The Wiretap in Your Pocket: A Beginner’s Guide to Mobile Operating System Alternatives

About 99% of smartphones run one of two operating systems: Google’s Android or Apple’s iOS. [1] The operating system is the layer under every app. It draws the screen, reads the keyboard, and talks to the radios. Swap the apps and you are still inside that layer. Swap the operating system and you change who holds the keys.

How a normal phone reports

Android ships Google inside. Play Services is not just the store. It is a system service with broad permissions, including location and device identifiers, and it talks to Google’s servers. The 2017 Quartz finding was specific: phones were sending the addresses of nearby cell towers with location services off and, in the tests, with no SIM card. Google ended that particular collection after it was published. [2]

Police can ask for Location History. If Location History is on, Google keeps a timeline of where the phone has been. US police have served geofence warrants: draw a circle on a map around a store or a protest, and ask Google for the phones that were inside. [3] [4] Innocent people get pulled in. NBC reported a Florida man who became a burglary suspect because a fitness app logged a bike ride past the house. [5]

On June 29, 2026, in Chatrie v. United States, the Supreme Court held 6 to 3 that police conduct a search when they obtain a person’s cell-phone location data from Google this way. An expectation of privacy still exists even though a company stored the data. The Court did not decide that this warrant was illegal. It sent that question, including whether the warrant was specific enough, back to the appeals court. [6] [7]

Apple is quieter. It is not mute. In 2022, researchers at Mysk found Apple’s own apps still sending usage data home with analytics turned off. The Verge reported it. [8]

What passes through them can be demanded. In 2023, Senator Ron Wyden said governments had been quietly collecting push-notification data from Apple and Google, because those alerts pass their servers. Reuters and 404 Media reported US warrants for the same kind of data. [9] [10] [11] In February 2025, Apple turned off Advanced Data Protection, its strongest iCloud encryption, for users in the UK rather than build the backdoor a secret UK order was reported to demand. Senators are still trying to make that order public. [12] [13] Apple’s 2021 plan to scan photos on the phone was dropped after a public fight. [14] Dropped is not the same as impossible to try again.

What encryption does not cover

End-to-end encryption stops the network and the chat company. It does not stop whoever controls the phone. The words have to appear on the screen in the clear so you can read them. The operating system owns the screen, the keyboard, and the memory. A malicious update, spyware, or a forensic tool on a seized phone can read what an app then encrypts for travel. Cellebrite sells that extraction as a normal product. [15] When Apple or Google says a message is end-to-end encrypted, read it as: other people on the wire cannot read it. Not: nobody who holds the handset can.

The wake word keeps the mic in the loop. “Hey Siri” and “Hey Google” only work if the phone is listening for that phrase. You can turn the feature off. While it is on, clips get stored and, in the programs revealed in 2019, contractors listened to them. Belgian reporters at VRT heard arguments, addresses, and medical details in more than a thousand Google Assistant recordings. The same year Bloomberg reported Amazon paying people to review Alexa clips, up to about a thousand per shift. That was not a break-in. It was the review desk. [16] [17] [18]

The radios notice the room. Android has switches named Wi-Fi scanning and Bluetooth scanning. Google’s own help page says they can keep looking for networks and devices to improve location even when Wi-Fi and Bluetooth look off. The path is Settings, Location, Location services. [22] Routers and Bluetooth gadgets broadcast hardware addresses. Match those to a map and a phone can be placed in a shop, not just a city. The New York Times reported retailers doing this with Wi-Fi pings in 2013. [19] Apple and Google’s COVID exposure notifications were a separate, opt-in system that swapped random Bluetooth IDs. They show a phone can notice other phones nearby. They are not a guest list Apple keeps of your living room.

Why the log matters later

A location log is a time capsule. Where you went, who was nearby, what you typed in a chat that was not end-to-end: stored now, readable under whatever rules exist in ten years. You are betting on the next government, not this one.

• Legal speech becomes a case file. After abortion restrictions, Nebraska prosecutors got a mother’s private Facebook messages from Meta and used them in a criminal case. [20]
• What they cannot subpoena, they can buy. A 2022 Homeland Security inspector general report found CBP, ICE, and the Secret Service bought commercial location data without the privacy policies that should have governed it. [21]
• One order hits every pocket on that platform. London or Cupertino can change the default for a billion phones. There is no exit inside the settings menu. The exit is a different operating system, on hardware that project actually supports.

