CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel

The week

On December 18, 2024, the Cybersecurity and Infrastructure Security Agency published mobile communications best practices for “highly targeted individuals”, meaning people in senior government or political roles likely to interest foreign intelligence services. The guidance followed months of disclosures about intrusions into U.S. telecommunications networks attributed to a China-linked group known as Salt Typhoon, which U.S. agencies said had stolen call records and accessed some communications. CISA recommended using only end-to-end encrypted communications, replacing SMS-based multi-factor authentication with phishing-resistant methods such as FIDO security keys, and setting a PIN on carrier accounts, among other steps. The guidance was written for individuals but was read widely across industries. It landed while the SEC and CFTC were still bringing cases, begun in late 2021, against financial firms whose staff used unpreserved messaging apps for business.

For compliance teams at broker-dealers, CISA’s advice arrived at an awkward moment. For three years the Securities and Exchange Commission and the Commodity Futures Trading Commission had fined firms, often heavily. The cause was employees using personal messaging apps, many of them encrypted, for business communications the firms did not preserve. Now a federal security agency was telling senior people to use encrypted messaging apps.

The conflict is narrower than it looks. Recordkeeping rules never prohibited encryption. Broker-dealers must preserve business communications under SEC Rule 17a-4 and FINRA rules; investment advisers, swap dealers and futures commission merchants have their own obligations; banks that are not broker-dealers are outside Rule 17a-4 but carry other retention duties. The enforcement cases arose because communications ran on channels the firm neither controlled nor captured. CISA’s concern was channels an adversary could read. Both point to the same answer: a channel the firm controls. That channel has three requirements, which are distinct and together sufficient. It must be secure against interception and account takeover, it must be captured and retrievable, and it must be usable enough that staff and clients actually use it.

Secure: protected in transit and at the account

Salt Typhoon showed that ordinary calls and SMS can be exposed inside carrier networks. End-to-end encryption protects message content even if the carrier is compromised, because only the endpoints hold the keys. For financial firms, the exposure goes well beyond executives. Traders, advisers and relationship managers communicate with clients by phone and text every day, and SMS offers no protection against a compromised network.

Security also covers the account. A messaging identity tied to a phone number can be hijacked through a SIM swap, and an SMS code sent to that number then confirms the attacker. CISA’s advice to move to phishing-resistant authentication applies here. Firm-issued messaging accounts should be bound to managed devices and protected with passkeys or hardware keys, and carrier accounts for firm phones should carry a PIN. The same logic applies to customers: high-value accounts and high-risk actions such as wire setup deserve options stronger than SMS codes.

Captured: preserved, searchable and supervised

Capture is what the regulators require. Messages must be preserved in a compliant archive, retrievable for examinations and litigation, and available to surveillance. Encryption in transit does not prevent this. Capture happens at the endpoint, on a managed device or through an enterprise version of the platform with an archiving integration.

The design choices carry trade-offs. Enterprise editions of mainstream platforms preserve the familiar user experience but depend on the platform’s archiving features. Capture agents on managed devices work across apps but require device management that some staff resist. Purpose-built firm messaging tools capture natively but ask clients to install something new. Voice deserves the same treatment as text. Recorded lines on trading desks are routine, but mobile calls to clients often are not, and a firm that captures messages while leaving mobile voice uncaptured has moved the gap rather than closed it. Each approach also adds a party to the chain of custody. The archiving vendor and any capture software become part of the security boundary, so they need the same diligence as the messaging platform. Surveillance teams need captured messages in a searchable form inside the same review tools they use for email. Firms should confirm specific configurations with counsel and compliance, because capture and retention details decide whether a channel is compliant.

Usable: good enough that nobody reaches for a personal app

The off-channel cases were, at root, a failure of usability. Staff used personal apps because clients were there and the approved tools were clumsy or absent. Prohibition without an alternative pushes behavior out of sight.

Usability starts with the client. Clients message on the app they prefer, and a relationship manager who ignores them will not keep them. Firms need a scripted, low-friction way to move a conversation onto the approved channel, and a method to capture what arrived before it moved, such as forwarding to the archive with an attestation. Adoption should be measured, not assumed. The share of client-facing staff actively using the approved channel each week, and the number of self-reported off-channel messages, are better indicators than signed policy acknowledgments.

Supervisors carry part of the load. A branch manager who texts staff on a personal phone signals that the policy is optional. Requiring managers to use the approved channel for all work coordination, and including their usage in supervisory reviews, sets the norm faster than training. So does making the approved app available on day one for new hires, before habits form.

Each requirement fails without the other two. A secure, usable channel that is not captured repeats the enforcement cases. A captured, usable channel without encryption leaves client data open to a compromised network. A secure, captured channel that nobody uses produces the off-channel behavior it was meant to stop.

With hindsight

Salt Typhoon proved broad and persistent. In August 2025 CISA, the NSA, the FBI and partner agencies from a dozen countries published a joint advisory (AA25-239) on the group. It described long-running targeting of telecommunications and other networks worldwide, confirming that carrier channels should not be treated as private. The SEC announced another batch of off-channel settlements in January 2025, shortly before leadership changed; afterward its enforcement emphasis shifted, but the recordkeeping rules did not. Two 2025 episodes, discussed in a later article in this series, showed the capture requirement’s own risks. In March, senior U.S. officials discussed military plans in a commercial encrypted group chat outside records systems. In May, TeleMessage, a vendor whose modified messaging app archived encrypted messages for government and corporate clients, was breached. Its flaws were then added to CISA’s catalog of known exploited vulnerabilities. Capture tools, in other words, are part of the attack surface.