The phone in your pocket is the most intimate sensor you own: microphone, camera, location, contacts, messages — always on, always broadcasting. This lesson covers the mobile threat, how it is managed, and the invisible signals around it.
Day 2MobileRF discipline
Notes: Set the stakes: the phone knows more about the principal than any other device and never leaves them.
Lesson 08 · Slide 2
The mobile threat model
Mercenary spyware — commercial-grade full-device compromise, sold to states and others
Zero-click exploits — no tap required; a message alone can be enough
Malicious & over-permissioned apps — spying in plain sight, with your consent
Risky sideloading — installing outside vetted stores removes a safety net
Why leaders are targeted here
Full phone compromise gives an adversary your location, your conversations, and your camera — the richest single source there is.
Notes: Keep spyware as a capability category — no product names, no code. The point is the class of threat, not the vendor.
Lesson 08 · Slide 3
"Just don't click" is not enough
The most capable mobile attacks are zero-click: they need no action from you at all. A crafted message processed by the phone can be enough. Awareness training does not save you here.
The consequence
If the attack needs no click, the defence cannot be "be careful what you click." It has to be reducing the attack surface — fewer apps, prompt patches, and lockdown modes.
Notes: Crucial mindset correction and the setup for the poll. Against zero-click, behaviour is not the control; surface reduction is.
Lesson 08 · Slide 4
Managing the fleet: MDM / UEM
Policy enforcement — encryption, patch levels, and settings applied centrally
Containerisation — work and personal kept separate on one device
Remote wipe — a lost device becomes a cost, not a breach
Attestation / compliance — verify a device is healthy before it gets access
Lockdown / isolation modes — for the highest-risk principals, shrink the attack surface hard
Notes: MDM/UEM as capability categories. The last point — high-risk lockdown/isolation modes — is the executive-relevant control against zero-click.
Lesson 08 · Slide 5
Apps: least privilege in your pocket
Every app you install is new attack surface — install fewer
Review permissions: does a torch app need your contacts and location?
Prefer vetted stores; avoid sideloading on the principal's device
Remove what you don't use — dormant apps still carry risk
Why you care
Over-permissioned apps are legalised spyware. The fix is boring and effective: fewer apps, least permissions.
Notes: Least privilege from Lesson 06 reappears on mobile. Permissions are the consenting-to-surveillance problem.
Lesson 08 · Slide 6
The wireless / RF attack surface
Your phone is a radio — several radios. Each is a channel in and a channel out. Press →.
Cellular · Wi-Fi · Bluetooth · NFC · GPS
→
Rogue base station / evil-twin / proximity attack
→
Intercept, track, or compromise
→
Continuous location & data leakage
Notes: Reveal step by step. The final node — continuous location leakage — ties directly to Lesson 05's pattern-of-life.
Lesson 08 · Slide 7
The RF channels, briefly
Rogue base station — a fake cell tower your phone trusts and connects to
Evil-twin Wi-Fi — a lookalike hotspot that sits between you and the internet
Bluetooth & NFC — short-range channels exploitable at close quarters
GPS spoofing / jamming — feeding false location or denying it
Location leakage — the steady exhaust that maps your movements
Notes: Concept-level only. The unifying idea: every radio is a door, and location is the payload that matters most for a principal.
Lesson 08 · Slide 8
Which measure best resists a zero-click mobile implant?
C. A zero-click attack needs no user action, so "avoid links" (A) does nothing, and a longer passcode (B) or download scanning (D) address different threats. The only real defence is to give the exploit less to hit: fewer apps, prompt patches, and high-risk lockdown/isolation modes that disable the very features these implants abuse.
Notes: Payoff of slide 3. Many pick A out of habit. Hammer home: against zero-click, surface reduction > behaviour.
Lesson 08 · Slide 9
RF discipline for sensitive meetings
Device custody — decide who brings what, and where devices go
No-phone rooms — for the most sensitive discussions, devices stay outside
Screened / faraday storage — block the radios you cannot verify are off
Powered down, not just "off" — a phone that is "off" may still be reachable
Don't trust the slider
"Off but in the room" is not the same as "not in the room." For truly sensitive talk, the device leaves.
Notes: Practical policy for board/sensitive meetings. The distinction between "off" and "absent" is the key discipline.
Lesson 08 · Slide 10
Location is an OPSEC indicator
Recall Lesson 05: your pattern-of-life is a targeting package. Your phone is the most reliable source of it — quietly, continuously, by default.
The link
Mobile security is not just about implants. Simply carrying a chatty device turns your movements into the adversary's map. RF discipline is counter-collection.
Notes: Explicitly bridge Lessons 05 and 08. Even an uncompromised phone leaks location; discipline reduces the exhaust.
Lesson 08 · Slide 11
Two-minute drill: set your meeting policy
For your next genuinely sensitive meeting, decide now: do phones come in? If so, where do they go and in what state? Write the one-line rule you will actually enforce.
Notes: Start the timer. A written, enforceable one-line rule beats a vague "we should be careful with phones."
Lesson 08 · Slide 12
Recap & what's next
The phone is your richest sensor; the top mobile attacks are zero-click
Defence is surface reduction — MDM/UEM, minimal apps, lockdown modes
Every radio is a door; location leakage is counter-collection's problem too
Next
Lesson 09 — Secure Communications & Trusted Decisions: how to talk, verify, and decide when the channel itself may be hostile.
Notes: Bridge to the Day-2 finale: having hardened devices and signals, we now secure the conversations and decisions that flow across them.