumer platform.

Encrypted phone

An encrypted phone designed for security and privacy can instead be designed around the assumption that the device itself is part of the security perimeter.

The objective is to control and protect:

communications;
applications;
operating-system behavior;
sensitive data;
device integrity;
authentication;
and the surrounding infrastructure.

This does not mean that encryption becomes less important.

It means that encryption becomes one component of a broader security architecture.

A secure Android messaging app can therefore be part of a larger architecture in which the endpoint itself is treated as a security component.

This is the fundamental difference between adding a security application to a consumer smartphone and designing the device itself as part of a secure communication environment.

The "forward" button is also a security problem

There is another aspect of mobile security that technology alone cannot solve.

Consumer messaging applications are designed to make communication easy.

Replying, copying, sharing and forwarding are normal features.

But these same features can become problematic when the information being exchanged is sensitive.

A confidential conversation can be propagated outside its original group with a few taps.

The recipient does not need sophisticated technical skills.

They may simply forward the message.

Or take a photograph of the screen.

Or copy the text into another application.

This is not necessarily a vulnerability in the messaging application.

It is a consequence of the consumer communication model.

The relevant question for an organization is therefore:

Should the distribution of strategic information depend entirely on the capabilities and behavior of a consumer application?

Some secure communication environments attempt to reduce these risks through features such as controlled message lifetimes and screenshot protection. For example, ghost messages for secure communications are designed around the principle that sensitive content should not necessarily remain permanently available to users.

These mechanisms do not eliminate the human factor, but they can reduce some of the ways in which sensitive information is unintentionally retained or redistributed.

Not every data leak is a cyberattack

Cybersecurity discussions often focus on technical attacks.

But information can leave its intended security perimeter in many different ways.

A malware infection can exfiltrate information to a remote server.

An application with excessive permissions can access data.

A cloud service can synchronize information outside the organization's intended environment.

But information can also be:

manually copied;
photographed;
forwarded;
exported;
or deliberately shared with another person.

The first group involves technical compromise.

The second may involve completely legitimate application functionality or human behavior.

The result can nevertheless be the same:

the organization loses control of the information.

This is why encryption alone cannot solve every information-security problem.

The insider threat

Security technologies can make interception extremely difficult.

They can encrypt traffic, protect cryptographic keys, authenticate users, and detect potentially compromised devices.

They cannot eliminate legitimate access.

This is the fundamental problem behind the insider threat.

An insider does not necessarily have malicious intentions.

A user can disclose sensitive information because of:

an error;
negligence;
misunderstanding;
convenience;
or a deliberate decision.

Every additional participant in a sensitive communication also represents another endpoint.

And every endpoint creates another location where information can potentially be copied or transferred.

This is why secure communications require more than trust.

They also require:

access control;
compartmentalization;
least-privilege principles;
endpoint security;
appropriate operational policies;
and clear rules for handling sensitive information.

An authorized user is still part of the attack surface.

How can I tell if my phone is being tracked?

This is another reason endpoint visibility matters.

If sensitive information is stored on a smartphone, an organization should be able to determine whether the device remains trustworthy.

Questions should include:

Has the device been compromised?
Are unauthorized applications present?
Are applications accessing sensitive permissions?
Is the operating system in an expected state?
Is spyware present?
Can the organization detect a security incident?
What happens if the device is no longer trusted?

For users who are concerned about surveillance, understanding how to tell if your phone is being tracked is therefore not simply a consumer privacy question.

In high-risk environments, it can become an operational-security question.

The same principle applies to smartphone interception protection: the objective is not only to protect information while it travels, but also to reduce the risk that a compromised endpoint becomes the weakest link.

From secure communication app to secure communication ecosystem

It is tempting to think about mobile security as a choice between messaging applications.

But the actual architecture is much larger.

A sensitive communication may involve:

User → Smartphone → Operating System → Applications → Network → Server → Data Center → Recipient's Smartphone

Every component can affect the security of the information.

A secure communication app is therefore only one element of the chain.

