Why secure communications remain a human problem

For years, government communications operated within a fairly clear set of boundaries. Official business happened on official systems. Employees had government phones, government email accounts and government networks. Personal communications happened somewhere else.

The arrangement was never perfect, but it created separation. If a federal employee picked up a government-issued device, there was little ambiguity about which rules applied, what information belonged there and what responsibilities came with using it.

Technology gradually erased many of those distinctions.

Today, the same device can carry a family text message, a boarding pass, a bank alert and a discussion involving sensitive government business. Smartphones collapsed activities that once lived in separate spaces, and most people adapted without giving it much thought.

That shift helps explain why debates over secure communications keep resurfacing. The names of the applications change. The concerns rarely do.

“There’s just a human tendency to think, I’m just going to use the same app that I use for everything,” said David Wiseman, vice president of secure communications for BlackBerry.

Most users do not choose communications platforms by studying security architecture. They choose what is familiar, widely available and easy to use. When one option requires extra effort and another does not, convenience usually wins.

Security and convenience rarely move in the same direction

Systems designed to protect sensitive information often require additional authentication, separation between personal and official activities, and controls that users experience as friction. Those safeguards serve important purposes, but they compete with the desire to complete a task quickly and move on.

Wiseman described the cycle as a version of “Groundhog Day.” New communications platforms emerge, people adopt them, security concerns follow and organizations respond. Then the process begins again.

“There’s a price to convenience. There’s a risk to perceived convenience,” Wiseman said. “At the end of the day, how convenient is it when it actually comes out … that your account had been hacked for a six-month window? That’s not very convenient.”

Much of the public discussion around secure messaging focuses on encryption. Wiseman argues that the larger challenge is establishing who is communicating, preserving records when required by law and maintaining accountability for official actions. Those obligations do not disappear simply because a message is private.

The growth of bring-your-own-device programs has made those responsibilities harder to manage. As personal and official communications increasingly share the same devices and applications, employees are left navigating boundaries that technology once enforced. Most are not trying to bypass security requirements. They are trying to keep work moving.

Compliance works better when technology does the work

The same tension appears in records management.

Policies can tell employees which communications must be preserved and training can explain retention requirements, but neither changes the reality that recordkeeping is rarely the most urgent task confronting a busy employee.

“I think asking people to manage it themselves is a bit of a joke,” Wiseman said.

His point was not that employees are unwilling to comply. Rather, systems tend to produce better results when compliance is built into the technology instead of depending on users to remember additional administrative steps.

That philosophy reflects a broader lesson about security. Organizations generally achieve more when they design controls around expected human behavior than when they expect human behavior to adapt to security controls.

Government has invested heavily in protecting networks and information. Wiseman said agencies also need tools that employees will consistently choose to use. When approved systems create obstacles that commercial applications avoid, workers will naturally gravitate toward alternatives.

Recreate the boundary

The same thinking informs one of his most practical recommendations: Keep official communications in a separate environment.

“Whatever messaging environment you’re going to use for official communications, it should absolutely be different than the one you’re using for personal communications,” he said. “It helps remind you: I’m opening this app because I’m doing government business.”

Separate applications do more than isolate data. They create a clear signal that different responsibilities apply. Simply entering a designated workspace can reinforce expectations about security, accountability and recordkeeping.

Technology changes. Human behavior doesn’t.

Wiseman does not expect the underlying debate to disappear.

“Maybe some of the apps will be different. But the core things we’re talking about around identity, around personal behavior, around records management, none of that changes,” he said. “It’s an ongoing aspect of how we communicate and how we do business.”

New communications platforms will continue to emerge, and security teams will continue responding to new threats. But the recurring challenge is older than any particular technology.

People tend to rely on familiar tools, especially when work is moving quickly and the risks associated with a security lapse feel remote. That reality is unlikely to change.

For security leaders, the objective is not to change human nature. It is to build communications systems that account for it.

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.