LastPsyOp: Read the Full Brief
Objectives
- Review permissions with the right defaults
- State what a phone leaks regardless of settings
Lesson
Updates first. Security updates close flaws that are already being exploited, and nothing else on this list buys as much for as little effort. Turn on automatic updates for the operating system and the browser and stop thinking about it.
Then permissions, which are subscriptions rather than one-time uses. Go through location, microphone, camera, contacts, and photos.
Prefer “while using” over “always” — background location is the setting the commercial tracking industry is built on — and single-photo access over the whole library. Anything you granted for one task two years ago should be revoked.
Reset or delete the advertising identifier and refuse cross-app tracking while you are in there; it is worth doing and it is not a cloak.
Know what the phone leaks anyway. Your carrier records which towers you connect to, and no app setting touches that. Location gathered inside apps has been bought and sold commercially: in 2024 the US trade regulator ordered two data brokers to stop selling precise location data and delete what they held, including data that revealed visits to medical clinics, places of worship and domestic violence shelters. Your settings reduce your contribution to that market; they do not remove you from the world.
The high-risk modes — Lockdown Mode on one platform, Advanced Protection on the other — are deliberate capability reductions for people who might be individually targeted. They block attachment types, web features, accessory connections, sideloading and insecure networks.
Most people do not need them and would find them irritating. The people who do need them need them badly, and turning one on takes a minute.
Finally, stalkerware. Cheap covert-monitoring apps are marketed for watching a partner, and installing one on another adult's device without consent is a crime in the United States under wiretap and computer-crime law. The trade regulator has banned one vendor and its chief executive from the surveillance business outright.
If you suspect one is on your device, get advice from a domestic-violence technology service before removing it, because removal tells whoever installed it that you know.