Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Privacy

Signal Head Defends Messaging App's Security After US War Plan Leak (yahoo.com) 161

The president of Signal defended the messaging app's security on Wednesday after top Trump administration officials mistakenly included a journalist in an encrypted chatroom they used to discuss looming U.S. military action against Yemen's Houthis. For a report: Signal's Meredith Whittaker did not directly address the blunder, which Democratic lawmakers have said was a breach of U.S. national security. But she described the app as the "gold standard in private comms" in a post on X, which outlined Signal's security advantages over Meta's WhatsApp messaging app. "We're open source, nonprofit, and we develop and apply (end-to-end encryption) and privacy-preserving tech across our system to protect metadata and message contents," she said.

Signal Head Defends Messaging App's Security After US War Plan Leak

Comments Filter:
  • Not the point (Score:5, Insightful)

    by flippy ( 62353 ) on Tuesday March 25, 2025 @01:31PM (#65258253) Homepage
    Regardless of the app's inherent security, it is against the rules (law, possibly?) to discuss classified information on such, and again, the app's security has NOTHING to do with the bonehead move of inviting a journalist to the chat group.
    • Re:Not the point (Score:4, Interesting)

      by garyisabusyguy ( 732330 ) on Tuesday March 25, 2025 @01:39PM (#65258271)

      I wonder if the same people griping about Hillary's email server will get outraged over Trump administration's apparent effort to get around document archive process?

      • Re:Not the point (Score:5, Informative)

        by MachineShedFred ( 621896 ) on Tuesday March 25, 2025 @01:46PM (#65258311) Journal

        Spoiler alert: one of the guys pitching a fit about Hillary's email server was one of the guys in this chat.

        Pete Hegseth on Fox News in 2016 [x.com]: “How damaging is it to your ability to recruit or build allies with others when they are worried that our leaders may be exposing them because of their gross negligence or their recklessness in handling information?”

        Pete Hegseth in 2025: “We are currently clean on OPSEC” in a Signal chat with an editor from The Atlantic.

        These clowns all should resign or be impeached.

        • Re:Not the point (Score:5, Informative)

          by ceoyoyo ( 59147 ) on Tuesday March 25, 2025 @01:51PM (#65258337)

          You missed the followup:

          Pete Hegseth: nuh uh, never happened, lol Atlantic, Russia, Russia Russia!

          https://www.independent.co.uk/... [independent.co.uk]

        • These clowns all should resign or be impeached.

          Including the Veep and also the one who picked them all.

        • Re:Not the point (Score:5, Informative)

          by fahrbot-bot ( 874524 ) on Tuesday March 25, 2025 @02:45PM (#65258503)

          These clowns all should resign or be impeached.

          This presumes they believe in, or even understand, accountability and responsibility for *their* actions. For others, like those they dislike (Hillary Clinton), disagree with (Democrats), or look down on (the poor), sure, but not for themselves. Introspection is not their strong point. /s/c

          To be fair, mistakes happen, but I'm *sure* at least some of the people in that group chat know that Signal and insecure cell phones are not approved for classified information and they did it anyway. Also no one bothered to review the group members to ensure everyone was cleared? Lastly, there are people whose literal job it is to ensure all those people have access to secure communications 24/7 -- a former one was interviewed on a nightly news show last night -- so it's not like secure communications weren't available. I'm also sure they all have been briefed on proper procedures at some point. People can claim incompetence, but indifference seems more likely. Any low(er) level person doing this would get immediately fired and perhaps prosecuted.

      • by gweihir ( 88907 )

        Naa. These are the "good" guys doing it! Whatever the great leaders and stable geniusses decide must be right!

        Do not expect even minimally working rational processes from the minds of the MAGA morons...

      • No they won't. Obviously you cannot compare the two. Their reality distortion field will take care of it.
        Oh and you are the idiot. (/s)
    • Re:Not the point (Score:5, Informative)

      by gweihir ( 88907 ) on Tuesday March 25, 2025 @01:57PM (#65258357)

      It is against the law. If you are, say, a general, doing things like this gets you a dishonorable disharge. If you are the chief asshole or one of his cronies, nothing happens.

