7 ms·
CIA Director Reveals Signal Comes Installed on Agency Computers
- gsibble 2y ago[flagged]
- SteveNuts 2y agoSure, up to and including top secret?
- ceejayoz 2y agoThe existence of a phone on your desk does not mean you’re approved to discuss secrets on it.
- treetalker 2y ago… but not approved for communicating certain information, such as advance battle plans, no matter to whom that information is communicated; nor communicating any information permitted on that channel to people who should not be included on that channel, such as journalists — and it seems that "accidentally" adding someone who should not be on the channel would be much easier to do in a group-messaging app, as opposed to, say, the Situation Room or some other in-person, secure location.
- gsibble 2y agoSource?
- treetalker 2y agoSimply by way of example: https://www.scribd.com/document/843124910/NSA-full https://www.scribd.com/document/843124910/NSA-full And just because I can't resist (not being snarky to gsibble), this meme: https://www.reddit.com/r/andor/comments/1jjwtn1/too_soon/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button https://www.reddit.com/r/andor/comments/1jjwtn1/too_soon/?ut... — They're building a weapon called the Death Star. — How do you know this? — Krennic added me to the group chat.
- treetalker 2y agoFor posterity, I'm also leaving this here. It's the link to,[1] and HN discussion about,[2] The Atlantic's follow-up story, which discloses essentially the entire chat transcript. Let the readers judge for themselves. [1]: https://www.theatlantic.com/politics/archive/2025/03/signal-group-chat-attack-plans-hegseth-goldberg/682176/ https://www.theatlantic.com/politics/archive/2025/03/signal-... [2]: https://news.ycombinator.com/item?id=43481521 https://news.ycombinator.com/item?id=43481521
- LPisGood 2y agoYes, the problem is not that these people messaged each other on Signal. It is that they: 1.) Conducted official business in a way seemingly incongruous with federal records keeping laws, and 2.) Discussed classified material using a commercial application that is not approved for classified communication.
- czk 2y agohttps://archive.is/9LqJN https://archive.is/9LqJN John Ratcliffe mentions it here: https://youtu.be/mz1sLlpee80?t=87 https://youtu.be/mz1sLlpee80?t=87
- jandrewrogers 2y agoA lot of tech people here are obviously unfamiliar with the history of this. They used to use Gmail for nominally unclassified communication. Several years ago they unceremoniously dropped Gmail for all purposes, without much explanation. It was mostly replaced with Signal. I originally started using Signal almost entirely as a side effect of this transition. It was blessed as a preferred choice of the US intelligence community for unclassified comms many years ago. And a lot of classified comms if we are honest. If you worked in the US government, you needed Signal. This isn’t a value judgement, just an acknowledgement of reality. Given this, it would be weird if they didn’t have Signal installed.
- ryukoposting 2y agoI can second this, and I'll add that other corners of the bureaucracy also like Signal. From my POV, the interesting part is that the CIA has incorporated Signal into SOP, rather than it being an ad-hoc thing.
- serviceberry 2y agoIt's probably a matter of pragmatism. People are gonna use instant messengers, might as well recommend the least bad one. I've seen it in corporate environments too. If you have locked-down workstations, there's usually some list of free software that isn't officially supported, but doesn't require special approvals.
- gpm 2y agoIt seems strange that the CIA isn't running their own fork of signal which uses their own servers to avoid leaking metadata.
- threeseed 2y agoNot really. The killer feature of Signal isn’t the encryption it’s auto-deletion. Which any CIA fork would not be able to keep since it violates FOIA laws.
- deleted 2y ago[deleted]
- ciafiles_org 2y ago[flagged]
- bediger4000 2y agoThis is just an attempt at damage control over the Goldberg-in-the-chat thing, isn't it?
- gsibble 2y ago[flagged]
- bediger4000 2y ago> There was no classified data transacted That is almost certainly false. Goldberg didn't show us any, to be sure, but he also noted he left out a lot of what went on in the chat.
- donnachangstein 2y ago> That is almost certainly false. Goldberg didn't show us any So your proof is no proof was provided? Do you call this "proof by omission"?
- twobitshifter 2y agoSo you want Goldberg to release the classified information? The journalist is the only one who knew what he was doing.
- thomquaid 2y agoHe never said he had classified information. He said he witheld sensitive information which is related to an ongoing investigation (and not related to Houthi airstrikes).
- jjulius 2y ago>He said he witheld [sic] sensitive information... You said, two minutes ago, that he published the messages[1]. I don't know that you're arguing in good faith here. [1]https://news.ycombinator.com/item?id=43478529 https://news.ycombinator.com/item?id=43478529
- lenerdenator 2y agoNice feather in the cap. But do they send the really sensitive stuff over it? Or, rather, do the competent people send really sensitive stuff over it?
- jandrewrogers 2y agoIn theory no. In practice yes. That is not unique to any administration.
- LPisGood 2y agoI would bet my bottom dollar that Sec Def, Sec State, and CIA director have never planned strikes in a Signal groupchat in any prior administration, including Trump 1.
- thakoppno 2y agoWhat about over a PSTN?
