A phone at 4 percent in an airport, and a free charging kiosk a few steps away. The National Security Agency’s mobile checklist leaves no room for negotiation on that one: “DO NOT use public USB charging stations.” The line comes from the agency’s Mobile Device Best Practices information sheet, dated October 2020 and marked revision 1.1.
Read next on Morning Overview: Arizona’s governor declared a statewide emergency after Flagstaff logged its wettest Nov. 1 on record
A second instruction sits a few bullets away and costs nothing at all. Owners are told to power the device off and on weekly. Between them, the two items say a lot about how the agency thinks ordinary phone habits turn into openings for attackers.
The public charging port and the cable behind it
The wording in the NSA information sheet is capitalized and absolute, and it comes paired with a milder instruction about equipment: use original cords and accessories from a trusted manufacturer. A USB cable carries data as well as power, so a port in a hotel lobby or shopping center is a connection to something the phone’s owner did not set up and cannot inspect.
The FBI’s Denver field office made the same point in a widely reported post. According to CNBC’s account, the office urged people to avoid free charging stations in airports, hotels or shopping centers, and described a scheme often called juice jacking, in which criminals tamper with public USB ports or cables to install malware or monitoring software. CNBC adds that the FCC has warned about the practice since 2021.
Weekly power cycling, listed without an explanation
The restart rule is the most unusual entry for casual readers. The sheet states it in six words: “Power the device off and on weekly.” The portion of the document reviewed for this article gives the instruction as a plain item and does not spell out a technical rationale beside it, so the reason is left to the reader. What can be said is that it appears in the same document as advice on updates, minimal apps and avoiding unknown links, which points to a general hygiene purpose.
The habit is easy to adopt. Many people go weeks without ever fully shutting a phone down, because sleep and wake feel like power cycling when they are not. A weekly calendar nudge is enough, and it fits naturally alongside installing pending updates, which the same sheet asks users to do as soon as possible.
The practical substitute for a kiosk is the wall outlet. The FBI office’s advice, as CNBC reports it, was to bring a personal charger and USB cord and plug into an electrical outlet instead, which keeps the data pins out of the picture entirely. A small battery pack carried in a bag does the same job, and the NSA’s guidance on trusted-manufacturer accessories applies equally to the pack and its cable.
The rest of the checklist around those two lines
Other entries fill in the picture of a device kept under tight control. The sheet recommends installing only a minimal number of apps, and only from official stores, and it advises against jailbreaking or rooting. It tells readers not to open unknown attachments or links, even from senders who seem legitimate, since accounts can be compromised or impersonated. Unexpected pop-ups are to be treated as likely malicious, with every application force-closed if one appears.
Physical habits count too. The document suggests covering the camera when idle, considering a case that blocks the microphone against so-called hot-miking attacks, keeping the phone under personal control, and avoiding unknown removable media. For passcodes, it calls a six-digit PIN sufficient if the device wipes itself after 10 incorrect attempts, with automatic locking after five minutes.
One more entry bears on the charging question. Never connecting personal devices to government computers by cable, Wi-Fi or Bluetooth is spelled out as a rule, which treats a computer’s USB port as a two-way street in the same way the public kiosk is. The sheet applies one idea to both: any cable joining the phone to equipment outside the owner’s control is a risk worth refusing.
On the agency’s telework and mobile security page, the agency pitches the entry as practical guidance for keeping a phone and the data on it safer. The page itself was last updated in August 2020 and lists the sheet under a September 2021 label, so the advice is not new, and some mitigations may read differently on current handsets. NPR also ran a piece in April 2023 under the question of whether juice jackers might come for phone owners.
The same agency’s July 2021 release on wireless devices in public settings was aimed at defense teleworkers, which is the audience for most of this material. The disclaimer in the checklist says the guidance is provided as is, without warranties, so the sensible reading is as a set of precautions weighted toward people with something valuable to protect, rather than a promise that any single step blocks an attack.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- A handful of car transmissions are so tough that mechanics say they almost never die
- Melting permafrost is setting off a newly identified kind of catastrophic landslide, scientists say
- Cadillac cut the price of its cheapest EV, which goes up to 317 miles on a charge
- Winter weather advisories cover I-80, I-70 and the Bighorns with up to 15 inches of snow