If another component is significantly weaker, the security of the entire system may be reduced.

This is why organizations should consider:

endpoint integrity;
application control;
identity management;
network security;
server infrastructure;
data storage;
access policies;
and incident response.

The objective is not simply to encrypt the message.

It is to maintain control over the information throughout its lifecycle.

For organizations that need to extend security beyond the messaging application, secure communications for organizations can be considered as an architectural approach rather than simply an app-level feature.

Secure communications require secure infrastructure

The endpoint is only one part of the architecture.

Sensitive communications also depend on the infrastructure that handles authentication, messaging, storage, and connectivity.

This is where secure server infrastructure becomes relevant.

A security architecture should consider where communication data is processed, where it is stored, who can access it, and which components are under organizational control.

Distributed and resilient infrastructure can also be relevant when organizations need communication continuity in demanding operational environments. Secure communication data centers are one example of an infrastructure-level approach.

The architecture should not assume that the network alone can compensate for an untrusted endpoint.

Nor should endpoint security be considered sufficient if the backend infrastructure remains outside the organization's security model.

From a personal smartphone to a strategic asset

The difference becomes particularly clear when a consumer smartphone is used for institutional communications.

For an ordinary private user, the consequences of a compromised smartphone may be primarily personal.

For a government official, military officer, political decision-maker, or executive working in a strategic industry, the consequences can extend far beyond the individual.

The device may contain information relating to:

government decisions;
industrial programs;
critical infrastructure;
military operations;
international relations;
intelligence activities;
or corporate strategy.

A compromised endpoint can therefore become a strategic security problem.

The conceptual shift is important:

The smartphone stops being merely a personal device and becomes part of the organization's information infrastructure.

Digital sovereignty and control

This also raises the question of digital sovereignty.

Digital sovereignty does not necessarily mean developing every component internally.

It means maintaining sufficient control over the critical elements of an information infrastructure.

An organization should be able to answer questions such as:

Who controls the device?
Who controls the software running on it?
Which applications can access sensitive information?
Where is communication data processed?
Where is it stored?
Can the endpoint be verified?
Can a compromised device be isolated?
Can the organization respond to an incident?

If the answers are unclear, the security of the overall system depends on factors outside the organization's direct control.

For defense and other high-security environments, this is not merely a technical issue.

It is an issue of resilience.

ENISA's Hardware Threat Landscape and Good Practice Guide places mobile and embedded devices within a broader hardware-security landscape and discusses how good practices in the design, development and implementation of mobile and embedded computing devices can contribute to protection.

Mobile communications need protection beyond the app

CISA's Mobile Communications Best Practice Guidance makes a similar point from the communications perspective.

The guidance addresses highly targeted individuals and warns that communications between mobile devices—including government and personal devices—and internet services should be considered at risk of interception or manipulation. It recommends, among other measures, the use of end-to-end encrypted communications.

End-to-end encryption is therefore essential.

But the existence of encryption does not remove the need to secure the devices that create, receive and process the encrypted information.

This is where endpoint security and communication security meet.

Zero Trust also reaches mobile devices

The same principle appears in enterprise mobility and Zero Trust architectures.

CISA's Applying Zero Trust Principles to Enterprise Mobility highlights the need for specific consideration of mobile devices and the enterprise security-management capabilities surrounding them. CISA describes mobile devices as an integral part of modern enterprise activity and maps mobile security capabilities to Zero Trust principles.

The implication is important.

A mobile device should not automatically be trusted simply because it belongs to an authorized user.

Trust should depend on the state of the device, its configuration, its identity, and the security controls surrounding it.

This reinforces the central argument of this article:

the endpoint is part of the security perimeter.

What the Italian political chat controversy tells us

The publication of Fratelli di chat by journalist Giacomo Salvini brought renewed attention to confidential conversations involving members of Fratelli d'Italia.

The important cybersecurity lesson does not require assuming that the chats were obtained through a cyberattack.

The relevant lesson is different.

Once sensitive information has been distributed among multiple authorized users and devices, maintaining control over that information becomes increasingly difficult.