Five systems you can actually install

All five are free and open source. “Best” here means the least painful fit, not a trophy.

System	Use it if	The catch
GrapheneOS	You have a Pixel and want the hardened one.	Pixels only, until Motorola hardware that meets its rules, aimed at 2027.
CalyxOS	You want ordinary apps, including banking, with less Google.	It went dark in 2025 and came back in July 2026. Check the device list.
LineageOS	Your phone is old, or not a Pixel.	Privacy extras are your job. It does not harden the phone for you.
/e/OS	You want a phone that already has it, and no command line.	Reviewed hardware has shipped well behind current Android.
Ubuntu Touch	You want nothing from Google or Apple in the stack.	Treat it as a second phone. Most banking apps will not run.

GrapheneOS

A hardened Android with Google removed from the base system. You can still run Play Store apps, locked in a sandbox, so the apps work without handing Google the rest of the phone. [23] [24] Today the official list is Google Pixels. GrapheneOS says a partnership with Motorola is aimed at 2027, starting with a non-folding flagship. Current 2026 Motorola phones do not meet the hardware bar, and reports differ on whether the 2027 phones will ship with GrapheneOS preinstalled. [25] [26]

CalyxOS

De-Googled Android that uses microG, an open stand-in so many normal apps still run. Firewall and private DNS tools come along. The project went on hiatus and, on July 1, 2026, said official releases were back, starting at version 7.2.2.0. If you were not already on their test build, they say you need a fresh install to get future updates. Supported hardware includes Pixels, Fairphones, and some Motorola models. Read the current list before you buy. [27] [28] [29]

LineageOS

The wide one. Community Android for a long list of models, which is how a phone the manufacturer abandoned can keep getting a system at all. Google is not required. Nothing here adds Graphene-style hardening for you. You are building the setup. [30] [31]

/e/OS, sold by Murena

The gentle on-ramp: its own store, an optional cloud, and phones that arrive with the system already on them. [32] [33] The cost can show up in updates: /e/OS builds have often been based on an older Android version than stock. Check the Android version and security patch level on the exact device before you trust it as a daily driver. [34]

Ubuntu Touch

GNU/Linux on a phone, kept up by the UBports Foundation. No Google, no Apple, its own open store, and a published device list. [35] [36] Banking apps and anything that expects Google Play will not be there. Use it when you can live with that, or as the phone you do not do banking on.

What a new OS does not touch

There is a second computer in the phone, and you did not install it. The cellular modem, the baseband, runs its own closed firmware and speaks to towers. On the Pixels GrapheneOS supports, that chip’s memory access is fenced off with an IOMMU, so a bug in the modem is not supposed to become a free pass into the main processor. GrapheneOS says this outright, and it also says the fence is not the same thing as trusting the modem. Google has been hardening the Pixel modem itself, with the Pixel 9 generation adding extra checks that restart the radio if code execution goes off the expected path. That is damage control. It is not a modem you can audit. [37] [38]

Your carrier still knows the phone. A different OS does not change the SIM, the number, or which tower you are standing under. Call detail, texts that are not end-to-end encrypted, and rough location from the network are the carrier’s records. GrapheneOS treats the cellular network as hostile on purpose: it strips carrier apps that stock Android gives extra power, it does not trust the tower for the clock, and it lets you turn 2G off even when the carrier tries to hide that switch. [39]

2G matters because it is the old generation. Google’s security team wrote in 2024 that Android 12 added a modem-level switch to disable 2G, first on Pixel, and that turning it off blocks a class of fake-tower text attacks that need 2G’s weak or empty encryption. Android’s Advanced Protection mode now forces 2G off on phones that support it. On iPhone, 2G is only switched off by turning on Lockdown Mode. Turning 2G off does not hide you from your real carrier. It removes the easy downgrade. [40] [41]

The network between carriers is old too. In 2014, researchers showed the signaling system phones use to find each other across companies could be abused to locate a handset and read texts that were not end-to-end encrypted. That system was not thrown out and replaced. An OS install does not move you off it. [42]

The lock that sends you back to stock Android

An iPhone cannot take another operating system. The five options above are for hardware that still lets you load one, mostly Pixels and a short list of other Android phones, plus Ubuntu Touch’s own list. If the phone in your pocket is an iPhone, the realistic move is a second device. There is no supported install path, and unsanctioned ones are how people end up with a worse phone.