      And yes, Signal is entirely blameless here. The people in this meeting fucked up to an extreme degree and they did it twice. First by using Signal for secret-level stuff, which is very much illegal and something they will have been explicitely warned against and second for failing the simple task of keeping it to the intended recipients. Failure does not get much more pathetic than this. These people must be really dumb for something like this to even be possible.

    • I suspect that including a journalist was done on purpose. What better way for a whistleblower to blow the whistle than to include the editor of an important news paper in the group list. What? You aren't manually verifying the keys of everyone you talk to on Signal? Shame on you!

      Signal is good tech, but it isn't magical. Hopefully, for whoever did this, Signal doesn't actually keep track of who added people to a group, because, if I am correct, then this could easily be full treason.

    • Re:Not the point (Score:5, Interesting)

      by DesScorp ( 410532 ) on Tuesday March 25, 2025 @02:11PM (#65258407) Journal

      Regardless of the app's inherent security, it is against the rules (law, possibly?) to discuss classified information on such, and again, the app's security has NOTHING to do with the bonehead move of inviting a journalist to the chat group.

      But Signal has to defend themselves because, media being what it is, many clueless writers are painting the problem not as a policy violation or procedural error, but in implying that Signal itself isn't secure. Signal is having to deal with media sensationalism.

      • Yeah - at least some of the very real issues are:

        - There are many laws that dictate how classified information is to be handled and disseminated
        - There are laws requiring that records of such discussions and transactions are recorded and kept

        Not to mention that

        - Jeffrey Goldberg, the Editor-in-Chief of the Atlantic turned out to be more careful about possible exposure of CIA agents and foreign assets than the UW cabinet members and security officials were.

        One side note (which was mentioned by Goldberg) - wh

        • I suspect someone realized that the conversation that they were having was both legally and morally wrong. I can certainly imagine a world in which someone might be a Trump supporter, but find this sort of thing farther than they were willing to go. What better way to whistleblow than to invite the editor of a newspaper into a ultra top secret conversation? I consider myself fairly security conscious, but I don't hand verify the keys of everyone that I talk to in a group in Signal.

          Of course, I also don

    • Re:Not the point (Score:4, Insightful)

      by Targon ( 17348 ) on Tuesday March 25, 2025 @02:15PM (#65258413)

      This goes back to the issue that Hillary Clinton had when it came to running her own personal e-mail server. Every system administrator for a server MUST be properly cleared for ANY piece of potentially sensitive information, no matter if it is a private or public service, the administrators and even customer service people may have access to the information flowing through it. If you don't have those people and the servers properly checked to make sure they are secure to DOD levels of security, then no government employee should be sending any sort of sensitive information through it.

      Even if the server itself is fully secure, if the administrators are not cleared to view that information, then that server/service should not be used. End of story. These mental incompetents who like to play politics but don't understand the basics of security all should be removed from their positions, and if Trump himself knew about it, then he is guilty of being responsible for it being used as well.

      • This is also one of the big problems (not the only one, unfortunately) with how Musk has been running the various DOGE takeovers.

    • No, it's neither against the rules nor the law. Secure mobile devices have been around for a rather long time, going back to at least Obama's Blackberry. The Biden Administration approved Signal for use and presumably it was installed on DISA-provided devices approved for classified use as opposed to their personal devices (no indication that personal devices were used here). No one yet knows how the journo was invited.
      • by Pascoea ( 968200 )

        The Biden Administration approved Signal for use

        For classified conversations? Or are strategic warfighting plans not classified any more?

        • by Z00L00K ( 682162 )

          Only until the plans are put into action, then those plans becomes obsolete.

          • by Pascoea ( 968200 )

            Only until the plans are put into action, then those plans becomes obsolete.

            So, we're in agreement that these were classified conversations then?

            • by Z00L00K ( 682162 )

              I don't disagree, but if you invite the wrong people and don't clearly state that this shouldn't be spread then the people invited aren't under constraints except by their own judgement.