A message can leave its original perimeter through:

a technical compromise;
malware;
excessive application permissions;
cloud synchronization;
screenshots;
manual copying;
forwarding;
or human behavior.

The security question therefore cannot be limited to:

Can somebody intercept the message?

It must also include:

Who can access the information, from which device, using which software, and with what ability to transfer it elsewhere?

The new security perimeter is the smartphone

For years, organizations focused heavily on network security.

Firewalls, VPNs, data centers, servers, and perimeter defenses remain important.

But the modern security perimeter extends much further.

It reaches the smartphone.

That is where:

the message is written;
the message is read;
sensitive documents are opened;
credentials are used;
applications interact with data;
screenshots can be created;
and compromised software can potentially observe activity.

The endpoint is therefore not simply where the communication terminates.

It is one of the places where the security of the entire communication can succeed or fail.

For this reason, Android antivirus protection can be considered one component of a broader endpoint-security strategy, particularly where the organization needs visibility into the integrity of mobile devices.

A mobile-security architecture may combine antivirus capabilities, spyware detection, communication protection and controlled infrastructure rather than relying on any single layer.

So, consumer smartphone or encrypted phone?

For ordinary communications, a modern consumer smartphone combined with reputable security practices and encrypted applications may provide an appropriate level of protection.

But sensitive institutional, military, government, corporate, or strategic communications require a different question.

Not:

"Which messaging app should we use?"

But:

"What system do we use to protect the information from creation to deletion?"

That system may need to combine:

secure communications;
encrypted messaging;
controlled endpoints;
application security;
anti-spyware and malware detection;
identity and access management;
secure networks;
controlled server infrastructure;
operational policies;
and incident-response capabilities.

This is the difference between protecting a communication and protecting an information system.

Conclusion

Encryption remains one of the fundamental technologies for protecting communications.

But encryption does not automatically protect the endpoint where the information is eventually decrypted, displayed, stored, copied, or shared.

For consumer communications, this distinction may have limited practical consequences.

For government, defense, political, corporate, and other sensitive environments, it can be critical.

The smartphone should therefore be treated as part of the security architecture—not simply as a device on which a secure messaging application happens to be installed.

The strategic question is ultimately simple:

How much control do we have over the data from the moment it is created until the moment it is deleted?

That is the question that should guide the design of modern secure communication systems.

For organizations looking beyond encrypted messaging toward controlled mobile endpoints, BlowFish combines secure Android communications, an encrypted phone, spyware detection, endpoint protection and secure communication infrastructure as components of a broader security architecture.

References

CISA — Cybersecurity and Infrastructure Security Agency. Mobile Device Cybersecurity Checklist for Organizations. U.S. Department of Homeland Security.
CISA — Cybersecurity and Infrastructure Security Agency. Mobile Communications Best Practice Guidance. U.S. Department of Homeland Security, December 2024.
CISA — Cybersecurity and Infrastructure Security Agency. Applying Zero Trust Principles to Enterprise Mobility. U.S. Department of Homeland Security.
ENISA — European Union Agency for Cybersecurity. Hardware Threat Landscape and Good Practice Guide.
Salvini, Giacomo. Fratelli di chat. Storia segreta del partito di Giorgia Meloni. PaperFIRST, 2025.

How Can I Tell If My Phone Is Being Tracked? Understanding Smartphone Compromise and Mobile Spyware

Manuel Spataro — Thu, 13 Aug 2026 10:48:00 +0000

Smartphones have become one of the most important repositories of personal and professional information.

Messages, calls, photographs, location data, credentials, documents and browsing activity can all be stored or accessed through a single device. For this reason, smartphones have also become valuable targets for cybercriminals, surveillance operators and spyware developers.

A common question is:

How can I tell if my phone is being tracked?

The answer is more complicated than looking for one suspicious symptom.

Modern spyware can operate discreetly, sometimes collecting sensitive information while leaving little visible evidence. Documented cases involving Pegasus, Predator and Graphite have demonstrated that highly invasive spyware can compromise mobile devices and access information such as messages, location data, files, calls, camera and microphone data.

