FBI suggests use of encrypted messaging apps while US faces huge cyberattack from China
The FBI and Cybersecurity and Infrastructure Security Agency say that Americans should use encrypted apps such as iMessage and FaceTime to be safe from foreign hackers.
Image credit: Elchinator on Pixabay
It's an about-face for the FBI, which has for years demanded that Apple allow the agency unencrypted access to Messages. The new warning comes in the face of what it and the Cybersecurity and Infrastructure Security Agency (CISA) say is China's ongoing Salt Typhoon hack.
"Our suggestion, what we have told folks internally, is not new here: Encryption is your friend, whether it's on text messaging or if you have the capacity to use encrypted voice communication," Jeff Greene, executive assistant director for cybersecurity at the CISA, told NBC News in a press call. "Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible."
The FBI official on the call, who has asked to remain anonymous, also appeared to specifically recommend using iPhones.
"People looking to further protect their mobile device communications would benefit from considering using a cellphone that automatically receives timely operating system updates," said the official, "[as well as] responsibly managed encryption and phishing resistant multi-factor authentication for email, social media and collaboration tool accounts."
The FBI and CSIA warning follows incidents such as the Salt Typhoon group reportedly gaining access to US law enforcement's wiretap network. It's suspected that the group also hacked the iPhones of US presidential campaign officials.
The size of the law enforcement tap in particular is so large that Greene said it was impossible "to predict a time frame on when we'll have full eviction."
Both Apple's iMessages and Google Messages are end to end encrypted, as is FaceTime. However, old-style text messages are not.
RCS is encrypted in Google's implementation, but Apple reportedly preferred to work with the GSMA to add encryption to the standard RCS. As of September 2024, however, Google and Apple were still working on the issue.
So it appears for now that using RCS to send messages between iPhones and Android is not encrypted. That also means that if any iMessage group has even one Android member in it, the group's conversation can potentially be read.
Read on AppleInsider
Comments
This is the number one reason that Apple should be aggressively involved in closing up their end of RCS. It makes everyone's messaging vulnerable as long as they don't, even those messages between iPhone owners that can't be sent with iMessage for varying reasons.
Ironic, isn't it.
So now those same people are saying we all need to use safely encrypted channels because bad people are breaking into our comms.
It's a free ride when you've already paid
Perhaps even more than you realize... what they've hacked into (and are still in) is the backdoor built into the telephone system used for legal wiretaps.
According to the article, Apple *is* working on that - except they're doing it by getting it added to the RCS standard itself, rather than doing it through a proprietary add-on.
FWIW Google has already integrated what will become part of the RCS standard and actively working with the GSMA in making it compatible with iOS: MLS E2EE. Apple will only need to use the most recent version instead of the very old and most basic one they currently employ in order for both Android and Apple users to have cross-platform RCS messaging encryption and security.
As long as every message is from a fellow iPhone owner and remains within iMessage, yup 100% support it. That's one of the things I like about my iPhone. But things are never constant, and like with iMessage, 100% of my Android contacts have RCS support with Google Messages, though there are some who choose to use other messaging apps instead, same as some iPhone owners who by choice don't use iMessage.
But I think you're missing the point entirely, just ignoring it.
If every person you want to contact has only an iPhone then iMessage is all you need. I have both Android and iPhone owning friends, and I'd wager you do too. The only reason my conversations between all of us can't be private and secure is primarily Apple's fault. Were it not for lack of encryption we'd be good. Google Messages is not lacking in privacy, security and for the most part, features.
None of the Android phone owners you know will ever have iMessage, Apple won't allow it, so that's not an option for a huge percentage of smartphone users. But as soon as Apple catches up we can all communicate securely anyway, iMessage or not.
It’s great that 100% of your Android contacts have RCS support, but several of mine do not, and by your own statistic of 70-80% RCS penetration you are probably an outlier here. So, if one of my no-RCS Android users were in a group chat with only other Android users there would be no E2EE (why do we use a “2”?!) in their chat.
You seem to be saying all messages between iPhone and Android users would be E2EE if only Apple would get on board, but that clearly isn’t the case since not all Android users have phones that support RCS. Even if Apple rolled out an update to iOS tomorrow that fully supported E2EE RCS there would still be Android users out there that either don’t or can’t support it.
Here’s another thing, if there’s still a reasonably large chance that sending a message to an Android user won’t be able to use RCS then why should Apple rush to offer it? Apple knows that all messages sent using iMessage are encrypted, as do many iMessage users, and all messages sent to an Android user are not encrypted. If they enable encrypted RCS now there’s still not much of a guarantee that the message will be able to be sent encrypted. That’s adding potential confusion to the process. Once Android gets to something much closer to 100% coverage than the current possibly 70% coverage then I’d expect Apple to offer it. Right now, not so much. (I mean, obviously)