Before hitting send on your next text, consider the security of your message. It's advisable to opt for end-to-end encryption to enhance privacy. Many people rely on messaging services from tech giants like Apple, Alphabet, and Meta Platforms, which include iMessage, Google Messages, WhatsApp, and SMS.

However, the level of security provided by these services can vary significantly. The U.S. government has raised concerns following a recent massive cyberattack on the country's largest telecommunications companies. In the previous month, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) exposed a cyber campaign by Chinese-linked hackers, known as Salt Typhoon, which targeted AT&T, Verizon, and others, marking one of the most extensive hacks of U.S. infrastructure in history. Following this revelation, CISA, the National Security Agency, the FBI, and international partners released a joint guide to assist Americans in protecting their digital communications. One key recommendation is the adoption of end-to-end encryption, a technique that bolsters the security of messages.

End-to-end encryption ensures that only the intended recipients can decrypt and read your messages as they are transmitted between devices. Secure messaging applications utilize this encryption method to safeguard communications from interception by hackers, surveillance, and unauthorized access, ensuring that even the service providers themselves cannot access the content of the messages. "Given the choice, you should always prefer a platform that offers end-to-end encryption," suggests Michael Hughes, the chief business officer at Duality Technologies, a company specializing in secure data sharing and analysis through encryption.

Many users are unaware of the secure communication options available through messaging apps. Here's a breakdown of the essentials. WhatsApp and Signal are among the top choices for end-to-end encryption, as this feature is integrated into their design. This makes them a more secure option compared to SMS and MMS, which do not provide end-to-end encryption, according to Trevor Horwitz, founder of TrustNet, a provider of cybersecurity and compliance services.

Even the most secure end-to-end encrypted platforms have their drawbacks. Signal, favored by privacy advocates for its commitment to not collecting or storing sensitive data, can be less appealing due to its limited user base. If your contacts aren't on Signal, communication is not possible, notes Roger Grimes, an analyst at KnowBe4, a security platform provider. There are also paid messaging apps like Threema that offer end-to-end encryption by design, requiring no phone number or email for registration, but they come at a cost and may face challenges in attracting users when free, popular alternatives exist.

Most individuals will embrace encryption "if it's the default setting and there's no inconvenience," Grimes remarks.

RCS and iMessage are two messaging protocols that many platforms now employ. RCS, or Rich Communication Services, is an advancement over SMS and MMS, offering enhanced features and the potential for end-to-end encryption, though not as a standard feature on all devices. For instance, Google Messages automatically upgrades RCS messages to end-to-end encryption, but Apple's implementation of RCS on iPhones does not support end-to-end encryption, as explained by Horwitz. For Apple device users, the proprietary iMessage app is end-to-end encrypted, but for those sending RCS messages through other text plans, such as a mobile carrier's text option, end-to-end encryption is not an option. Apple itself states that messages sent through non-iMessage RCS options "are not protected from third-party interception while in transit between devices."

Furthermore, not all devices are compatible with RCS, and it is not universally supported by carriers. There are also ongoing compatibility issues between some iPhone and Android devices, according to Horwitz.

The encryption landscape is further complicated by the fact that tech companies offer multiple messaging products, and not all applications from a single provider support end-to-end encryption in the same manner. Facebook Messenger, for example, offers end-to-end encrypted messages, but this is not the case for all its features. Facebook states that certain products, such as community chats for Facebook groups, chats with businesses, or accounts using business messaging tools, do not currently support end-to-end encryption. Consumers should delve deeper into the apps they use to understand the specifics of end-to-end encryption, advises Deirdre Connolly, a cryptography standardization research engineer at SandboxAQ, an AI applications developer. This information is typically found in the support or privacy sections of a provider's website, but it can be challenging to locate and interpret.

The encryption policies of Google and Apple also differ. Google Messages, the default messaging app on many Android devices, supports end-to-end encryption when messaging other Google Messages users over RCS. However, messages sent to iPhone users are not end-to-end encrypted. In Apple's case, communications between two iMessage users are end-to-end encrypted, but since iMessage is exclusive to Apple, communications between iMessage users and Android device users are not end-to-end encrypted. A green message bubble indicates that the message was sent using MMS/SMS instead of iMessage.

The Department of Justice's antitrust case against Apple also highlights the lack of end-to-end encryption outside of its iOS messaging app as a monopolistic concern. Efforts are underway to develop protocols that enable end-to-end encryption across different communication platforms using RCS, but this is still in progress. "Collaboration with key industry stakeholders is advancing well, and we anticipate updates for the market in the coming months," said a spokesperson for the GSMA, an industry organization leading this initiative.

Users should also check their phone settings, as many may have older phones that miss critical security updates if auto-updates are not enabled, which could include messaging apps with end-to-end encryption capabilities, according to Chris Henderson, senior director of threat operations at Huntress, a cybersecurity firm. Additionally, settings from transferred apps may not carry over to a new phone. If end-to-end encryption was enabled on a previous device, it's wise to verify that the settings are active on the new device as well.

End-to-end encryption is not infallible, as hackers can still intercept communications through other means, such as by compromising the device itself, Horwitz points out. For security, it's crucial to maintain device health by installing all software updates, avoiding dubious downloads, and performing periodic reboots.

Nevertheless, employing end-to-end encryption is a prudent practice whenever it's available. "Threat actors target where the majority of users are," said Kory Daniels, global CISO for Trustwave, a provider of cybersecurity and managed security services. "If the majority continues to use unencrypted communication methods, malicious actors will keep exploiting these vulnerabilities until users adapt their digital behaviors."