At the same time, many symptoms commonly associated with spyware — such as battery drain, overheating or increased data usage — can have completely legitimate explanations.

The correct approach is therefore not to assume that every anomaly means surveillance, but to understand which indicators deserve investigation and how to perform a structured security assessment.

Why Is It Difficult to Know If a Phone Is Being Tracked?

Modern mobile threats are specifically designed to remain difficult to detect.

Traditional malware may produce obvious symptoms, while sophisticated spyware can attempt to minimize its impact on normal device operation.

The Citizen Lab has documented cases in which mercenary spyware such as Pegasus and Predator was found on mobile devices after forensic analysis. In one documented case, the same iPhone was found to have been compromised by both Pegasus and Predator.

Amnesty International's Security Lab has likewise documented highly invasive spyware systems capable of accessing sensitive information and operating covertly on mobile devices.

Recent cases involving Graphite have also demonstrated that mobile spyware remains a current security concern rather than a purely historical threat. ANSA reported in 2026 on forensic findings concerning Android devices associated with the Graphite spyware case in Italy.

This means that there is no universal "spyware symptom".

A device should instead be evaluated by considering multiple indicators, the applications installed on it, permissions, software versions, account security and the context in which suspicious behavior occurs.

The Most Common Signs That a Phone May Be Compromised

Rapid Battery Drain

A sudden reduction in battery life can have many explanations.

Operating system updates, demanding applications, background synchronization and battery degradation can all increase power consumption.

However, software continuously operating in the background can also consume additional processor, memory and network resources.

Battery drain should therefore be treated as an indicator to investigate, not as proof that a phone is being monitored.

Unexplained Overheating

A smartphone that becomes unusually warm while it is idle or performing only basic tasks may deserve closer attention.

Background processes can continuously use system resources.

This does not automatically mean spyware is present. However, persistent unexplained activity becomes more significant when it appears together with other anomalies.

The Citizen Lab has documented a real spyware investigation in which the target noticed that the phone was "running hot" before forensic analysis confirmed both Pegasus and Predator infections.

Unusual Mobile Data Usage

Some surveillance tools periodically communicate with remote infrastructure and transmit information collected from the device.

An unexpected increase in mobile data consumption can therefore be worth investigating.

However, streaming, cloud synchronization, application updates and other legitimate services can produce exactly the same symptom.

Android provides tools for reviewing application and system resource usage, making it possible to compare current behavior with normal patterns.

Unknown Applications

One of the simplest checks is to review the applications installed on the smartphone.

Applications that you do not remember installing, applications with unclear names or software whose purpose you cannot identify deserve further investigation.

An unfamiliar application is not necessarily malicious. It may be part of the operating system, installed by the manufacturer or managed by an organization.

The important question is:

Why is this application installed, and what can it access?

ENISA recommends installing applications from trusted sources and checking both the application and its requested permissions before installation. Its recent mobile-malware guidance also recommends using a mobile security solution capable of detecting malware, spyware and malicious applications.

Unusual Permission Requests

Permissions are particularly important because they determine which sensitive resources an application can access.

An application requesting access to the microphone, camera, location, contacts, SMS or other sensitive information should have a legitimate reason for doing so.

Android's official documentation explains how permissions protect access to restricted data and actions and emphasizes requesting only the permissions an application actually needs.

OWASP similarly considers excessive access to sensitive resources an important mobile privacy and security concern.

Unexpected Smartphone Behavior

Unexpected restarts, freezes, slowdowns, unusual notifications or applications opening without interaction can have many causes.

They may result from:

software bugs;
operating system updates;
hardware problems;
poorly optimized applications;
insufficient system resources;
malicious software.

A single symptom therefore has limited diagnostic value.

Multiple persistent anomalies occurring together deserve much greater attention.

How Can I Check If Spyware Is Installed?

If you suspect that your smartphone may be monitored, the first step should be a structured security assessment rather than immediately assuming that spyware is present.

