A friend is traveling abroad with sensitive information that a foreign government may want or may target after they learn it was shared. Are there any guides for securing a Android or iPhone against state actors?
How to secure phone against state actor?
1–10 of 17 posts
Re: How to secure phone against state actor?
#2> Are there any guides for securing a Android or iPhone against state actors?
You cant, in fact an entire industry exists namely infosec to mislead you into this line of thinking, in much the same way the diet and weightloss industry exists to make you think its possible to stay slim and sexy for the rest of your life!
Re: How to secure phone against state actor?
#3The most simple answer is don't. Divorce it from the device, fully encrypt it and transfer it separately from your friend.
Then, when traveling, have your friend carry a separate completely clean phone. If he's suspected and the phone is compromised, it won't be found.
When you say state actor, it implies that they're efforts are funded with and armed with the vast resources of a nation which means they could manipulate regular citizens, police forces, or potentially bring a considerable military force to bear against this problem, so the most effective approach would be to separate the person from the information entirely.
Re: How to secure phone against state actor?
#4I believe a good blender can prevent a state actor to access sensitive information stored on a smartphone. But I would spread the resulting dust over a large random and secret area just to be on the safe side.
Re: How to secure phone against state actor?
#5To put it in perspective, state actors have departments full of people who spend their work weeks figuring out how to act on behalf of the state and then executing upon those methods.
Those people are more organized than you. They are more motivated. They often have the resources to align Apple's and Google's interests with their own.
And they are more motivated than you. They are patriotic and surrounded by people who are patriotic and paid to be patriotic.
A state actor can travel to your state and get the information when just beating it out of you isn't the better option...but if you're in its state, beating the information out of you is probably the simplest thing that might work.
The revolution will not happen on your smartphone. Those days are past and the Arab Spring taught states all they needed to know.
Good luck.
Re: How to secure phone against state actor?
#6Leave the phone in their home country? Bring a burner phone for communications while traveling, and don't connect it to accounts.
Re: How to secure phone against state actor?
#7"How to secure phone against state actor?"
Don't use one.
Re: How to secure phone against state actor?
#8Governments (such as Saudi Arabia) often buy expensive hacking software from the companies abroad (such as NSO in Israel), needless to say with citizens tax money. Such software can hack into any phone, even with zero click. A mere phone number would be enough. They also have internal hacking teams and APTs, with own hacking tools.
Further, if you are in a country that manufactures key closed source components of the phone, you should assume that the government of that country can access the phone with the help of a backdoor or zero days embedded in the closed source software or hardware. iPhone is a good example.
Sandboxing in desktop is worse. Still you can better lock down a laptop if you know what you’re doing, since a computer is not linked to a phone number and you can leverage the flexibility.
Re: How to secure phone against state actor?
#9As others have alluded, the attack surface on a smartphone is too large to ever be secure against sophisticated and wealthy adversaries. The regimes most inclined to spy are the same ones who spend the most on point-and-shoot exploits to own your phone.
Best answer from a US perspective is Michael Bazzell's work, with product specific to mobile phones having just been released: https://inteltechniques.com/book7a.html
Re: How to secure phone against state actor?
#10I would give this a watch:
https://www.pbs.org/wgbh/frontline/documentary/global-spywar...
Journalists, your parents, your friends... every contact can be weaponized.
You can attempt to trust apple's new features, but I don't think the world knows how effective they are yet. Going through a border with enhanced security features to defend yourself from state actors at great cost of convenience is going to make a person stand out.