Thanks frank, there seems to be a paywall for me so I can't read the article.
As at tech guy, the larger question I have is why in the sweet name of Elijah doesn't the federal government have its own internal access only messaging platform to discuss sensitive info? Its possible that Signal was used to subvert FOIA/ record keeping issues, but is more likely that the free market simply baked a better cake than the government could, and it is free to boot. Amazon S3 (Amazon cloud storage and server services) has an entire site of the business dedicated to the federal govt, so hosting a messaging app for .gov identities only should be pretty simple.
Anyway, I think it was a dumb mistake, but notice that none of these guys tried to "wipe the server with a cloth."
Stogie1020 wrote:
I'm definitely NOT a tech guy but I sometimes like to read this guy Bray if the lead looks like something of interest to me...lots of updates about phones and stuff, normally apolitical, but in this case it's become political rather than about protocol, security and options that any American should hope is being used.
It's more than possible I've missed the message but here is the article that I thought addressed your link...
I'd be interested in your reaction...as you know.
TECH LAB
The Signal scandal is even worse than it looks
By Hiawatha Bray Globe Staff,Updated March 27, 2025, 5:00 a.m.
Through a stroke of exceptional carelessness, President Trumpâs top deputies got caught this week discussing sensitive military operations via the popular smartphone app Signal. The brewing scandal might actually be worse than it looks.
If youâre an everyday consumer, you canât do much better than Signalâs message encryption services to protect the privacy of your correspondence. And security services on consumer-grade iPhones and Androids has gotten pretty good too. But regular people donât generally discuss national security plans in their group chats.
The lapses by the Trump administration show why government officials are supposed to discuss military secrets only on high-security devices. If the officials had followed protocol, for instance, it would have been nearly impossible to accidentally include a member of the public â as Trumpâs team did by sharing the exchange with The Atlantic editor Jeffrey Goldberg.
Thatâs not the only boneheaded decision revealed by this weekâs self-inflicted leak. It appears, from the now-published exchange, that the administration may be ignoring other basic cybersecurity protocols. Hereâs how.
Relying on Signal for security
Related
The White House security breach raises concerns among some military spouses and veterans
Trump officials double down on claims that no classified material was shared in texts detailing war plans
What is Signal, the chat app used by US officials to share attack plans?
The Atlantic releases entire Signal chat showing Hegsethâs detailed attack plans against Houthis
Signal is more secure than your average chat app, but it falls far short of military standards. âAny normal person would have been arrested alreadyâ for discussing military operations on Signal, said Bruce Schneier, a lecturer at the Harvard Kennedy School and author of multiple books on cybersecurity.
Signal features end-to-end encryption thatâs supposed to be much more secure than standard voice and chat smartphone apps. In fact, last December, the US Cybersecurity and Infrastructure Security Agency recommended that government officials start using Signal, to protect themselves against possible attacks from Chinese hacker teams.
But the federal advisory didnât say that Signal was suitable for use in conducting airstrikes. And according to Schneier, itâs not even close.
For one thing, military-grade systems use their own custom-made encryption algorithms. For another, the phones they run on feature custom-made operating systems, not the standard iOS or Android software found on consumer phones.
Relying on consumer-grade phones
Hackers are constantly on the hunt for ways to crack iOS and Android systems. This could enable them to smuggle spyware onto a supposedly secure phone. Once the device is compromised, Signal messages could be intercepted before they were encrypted.
âThose systems are not secure in any important sense,â said Dan OâDowd, chief executive of Green Hills Software, a California company that makes hardened phone systems for military use.
This isnât news to the Trump administration. During last yearâs election, the Trump campaign began using Green Hills secure phones after learning that phones used by Trump and Vice President JD Vance were attacked by China-based hackers. Yet the presidentâs national security team failed to take the hint.
Connecting one Signal-equipped phone to another is designed to be easy â maybe too easy. Hackers believed to be based in Russia have used phishing emails to trick people into connecting their Signal accounts to cybercriminals looking to steal sensitive data. NPR reports that the Pentagon last week alerted all personnel to avoid using Signal to discuss even unclassified military matters, because of the phishing threat.
In addition, the German magazine Der Spiegel on Wednesday said it has uncovered mobile phone numbers, email addresses, and passwords used by national security adviser Mike Waltz, Defense Secretary Pete Hegseth, and Director of National Intelligence Tulsi Gabbard. The sensitive information was found in the records of commercial data brokers and in files published by hackers on underground websites, the magazine said.
But a military-grade system isnât vulnerable this way, Schneier said. Each participant in a chat has to have a secure device and must be cleared in advance to participate in such communications. âA military-grade encryption product is not going to have the ability to link random people to it,â Schneier said. So forget about a journalist stumbling in by accident. âItâs restricted in the mistakes it can make,â Schneier said.
Disregarding government transparency
Thereâs one more troubling aspect to the Signal affair â its possible damage to our right to know what our leaders are doing.
Signal is famous for offering âdisappearing messages,â which can be programmed to delete themselves after 24 hours from every device that receives them. Itâs a handy way to ensure that a userâs careless comments wonât come back to haunt her. But it runs headlong into the governmentâs responsibility to keep accurate records of official activities.
Itâs not a new question, either. In 2021, the Defense Departmentâs inspector general rebuked the outgoing director of the Defense Departmentâs digital service for using Signal and urging his colleagues to do the same. The investigators said that Signal was not approved for Defense Department use, because its disappearing message feature could violate the Freedom of Information Act.
At least some of the messages intercepted by Goldberg were intended to self-delete. For example, Waltz apparently set his message thread to disappear after four weeks. It doesnât inspire confidence when government officials make critical decisions using a technology that can automatically cover their tracks.
