Finding Dominic Raab’s mobile phone online is more than just embarrassing for the foreign secretary: it also represents a security risk, just as when it emerged Boris Johnson’s number could be easily found online in April.
Sophisticated spyware technology – of the type available to a rapidly growing number of governments outside the west – can, in some circumstances, be secretly inserted into a person’s phone without any interaction from the target.
Just knowing a phone number can be enough. Last December, Citizen Lab, a privacy watchdog that is part of the University of Toronto, said it had detected that spyware had been secretly inserted into 36 phones belonging to journalists, producers and executives at the Qatar-based al-Jazeera news network.
Such spyware can quietly take over a device, exploiting little-known vulnerabilities to give an attacker complete access to calls, messages, contacts and other media. More disturbing still, it can take over a phone’s camera and, in particular, the microphone for eavesdropping.
Even in the absence of such vulnerabilities, there are simpler techniques: billionaire Jeff Bezos allegedly had his phone hacked in 2018 after he had been sent a WhatsApp message containing a malicious video file from the personal account of the Saudi crown prince Mohammed bin Salman, although the Saudis deny the claim.
Political leaders the world over are invariably targets for spying, although revelations of that truth are rarely comfortable when they burst into the open. Angela Merkel accused the US of a “serious breach of confidence” in 2013 after it emerged that the German chancellor’s mobile phone was likely being monitored by the National Security Agency.
So it was not surprising that when the Foreign Office was told Raab’s phone number was available online, officials wanted it removed before the Guardian published its story. The spectrum of possible risks is well understood.
Nevertheless, the UK prides itself on having some of the best cyber capability in the world, based at GCHQ. It is a claim that few would doubt, though Britain’s cyber defenders are up against other sophisticated opponents: China, Russia and private companies selling spyware technology around the world.
Politicians, when they enter the British government, are offered a mobile phone security assessment, according to Whitehall sources, and a new device – so long as they do not mind the intrusion of having the security services taking control of their phone.
Last week, it was reported that Johnson had his mobile phone swiftly removed and replaced in April after the news emerged that his number had been available online. But his number had been accessible to anyone for 15 years, nearly two of them when he was prime minister.
Ministers are told not to transact classified government business by mobile phone but security insiders recognise that in reality prime ministers and foreign secretaries will want to hold informal conversations with colleagues and counterparts on the device to hand, just like everybody else.
For a senior politician, like Johnson or Raab, simply having a mobile phone represents a potential security risk that has to be managed. Having their private phone numbers circulating freely online compounds that risk.