Leaving the bootloader unlocked is a downgrade. Verified boot is what stops someone with five minutes and a cable from swapping the system for one that records your PIN. GrapheneOS is built so you can relock the bootloader onto its own keys after install. A lot of community ROMs leave it unlocked. You then have a “private” phone that is easier to tamper with than the stock one you left. [23]

Play Integrity is the leash. Banking apps, some government ID apps, and payment apps ask Google whether the phone is a certified, unmodified device running Google’s blessed software. GrapheneOS can be locked, up to date, and hardware-attested, and still fail that test, because Google did not certify it. The project will not ship a spoofer. Spoofing means root and an unlocked bootloader, Google can revoke the trick, and it deletes the reason you switched. What GrapheneOS asks app makers to do instead is allowlist its verified-boot keys in the normal hardware attestation API. A few will. Many will not. The future version of this is simple: the bank, the ticket window, and the tax office only talk to phones Apple or Google signed. Your private OS becomes the phone that cannot pay rent. [43]

microG is not “no Google.” CalyxOS uses it so ordinary apps keep working. It is an open reimplementation, and some features, such as push notifications, still go through Google’s servers. Read that before you tell yourself the umbilical cord is gone. [44]

A late patch loses to a current stock phone. Commercial spyware has entered phones through a message nobody tapped. The defense that has mattered in those cases is a patch level measured in days, not a logo. GrapheneOS ships security updates quickly and adds its own hardening. Any phone, private or not, that sits months behind on security patches is a softer target than an up-to-date one. If you are not going to update, do not switch. [34] [45]

What they can already store for later

A quantum computer that can break real encryption does not exist in public evidence. NSA uses a separate name for the one that would: a cryptographically relevant quantum computer. Small lab machines are not that. If one is built, NSA says it would undermine the public-key algorithms used to start secure sessions and to sign software. Making today’s RSA or elliptic-curve keys longer does not fix it. NSA says that too. The bulk cipher they still specify is AES-256. The part that ages badly is the handshake, not every scrambled byte. [46]

In August 2024, NIST published the replacements: ML-KEM for key establishment, and ML-DSA and SLH-DSA for signatures. Its transition notes tell organizations to start now, and they describe a cutoff around 2035 for retiring the quantum-vulnerable public-key algorithms, sooner where the secret has to stay secret for many years. The attack they are planning for has a plain name: harvest now, decrypt later. Record the encrypted traffic today. Break the key exchange when the machine exists. A chat about a protest, a medical note, a source’s name, pulled off a wire in 2026, is still useful in 2036. [47] [48]

A different OS does not add this protection. The app does. Signal’s PQXDH, shipped in 2023, mixes the current elliptic-curve handshake with a post-quantum one, so a recorder has to break both. Signal’s own writeup says this is aimed at a future machine decrypting recorded traffic, and that a quantum computer present during the chat is still an open problem. Apple’s PQ3, in iMessage from 2024, does a post-quantum handshake and keeps rekeying as the conversation goes. SMS, ordinary email, and a lot of “private” webmail do none of this. If the message matters for a decade, the OS you installed is the wrong layer to worry about. [49] [50]

So are the five any good?

• GrapheneOS on a current Pixel, bootloader relocked, is the one that matches the threat model in this article: fast patches, a sandboxed Play Store, a modem that is at least fenced off, and a 2G switch the carrier cannot bury. You will lose some banks. That is the point of Play Integrity, not a bug in your install.
• CalyxOS is reasonable if you need more apps and you accept microG and a project that already went silent once. Confirm the device is on the July 2026 line or newer before you trust it.
• LineageOS is how a dead phone keeps breathing. It is not a hardened phone unless you make it one, and an unlocked bootloader can leave you worse off than stock.
• /e/OS is the least frightening install. Check the Android version and patch level on the device in your hand before you rely on it.
• Ubuntu Touch is the clean break, and the smallest life. Use it when you can live without the apps, not as a surprise daily driver.

