[SILENT - 15.7s]

why the iphone is the most surveilled device on the planet

let me ask you something

you're holding a device right now that knows your face tracks your location

listens for your voice reads your messages backs up your life to a server you don't control

and somewhere along the way we decided that's fine because it's an iphone because apple said so

because the box said privacy

Welcome to the Closed Network Privacy Podcast.

I'm your host, Simon.

And today, we're going to dismantle one of the most successful lies in the history of

consumer technology.

The app does things like turn on the microphone, the camera, and read WhatsApp messages or

listen to calls or track location.

And then it sends all that data back to the attackers without the victim knowing that

any of this happened.

Specifically, this worked with iPhones.

First, it required the user to click a malicious link using their phone.

Clicking the link opens the Safari browser and the user visits the website.

Safari uses a thing called WebKit, which is like the browser's engine.

When a user clicks the link, a JavaScript program runs.

And that JavaScript program tries to exploit a bug in WebKit, which would allow it to write

data to the phone.

Through this bug in WebKit, the JavaScript program...

downloads a malicious program.

The malware uses an exploit to jailbreak the iPhone,

which allows it to run any app that's on the phone,

not just the ones downloaded through the App Store.

Once it's jailbroke,

then the last step is just for it to run the malicious app.

And at this point, the app is just a normal iPhone app,

and it can be started like any other app.

The app is just for it to run the malicious app.

got upset i had to put all the egos in check i want the money the power welcome back everybody

simon close network privacy podcast episode 54 mini pod why the iphone is the most surveilled

device on the planet had a lot of conversations going in the chat room the last week especially

since the last episode dropped regarding mobile devices since there's so much conversation

happening around age verification app gatekeeping through specific app stores both through apple

and google where things are heading down the road no one really knows for sure no one has all the

answers but oftentimes we see the messages come up when talking about different phone platforms and

if i can't use graphino us what should i use instead often the times and even myself recommended well

an iphone it's actually quite secure private debate

but possibly more private than stock Android, especially if you're using it with, if you're

an iCloud user, then definitely enabling advanced data protection if you're allowed to. Some

countries are now making that feature not available, as well as using lockdown mode.

Lockdown mode on an iPhone provides additional security benefits and

depending upon your threat model, it may be something you want to consider.

I think it really, the only person I can answer these questions is yourself. So my objective

for this episode is kind of a mini pod focused specifically just on this subject. So the iPhone,

yes, the key features in lock mode or the lockdown mode.

requires you know the the functionality of the phone still continues to work uh but it adds

uh some some layers that it basically will uh block connections automatically like wi-fi

uh 2g 3g those should be blocked uh at all times and then uh there's you know different

configurations within there for high-risk users like journalists activists government employees

human rights workers those types of things where uh it adds additional layer of of security to the

device physically so yeah i think the iphone's probably like okay and it's a you know when i

say okay i'm like relative uh in my opinion graphenois is probably the most secure and most

private not because it's just that way out of the box but because the phone doesn't require you to

log into the device during during setup you don't even have to install any google services at all

if you don't want to

sometimes that's a requirement for certain things to work like banking apps and things of that

nature. But if you absolutely just don't want any ties, then, you know, you can set that phone up

and you have a lot of granularity over what the applications that are installed, what they can

have access to sensors, microphone, location, wifi, you know, network, all that type of thing.

So this episode is going to be just really focused on iOS and then kind of a little contrast

as well to Graphene OS. So I'm just going to take a quick second just to thank some people

really, really quick. This is going to be a quick, quick episode. Michael Bates, David, TK,

Vo, Mr. Milk Mustache, Hutch, Bond, Wartime, Circus Media, a couple unknowns and anonymouses.

Thank you. Thank you for your support. If you are interested in supporting the podcast,

you're welcome to do so. You can do all of that at closednetwork.io.

We also have a Patreon.

You can also support directly through closednetwork.io directly for as little as five bucks a month.

If you feel compelled, also feel free to join for free under the free plan as I'm working on different newsletters and ways to push information out that I find interesting or that I think others might find interesting without overusing it.

But yeah, kind of trying to build some better lines and channels of communication.

All the links to join our chat rooms are at closednetwork.io.

And a quick shout out to our moderators, Mattis Max on Intelligence 7.

Thank you for all the hard work.

Much appreciated.

And with that, we're going to get into the episode.

We'll see you next time.

The iPhone is not a private phone.

It is, in many measurable ways, the preferred platform for state-sponsored surveillance on the planet.

