Methodology¶
This is independent documentary research, not a security certification. Sources include specifications, public code, audits, academic papers, advisories, transparency reports and public legal records. Vendor statements are distinguished from independent evidence and explicit inference.
The conclusions are dated 14 October 2026, report 1.0. They do not automatically apply to other platforms, versions or settings. Limited passive DNS/BGP observations and source-manifest samples are not a production infrastructure audit.
Not performed: a comparative network laboratory, controlled forensic acquisition of current phones, complete current APK/IPA inspection, or bit-for-bit reproduction of distributed binaries. No port scanning or unauthorised access was performed.
Confidence is medium for well-documented protocol properties and explicitly published legal results, and low to medium for production metadata, version-specific calling, distributed builds, contemporary mobile forensics and censorship. Unknown remains Unknown.
The detailed evidence is maintained in the French Phase 2 register. The translation is a restatement, not new evidence.