None of them hide you from the tower, the SIM, or a recording of last year’s handshake. They change who can push code into the part of the phone that shows you the message. That is worth an afternoon. It is not a cloak.

Switching without bricking the week

• Buy from the project’s own device list, not a forum comment. An unsupported phone gets no security patches. You traded a surveillance problem for a theft problem.
• Use the official installer. GrapheneOS and CalyxOS both have web installers. Unlocking the bootloader wipes the phone. Back up first, and expect an afternoon, not a button.
• You do not have to suffer. A de-Googled phone for the day, and the old one in a drawer for the two apps that refuse to run, is a normal setup.

Staying on stock is the easy default. An afternoon is the whole price of changing it.

---

Sources

1. [1] StatCounter: mobile OS share worldwide
2. [2] Quartz, Nov. 2017: Android location collection with services off
3. [3] The Markup, 2020: what geofence warrants are
4. [4] The Guardian, 2021: police mining Google location data
5. [5] NBC News, 2020: the bike ride that made a man a suspect
6. [6] Supreme Court, June 29, 2026: Chatrie v. United States
7. [7] SCOTUSblog: Chatrie case page, 6 to 3
8. [8] The Verge, 2022: Mysk on Apple analytics
9. [9] Sen. Ron Wyden, Dec. 2023: push-notification surveillance
10. [10] Reuters, Dec. 2023: governments and push notifications
11. [11] 404 Media, Dec. 2023: a US warrant for push data
12. [12] Reuters, Feb. 2025: Apple pulls Advanced Data Protection in the UK
13. [13] Wyden and Davidson: the reported UK backdoor demand
14. [14] EFF: Apple’s on-phone scanning plan
15. [15] Cellebrite: phone extraction product page
16. [16] VRT NWS, 2019: Google Assistant recordings
17. [17] The Verge, 2019: contractors listening to Assistant
18. [18] Bloomberg, 2019: Alexa review teams
19. [19] The New York Times, 2013: stores tracking phones by Wi-Fi
20. [20] ABA Journal, 2022: Facebook messages in a Nebraska case
21. [21] DHS inspector general, Sept. 2022: CBP, ICE, and Secret Service buying location data
22. [22] Google: Wi-Fi and Bluetooth scanning
23. [23] GrapheneOS: project site
24. [24] GrapheneOS: features, including sandboxed Google Play
25. [25] GrapheneOS forum: Motorola partnership
26. [26] GrapheneOS, 2026: 2027 Motorola hardware, non-folding first
27. [27] CalyxOS: project site
28. [28] CalyxOS: current devices and versions
29. [29] CalyxOS, July 1, 2026: official releases are back
30. [30] LineageOS: project site
31. [31] LineageOS: supported devices
32. [32] /e/ Foundation: project site
33. [33] Murena: phones and cloud
34. [34] Ars Technica, 2025: Murena tablet, two Android versions behind
35. [35] UBports: Ubuntu Touch
36. [36] Ubuntu Touch: device list
37. [37] GrapheneOS FAQ: baseband isolation
38. [38] Google security blog, Oct. 2024: Pixel modem hardening
39. [39] GrapheneOS FAQ: cellular tracking, interception, and the 2G toggle
40. [40] Google security blog, Aug. 2024: disabling 2G at the modem
41. [41] Google: Advanced Protection turns 2G off on supported phones
42. [42] The Washington Post, Dec. 2014: the carrier signaling flaw used to track phones and read unencrypted texts
43. [43] GrapheneOS: how apps can allow a private OS instead of using Play Integrity
44. [44] microG: the open stand-in CalyxOS uses, which still talks to Google for several services
45. [45] Citizen Lab, 2021: commercial spyware that did not need a tap
46. [46] NSA, CNSA 2.0 FAQ (Dec. 2024 update): what a cryptographically relevant quantum computer would break, and what AES-256 still covers
47. [47] NIST: post-quantum standards, including the August 2024 FIPS releases
48. [48] NIST IR 8547 initial public draft: transition plan and harvest-now, decrypt-later
49. [49] Signal, Sept. 2023: PQXDH, the hybrid handshake
50. [50] Apple Security Research, 2024: iMessage PQ3