Secure Communications – providing the right tools to do the job

Armour CTO, Dr. Andy Lilly asks: “Have we learnt our lesson yet when it comes to using consumer apps for sensitive conversations?”

When it comes to government, military and business communications about sensitive topics, consumer apps are simply not designed for the job.  However, there are commercially available solutions that are built for exactly these type of conversations.  They are every bit as easy to use as consumer apps, but with far more robust security. With all the stories that have hit the headlines in the last 18 months, surely it’s about time that government agencies provided their employees with a suitable tool to enable them to do their jobs securely (Matthew Wilson, chair and co-founder of Penten – an Armour partner – explains in this interview with CyberDaily )

When will they learn?

The most recent, and arguably the most high profile example, was the news that a journalist was mistakenly included in US government discussions about sensitive military operations (aka “SignalGate” ).  It has been reported by the BBC that the journalist’s number was mistakenly attributed to one of the government staff who  was invited to the group chat. So, in this instance, it was human error that such sensitive data leaked to the outside world, but an app that was Secure by Design would have ensured that user identities could not be confused in this way.

In June 2024 news broke that the ex-Prime Minister and (at that time) UK Foreign Secretary David Cameron had fallen victim to a hoax video call.  The call was with someone pretending to be former Ukrainian President Petro Proshenko, with whom Mr Cameron had had multiple dealings, including face-to-face, during his tenure as Prime Minister.  As soon as the impostor started asking for contact details, Mr Cameron smelt a rat and ended the conversation, with no sensitive information exchanged.

This was clearly a sophisticated, targeted attack, given that Mr. Cameron was taken in by the impersonation, and demonstrates how such calls provided no authentication of the true caller identity. A communications app that uses identity-based encryption means that people using the app can be sure of the identity of those they are communicating with.

In May 2024, The Times article “Russia targets British soldiers’ mobile phones” stated that UK troops had been warned about the risk of Russian agents spying on their mobile phones. While this had long been suspected, during NATO battle exercises in Estonia, troops were once again reminded of the dangers around using mobile phones while in theatre.  This particular attack involved the use of fake base stations and GSM calls, which are inherently unsecure – an old attack vector which is still in use. (Our blog ‘Is someone listening in on your confidential calls?‘ explains how it works)

Spear-phishing attacks against targeted organisations and individuals

In February 2025, we read about a spate of instances involving the use of malicious QR codes to compromise Signal accounts, including those of military users, by exploiting the device-linking feature within the app. Google Threat Intelligence Group (GTIG) reported that use of the device-linking feature is being widely used by state-sponsored groups to attack Signal accounts, using social engineering to trick targets into scanning malicious QR codes that link their device to a device controlled by the attacker.  The scammer can then synchronize with the victim’s device and see all their sensitive communications.

A secure, centrally managed communications service would not allow users to add unauthorised devices to their accounts in this manner, nor allow unauthorised users to ever get access to the service in the first place.

Of course, the use of consumer apps also makes it ridiculously easy for a malicious insider to deliberately exfiltrate sensitive data sent over such systems, as demonstrated by the Daniel Khalife case.

Mis-use of personally-identifiable information (PII) in consumer apps

While a covert operative really won’t want their personal phone number associated with their classified conversations, the direct and visible link between most consumer apps and the user’s underlying phone number raises personal privacy issues. Use of a platform where personal details of users can be protected, provides stronger ‘duty of care’ processes, while the ability to record, store and securely audit communications further ensures compliance with data protection regulations.

Such measures can protect against potential harassment in the workplace, mis-use or abuse of the communications service, and other such serious issues.

Some Governments have banned the use of consumer apps 

In December 2024, the Scottish Government hit global headlines when it announced a ban on the use of the consumer messaging app WhatsApp for official business. The Scottish government were not the first to take such measures; the French government banned the use of WhatsApp, Signal and Telegram by ministers and their teams, as have banks (e.g. NatWest ), and over previous years, privacy-sensitive companies (e.g. Germany’s Continental AG ).

There’s more to security than end-to-end encryption

Mass adoption apps are simply not secure enough. While they all claim end-to-end encryption that protects data in transit, the incidents mentioned above demonstrate that this doesn’t mitigate the wrong person being added to a group chat, users being fooled by deepfake impersonation-based attacks, spear-phishing, social engineering, accidental or deliberate insider mis-use. As we’ve discussed many times before, there is much more to secure communication than encryption (while remembering that ‘normal’ phone calls and text services are even less secure, especially if your telecoms provider has been compromised by a nation state attacker.

Central management of users significantly mitigates the risks

A particular danger of consumer apps is that there is no central management of users. Anyone can download an app, and anyone can assume a false user identity. For handling sensitive, higher assurance conversations and data, instant messaging apps must be Secure by Design and Secure by Default. For example, the use of crypto protocols such as identity-based encryption will ensure a user really is who they say they are, and so prevent imposter-based attacks. Without built-in security features, with default settings to control users and data, instant messaging apps are prone to human error as well as deliberate mis-use.

It’s ironic that these are often referred to as “Closed Messaging Apps” when, in fact, in most aspects they are actually totally open – to faked identities, social engineering and other abuses.

Delivering Certainty in an Uncertain World

The Armour Secure Communications Platform offers total data sovereignty within a controlled environment where all users are centrally managed and enrolled.  Users can only enrol once invited to do so by their Administrator.  Once their device is enrolled, the user authenticates to the communications app in their usual manner (which can include in-built biometric readers) and only then can they use the service.

Different organisations working together, for example, on a joint project, or across different government departments or branches, often need to communicate at more secure levels of assurance to protect commercially or operationally sensitive information. The Armour platform provides a trusted mechanism to enable federated communication capabilities between disparate user Communities while maintaining robust security.

As a trusted third-party system, the Armour Secure Communications Platform can be used for sensitive conversations, safely segregated from the IT infrastructure used for everyday communications.

Award-winning Armour Comms solution

•  Multi-domain, multi-organisation structure with strictly siloed security means that Armour can augment and broaden secure communications and collaboration capabilities
•  Corporate Confidential, OFFICIAL, OFFICIAL SENSITIVE, NATO RESTRICTED, and higher assurance collaboration can be provided via Armour’s Secure Cloud extending to include desktops, workstations and unified comms systems (such as office phone systems).
• Alternatively, the Armour installation can be hosted and managed on-premises to give the organisation total data sovereignty.
• Different groups can be ‘Federated’ to permit them to communicate using the Community Allow-list feature.
• Third parties can be added and removed as needed, and only Federated to collaborate with specific teams or project

Armour will be at Cyber UK, being held in Manchester 6 – 8 May 2025.

Visit us to learn more about how your organisation can provide secure communications capabilities to staff.  And read our latest white paper: Secure Communications Architecture and Platform for security conscious organisations  – Designed for, and used in, higher assurance environments.