For sensitive chats, use an end-to-end encrypted app, set messages to expire, and review the linked devices list so you know every screen that can read your account. CISA gives all three as advice for highly targeted people. On a company phone, check records retention rules before turning on expiry.
Why messaging apps matter
CISA's guidance responds to intrusions into commercial telecom networks that exposed call records and compromised some private communications. It tells highly targeted people to assume communications between mobile devices and internet services are at risk of interception or manipulation, and to use end-to-end encrypted communications only. It names Signal as an example and recommends an app that works across iPhone and Android.
It also says to evaluate how an app collects and stores metadata that could identify or trace the user.
Settings to check this week
- Enable message expiration. Set sensitive chats to delete after a period you choose. CISA says to do this for sensitive messages.
- Open the linked devices list. Remove any device you do not recognise and keep only those you need.
- Review group invitations. Verify an invite with the group creator through a separate channel.
- Check app permissions for location, camera and microphone in your phone settings.
- Report suspicious messages using the app's reporting tool.
Records retention
CISA notes that for employer issued devices you should verify that records retention policies allow expiry and that it is consistent with law. Executives at public companies and in regulated industries often have retention duties for business communications. Ask legal or compliance before changing the setting. If retention applies, use the company approved channel for business and keep the personal app for personal use.
What E2E encryption does and does not do
It protects message content in transit between the people in the chat. It does not protect a message after someone screenshots it, forwards it or reads it on a phone you have lost. It does not hide who you talk to from everyone, which is why CISA mentions metadata.
Linked devices are a quiet risk
Attackers have used linked device features to read accounts. CISA references Google Threat Intelligence reporting that Russia aligned groups actively targeted Signal Messenger. We did not fetch that report, so check it directly. Your own check takes two minutes. Do it monthly, and after any suspicious message.
See also how attackers trick users into linking: account takeover through fake security alerts.
Tips for assistants and family
If an assistant needs to see messages, use the company approved tool with delegate access rather than sharing your personal account. Never hand over a one time code or PIN, even to someone you trust, because the code is a key to the account.
Quick check
Should I enable message expiry on a company phone?
Check records retention rules first. CISA says to verify that policies allow it and that it is consistent with law.
Sources
Last reviewed: 19 October 2026.