- mattmcknight 2y agoProbably. https://en.wikipedia.org/wiki/STU-III https://en.wikipedia.org/wiki/STU-III
- sterlind 2y agoI'm a little surprised that encrypted voice fits through PSTN. like, logically voice can fit, and encryption shouldn't change message size, but plaintext (plainspeech?) voice over PSTN is/was analog, while the ciphertext is digital. I wonder if the quality suffered.
- jandrewrogers 2y agoI honestly wouldn’t know but I also wouldn’t be surprised if they did. DC lives in its own universe with its own rules.
- jaysonelliot 2y agoDoes this mean the CIA is not subject to the Federal Records Act, or does it mean they're simply flaunting the law?
- deelowe 2y agoIn every instance where I've been privvy to government partnerships, the version of the solutions we deployed were modified to meet regulatory standards.
- timewizard 2y agoThe "Houthi PC small group" was set to have it's messages to be automatically deleted after expiration.
- threeseed 2y agoThere is zero chance that Signal has been modified for the US government.
- deelowe 2y agoI don't know the specifics of signal. Can you elaborate?
- snowwrestler 2y ago> The practice began during President Joe Biden’s administration and had the official approval of CIA records management officials, Ratcliffe said, as long as “any decisions that are made are also recorded through formal channels.” There is a tension in the interpretation of text messaging. Is it a written record like an email, which is stored and archived? Or is it more like voice conversation; ephemeral and generally not recorded or archived? For a long time the default behavior of messaging apps was to just hold onto all messages indefinitely. This led a lot of folks in law enforcement to think of them as permanent written records. The approach in the quote above treats them more like a voice conversation. Anything of significance should be written down in an official way, even if it originated over messaging.
- epistasis 2y agoSignal can be used to arrange meetings, but secret materials like war plans need to be in SCIFs Everybody that saw that usage of Signal and didn't shut it down should face the normal consequences, in addition to the consequences that a leader undergoes for such terrible decision making.
- Someone1234 2y agoSCIF is a physical place, not a communications mechanism. I believe the DoD can use applications in the JWICS suite of tools to communicate up to top secret level information. With the DCS platform for only Secret level communications. However, these tools are on dedicated networks and dedicated machines. I suspect the reason for Signal usage here is that they were using their personal smartphones, which would never get on the JWICS or DCS networks.
- epistasis 2y agoSending war plans around on signal to mobile phones guarantees that the information is reviewed outside of a SCIF. So what's the significance of pointing out that a SCIF is a place and not a network? Further, one of the members of the group chat was in Russia at the time, because he's the special envoy to Russia, which means that the communication was likely viewed visually by cameras if he were to open the signal chat on his phone. It's hard to understand this level of incompetence from supposedly "senior" people that are running our government. I would hope that any company would fire people like this immediately. But because they are politicians, they are apparently unfirable. (And this is entirely ignoring the only reason we know this is going on, that they added a journalist to the chat, one that they claim is particularly unreliable, further damaging the opsec credibility of the politicians.)
- ConfusedDog 2y agoPretty sure one of their phones are hacked... They like to be mobile. SCIF would be counterproductive. After Hillary and this, I think they really need to invest more into a secure mobile comm program...
- colmmacc 2y agoI'm not saying this in humor, I'm genuinely curious ... how do they handle Signal's absence of FIPS validation and FedRamp certification? Signal isn't even capable of being FIPS validated, the core cryptography is off NIST piste.
- dmix 2y agoThis failure should highlight the primary risk in infosec is always adherence by the human element, not whether you spent an extra $10B on a gov software contractor who checked the right checkboxes.
- jaredledvina 2y ago100% agree, as someone subjected to the trials of FedRAMP High and DoD IL-5 audits, how is Signal the go to when there's programs for getting SaaS services approved for unclassified communications already in place. Framed selfishly, why the heck are we even bothering with these frameworks if folks are just yolo'ing messages onto Signal? If we've got to suffer through FIPS-validated crypto, DISA STIGs, etc. shouldn't the messaging platform used at least meet par?
- derbOac 2y agoThere was a lot of chatter on Bluesky earlier about what devices and systems were and should have been used in this particular case, and whether or not some of the testimony given was truthful or accurate. https://www.cbsnews.com/news/nsa-signal-app-vulnerabilities-before-houthi-strike-chat/ https://www.cbsnews.com/news/nsa-signal-app-vulnerabilities-... This Intercept article I think is a little misleading as it's taking something said in testimony at face value, and not really contextualizing it well. Some of these issues are raised in the piece a bit, but to me it reads a little strangely, like a lot of context and background is missing.
- cakealert 2y agoThere are certain times where compliance is waved off for the simple reason that even the enforcers don't comply and no one wants to inconvenience themselves.
- raggi 2y agodedramp
- deleted 2y ago[deleted]
- rich_sasha 2y agoSerious question: how would it be different if JD etc al used a "proper" secure comms app? Perhaps it would be harder to add a random journalist, but they could still accidentally add the wrong government official (maybe).
- ttyprintk 2y agoSuch an app would have access to the DoD global address list in Exchange. It would also encourage a handshake akin to “are you in a place where you can securely talk?” which would have taken the Russian envoy out of the chat.
- maxsupport 2y ago[dead]
- monocasa 2y agoReminder that the CIA funded Signal in the first place through the National Endowment for Democracy.