Not because Apple is uniquely evil, but because the very thing that makes iOS secure to you,

that locked-down, controlled, walled-garden architecture is exactly what makes it irresistible to intelligence agencies and spyware vendors.

When you crack a walled-garden, you own everything inside of it.

So today we're going to talk about three things.

One, Paragon Solutions, an Israeli spyware firm that hacked fully updated iPhones.

No clicks, no links, no user error, while the victims slept.

Two, Apple's quiet acquisition of companies that read your facial micro-expressions.

your emotions in real time and as of 2026 translate silent movements of your lips and jaw into words

you haven't spoke out loud what an actually private phone looks like in 2026 and why paradoxically

it's made by google so grab your coffee this one's gonna sting

part one the spyware that needs nothing from you so picture this you're a journalist in italy

your iphone is fully updated running the latest version of ios available at the time

you haven't clicked anything suspicious

no links you haven't opened any weird attachments you haven't installed anything from outside the

app store you've done everything right and your phone is already compromised that is not a

hypothetical that is what happened to at least two european journalists in early 2025 confirmed

forensically by the citizen lab at the university of toronto the iphones were infected with spyware

called graphite built by an israeli firm called paragon solutions the attack vector was imessage

apple's own messaging system the exploit processed a malicious photo or video shared through an

icloud link automatically silently the way your phone always processes incoming media

the victim didn't touch a thing the spyware was installed game over citizen lab calls this a

zero click attack no user error no phishing no you should have known better the phone just gets owned

once

graphite is in it has access to everything your messages including signal whatsapp your call logs

your photos your contacts your location microphone your camera

every app on your device becomes a window that paragon's client can look through your phone has

been silently converted into a full spectrum surveillance device and you have no idea now

who is paragon solutions founded in 2019 co-backed by former israeli prime minister

ehad barak it's a founder a former commander of unit 8200 israel's elite signals intelligence unit

essentially the nsa's hacking division these are not amateurs who stumbled into spyware business

these are people who spent their careers cracking communications infrastructure for nation states

their product graphite is marked as a lawful

intercept tool sold exclusively to vetted democratic governments for legitimate law

enforcement. We're the ethical spyware company. We only sell to the good guys. So in December

2024, a U.S. private equity firm acquired Paragon for approximately $500 million.

The surveillance for hire industry is no longer in the shadows. It's on Wall Street.

And here's where it gets political. Italy's parliamentary intelligence oversight committee

confirmed in June, 2025, that the Italian government has used Paragon's graphite to spy

on two activists, the founders of an NGO that rescues migrants drowning in the Mediterranean

sea, not terrorists, not criminals, people pulling bodies out of the water. A democratic EU member

state using a half a billion dollar Israeli-American

country.

Thank you.

spyware to monitor humanitarians. And in the United States, the Drug Enforcement Administration

is reportedly a Paragon customer. So after briefly pausing the contract, the Trump

administration reinstated it. By August of 2025, ICE, for those that don't know ICE as the

Immigration and Customs Enforcement in the United States, had the green light to use green graphite

again. The agency's director publicly stated they would use a new surveillance capability

to track anti-ICE protesters. There's even a journalist who warned publicly that Paragon

spyware can be covertly installed on anyone's phone from a drone hovering over a protest.

This is not a hypothetical. This is operational. So why is Apple? Why Apple, right?

is the spyware industry's favorite platform.

You might be asking, doesn't this stuff target Andrew as well? Technically, yes. But practically, iOS is the preferred and confirmed platform. And the reason is architectural. iOS is a monoculture.

Every iPhone runs essentially the same software stack, the same iMessage implementation, same photo processing libraries. If you find a vulnerability in iMessage on one iPhone, it works virtually on every other iPhone in the world. So the attack surface is uniform, predictable, and enormous by market share.

So for a spyware developer, that's a dream. You develop it once, you deploy it millions of times. Android is the opposite. Different manufacturers, different software versions, different custom layers. A zero-click exploit that works on a Samsung Galaxy may not work.

on a pixel each is a separate engineering problem the fragmentation that frustrates consumers is

paradoxically a security feature but here's the deeper issue and this is the part most most people

miss apple security pitch is this basically because you can't modify ios because you can't

install software from outside the app store because the operating system is cryptographically

verified from boot to runtime your device is secure and that's true for a certain definition

of secure but the same locked bootloader that prevents you from installing a custom operating

system also prevents you from inspecting the one that you have you cannot audit ios you cannot modify

how i message works you cannot remove the attack surface you are completely dependent

on apple

you

single private company to find and patch every vulnerability before spyware vendors do.

