Thought. Active defense system. The forensic tools are usually connected to the phone via USB port. What about building in a little high-voltage generator, something like a shrunk-down photoflash, which in case of attempted forensic access charges a capacitor and then discharges it into the USB port data lines? If nothing more, it will fry the interface chip in the forensic box and take it out of commission for couple days. Few microfarads at few 100s volts (or maybe even few 10s, we need to protect our own phone's internals with physically small circuits) will do a good job here. The ESD protection networks on chips have just few square micrometers and they fry easily. The external ESD diode networks are a tougher nut (MUCH bigger thermal mass, fewer size-performance compromises) and can absorb more energy but ultimately even they can be fried by depositing enough energy in shorter time than it takes for it to dissipate from the silicon die.
This can be countered with beefed-up ESD protection in the forensic reader,but will take time and money to deploy.
A phone can have multiple personalities. A NFC reader in a phone can look for the presence of a chip implanted in the operator's hand (see Amal Graafstra's work) and use it to determine if it should show certain locked items in the directory or it should keep them for itself. Hand the phone over to a cop, and the cop sees sanitized version. Get it back in your hand, and the hidden icons and addressbook items pop back into view.
Re POCSAG modules, what about a standalone module either hardwired to the phone or linked via Bluetooth (with caution about opening the data link to remote detection and usual SIGINT/ELINT unpleasantness)?
The paging app should also work with wifi VoIP solutions, so the call back can be done from e.g. a coffee shop's wifi or any open node. Should also support an equivalent of SMS messages, so instead of a call the reply can be composed at leisure and then sent away from the nearest open wifi the user walks around. Randomizing the wifi module's MAC address per connection is also a good add-on here.
Thought: A wearable directional antenna array for wifi. A vest with flat patch antennas, each with its own configurable delay line. In a way the electronically steerable radars use for decades, it can be made as directional as possible and track a moving target (when you are in a bus, a wifi in a building counts as a moving target). Anybody working here on radars who could advise about how complex the multiple-element steerable antennas are? There is some noise about making these "smart antennas" standard for cellphones and other stuff, as a way to conserve spectrum (by allowing sharing it spatially), but it goes on rather quietly for rather too long.