4 ms·

Surely the real question is why they were using Signal, rather than a secure government network?

HenryBemis 2y ago
Because now _this_ party is in power and controls the systems and information, but in 4/8/12 years _that_ party will be in power and a good-willing-mistake-making-bureaucrat may leak these 'by accident/mistake/etc' if they are properly recorded on a gov-controlled system. But the auto-delete-after-1-week messages from Signal would never be recovered (unless someone is logging all that data and in the future will be able to crack it).
- fragmede 2y ago
  There is No Such Agency doing that, and definitely not in Utah https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
nightfly 2y ago
Can't follow FOIA requests if there is no record of the conversation existing
- hypeatei 2y ago
  I doubt FOIA is even a concern considering this is classified information. I think they're more worried about investigations by a future DOJ or by a future Congress since they can look at this information (if it's not deleted, that is)
  - mpalmer 2y ago
    FOIA requests can be made against formerly-classified information. But it's beside the point; any(?) non-classified information/communiques in government are subject to FOIA. Plenty of non-classified info in that chat and the ones we still aren't privy to.
    - zzrrt 2y ago
      I think the idea is they would configure Signal to delete messages after a few weeks, which bypasses FOIA because the records may not exist by the time someone requests them.
      - iAMkenough 2y ago
        Doesn't "bypass" FOIA, it violates it. Even if the app is configured to do it for them automatically, they're actively deleting public records and violating the law by doing so.
    - chipsa 2y ago
      Not all unclassified can be FOIA’d. There are exemptions to FOIA, that aren’t “it’s classified “. And there are things that aren’t “records” according to DoD records management regulations, and so would not be FOIAble, because they wouldn’t be a record to get.
  - nkozyra 2y ago
    > I doubt FOIA is even a concern considering this is classified information A bit of a conundrum then since multiple folks in the admin said it wasn't classified.
Cthulhu_ 2y ago
Lack of oversight, too much power, failing checks and balances. It's not unique either; the former prime minister of the Netherlands, Rutte, insists on using a Nokia phone and plain text messages, refusing to divulge what is in those messages and deleting them as there's limited space, thus not adhering to any archival requirements.
- nindalf 2y ago
  Plaintext SMS in the year of our lord 2025. People will do literally anything other than following the fucking law and recording their correspondence.
ungreased0675 2y ago
Because a secure government messaging platform doesn’t exist. The DoD is horrible at buying modern software. Still not an excuse, because the people with the power to fix it are using Signal instead.
- khafra 2y ago
  You can joke about Microsoft Teams not being a real messaging platform, but running it on a network that's physically separated from the Internet is quite effective at keeping random journalists out of your chat groups.
  - codedokode 2y ago
    But how do you connect to this network from a mobile phone, for example, when playing golf?
    - sterlind 2y ago
      install teams on your phone? you'll need to cave a bit and allow VPN access from the phone to the Teams server, though.
    - khafra 2y ago
      In practice? You are issued a special, secure phone expressly for connecting to the network which is not physically connected to the internet. Many details of e.g. CsfC are unclassified; you can read the architecture pdfs.
- spacebanana7 2y ago
  Reminds me of how the British government runs on WhatsApp.
- NetRunnerSu 2y ago
  German government seems to be trying the Matrix network.
Hamuko 2y ago
My guess that the actual secure government messaging services are a pain to use vs. Signal that's on your phone in your pocket, and these people don't really value security over their own convenience. They did share some of the details over actual secure systems ("you should have a statement of conclusions with taskings per the Presidents guidance this morning in your high side inboxes"), but I guess when the attacks were starting, it was easier to just blast them on Signal.
philk10 2y ago
One of the guidelines from Project 2025 was to do this
- tjarrett 2y ago
  Are you sure? I was shocked by this comment and Googled it... https://www.snopes.com/fact-check/signal-project-2025/ https://www.snopes.com/fact-check/signal-project-2025/
billfor 2y ago
Because CISA recommended it and it’s preinstalled on some government phones. https://www.bleepingcomputer.com/news/security/cisa-urges-switch-to-signal-like-encrypted-messaging-apps-after-telecom-hacks/ https://www.bleepingcomputer.com/news/security/cisa-urges-sw...
- Raudius 2y ago