        • If it was installed on a device approved for classified use, then yes. All the reporting I've seen has been pretty breathless and not curious as to the backend security architecture which, to be fair, probably wouldn't be answered in a public forum. Hopefully Congress thinks to ask those questions. My assumption (having done this for flag officers) is that the officials get a phone cleared for TS with a preloaded/approved software package. It's centrally managed, so they can't add random apps.
      • Pretty sure it is against the rules and the law for these communications to be set to automatically be deleted after a few days...
    • Re:Not the point (Score:5, Interesting)

      by gtall ( 79522 ) on Tuesday March 25, 2025 @02:37PM (#65258477)

      One thing pointed out in today's Senate hearings was that, (1) the alleged administration argues that nothing in that conversation was classified, (2) no, they couldn't discuss it with the senators because some faux "committee" on national security was investigating the matter. The senators were not buying that. Well, the Democrat senators were not. The Republican senators were there but were MIA.

      What they meant to say was they didn't want to air their dirty laundry (their comments about Europe are why we have no allies left) and that this faux committee is actively attempting various spins to see which one they can get corporate press to buy into.

      The N. Security head (I think it was him) was in Moscow while on the call. They also claimed that it was Bidien's fault because his administration also used Signal. What they left unsaid was that the Biden administration wasn't stupid enough to discuss classified plans on Signal. Hence they couldn't admit the information was classified. An alternative explanation was the information should have been classified (war plans putting American personnel in harms way) but they were too stupid to do it.

    • Re:Not the point (Score:5, Interesting)

      by toxonix ( 1793960 ) on Tuesday March 25, 2025 @04:41PM (#65258879)

      Yes, because Signal conversations are supposedly auto-deleted, and these kinds of conversations are legally required to be recorded/stored by law as part of the FOIA. The fact that a journalist was added is just a bumble by idiots. The fact they were discussing war plans on Signal is the bigger story. The Kremlin didn't tell the Houthis when and where they were going to be bombed probably because the Russians make more money selling them replacements than they do passing on intelligence. The fact is the Russians probably had the opportunity to tell a US enemy when and where to shoot down US fighter jets.
      The Kremlin is actively targeting Signal accounts and exploiting their device linking feature to get copied on any conversation on a compromised device. I'm not sure any of these guys on the conversation are savvy enough to know the difference between a QR code from a Kremlin account and a legit one from Signal.

    • But her emails. Check and mate libtardo /s

      Also TDS! TDS! TDS! /s

      (It's 2025 so I felt the /s was necessary )
  • by OverlordQ ( 264228 ) on Tuesday March 25, 2025 @01:33PM (#65258257) Journal

    jk, we all know MAGA are too busy inviting pedos and rapists to the white house.

  • by MachineShedFred ( 621896 ) on Tuesday March 25, 2025 @01:34PM (#65258259) Journal

    Great. You claim that the chat was "secure" except it should have never been on your app to begin with because THEIR PHONES ARE NOT SECURE TERMINALS IN A SCIF. That chat existing, with it's contents, is a violation of records keeping laws, and classified information laws. If this would have happened under any other administration, we'd be seeing people resign or be fired. And if it happened to lower-level cronies in this administration we would also see people fired. But when it's cabinet-level cronies and yes-men we'll see obfuscation, bad-faith arguments, diminishment of severity, gaslighting, lies, and absolute bullshit.

    I look forward to experiencing the mental gymnastics associated with trying to bothsides and whatabout this from the cultists. I'm already going to actively ignore any false equivalencies of "but but but whatabout Hillary's emails?!?!?" - try harder, apologists.

    • My past experiences entering a SCIF always involved leaving any unauthorized device outside the door. I guess rank does have its privilege.
    • by gweihir ( 88907 )

      Do not expect anything from the mindless fanatics. This whole disaster is just an indicator of how well the current US administration has things in hand.

      • You know, as bad as the Trump Administration is, the one thing to be thankful for is this isn't like Hitler, Mussolini, Franco, Mao or Stalin. Those guys were brilliant, strategic immoral monsters. Trump and his gang are immoral monsters, but may count as some of the dumbest people to ever fall upward. What a pack of unbelievable idiots.

        • by gweihir ( 88907 )

          Indeed. Better incompetent and dumb immoral monsters than ones that actually can get things done.

        • You know, as bad as the Trump Administration is, the one thing to be thankful for is this isn't like Hitler, Mussolini, Franco, Mao or Stalin. Those guys were brilliant, strategic immoral monsters. Trump and his gang are immoral monsters, but may count as some of the dumbest people to ever fall upward. What a pack of unbelievable idiots.

