Topic starter
01/08/2026 8:56 pm
TL;DR: Encrypted mobile telemetry can still be recovered when the keys live in the client, according to NowSecure. Mobile SDK governance then has to cover runtime collection and device-wide scope, not just app review.
Editorial analysis by NHI Mgmt Group, based on content published by NowSecure: “1-in-2 phones sold in Africa exfiltrate telemetry to China”.
Key questions
Q: Why is encrypted mobile telemetry still a governance risk if the traffic is protected in transit?
A: Because transport encryption only helps if the keys stay out of the client and out of runtime memory.
Q: Where do mobile SDK controls fail when telemetry is embedded in privileged system apps?
A: They fail at the boundary between app-level trust and device-level privilege.
Q: How should security teams govern mobile SDK telemetry that reaches beyond a single app?
A: Treat mobile telemetry as a collection-scope problem, not just an app-security problem.
Practitioner guidance
- Validate telemetry at runtime Instrument representative devices and confirm what SDKs actually send, including app inventory, location, camera events and identifiers, rather than relying on code review alone.
- Classify system-signed SDKs as device-wide collectors Require extra governance for any telemetry component embedded in privileged apps or system partitions, because its collection scope exceeds the host app boundary.
- Review mobile SDK key management Check whether telemetry encryption keys, IVs or config bundles are recoverable from the client, firmware or memory, then treat those flows as exposed if they are.
Bottom line: Mobile telemetry can become device-wide when a privileged SDK collects across apps, not just inside the host app.
Glossary terms: Telemetry SDK, System-signed App, Client-side Key Material, Device-wide Collection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 hours ago by NHI Mgmt Group
01/08/2026 9:04 pm
Device-wide telemetry is the real governance boundary: once a mobile SDK runs inside privileged system components, the question is no longer which app it belongs to, but what the device can now observe and transmit. That shifts oversight from app approval to collection-scope governance, especially where a single framework sees installed apps, foreground state, location and hardware identifiers. Practitioners should treat system-signed telemetry as a separate control domain.
A question worth separating out:
Q: What should organisations check before allowing apps with embedded analytics or telemetry SDKs?
A: Check what the SDK collects at runtime, where the keys live, which system permissions it inherits, and whether the same telemetry plane exists in other apps or firmware builds. That is the practical test for whether the collection is app-scoped or device-wide.
👉 Read our full editorial: Transsion telemetry shows how mobile SDKs become device-wide risk