Start by reviewing the applications installed on the device.

Then review the permissions granted to each application, paying particular attention to:

microphone;
camera;
location;
SMS;
contacts;
files and other sensitive information.

Android also provides system-level privacy and security controls that can help users understand which applications are accessing sensitive resources.

Next, examine:

battery consumption;
mobile data consumption;
recent application activity;
operating system version;
security update status.

Keeping Android and applications updated is particularly important because vulnerabilities in outdated software can provide opportunities for attackers.

ENISA's current mobile-malware guidance recommends keeping devices protected, installing applications from trusted sources, checking permissions and using mobile security solutions capable of detecting malware and spyware.

For a practical step-by-step guide, see:

How can I tell if my phone is being tracked.

For additional information about Android spyware detection, see Android Spyware Detection.

Sophisticated Spyware Can Operate Without Obvious Symptoms

One of the most important distinctions in mobile security is between ordinary malware and highly targeted surveillance tools.

Some spyware campaigns use phishing messages or malicious applications.

CISA documents mobile attack techniques involving phishing, Trojanized applications and spyware such as Pegasus and Intellexa. These attacks can provide access to sensitive information including call logs and geolocation data.

Other spyware has exploited vulnerabilities in operating systems or applications.

Amnesty International and Citizen Lab have documented cases involving both one-click and zero-click exploitation techniques, demonstrating that some highly targeted attacks do not necessarily depend on the victim knowingly installing an application.

This is why simply asking:

"Do I have an unknown application installed?"

is not sufficient to assess every possible form of mobile compromise.

Why a Factory Reset Is Not Always the First Answer

A factory reset is often considered the obvious solution when someone believes a phone is being monitored.

It is not necessarily the first step.

Before resetting a device, it can be useful to understand what happened, review applications and permissions, update the operating system and perform a security assessment.

A reset may be appropriate in certain situations, but it does not automatically solve every underlying security problem.

For example, if the original problem involved compromised account credentials, phishing, malicious links or another security weakness, resetting the device alone may not address the broader attack path.

The objective should therefore be to understand the source of the compromise, not simply to remove its visible consequences.

How to Protect a Phone From Future Monitoring

The best defense against spyware is a layered security strategy.

Keep Android Updated

Operating system and application updates should be installed as soon as practical.

Security updates address vulnerabilities that attackers may otherwise exploit.

Android's security documentation provides guidance on application risks, secure platform interaction, data protection and other aspects of mobile security.

Install Applications Carefully

Applications should preferably be downloaded from trusted sources.

Before installing an application, consider:

who developed it;
what it does;
its reputation;
the permissions it requests;
where it was obtained.

ENISA specifically recommends trusted application sources and reviewing permissions before installing mobile applications.

Avoid Suspicious Links and Attachments

Unsolicited SMS messages, emails and other communications can be used to deliver malicious links or applications.

CISA identifies phishing through mobile messaging and Trojanized applications among techniques used to compromise mobile devices.

Protect Access to the Device

Use a strong screen lock and enable multi-factor authentication for important accounts whenever possible.

Physical access to an unlocked smartphone can also create opportunities for unauthorized changes or software installation.

Review Permissions Regularly

Permissions should not be treated as a one-time configuration.

Review which applications can access sensitive resources and remove access that is no longer necessary.

This follows the principle of least privilege that is central to secure mobile application design and platform security.

Protect Sensitive Communications

Device security is only one part of the problem.

If a smartphone is used to exchange sensitive information, communications themselves also need protection.

Messages, calls and files can become valuable targets independently of the underlying operating system.

A secure communication app or a secure messaging platform can therefore be part of a broader strategy for reducing communication-interception risks.

Phone Security Requires More Than One Tool

A common mistake is to search for a single application that can answer the question:

"Is my phone being tracked?"

Modern mobile security does not work that way.

A more effective strategy combines several layers:

operating-system security;
application security;
permission management;
security updates;
malware and spyware detection;
strong authentication;
phishing protection;
secure communications;
appropriate organizational controls.