          And yet despite being total morons, they've managed to rally enough of the other morons to take over most positions of power and start shitting and pissing all over everything.

    • They're already saying it didn't happen (even though the whitehouse confirmed it) and blaming everyone but Hegseth. Tulsi Gabbard is claiming none of the info was classified.

      • It's going to be entertaining when the evidence of her perjury before Congress is made public.

        After all, if it's not classified, then there's no reason for The Atlantic to hold back the entire transcript.

    • Great. You claim that the chat was "secure" except it should have never been on your app to begin with because THEIR PHONES ARE NOT SECURE TERMINALS IN A SCIF. That chat existing, with it's contents, is a violation of records keeping laws, and classified information laws. If this would have happened under any other administration, we'd be seeing people resign or be fired. And if it happened to lower-level cronies in this administration we would also see people fired. But when it's cabinet-level cronies and yes-men we'll see obfuscation, bad-faith arguments, diminishment of severity, gaslighting, lies, and absolute bullshit.

      I look forward to experiencing the mental gymnastics associated with trying to bothsides and whatabout this from the cultists. I'm already going to actively ignore any false equivalencies of "but but but whatabout Hillary's emails?!?!?" - try harder, apologists.

      What's sad about this is that the company head feels it was prudent to put out any statement at all about this. That may be a miscalculation. The idiot brigade that made all this happen isn't smart enough to have thought of blaming Signal for their dumbassery all by themselves.

  • by maladroit ( 71511 ) on Tuesday March 25, 2025 @01:43PM (#65258297) Homepage

    The only people questioning Signal's security right now are trying to distract from the boneheaded choice to use a non-classified system for operational military secrets.

    Signal is fine for it's intended uses; protecting against drunk SecDefs leaking secrets is not one of them.

    • by MachineShedFred ( 621896 ) on Tuesday March 25, 2025 @01:47PM (#65258319) Journal

      Clearly he's a "DUI Hire". /rimshot

    • by gweihir ( 88907 )

      Indeed. This is not a Signal issue. All claims to that effect are lies by misdirection. Well, the current US administration has a lot of experience and some stunning "successes" with low-quality lying. Hence no surprise they are trying this approach for this pathetic fuck-up as well. And they will probably succeed, with the mental capabilities their fans have demonstrated so far.

    • The only people questioning Signal's security right now are trying to distract from the boneheaded choice to use a non-classified system for operational military secrets.

      Signal is fine for it's intended uses; protecting against drunk SecDefs leaking secrets is not one of them.

      Kegsbreath is a DUI hire, I’m not so sure granting a chronic alcoholic that license on the promise he’d consider stopping was a great idea.

    • by Targon ( 17348 )

      That is my feeling. After the Hillary Clinton private mail server situation, it seems that Trump and his administration want to do it 100 times worse.

  • by gweihir ( 88907 ) on Tuesday March 25, 2025 @01:46PM (#65258309)

    This was a complete fuck-up of the cretins in chatrge of "leading" the US at this time. They apparently are too dumb to even get a simple OpSec issue right, like basic secure communication. Extreme Dunning-Kruger cases, the lot of them. But this action is only an indicator of a much larger problem. I mean, they cannot even get simple things right, like a list of whom to invite. What do you expect their performance on more complex issues will be? Right.

    • by MachineShedFred ( 621896 ) on Tuesday March 25, 2025 @01:54PM (#65258341) Journal

      Also, this is just the one where they got caught.

      How many other Signal chats are happening, containing classified information or would be deemed official administration communications that should be going to the national archives that we don't know about?

      • by Ogive17 ( 691899 )
        We already know Trump is a security disaster so this is really not surprising at all.
      • by gweihir ( 88907 )

        Indeed. Makes one wonder whether Trump is really a russian intelligence asset. I would expect the Russians to have higher standards.

        • by smooth wombat ( 796938 ) on Tuesday March 25, 2025 @02:49PM (#65258509) Journal
          Makes one wonder whether Trump is really a russian intelligence asset.

          He is. Both before and now he has exposed U.S. secrets to Russian officials. One need only look at his exchange with Zelensky. The man is trying to save his country and the convicted felon berates him for a) not saying thank you even though Zelensky has said it hundres of times and b) for standing up to for his country when the convicted felon lied about what's going on.