And we've just seen sometimes Apple doesn't win that race. The walled garden that looks like

security is actually a single point of failure. When it fails, it fails completely. There is no

fallback. So we're looking at kind of Apple's face reading empire, right? Now let's see Paragon.

Let's set Paragon aside. Let's take Apple at their word that they're fighting spyware,

not enabling it. There's a separate quieter story being built through Apple's acquisitions.

And it tells a very different story about what your device is being designed to do.

So let's trace the timeline. 2013, Apple acquires PrimeSense, an Israeli company whose 3D sensing

technology maps your face.

with 30,000 infrared points, and this becomes Face ID. Three years later, 2016, Apple acquires

Emotent, a company whose entire business was detecting human emotions from facial expressions

in real time. Their pitch is discern the most subtle expression changes and translate them

into defined emotional reactions. Apple has never publicly explained why they needed real-time

emotion detection. 2017, RealFace, another Israeli startup, AI-driven facial recognition and

identification. Combined with PrimeSense, this forms a core of Face ID, as we know it today,

to unlock your phone. 2020-24, Datacob, a French computer vision startup that deployed AI tools

in Paris, transit systems to monitor people's faces for...

mask compliance during the pandemic. Apple acquired them, quoted their privacy by design

credentials. Their use case was monitoring faces in public spaces. Okay. Then in January,

2026, Apple acquires a company called QAI, approximately $2 billion for the acquisition.

Apple's second largest acquisition ever after Beats, the Beats by Dre headphones. So QAI's entire

website had one line of copy. Quote, in a world full of noise, we craft a new kind of quiet.

What does QAI actually do? Their patents reveal technology embedded in headphones or glasses

that uses facial skin micro movements for nonverbal communication. The system

analyzes the tiny movements of your jaw, your lips, your face.

muscles to understand what you're saying, even if you're whispering, even if you're saying nothing

out loud. So, you know, silent speech detection, not your location, not your messages, the words

forming in your head before you speak them. QAI CEO is Aviad Meisels, probably mispronounced that

M-E-I-S-E-L-S, the same founder who sold PrimeSense to Apple in 2013, the same man whose technology

became Face ID. He described his vision like this, and I really want you to hear this sentence,

biology can only take us so far, QAI will do the rest. What comes after biology? When it comes to

extracting your inner monologue, a machine that reads your face to finish your...

Thoughts? Apple's official spin is that this will power smarter AirPods and a better Siri.

Maybe that's all it is, but let's be clear about what has been assembled acquisition by acquisition

over more than a decade. Three-dimensional facial mapping, real-time emotion detection,

advanced facial recognition, computer vision for public surveillance, and now technology that

decodes speech from micro-movements of your face without any sound at all. So whether Apple uses

it for advertising, for government cooperation, or simply keeps it locked on device as a feature,

the capability is being built piece by piece, year by year. So the device in your pocket is being

upgraded into a biometric surveillance platform with extraordinary sophistication. So the alternative

nobody wants to hear. I know what you're thinking. Okay, so I use Android. Android is Google. Google

is surveillance capitalism. How is that better? That's the right question. And the answer is

stock Android isn't better. The Android you buy at the carrier store with the Google services

baked in is absolutely a surveillance platform. Google knows where you are, what you search,

what you buy, who you talk to. But here's the crucial distinction between Apple's marketing,

you know, that has successfully kind of obscured. And then on Android, specifically on Google's

pixel hardware, the software and the hardware are, you know, are separable, is you can unlock the

bootloader, right, install a completely different operating system, then relock the bootloader. So

now validates the new OS. The cryptographic chain of trust is still intact, but what's running

underneath isn't.

different. That's what Graphene OS does. Graphene OS on a Google Pixel is currently the most

defensible consumer smartphone platform available. That's right. It's the hardest to spy on,

and it's built by Google, running software that removes Google entirely.

So what does Graphene OS actually give us? Memory protection that wipes sensitive data

immediately after use, closing entire classes of exploits. Hardened memory allocation that prevents

a heap of corruption attacks. That's oftentimes where they're exploited. It's within the memory.

Per-connection MAC address randomization that prevents network tracking, USB connection

blocking when the screen is locked at the hardware level, not just software. So no Google services,

no telemetry.

no cloud sync unless you explicitly configure it,

no iMessage equivalent attack surface.

Critically, it's open source.

Anyone can audit the code.

Every security patch is published,

and when Citizen Lab wants to verify a claim

about Graphene OS protections, they can read the source.

When they want to verify Apple's claims about,

air quotes, private cloud compute,

they're reading marketing copy and legal agreements.