ENISA has long emphasized that smartphones contain highly sensitive personal and business information and require a combination of security measures rather than a single protective mechanism.

Its more recent threat landscape also identifies mobile devices as high-value targets and highlights vulnerabilities and malicious applications among important attack vectors.

When Smartphone Security Becomes an Organizational Issue

For an individual, a compromised smartphone can expose:

personal messages;
photographs;
credentials;
contacts;
location;
documents;
account information.

For an organization, the consequences can be much broader.

A compromised smartphone may become an entry point into corporate accounts, sensitive communications or other organizational resources.

This is why mobile devices should be considered part of the broader cybersecurity architecture.

For organizations handling sensitive information, mobile threat defense, secure communications, endpoint security and appropriate device-management policies can complement traditional cybersecurity controls.

ENISA has specifically highlighted the importance of secure smartphone development, sensitive-data protection, authentication, authorization, secure communications and privacy protection in mobile environments.

Final Thoughts

So, how can I tell if my phone is being tracked?

There is no single symptom that can provide a definitive answer.

Rapid battery drain, overheating, unusual data consumption, unknown applications, unexpected permissions and abnormal device behavior can all justify further investigation — but they can also have completely legitimate explanations.

The right approach is therefore to consider multiple indicators together and perform a structured security assessment.

Keeping Android updated, reviewing application permissions, installing software from trusted sources, protecting accounts with strong authentication and being cautious with unsolicited messages can reduce the risk of compromise.

For highly sensitive use cases, however, device security should be considered together with communication security.

The objective is not simply to determine whether a phone is being tracked after something goes wrong. It is to build a mobile environment in which unauthorized access, surveillance and interception are substantially harder to achieve.

For a practical guide to checking the most common warning signs and reviewing an Android device, see:

How can I tell if my phone is being tracked.

Sources and Further Reading

Institutional and cybersecurity sources

CISA — Guidance for Civil Society: Mitigating Cyber Threats with Limited Resources — mobile initial access, phishing, Trojanized applications and spyware including Pegasus and Intellexa.
ENISA — Mobile Malware: Tips & Advice to Protect Yourself — trusted application sources, permissions, updates and mobile security solutions.
ENISA — Threat Landscape 2025
— current European threat landscape, including mobile devices, vulnerabilities, malicious applications and phishing.
ENISA — Smartphone Security Risks and Opportunities
— risks involving spyware, malicious applications, sensitive data and smartphone security.

Technical and forensic research

Citizen Lab — Pegasus vs. Predator — forensic investigation documenting simultaneous Pegasus and Predator infections on a mobile device.
Citizen Lab — The Predator in Your Pocket — research into spyware capabilities including monitoring communications, location, microphone and camera access.
Amnesty International Security Lab — Predator Files — technical analysis of Intellexa's Predator spyware and its infrastructure.
Amnesty International Security Lab — The Pegasus Project — forensic investigations into Pegasus infections and zero-click attacks.

Android security

Android Developers — Permissions on Android — official documentation on Android permissions and access to sensitive resources.
Android Developers — Privacy and Security — official Android privacy and security guidance.
OWASP Mobile Application Security Verification Standard (MASVS) — mobile application security and privacy controls.

News and current cases

ANSA — È davvero possibile clonare un telefono? — explanation of smartphone compromise, SIM swap and spyware.
ANSA — Cos'è Graphite e cosa è capace di fare lo spyware dell'azienda israeliana Paragon — background on Graphite and its capabilities.
ANSA — Caso Paragon, l'atto di accusa dei pm: spiati tre telefoni — 2026 reporting on forensic findings involving Graphite and Android devices in Italy.

Practical resource

Secure Phone Messaging — How can I tell if my phone is being tracked? — practical guide to smartphone monitoring indicators, Android checks and security practices.

Blowfish resources

Android Spyware Detection — Blowfish resource on detecting Android spyware.
Secure Android Messaging App — Blowfish resource on secure communications. Smartphone Interception Protection — Blowfish resource on interception risks.