As a group of suspected conspirators recently learned, encrypted messaging is no guarantee that your private conversations will stay that way. The FBI arrested six men Thursday for allegedly plotting to kidnap Michigan Governor Gretchen Whitmer. How did the authorities get the information they needed? You have intercepted the group's encrypted calls.
To be clear, intercepting communications wasn't a high-tech effort. The FBI had a confidential informant who participated in the group messaging threads that reported much of the conspiracy, according to a criminal complaint. This kept the FBI informed even if the group changed the messaging apps to avoid detection.
For more of that
Subscribe to the mobile newsletter, receive notifications and see related articles on CNET.
"Because the group was still there [the informant]the FBI has retained the ability to monitor chat communications amicably, "said FBI special agent Richard J. Trask II in the complaint.
The incident highlights a fundamental fact about encrypted messaging apps like Signal, Telegram, and WhatsApp. While they all offer some level of privacy, there are many ways for someone to access your messages through these services.
That is good news and bad news. On the plus side, this means that criminals planning violence cannot fully rely on encryption to hide their plans from the police. While law enforcement officials have warned that encryption could "darken" their investigation against the worst criminals, this case is an example of how investigators can continue to intercept encrypted messages.
On the other hand, it means regular users who want their data safe from hackers, horrors, and foreign governments need to rethink what encrypted messaging really means to them. It's not a magic wand. Here's what you should know about what encryption does and doesn't do to protect your privacy.
How does encrypted messaging work?
It's okay, most people don't have a handle exactly what encrypted messaging apps do like Signal, Telegram and WhatsApp from Facebook. They look and act like normal SMS tools. Behind the scenes, the services encrypt your messages as they travel over cellular systems and the Internet to get to the intended recipient's phone.
This means that no one involved in sending the message - including the encrypted messaging service - can read your messages. Regular SMS messages are sent in clear text and do not have this protective layer. Therefore, your SMS messages can be intercepted in several places when they are transmitted from your phone to the recipient's device.
Is my phone encrypted too?
If you are using an iPhone, the data on your phone will be encrypted when the device is locked. On Android phones, users have to enable disk encryption by themselves. Device encryption protects your messages while the phone is locked.
Apple describes this form of encryption as essential for user privacy. For one, it protects all personal information on your phone in the event that it is stolen. Think of private messages and photos, as well as access to your email account and financial information.
Like encrypted messages, device encryption has been a major issue with law enforcement agencies. The FBI attempted a court order in 2016 to force Apple to access encrypted messages on an iPhone being used by an extremist gunman. After Apple refusedfinally could the agency Access to the data on the phone with a different technique.
How can someone get my encrypted messages?
As the Michigan case shows, anyone you send a message can share it with a wider audience, regardless of whether it is sent through an encrypted service. The same goes for anyone who can unlock your phone, which will disable device encryption. If you don't lock your device at all, anyone who gets your phone can access your messages.
Then there is hacking, which is used by law enforcement, as well as criminals and foreign governments, to attack someone's phone with malicious software. Once the device is compromised, the malware can read messages on the device just like someone looking over your shoulder to watch you type. These tools are sophisticated, can be very expensive, and require someone to target you.
Another form of malware that can get hold of your communications is called stalkerware. This is phone monitoring software that many people admit to use Usually, in order to spy on their partners or exes, the person needs to have access to your phone. There are steps you can take if you are concerned that your device has stalkerware.
Finally, there are your backups. Data in your cloud accounts may not be encrypted and anyone with the password can access your secured messages there. Some stalkerware programs access your phone's cloud backup. This is a good argument for using a unique, hard-to-guess password to protect your cloud accounts and use a password manager.
