> I think the various governments are well aware of their own abilities and assume that the opposition have equal capabilities.

Exactly. From most people, "smartphones are spying on us" sounds a little tinfoil hat. Coming from the Director of Military Intelligence, however, gives the message some credence.

Which still needs to be read with nuance though: militaries and governments are worried about targeted, specific efforts directed at specific individuals, and the general difficulty of securing random electronic devices which exist outside of high-security environments sometimes (close to impossible).

This is probably a reasonable threat for executives to worry about, but it's still ultimately an expression of "we're concerned about a threat where breaking into a home and bugging the device or swapping it with a compromised one is a real concern".

Execs are definitely subjected to targeted attacks on a regular basis, but they don’t need to be exploits on physical devices to be effective. For a high profile example: see the Bezos hack. There’s enough money in this space that zero-days are within budget.

Considering the lengths to which people go to get an edge on the stock market (like using satellite feeds to observe parking lots, factories and tracking executives), I think the concern should be real for executives of large multinationals. On top of that, industrial espionage is a thing.

I mean absolutely. What I'm cautioning against is reading too much into the overall security posture of mass market devices (or intelligence agency intercept capabilities) from this advice.

This is closer to "if you can pay a team to go and find a way into that specific person there" then they're going to succeed.

But you're already close to "infiltrate the window washing company, and stick solar powered listening bugs to every window on the upper floor suites".

Fun Fact. I've been in to places where it was an almost impossible feat to achieve without substantial background clearance checks. Chatting to the cleaners around the coffee machine during down times showed a shocking disparity between the checks run on 'obvious people' vs. the 'invisible people'. (My personal viewpoint on life is that we are all just people doing equally important jobs, i.e. Cogs in the Machine, regardless of pay rates).

Pen-Testers use the 'cloned cleaners' pass' thing all the time and it works surprisingly well.

We were told by our IT department that its now SOP by both nation states and hacker groups to target all executives of MNCs. Even those in "visible" technical roles are targeted as a standard matter of procedure.

True, but somewhat irrelevant to most people. There are so many lower-hanging and juicier fruit than recording audio from your phone that I just don't understand why this would be a relevant case.

Most people have their email, personal photos, medical records, financial records, chats etc. on their phones. If you believe your phone is likely compromised, you should first move all of those off your phone before being concerned about realtime audio recording.

I'm debating about whether or not to post this but if it makes it this far then I opted to do so.

A year or so back I stayed over with some extended family, one of which was 'In to IT and earns a living from it. During that time (using the I.T guy's network) I noticed that one of my phones was eating through the battery at a crazy-stupid-mad rate. A quick check showed that this particular phone had begun uploading a metric shit-ton of data on an otherwise normally asymetric data profile (in other words Data Uploaded vs Data Downloaded Ratio).

A check with the 'family IT guy' confirmed that he had Remoted In to a high value clients' system to trouble shoot something at around the same time that one of my phones began to furiously upload any and every thing on its' memory card.

Sounds like one of those "Cool Story Bro" types stories right?

All I will say is that because one of my 'Low Hanging Fruit' thangs got p0wned I was able to alert the $corp of the problem (since the probe originated on their end not mine).

As with all things in Life, YMMV.

I absolutely believe that such attacks are possible - no doubt about that.

But most corporate networks likely have much more likely vulnerabilities that are worth much more thought than this, in my opinion. If your phone has been taken over to the extent that an audio/video stream can be recorded without your permission, I would bet also that much more valuable information than that audio/video stream can usually be obtained as well, for most people who are not used to high security.

This is very sound advice for anyone who wants to feel more secure about their surroundings and mobile devices.

People underestimate the spying potentially of mobile phones very often. They are always on, have a data connection, and run software that is abysmal for security.

I would bet that at least an iPhone is much safer than a regular company laptop in 90% of companies. It is quite likely safer than the internal network. Security is often a second rate citizen in most companies.

Also, strict security practices that affect productivity often get worked around - for example, if I want to examine a diagnostics archive I got by mail on my phone, but the IT policy won't let me, I may well forward it to my personal mail, open that though Firefox, and get the archive this way. It's much worse for overall security, but pretty hard to prevent, and less important to me when I get a call about blocked builds at 10 o'clock.

They wonder sure. But tells us also what happens after you give them a budget of what its going to cost the org.