Bluetooth, Wi-Fi, location: the NSA says switch all three off when not in use

Three switches on a phone’s settings screen stay on all day for most owners: Bluetooth, Wi-Fi and location. The National Security Agency’s mobile guidance asks people to turn each of them off whenever it is not doing a job. The advice sits in an information sheet that the agency labels Mobile Device Best Practices, dated October 2020 and marked revision 1.1, and it remains the document NSA posts for end users.

Read next on Morning Overview: Shaq spent $1.3 million on three Rolls-Royce Phantoms to prove a point to a salesman

It reads less like a threat briefing than a short list of habits. Each of the three items closes a radio that a nearby attacker, an app or an advertising network could otherwise use, and none of them costs money or needs special software.

Bluetooth and the airplane-mode gap

The NSA information sheet tells readers to disable Bluetooth when it is not in use. It then adds a caution that catches many people out: “Airplane mode does not always disable Bluetooth®.” A traveler who flips airplane mode on and assumes every radio went quiet may still have a Bluetooth connection active, depending on the handset and what was reconnected afterward.

The practical reading is that the Bluetooth toggle itself, not airplane mode, is the reliable off switch. NSA’s wireless-security work has long treated the short-range radio as an attack surface. In a 2021 release on securing wireless devices in public settings, the agency warned that cyber actors can compromise devices over Bluetooth, public Wi-Fi and near-field communications, and said its minimum recommendation was to disable Wi-Fi, Bluetooth and NFC when not in use.

Wi-Fi: public networks and saved ones

For wireless networking the information sheet gives two instructions. One is to avoid connecting to public Wi-Fi at all. The other is the short line “Disable Wi-Fi when unneeded.” It also recommends deleting networks the phone no longer uses, because a handset that remembers an old network name may try to rejoin anything that broadcasts it.

The 2021 public-settings sheet goes further for people who cannot avoid hotspots. It points to a personal or corporate mobile hotspot with strong authentication and encryption as the better choice, and to a VPN supplied personally or by an employer when public Wi-Fi is unavoidable. Those materials were written for national security system, Defense Department and defense contractor teleworkers, so the tone is stricter than a typical consumer tip.

Reading the three together shows the logic: each setting governs a way for something outside the phone to find it, talk to it or watch where it goes. Turning a radio off removes that path until the owner chooses otherwise, which is why the sheet treats the off position as the default and the on position as the exception to be justified.

Location services and what an app can learn

On location, NSA’s wording is direct: “Disable location services when not needed.” The sheet also recommends keeping the device away from sensitive locations altogether, a line aimed at government and contractor staff but easy to apply elsewhere. A phone that reports where it sits is a record of home, work and routine, and that record can be collected by apps with location permission.

The setting is easy to reach on an iPhone. Apple’s support page explains that opening Settings, then Privacy and Security, then Location Services lets an owner switch location off for every app, or choose Never for a single app. Apple also warns that some apps may not work without it, which is the real cost: maps and ride-hailing need it, while many other apps do not.

Limits of the three-switch habit

The three settings sit inside a longer checklist. The same information sheet advises weekly restarts, updates as soon as possible, a minimal set of apps from official stores, and no jailbreaking. It also carries a disclaimer that the material is provided as is, without warranties, so it is guidance rather than a guarantee. A threat matrix in the document rates each mitigation as almost always preventing, sometimes preventing, or not preventing a given attack.

Context matters as well. NSA’s telework and mobile security page lists the sheet among end-user products and describes its aim as steps users may take to better protect their devices and data. The page was last updated in August 2020, and the mobile entry is labeled September 2021, so the guidance is several years old. Operating systems have changed since, and the agency has not published a replacement on that page. Its broader advisories and guidance library is the place to check for newer material.

For a phone used mostly at home on a trusted network, the benefit of toggling Wi-Fi is small and the inconvenience real. The value grows when travelling, at conferences or anywhere a stranger might sit within radio range. Even then, the NSA sheet frames the choice as weighing risk, and nothing in it claims that three switches make a phone safe on their own.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.