According to the Atlantic, top White House officials used the end-to-end encrypted messaging app Signal to discuss military strikes in Yemen before those strikes were carried out on March 15. White House National Security Council spokesman Brian Hughes confirmed the messages' authenticity to ABC News, and this revelation has drawn criticism from others in the government.
"If true, these actions are a brazen violation of laws and regulations that exist to protect national security, including the safety of Americans serving in harm's way," the top Democrat on the House intelligence committee, Jim Himes, said according to the Guardian. "These individuals know the calamitous risks of transmitting classified information across unclassified systems, and they also know that if a lower-ranking official under their command did what is described here, they would likely lose their clearance and be subject to criminal investigation."
Tech Tips
But what is Signal, and have government officials used it before?
The app was released over a decade ago in 2014, and more than 40 million people were using the app for encrypted messaging as of 2022, according to the BBC. The app gained popularity in January, 2021 after WhatsApp, another encrypted messaging app owned by Facebook's parent company Meta, changed its privacy policy. In the wake of this change, people flocked to Signal, causing a surge of new users and a temporary outage of the app. The app-tracking firm Apptopia reported that Signal was downloaded about 1.3 million times a few days after the policy change.
If you're new to Signal, or want to learn about it, here's what you should know about the encrypted messaging app.
What is Signal?
Signal is an open-source, encrypted messaging app. It's available on Android and iOS devices, and it's free to download and use. You can voice or video call others through the app, and you can send payments through the app using the cryptocurrency MobileCoin.
Is Signal secure?
Signal uses end-to-end encryption to protect your messages and calls, which means that only your intended recipient can read your messages and receive your calls. That way a third-party or government entity can't intercept your message. But nothing is absolutely secure.
The Google Threat Intelligence Group reported in February that Russia-aligned malicious actors were targeting Signal users. The group found that many of these malicious actors tried to gain access to Signal accounts by abusing the app's legitimate "linked devices" feature by using fake QR codes.
"When scanned, [these QR codes] will link a victim's account to an actor-controlled Signal," the group wrote online. "If successful, future messages will be delivered synchronously to both the victim and the threat actor in real-time, providing a persistent means to eavesdrop on the victim's secure conversations without the need for full-device compromise."
However, the group said that recent versions of Signal contain features to help protect people against similar attempts in the future, so make sure you update your app to the latest version for the most protection.
But in 2023, another group of researchers found a way to figure out a Signal user's location by measuring the time between sending a message and receiving a notification that a message was delivered. The method had an overall accuracy of about 82%, and could be used to spy on someone's location.
It's also important to note that the app doesn't stop you from accidentally including people in your group chats or sending messages to the wrong person. If the app could stop that, I'm sure there would be a lot fewer drunk texts sent to former partners.
Signal
Signal
Does my contact need Signal for the app to work?
Yes, you both need to be using Signal for the app to work. You can't use Signal to message WhatsApp, for example.
Does Signal send my number to others?
Not necessarily. The app doesn't send your phone number to others unless you change the setting so others can see your number. Here's how to change this setting.
1. Open Signal.
2. Tap your profile in the top-left corner of your screen.
3. Tap Settings.
4. Tap Privacy.
5. Tap Phone Number.
Under Who Can See My Number, you can tap either Everybody or Nobody.
From this menu you can also let anyone who has your number see you're on Signal or hide that you're on the app. Under Who Can Find Me By Number, tap Everybody or Nobody.
Should I use my real name or a nickname for more privacy?
You can use your real name or a nickname. According to Signal, your profile -- name and photo attached to your number -- is encrypted, and because of that Signal doesn't know what name or photo you've selected.
"Your profile information is end-to-end encrypted with a unique profile key that is securely shared via the same Signal Protocol messaging channel that already protects your conversations and calls," Signal wrote online.
Keep in mind that using a photo and a last name in your profile are optional. Signal wrote that a first name is required, but that first name could be your name, a nickname, a single character or an emoji.
Do government employees and officials use Signal?
According to PBS, government officials have used Signal for organizational correspondence, like scheduling sensitive meetings. A former national security official who served in the Biden administration said some people in that administration had permission to download it on their White House-issued phones but were instructed to use the app sparingly. The official said the app was mostly used to notify people to check for classified messages sent via other means.
However, Signal could allow government officials to circumvent open records laws and public information requests. Without specialized archiving software, Signal messages can be set to delete themselves from your device after a certain amount of time, which could be considered a crime.
Signal
Signal
Can I use Signal for work or travel?
Yes and yes. If you use Signal for work, just know that every phone must register with a different number in order to work. And if you're traveling, the app uses the internet to message and call others. So as long as you are connected to the internet you can use the app instead of your own cell service and potentially incurring roaming fees.
Can I send or receive SMS/MMS messages with Signal?
No. Signal used to support SMS/MMS messages in its Android app, but that functionality was removed in 2022. The company wrote at the time that it was removing this capability to prioritize security and privacy, to ensure people don't encounter unexpected messaging bills and to create and clear user experience for all Signal users.
What are safety numbers and are they important?
Safety numbers are assigned to one-on-one chats in Signal, and these allow you to verify the security of your calls and messages with a contact. Verifying safety numbers is a good way to make sure you're talking to who you intend to be talking to. Once this number is verified, changes to the number must be manually approved in order to send another message.
Signal will let you know when someone changes a safety number. According to Signal, this could just be a person using a new phone or reinstalling Signal, but if you see the safety number changing a lot there could be other issues.
Here's how to view and verify a safety number.
1. Open Signal.
2. Go into a chat.
3. Tap on the chat header or the recipient's name across the top of the chat.
4. Tap View Safety Number.
Then, either scan your contact's QR code that's displayed on their screen, or compare the numeric sequence displayed beneath the QR code. If the sequence matches on both yours and your contact's phones, you can each tap Mark as Verified across the bottom of your screens. If the sequences are different, something is wrong.
Does Signal store or sell my data?
"Signal is designed to never collect or store any sensitive information," Signal wrote online.
Signal
Signal
All your data is stored locally on your device, and since everything in the app is end-to-end encrypted, the Signal service can't access that data. And because Signal can't access that data, it can't sell or monetize your data.
How do I request and download my account data?
1. Open Signal.
2. Tap your profile in the top-left corner of your screen.
3. Tap Settings.
4. Tap Account.
5. Tap Your Account Data.
You can either export your data as an easy-to-read text file, Export as TXT, or a machine-readable file, Export as JSON. Tap which kind of file you'd like to export your data as then tap Export Report.
For more on privacy, check out CNET's best VPN services, best password managers and best antivirus software.