The NSA still tells every phone owner to switch off one setting most people leave on

One of the most consistent pieces of advice the National Security Agency gives ordinary smartphone owners has nothing to do with spy craft and everything to do with a toggle sitting in plain sight on every phone. The agency’s mobile security guidance urges people to switch off Bluetooth whenever they are not actively using it, a setting most users leave on around the clock without a second thought. The recommendation is not new, but it has quietly endured across years of updated threats, and it reflects a simple principle: a wireless connection left open is a door left unlocked.

The guidance is aimed at everyone, not just officials handling sensitive information. It appears in a plainly written set of best practices meant for the general public, and Bluetooth is only one item on a longer list of habits the agency says can meaningfully reduce a phone’s exposure.

The specific setting the agency flags

The advice comes from the NSA’s Mobile Device Best Practices, a concise guide that lays out steps smartphone owners can take to harden their devices against common attacks. Among its recommendations is to disable Bluetooth when it is not in use, alongside similar guidance to turn off Wi-Fi and near-field communication when those are not needed. The reasoning is that each active radio is a potential avenue for an attacker to detect, connect to, or exploit a device, and that leaving them all on continuously widens the attack surface for no real benefit when the features are idle. The document is written for a broad audience and does not assume any special technical background.

Why an open Bluetooth connection is a risk

Bluetooth is designed for convenience, pairing headphones, speakers, car systems, and wearables with minimal friction, and that convenience is exactly what makes it a target. A phone with Bluetooth enabled is broadcasting its presence and, in some configurations, is discoverable to nearby devices. Over the years, researchers have documented a series of vulnerabilities in Bluetooth implementations that could allow eavesdropping, tracking, or in some cases the delivery of malicious code, several of which required no action from the victim beyond having the radio switched on. Turning Bluetooth off when it is not in use removes that exposure entirely for the periods it is disabled, which for most people is the majority of the day.

The rest of the checklist

Disabling Bluetooth is one line in a broader set of habits the agency recommends. The same guidance advises keeping the operating system and apps updated as soon as patches are available, using a strong screen lock, being cautious about public Wi-Fi, and disabling location services when they are not needed. Perhaps the most widely cited item is a recommendation to power the phone completely off and back on at least once a week. As Forbes has reported, that weekly reboot is meant to disrupt certain sophisticated attacks, including so-called zero-click exploits that can compromise a device without the owner tapping anything, since many such intrusions do not survive a restart. None of these steps is a cure-all, and the agency is explicit that layered habits, not any single action, are what improve a phone’s resilience.

Why the advice has stayed the same

The durability of the recommendation is itself telling. Phones, operating systems, and threats have all evolved, yet the counsel to close down idle wireless radios has remained a fixture because the underlying logic does not depend on any particular exploit. It is a matter of minimizing exposure, a defensive posture that holds up regardless of which specific vulnerability is making news. That is also why the guidance applies equally to iPhone and Android users; it targets behavior common to both platforms rather than a flaw unique to one. For a setting that takes seconds to change, the trade-off the agency describes is modest: a brief reconnection when a user next wants their earbuds, in exchange for shutting a persistent, low-effort avenue of attack.

Putting the recommendation to use

Acting on the advice requires no special software. Both major mobile platforms expose Bluetooth, Wi-Fi, and location toggles in their quick-settings menus, making it straightforward to switch a radio off when it is not serving a purpose and back on when it is. For people who rely on Bluetooth constantly, through a car, a smartwatch, or hearing aids, the practical takeaway is narrower but still useful: disable it in unfamiliar public settings where the convenience is not needed. The larger point the agency keeps returning to is that small, repeatable habits, applied consistently, do more for everyday phone security than any one dramatic measure.

Advice that reaches beyond one radio

Security specialists who have summarized the guidance note that its strength lies in being unglamorous and universal, a set of steps any owner can apply without buying anything. A walkthrough by PhoneArena laid out the same core measures, from powering the device down weekly to switching off idle wireless connections and keeping software current. The recurring theme is exposure management: every feature left running when it is not needed is a small opening, and closing those openings costs the user almost nothing. For a threat landscape that keeps changing, the agency’s bet is that durable habits outperform reactive fixes.

This article was produced with AI assistance and reviewed by Morning Overview editors.

More from Morning Overview