The NSA wants you to turn your phone off once a week

Turn it off and on again. The National Security Agency put it in writing. Its guide for people's personal phones spends one line on the subject, "Power the device off and on weekly."

That guide dates to October 2020, and every headline since about the NSA wanting you to reboot has pointed back at the same two-page PDF. Nothing newer has replaced it.

What a restart clears

Your phone runs two kinds of things. Stuff that's installed, which lives in storage, and stuff that's running, which lives in memory. A restart empties the memory and reloads everything from storage. Anything that existed only in memory is gone.

The most expensive spyware aimed at phones has learned to avoid installing itself at all, because installed things get found. Kaspersky's researchers, picking apart a 2023 iPhone campaign, wrote that "the malicious toolset does not support persistence" and that infected phones "may be reinfected after rebooting." Amnesty's lab found the same pattern with Pegasus, and hedges it. Its investigations "seem to suggest that Pegasus is no longer maintaining persistence on iOS devices." Those attackers are betting you never turn the phone off. An NSA official told the Associated Press it was "all about imposing cost on these malicious actors."

The NSA's chart is modest about it. The weekly power-off sits in the "Sometimes prevents" tier, and it's marked only against the attacks that involve getting code onto the phone in the first place.

The everyday reason is less dramatic and more likely to affect you. Memory fills with leftovers. Apps misbehave. Apple and Google both list restarting among the first things to try for a frozen or flaky phone, and Samsung's own page says "A more thorough way to clean the phone's memory is to reboot it occasionally." The weekly restart is the one you do so you don't end up doing the panicked one.

Your phone may already be doing some of this

Apple added an automatic restart in iOS 18.1 that fires when an iPhone stays locked for "a prolonged period," in Apple's words, and "purges sensitive security keys and transient data from memory." Google documents a 72-hour "Inactivity Reboot" on Android 16, but only inside its Advanced Protection bundle, which also blocks app installs from unknown sources and several other things.

Neither one does the weekly job for you. Both wait for the phone to sit locked for days. A phone you pick up every morning never gets there.

How to do it

Before you start, know your passcode. After any restart, Face ID, Touch ID, and fingerprint unlock are off until you type it once. Apple, Google, and Samsung all say so. It's normal, and it catches people who haven't typed the code in a year.

iPhone with Face ID. Hold either volume button and the side button until the power-off slider appears. Drag it. Wait for the screen to go dark, then hold the side button until the Apple logo shows. There's also a no-buttons route at Settings, then General, then Shut Down.

iPhone with a Home button. Hold the side button until the slider appears, drag it, then hold the side button again to turn it back on.

Pixel 6 and later. Hold the power button and the volume up button together for a few seconds, then tap 'Restart' or 'Power off'. On a Pixel 5a or earlier, hold the power button by itself.

Samsung. Hold the side button and the volume down button together until the power menu appears, then tap 'Restart' or 'Power off'. Or swipe down from the top with two fingers and tap the power icon in the corner. If you'd rather not remember any of that, Samsung will do it on a schedule. Open Settings, then Device care, then Auto optimization, then Auto restart, and pick 'Restart on schedule'. On older phones the first step is called Battery and device care.

Neither Apple nor Google documents a scheduled restart. Those two are by hand.

What it doesn't do

A restart doesn't remove an app you were tricked into installing, and it doesn't undo a password somebody stole. The NSA's own list puts updates above reboots, and the 2023 iPhone spyware went so far as to break the software update. If you do one thing, install the update. If you do two, restart afterward.

Swiping your apps closed every night isn't a substitute either. Apple says to close an app "only if it's unresponsive," and Google says "Even if you don't close apps, you won't run out of memory or battery." Swiping apps away doesn't reload anything.

The Sunday routine

Pick a moment when the phone is in your hand, since you'll want to type the passcode when it comes back. Restart it. Unlock it. That's the whole routine, and the phone you pick up Monday morning is running what you installed on it and nothing more.

When did you last turn yours all the way off? I'm guessing most people can't remember, and I'd like to know if I'm wrong. joel@freshfromcache.com