Beware of the multi-billion-dollar industry swooning over SignalGate

COMMENTARY: Recent reports that U.S. government officials use encrypted messaging apps like Signal to discuss sensitive matters have sparked understandable concern, framed largely around assumed violations of security protocols.

But this focus, while politically convenient, dangerously misses the true national security threat. The danger isn't whether Signal's encryption holds: it's that the mobile devices carrying these conversations are increasingly vulnerable platforms for sophisticated espionage.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

Today's smartphones are not just communication tools, they are repositories of our most sensitive personal and professional lives – calendars, contacts, locations, private communications, and access credentials. For senior government officials, these devices hold data that constitutes an intelligence goldmine, often containing information far more sensitive than what's discussed in casual texts. These phones are prime targets for exploitation, regardless of which encrypted app is installed or whether official business gets discussed.

Evidence has mounted that nation-state adversaries are actively exploiting mobile endpoints at the same scale as desktop endpoints, often through the use of sophisticated mercenary spyware like Pegasus and Predator, but increasingly via home-grown capabilities. These are not clumsy phishing attempts. We know, based on documented attacks against high-value targets globally, that adversaries possess "zero-click" capabilities: the ability to compromise a phone remotely, without the user even having to touch their device or click a malicious link. There’s little doubt such capabilities are being aimed squarely at the phones of senior leaders across government and critical industries.

Our own research underscores the scale of this challenge. In a recent analysis involving highly targeted individuals, we found roughly 1 in 1,000 devices showed signs of Pegasus infection alone. Factoring in other sophisticated spyware strains, the true incidence rate among targeted populations is likely significantly higher. Consider this against the backdrop of nearly 3 million federal employees and countless contractors with access to sensitive information. The potential exposure within the U.S. government ecosystem is staggering, particularly given that the specialized tools and expertise required to detect these advanced "zero-click" compromises are far from commonplace.

The prevailing security mindset regarding mobile devices remains dangerously outmoded. For years, we operated under the assumption that personal phones were distinct from enterprise computers – maybe they were targets for petty crime, but not sophisticated state-sponsored espionage.

This was partly rooted in a time when mobile platforms were notoriously difficult targets for external compromise. But the modern smartphone has become a powerful, portable computer, deeply integrated into both our personal and professional lives, and critically, into enterprise networks. The technical barriers that once existed have largely evaporated, yet our security practices haven't caught up.

A glaring disconnect in investment priorities compounds the complexity of the situation. Venture capital has poured billions into the commercial spyware industry, driving innovation in offensive capabilities. Meanwhile, enterprise investment in mobile security remains anemic. There's a pervasive cognitive dissonance: awareness of the mobile threat has grown, yet commensurate action remains conspicuously absent.

Organizations spend millions securing laptops and servers, but mobile devices typically receive only leftover, paltry security budgets. Estimates suggest fewer than half of organizations implement any dedicated mobile security beyond relying on the device manufacturer's baseline protections which, while foundational, are insufficient against nation-state threats. Even when measures are taken, they often mimic outdated perimeter defenses or signature-based antivirus common in early desktop security – methods long proven ineffective against today's advanced persistent threats.

The commercial spyware business model, fueled by venture capital demands for rapid growth, incentivizes aggressive sales tactics and a race to the bottom on price and features. This competitive pressure often pushes firms to operate in ethical grey areas and sell to a wider range of clients, as well as skirt their own internal controls on spyware abuse. As prices fall and availability increases, these potent surveillance tools, once the exclusive domain of a few top-tier intelligence agencies, are proliferating. This accelerates the development and adoption of similar zero-click capabilities by a growing number of nation-states, democratizing advanced digital espionage in dangerous ways.

Another trend further exacerbating the situation: America's principal adversaries like China leverage extensive global telecommunications infrastructure – from network hardware providers like Huawei to state-owned mobile interconnect points operating internationally. This lets potential vectors target the devices of Americans and their allies as they travel through countries reliant on such infrastructure, offering a sophisticated delivery mechanism for spyware.

While legal actions, such as the case brought against NSO Group by Meta over Pegasus exploitation, represent important steps, they have not fundamentally curtailed the industry. Venture capital continues to flow, and development continues apace. Many of these firms strategically operate outside Western legal jurisdictions, deliberately placing themselves beyond the immediate reach of democratic oversight and regulation. Today’s reality: the mercenary spyware threat does not represent a passing phenomenon; it’s a persistent, evolving challenge.

The controversy surrounding government officials' use of encrypted apps has become less a scandal of communication tools and more a glaring symptom of a deeper, unaddressed national security vulnerability. We are collectively sticking our heads in the sand on a problem that's not an easy to solve. The very design choices that make modern phones user-friendly and seemingly secure also create blind spots for traditional security monitoring and incident response. But we cannot even begin to develop effective defenses if we refuse to confront the scale and nature of the threat.

Historically, significant cybersecurity investments and policy changes have often required a major incident – a SolarWinds for supply chains, a widespread ransomware attack for critical infrastructure. This time, the target isn't just corporate data or network availability. It’s the integrity of classified information, the security of our leaders' communications, and ultimately, the national security of the United States. We need to address the mobile security crisis now, before the next inevitable breach forces our hand.

Rocky Cole, co-founder and COO, iVerify

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.