"Encryption is your friend," says CISA. 

The United States recently highlighted an unprecedented cyberattack on U.S. telecommunications giants like AT&T and Verizon by cyber espionage group Salt Typhoon, an organization backed by China. Now, the FBI and Cybersecurity and Infrastructure Security Agency (CISA) are urging all Americans to use encrypted apps on their phones. Even if you don’t think your texts are important, privacy is your right. Powerful nation-state actors share the data they steal with scammers. There are ways your unencrypted communication can be used to commit crimes against you.

Here’s what you need to know and do to safeguard your private information. 

Why your messages are at risk 

• SMS and regular calls aren’t secure: Traditional SMS texts and most cellular calls are not encrypted, leaving them vulnerable to interception, whether lawful or malicious. 

• iMessage and Google Messages don't play nice: These apps support end-to-end encryption—but only when messaging users on the same platform! Messages to Android from iPhone or vice versa revert to unencrypted SMS. On iPhones, you can tell when a text isn't encrypted when the bubble is green instead of blue.  

• Old cellular networks: Even with modern phones, your communications can still travel through insecure networks like 2G and 3G, increasing exposure to interception. 

How to protect your texts and calls 

The U.S. government is now urging Americans to use more encryption, a significant change from recent years. You can get started easily right now for free! 

“Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication," Jeff Greene, executive assistant director for cybersecurity at CISA, told reporters on call in December 2024. "Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible." 

1. Use encrypted messaging apps

Apps like Signal and WhatsApp offer end-to-end encryption for both messages and voice calls. Remember, iMessage and Google Messages are encrypted when messaging people on the same platform. This means that even if hackers intercept your data, they cannot read or hear it.

• iPhone users: Use iMessage for other iPhone contacts, but switch to an encrypted app like Signal or WhatsApp for non-iPhone users. If the text bubble is green instead of blue, your communications are not encrypted.

• Android users: Enable end-to-end encryption in Google Messages and turn off RCS to ensure full encryption.

• Avoid SMS, MMS, and RCS: Both Apple and Android users should avoid using standard text messaging like SMS, MMS, and RCS. Basically, this is the way you text with someone who isn’t on the same platform (i.e., iMessage or Google Messages) as you. SMS are standard text messages, MMS is a way to send photos and other media through standard text messages, and RCS is basically a more advanced form of text message (it lets you turn on read receipts and “like” a text) – but none of them are encrypted

2. Switch to encrypted calling options Instead of traditional cellular calls, opt for VoIP-based encrypted voice calls using apps like Signal and WhatsApp. VoIP stands for Voice over Internet Protocol.  

If you have an Apple product and are calling another Apple user, FaceTime is a good VoIP choice with end-to-end encryption! Remember, you can do audio calls over FaceTime if you are having a bad hair day. 

3. Avoid sharing sensitive information over unsecured channels 

Do not send sensitive data through SMS or regular phone calls. Use encrypted platforms or, for email, attach the information in an encrypted file and share the password securely. 

4. Keep your devices updated 

Hackers often exploit outdated systems. Ensure your phone’s operating system is current and enable automatic updates for enhanced security. 

5. Use MFA 

Always use multi-factor authentication, which adds another layer of protection to an account compared to only a password. FaceID and other biometric factors (like fingerprint scans) are terrific forms of MFA. 

6. What about email? 

Most common email services like Gmail and Outlook are encrypted, but only on their network, such as if a Gmail user sends an email to another Gmail user. The simplest way to improve the security of your email is to only send sensitive information through encrypted apps like WhatsApp or Signal. You can also put the information in an attached document and encrypt the document, which will require the receiver to enter a password. Share the password through an encrypted channel, not in the body of the email.

Our prescription is more encryption! 

To stay ahead of threats like the Chinese government Salt Typhoon attack: 

• Download and use vetted encrypted apps like Signal or WhatsApp for messaging and calls. 

• iMessage with other iMessage users and Google Message with other Google Message users is encrypted, but sending an iMessage to a Google Message user (or vice versa) is not.  

• Avoid unencrypted channels for sensitive communications. 

• Regularly update your device’s software. 

• Use MFA. 

Your private communication deserves to stay private. Encryption is your friend.