When Phone Security Becomes a Strategic Risk for Governments and Institutions
A secure messaging app is only one part of institutional communications security. Governments and organisations handling sensitive information must also protect the identities, devices and accounts behind a conversation. Removing a SIM card can reduce some dependencies on mobile networks, but it does not make a phone anonymous or prevent zero-click spyware attacks.
Why a phone number can matter
A phone number linked to a minister, military officer or senior official can help someone connect an individual with an organisation or account. Combined with other information, it may support impersonation or targeted approaches. This is a risk assessment, not evidence that every exposed number has been used in an attack.
Contact details and communications metadata also need to be distinguished. A contact list identifies people and ways to reach them. Metadata, such as records of who communicated with whom and when, can reveal patterns of interaction. Neither should be confused with the content of a conversation.
What the European incidents actually show
European incidents illustrate different kinds of exposure. They do not establish a single technical weakness or a common attack method.
In Italy, ANSA reported on 8 April 2025 that prosecutors were investigating the availability of senior officials’ phone numbers online. The following day, the national cybersecurity agency disputed claims about how it had been alerted and responded. The agency’s statement addressed the reporting and handling of the alert; it did not resolve every question about the exposed data. [1, 2]
In Spain, RTVE reported on 19 June 2025 that police were investigating personal details of ministers and former officials published in a Telegram channel. In Portugal, ECO reported on 31 July 2026, citing Expresso, that officials’ personal contact details were available through online data services. These reports concern exposed information; they do not establish that the affected phones were infected with spyware. [3, 4]
The German military incident involved intercepted conversation content. On 5 March 2024, Reuters reported that Defence Minister Boris Pistorius attributed the leak to a participant’s connection error in Singapore. This illustrates the importance of how people join a confidential call. It does not establish that removing a SIM would have prevented the interception. [5]
Encryption has limits when a device is compromised
End-to-end encryption protects content between communicating endpoints. It cannot, by itself, protect information already accessible to an attacker on a compromised endpoint. Nor should organisations assume that encrypted services all collect the same amount of metadata. CISA’s guidance specifically recommends assessing metadata collection when choosing a messaging service. [6]
For an institution, the assessment therefore extends to account access, linked devices, contact discovery and the way staff use the service. An approved application still needs appropriate configuration and operating procedures.
What communication without a SIM can change
Three choices are often grouped together: removing a physical SIM, operating without any active mobile subscription, and using a service that does not require a telephone number. They address different dependencies. An active eSIM still provides a mobile subscription. A messaging account may remain associated with a number even when its device connects through Wi-Fi.
Where a workflow genuinely avoids conventional telephone numbers, it may reduce the exposure of that particular identifier. This is a design option to assess against an organisation’s threat model, rather than a general security guarantee.
Other ways to identify or reach a user remain. Apple, for example, documents that iMessage can receive messages addressed to an email address as well as a phone number. EFF also describes location tracking through Wi-Fi and Bluetooth. Operating without a SIM therefore does not establish anonymity or remove every communications interface. [7, 8]
Why a SIM-free phone is still exposed to zero-click attacks
A zero-click attack exploits a vulnerability without requiring the victim to open a link or attachment. Its success depends on the vulnerable software and how the attacker can reach it.
In September 2023, Citizen Lab documented BLASTPASS, an exploit chain used to deliver Pegasus through malicious iMessage attachments. It could compromise an iPhone running iOS 16.6 without user interaction. The researchers reported that Apple issued fixes and confirmed that Lockdown Mode blocked that particular attack. This was a specific historical finding, not proof of protection against every spyware technique. [9]
In June 2025, Citizen Lab documented Graphite targeting involving an iMessage zero-click attack. Apple told the researchers that the attack used in those cases had been mitigated in iOS 18.3.1. These findings concern application and operating-system attack paths; they do not demonstrate that taking out a SIM would have blocked them. [10]
The practical distinction matters: removing or restricting a vulnerable feature can reduce the attack surface when an attack depends on that feature. Removing a SIM alone does not demonstrate that the feature is disabled or unreachable. Apple’s Lockdown Mode illustrates this approach by restricting selected functions while allowing ordinary calls and text messages to continue. [11]
What institutions should prioritise
Start with the information being handled, the people likely to be targeted and the consequences of exposure. Then choose controls that address those risks. CISA’s guidance for highly targeted individuals provides a useful baseline. [6]
Use approved end-to-end encrypted communications and assess the service’s metadata practices.
Keep devices and applications updated. Use phishing-resistant authentication, such as FIDO security keys or passkeys, where supported.
Reduce reliance on SMS for authentication and check account recovery options.
Review linked messaging devices and remove sessions that are unnecessary or unrecognised.
Consider additional protection for highly targeted staff, including restricted device features. Check operational compatibility before deployment. [11]
For particularly sensitive work, dedicated devices may be appropriate. That decision should include update support, administration, availability and a response process for suspected compromise. A separate device is useful only if its configuration and use address the relevant risks.
Commercial providers such as BlowFish offer dedicated communication environments. Organisations considering these systems should independently assess their security claims, update policies and operational suitability.
Protecting the decision-making process
Institutional phone security includes the protection of conversations, the people involved and the information that connects them. A phone-number-free workflow may have a place in that strategy. Its value depends on which specific exposure it removes and which risks remain. Procurement and operating decisions should follow that assessment, supported by evidence about the actual system in use.
Sources
Sources checked on 15 October 2026. News reports document reported incidents; technical research and official guidance support the security explanations. Historical software versions identify the cases discussed and are not recommendations for current deployment.
