Desk live·
ForensicPost
Nation-state/Accountability/File 24-1203

The Government Told Everyone to Encrypt

In December 2024 the FBI and CISA advised the public to use end-to-end encrypted messaging and calls. It is the most consequential thing anybody said about this incident.

Constructed geometry · not a chart of case data
JurisdictionUSAthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetUS telecommunications carriers
ActorSalt Typhoon
D. Kennedy12 min readConfidence: high3 sources reviewed

On 3 December 2024, officials from the FBI and CISA recommended that people move to encrypted communications on their mobile devices, in response to the continuing intrusion at AT&T, Verizon, Lumen and other providers.

Read plainly: agencies of a government that requires carriers to maintain interception capability advised the public to adopt communications those carriers cannot hand over.

The Advice Is Correct, Which Is The Point

If an adversary is inside a carrier’s network, then anything the carrier can read, the adversary can read. End-to-end encryption removes the carrier from the equation, so it removes the adversary that is standing in the carrier.

It is straightforwardly the right advice for the threat. It is also an admission about the architecture: the recommended mitigation for a compromised carrier is not to fix the carrier but to route around it.

What It Concedes

That the intrusion could not be quickly evicted. Advice to change your own behaviour is what a defender issues when it cannot change the thing that is broken.

This corpus has recorded the same pattern from private organisations: a notification offering credit monitoring is the same shape, an action transferred to the affected party because the responsible party has nothing else to offer.

It Sits Directly Against The Position On Encryption

Law enforcement agencies in several countries have argued for years that end-to-end encryption impedes investigations and that providers should retain a means of access.

This desk records the tension rather than resolving it, because resolving it is a policy judgement and this is a corpus of incidents. What the incident establishes is narrow and hard to argue with: at the moment the interception architecture failed, the advice from the agencies that use it was to stop relying on it.

How we reported this

Based on the reported December 2024 guidance from FBI and CISA officials and contemporaneous coverage, listed below. Graded high: the advice is official and was widely reported. This file characterises the advice and the tension it sits in; it does not take a position on encryption policy, and no agency position beyond the reported guidance is attributed here. Corrections: corrections@forensicpost.com.

Sources
  1. Chinese threat actor activity drives US government recommendation for encrypted communicationsArete
  2. Salt Typhoon hacks of telecommunications companies and federal response implicationsCongressional Research Service
  3. CISA issues guidance to telecom sector on Salt TyphoonDark Reading
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary