In a remarkable shift that underscores the critical state of digital privacy, US officials are now actively encouraging Americans to use encrypted messaging apps for their communications. This recommendation comes after the “Volt Typhoon” attacks—attributed to a Chinese state-sponsored hacking group targeting US critical infrastructure, including communications, energy, and transportation sectors—and the “Salt Typhoon” attacks. The latter, involving the Chinese infiltration of telecommunications providers, represents one of the most extensive intelligence compromises in US history.

This breach was partly due to the1994 Communications Assistance for Law Enforcement Act (CALEA). The law was designed to ensure that telecommunications networks could facilitate lawful surveillance by law enforcement agencies. While well-intentioned, the law required the creation of standardized backdoors and interception mechanisms across networks, inadvertently introducing significant cybersecurity vulnerabilities.

These lawful intercept capabilities meant to combat crime, have become targets for exploitation by state-sponsored actors, such as in the Salt Typhoon cyberattack. This attack leveraged administrative tools and access points—potentially including CALEA-mandated mechanisms—to infiltrate critical US infrastructure stealthily. The incident highlights a critical flaw in CALEA’s design: While enabling surveillance, it created single points of failure that adversaries can exploit. As the cybersecurity landscape evolves, CALEA’s vulnerabilities underscore the urgent need to balance law enforcement requirements with robust protections against misuse, ensuring that security enhancement efforts, like encryption are not inadvertently undermined.

Volt Typhoon and Salt Typhoon are Chinese state-sponsored cyber espionage operations but they differ in focus and tactics. Volt Typhoon targets US critical infrastructure sectors like communications, energy, and transportation, using techniques by leveraging legitimate administrative tools to evade detection. Its objectives include pre-positioning for potential disruptions during geopolitical crises.

In contrast, Salt Typhoon focuses on telecommunications networks, infiltrating companies like T-Mobile, Verizon, and AT&T to access unencrypted communications. Salt Typhoon’s primary aim is surveillance and intelligence gathering, targeting mainly high-profile individuals and government officials. These distinct approaches highlight the breadth of China’s cyber capabilities and objectives, from infrastructure disruption to extensive data exfiltration.

The cyberattacks on America’s digital network infrastructure remind us that our communications are more vulnerable than many realize. When federal officials, including the FBI and Cybersecurity and Infrastructure Security Agency (CISA), start advocating for encryption, we should pay attention. CISA’s executive assistant director, Jeff Greene, noted, “Encryption is your friend. Even if the adversary can intercept the data, if it is encrypted, it will make it impossible [to read].”

It’s particularly noteworthy that the FBI—historically resistant to certain forms of encryption—is now advocating for encrypted communications. This shift reflects the changing nature of security threats in our interconnected world. While law enforcement agencies maintain their stance on device encryption (still seeking “backdoors for good guys”), they recognize the encrypted communications’ vital role in protecting against foreign surveillance.

End-to-end encryption isn’t just another tech buzzword—it’s a crucial tool for protecting digital privacy. Only the sender and intended recipient can access the content when a message or call is encrypted end-to-end. Even if intercepted by hackers, government agencies, or service providers themselves, the communication remains unreadable without the proper encryption keys.

The secure communications landscape offers several robust platforms for everyday use. Signal and WhatsApp stand out by providing comprehensive end-to-end encryption for messages and calls, while Apple’s FaceTime ensures that encryption protects all voice and video calls. Apple’s iMessage was built with the foundational feature of end-to-end encryption. Meanwhile, Google Messages offers encryption for Rich Communication Service chats, but only between users of recent versions of the Google Messages app. Traditional SMS and phone calls remain generally unencrypted and vulnerable to interception.

The implications of unencrypted communications extend far beyond government surveillance concerns. Your conversations should remain private, whether about sensitive personal matters, health issues, or daily life. Many of us discuss financial matters or share sensitive information through digital communications, making encryption crucial for financial security. Professional communications often contain proprietary information that could be valuable to competitors or malicious actors, while personal information shared in communications could be used for identity theft if intercepted.

Protecting your communication medium means using encrypted messaging apps as your primary communication tools, verifying encryption status within apps, and keeping your apps updated. Many apps provide visual indicators of encryption status, and learning to recognize these can help your communications remain secure. Encouraging friends and family to adopt encrypted communication platforms is equally important, as security is often only as strong as the weakest link in our communication chain.

As cyber threats evolve, encrypted communications will only become more critical for government workers, businesses, and individuals at every level. The US must remain united in its commitment to addressing cyber threats and holding adversaries accountable for their actions.

Learn more: AI and the Future of Civics | The Power of Pivots: How Smart Companies Change the Game | Between Rules and Reality: The Complex Challenge of EU Data Compliance | Cybersecurity Concerns with QR Codes: Staying Safe in the Digital Age