Apple's code is proprietary, closed-sourced, and transparent,

you know, are not synonyms.

So security researcher, and I'm going to mess this up,

Stanislav Kogan put it plainly.

If a spyware vendor attempts to use a standard exploit chain

against a device running Graphene OS,

they must burn an entirely different exploit,

and one that is exponentially more scarce.

So the research and development cost is dramatically higher.

And practice...

you stop being worth the budget.

Graphene OS also lets you disable the cellular modem at the hardware level.

Your phone literally cannot communicate with a cell tower.

You can air gap applications completely,

give an app network permission for one session, then revoke it.

You can run Google Play apps in an isolated sandbox,

so even if you install something that would normally phone home,

it runs in a quarantine with no access to your real identity.

Yeah, you lose iMessage, you lose FaceTime,

the App Store ecosystem without workarounds,

and that's the real-world trade-off.

This isn't for everyone, right?

If your threat model is, I'm a journalist, I'm an activist, an NGO worker,

a lawyer with sensitive clients, a defense contractor, a politician,

anyone whose phone might be worth targeting

with a half a billion dollar spyware capability.

then iPhone isn't just insufficient.

It may be a liability.

So these are the types of things

that I think are oftentimes hard to communicate

when you're talking about a normal everyday person

who isn't one of those things

about trying to pick the best device that fits their life.

And sometimes in life,

you are required to use certain apps and certain devices.

That's not what we're talking about here.

Just wanted to break down the differences

between Apple's iPhone,

the marketing around privacy,

their actual security practices versus Android,

and then Graphene OS, AOSP running on a Google Pixel.

So QAI's tagline was beautiful.

In a world full of noise,

we craft a new kind of quiet.

I want to seal it forever.

a moment to make a different point. In a world where your phone is reading your facial micro

expressions, decoding your silent speech, transmitting your dictated messages beyond

the boundaries of end-to-end encryption, and maintaining a locked-down architecture that

happens to be a preferred platform for state-sponsored spyware, quiet is not what Apple

gives you. Quiet is what they sell you the feeling of. Real quiet requires a different kind of phone.

One you can verify, one that doesn't phone home, one where the attack surface has been systematically

stripped away by people who publish their work publicly, one when a spyware vendor runs their

standard exploit chain against your device, the engineers have to go back to the drawing

board. That quiet is unglamorous.

it doesn't come in obsidian or lemongrass it doesn't have a polished unboxing experience

it doesn't run automatically when you set it up with your apple id but it's real and in 2026

the rarest thing in the smartphone market is that it that it's real so that uh is

my kind of breakdown and comparison if there's anyone that you know in your life that has

asked questions or questioned why a graphene os operating system running on a phone built by

google versus an iphone which literally uses privacy as part of its tagline for selling

their hardware and their software send them this episode because it really

is that simple. It's one of the reasons why most malware and viruses are written for Microsoft

Windows operating systems versus macOS or Linux. It's not that you can't write malware or viruses

or that they can't be deployed on Linux or macOS. It's just that the user base is so big

with Microsoft Windows that it is financially a better return for the investment to write malware

and viruses for that platform. It doesn't mean they don't exist on other platforms. It's just

it's the largest target rich audience and that's really what comes down to with Apple iPhone

and with their latest acquisitions of these different companies that I had mentioned.

It seems that Apple wants to move in more of a surveillance of your face, your facial recognition,

your expressions more often.

than not and i'm curious to know what their plans are for the future for future rollouts as

age identity on-device os age verification are are being pushed to the forefront by by regulators

and legislators that maybe this is going to be part of that which is basically checking the

user of the phone initially before they even touch the screen i don't know for sure that's

going to be the case but it would make a lot of sense if that's the direction they were going

all of their devices with the exception of of their macbooks their ipads and their iphones use

face id as an option to unlock the device once these things are are baked into the operating

systems and they're standardizing their security and privacy features across all of their all of

their devices i.e ios mac os ipad os 26 standardization

It may be that that's actually the technology that they use going forward to check and verify

or guess the age of the person based on what the camera sees, what the camera detects as

they pick it up.

So that's just a quick little mini pod I wanted to get out because it's been on my mind and

I had put this script together from my notes from previous conversations.

And I hope that you found it valuable.

So I'm going to get ready to go have dinner and I will catch you in episode 55.

I'm going to get ready to go have dinner and I will catch you in episode 55.

I'm going to show you I'm with it.

I've been really happy you to sit and watch me win again and win again and win again.

I know it's probably getting on me.