What is the Signal messaging app and how secure is it?

The Signal messaging app is a popular tool that allows users to send messages securely. Its logo features a white speech bubble on a light blue background, and the app promotes itself with the slogan 'say hello to privacy'. Recently, Signal has gained attention after it was revealed that it was used by high-ranking officials in the US government to discuss military strategies. In March, the White House confirmed that Signal was utilized for a secret group chat regarding air strikes against the Houthi group in Yemen. This chat inadvertently included Jeffrey Goldberg, the editor-in-chief of the Atlantic. In April, US Defense Secretary Pete Hegseth shared information about the same military operation in another private Signal group that included his family members and personal lawyer. The creator of Signal, Matthew Rosenfeld, who is better known by the name Moxie Marlinspike, humorously noted that one of the reasons to join Signal is the chance of being randomly added to a group chat for coordinating sensitive military operations. However, not everyone found this amusing. Chuck Schumer, the Senate Democratic leader, described it as 'one of the most stunning' leaks of military intelligence in history and called for an investigation into the matter. This raises the question: what exactly is Signal, and how secure are the communications of senior politicians using it? Signal boasts an estimated 40 to 70 million monthly users, which is relatively small compared to major messaging services like WhatsApp and Messenger, which have billions of users. However, Signal is recognized for its strong security features. At the heart of its security is end-to-end encryption (E2EE). This means that only the sender and the recipient can read the messages, and even Signal itself cannot access them. Cyber correspondent Joe Tidy has explained how end-to-end encryption functions. While other platforms, including WhatsApp, also offer E2EE, Signal's security measures extend beyond this. For instance, the app's code is open source, allowing anyone to review it for potential vulnerabilities that hackers could exploit. Signal's owners claim that they collect significantly less information from users and do not store records of usernames, profile pictures, or group memberships. Additionally, Signal does not need to compromise its features for profit, as it is owned by the Signal Foundation, a non-profit organization that relies on donations rather than advertising revenue. Meredith Whittaker, the head of Signal, stated that Signal is the 'gold standard in private communications' following the revelation of the US national security story. However, even this high level of security is considered inadequate for extremely sensitive discussions regarding national security. This is due to the inherent risks associated with communicating via mobile phones: the security of the app is only as strong as the person using it. If someone gains access to your phone while Signal is open, or if they discover your password, they can read your messages. Furthermore, no app can prevent someone from looking over your shoulder while you use your phone in a public setting. Caro Robson, a data expert who has worked with the US administration, remarked that it is 'very, very unusual' for high-ranking security officials to communicate on a messaging platform like Signal. Typically, they would utilize a highly secure government system that is operated and owned by the government, employing very high levels of encryption. This usually involves devices kept in 'very secure government-controlled locations'. The US government has historically relied on sensitive compartmented information facilities (SCIFs) to discuss national security matters. A famous photograph taken in 2011 shows President Barack Obama and his team in a SCIF during the operation to capture Osama Bin Laden. In a SCIF, personal electronic devices are prohibited, and accessing classified information requires being in a specific room or building that is regularly checked for bugs or listening devices. SCIFs can be found in various locations, including military bases and the residences of officials. The entire system is heavily encrypted and secured using the government's highest standards of cryptography, especially when defense matters are involved. Another concern related to Signal is the feature that allows messages to disappear after a set period. Signal, like many other messaging apps, offers users the option to set messages to vanish after a certain time. Jeffrey Goldberg from the Atlantic mentioned that some messages in the Signal group he was added to disappeared after a week. This could potentially violate laws regarding record-keeping unless users forward their messages to an official government account. This is not the first controversy surrounding end-to-end encryption. Various administrations have sought to create a so-called backdoor into messaging services that utilize E2EE, allowing them to read messages they believe may pose a national security threat. Apps like Signal and WhatsApp have previously resisted attempts to create such backdoors, arguing that it would ultimately be exploited by malicious actors. This year, the UK government found itself embroiled in a significant dispute with Apple, which also employs E2EE to protect certain files in cloud storage. Apple ultimately removed the feature in the UK after the government demanded access to data protected by the technology. The legal case is still ongoing. However, as this controversy illustrates, no level of security or legal protection is effective if you inadvertently share your confidential information with the wrong person. As the saying goes, 'Encryption can't protect you from stupid.