WASHINGTON (Reuters) - The US government is urging senior government officials and politicians to ditch phone calls and text messages following intrusions at major American telecommunications companies blamed on Chinese hackers.
In written guidance, released on Wednesday, the Cybersecurity and Infrastructure Security Agency said "individuals who are in senior government or senior political positions" should "immediately review and apply" a series of best practices around the use of mobile devices.
The first recommendation: "Use only end-to-end encrypted communications."
Neither regular phone calls nor text messages are end-to-end encrypted, which means they can be monitored, either by telephone companies, law enforcement, or - potentially - hackers who've broken into the phone companies' infrastructure.
That's what happened in the case of the cyberspies dubbed "Salt Typhoon," a group that U.S. officials have said is being run by the Chinese government.
Beijing routinely denies allegations of cyber espionage.
Speaking earlier this month, a senior U.S. official said that "at least" eight telecommunications and telecom infrastructure firms in the United States were compromised by the Salt Typhoon hackers and that "a large number of Americans' metadata" had been stolen in the surveillance sweep.
Last week, Democratic Senator Ben Ray Lujan said the wave of intrusions "likely represents the largest telecommunications hack in our nation's history" and it's not clear that American officials have figured out how to defeat the hackers' spy campaign.
A senior CISA official told reporters earlier this month that "it would be impossible for us to predict when we'll have full eviction."
Communicating only via end-to-end encryption has long been a recommendation pushed by digital safety experts like those at the Electronic Frontier Foundation, whose senior staff technologist Cooper Quintin welcomed the guidance. Still, he said the idea that the government was steering its own officials away from the regular phone network was worrying.
"It is a huge indictment of the telecoms that run the nation's infrastructure," he said.
Other recommendations include avoiding text messages based on one-time passwords - like the kind often sent by U.S. banks to verify logins - and using hardware keys, which help protect against a password-stealing technique commonly known as phishing.