          Contrast that with his words about Putin where he says Putin is much more easy to get along with, is holding all the cards (wtf does that even need to be said?), and has said Putin is savvy and a genius for invading Ukraine. Not to mention him spouting the exact Russian talking points.

          It is a guarantee the convicted felon is working for Russia, knowingly or unknowingly.
          • by gweihir ( 88907 )

            It is a guarantee the convicted felon is working for Russia, knowingly or unknowingly.

            I agree that there is no doubt about that. But I think that he is just too dumb to understand what he is doing.

        • there are Assets and Useful Idiots

          you choose

  • I'd know where to target my efforts, and I don't just mean Jeffrey Goldberg's phone.

  • I for one am thankful there are no blunders we don't know about that this esteemed administration is making.

  • Trump's cabinet is a clown car of subservient weirdos and amateurs who do not belong in any position of responsibility.

  • Text of conversation (Score:5, Informative)

    by smooth wombat ( 796938 ) on Tuesday March 25, 2025 @02:08PM (#65258403) Journal
    Newsweek has text and screenshots of some of the conversation the reporter released. In one particular line it is mentioned the reporter did not include the name of a CIA official mentioned in the exchange to protect security. It seems he has a higher duty to protect than these amateurs do.

    Text of conversation [newsweek.com]. Note: the reporter is considering to release the entire conversation [newsweek.com] he has. This article only has part of what was recorded.

    Did Hegseth break the law [newsweek.com]?

    David French, a former military attorney, wrote an article in The New York Times on March 25 in which he wrote that Hegseth could potentially be facing criminal charges.

    "I don't know how Pete Hegseth can look service members in the eye. He's just blown his credibility as a military leader," French wrote.

    French is a former attorney with the Army Judge Advocate General's Corps (JAG Corps) and is very familiar with prosecuting military officers for breach of security.

    This incident shouldn't surprise anyone. This is what you get when you have a drunk DEI hire.

  • I don't think anyone is blaming Signal for this screw up. A hammer may be a great tool but if you give it to a moron they will bonk themselves in the head with it.

    • by Z00L00K ( 682162 )

      Right now it seems like the fool is bonking everyone else with the hammer. It would be a relief if they were bonking themselves with it.

  • by Jayhawk0123 ( 8440955 ) on Tuesday March 25, 2025 @04:00PM (#65258751)

    Signal is not the issue - use of any app for S&C subject matter is. These conversations are only allowed in a secure environments (a SCIF)... they can be set up nearly anywhere and portable versions exist. There was no reason for this fiasco.

    That this chat even existed is the issue. (and most of the people on it knew better than to participate and discuss these matters on there)
    What some of the decision makers said in the thread is the issue. And is now out in the public. Good luck pulling those words back and showing the world that the US can be trusted to uphold agreements without first sending money.
    The sheer idiocy of the people in those conversations is the issue.
    The fact a journalist was added ACCIDENTALLY is the issue.
    The white house response full of lies is also the issue- "no classified info was shared"... yes there was, the journalist decided to NOT PUBLISH IT, that doesn't mean it wasn't in the fucking chat- but he can't now legally publish it to prove it, so the white house has it technically contained behind that bullshit of a lie. If he wants to prove the existence of classified intel in the chat, he puts himself in jeopardy just to prove the lie.
    The fact that steven miller shut down any dissent with a single message is an issue.
    The fact that the military actions are done based off of "as i heard it"... which is a weasly legal way to not get blame/blowback and say oops, i misunderstood... my bad.. insulating everyone above from repercussions... while putting all the heat on anyone below.

    as for the security of Signal- it's great that they are open source, and all that... none of that guarantees their security.... encryption can be broken, people at signal can be compromised, hardware can be compromised, unknown vulnerabilities in code/repos/encryption tech, etc can exist and be exploited. End user devices can be compromised, lost/stolen devices... video captures of the screen can reveal data... any number of things can compromise the security, it's WHY IT IS NOT ALLOWED. This should never have been a fucken thing. what a fucken embarrassment. (not a single fucker will lose their job/security clearance for this... Any grunt in the military would get CM'd for far less and face jail time. )

Always try to do things in chronological order; it's less confusing that way.

Working...