  That only explains that Signal was considered safe and allowed on their phones not that it was an authorized medium for sharing confidential information.
mft_ 2y ago
Genuine question: I get that there’s usually an expected/different process, and (obvs) the ability to add the wrong person is a problem (!) but is there a fundamental practical reason that their using Signal is/was a problem?
- saulpw 2y ago
  The reason that there's an "expected" process is because the people who were hired to think deeply about security got together and, for a bunch of reasons including "(obvs) the ability to add the wrong person is a problem", decided that the process should be something other than Signal. I'm not sure if we know all of the reasons they made that decision, but I think we can infer a few: - all communication must be stored for legal purposes - all communication must be on secure government hardware - the entire security infrastructure must be operated by the government Which of these aren't fundamental and practical?
  - mft_ 2y ago
    Thanks for your interesting reply. Some of this is what I was getting at with "fundamental" and "practical": > all communication must be on secure government hardware > the entire security infrastructure must be operated by the government ...only matter practically, if the Government hardware and infrastructure are guaranteed to be more secure than the alternative, also considering the fallibilty of the users. And while I appreciate that iPhones and Signal likely aren't infallible, I'm not sure we know what level of absolute trust to place on Government-supplied hardware or infrastructure provided by whoever got the contract?
- shitpostbot 2y ago
  Signal is end-to-end encrypted. One end is the Signal app on your phone. The other end is the Signal app on their phone. The Signal app is developed by people, using computers. Both of those things can be compromised, neither of them are under the perview of the U.S. security agencies. I would put the market value of a backdoor into all Senior White House communications as certainly >$10B, and probably >$100B, limited only by how long the buyer believed it would be a reliable source of intel. (it may be better to offer it as a subscription service.) At that point everything should be assumed to be compromised until demonstrated to a reasonable degree of confidence that it's probably safe. A random install from an app store is not that.
AndrewKemendo 2y ago
Former Intelligence officer here. Cause SIPR, JWICS, GIANT etc… are nearly impossible to access - to the extent where for SCI info (which is arguably the level of data they were passing) they constrain you to having to communicate in a certified SCIF The SecDef has a bunch of SCIFs but even NSC staff don’t to the same degree. People pass TS/SCI data outside of the system regularly - congress is notorious for this and I have personally had multi year operations shut down because a congressman talked about it at a hearing. I know of plenty of parking lot “SCIF” and sneakernet SCI conversations because time was an issue The reality is this admin doesn’t care about the structures that the national security community is statuatorily mandated to use, but there’s nobody that is going to do anything to them about deviating. Classified networks suck to use, anyone who can get around it does. The fact that its the secdef and nsc and they got busted just demonstrates that they view their behavior as more important than the system. Left to the viewer to determine if thats a good tradoff
- zamadatix 2y ago
  SCIF (Wikipedia): A sensitive compartmented information facility (SCIF /skɪf/), in United States military, national security/national defense and intelligence parlance, is an enclosed area within a building that is used to process sensitive compartmented information (SCI) types of classified information.
  - RichardCA 2y ago
    The recent PBS Frontline on the Jack Teixeira / Discord leaks provides an excellent primer on how classified systems work these days. https://youtu.be/AkgkBEuEHwU https://youtu.be/AkgkBEuEHwU
- oyashirochama 2y ago
  The thing is, it's up to the official classification officer to decide on how far is too far for classification down and this administration loves to short man everything so likely they decided it wasn't an issue, but it is, and someone should be blamed in my opinion since that is that official's job. You can go around legally too just ask what is and isn't considered classified by derivative.
foundart 2y ago
According to the article: “ the White House had authorized the use of Signal, largely because there is no alternative platform to text in real time across different agencies, two people familiar with the matter said.”

Because now _this_ party is in power and controls the systems and information, but in 4/8/12 years _that_ party will be in power and a good-willing-mistake-making-bureaucrat may leak these 'by accident/mistake/etc' if they are properly recorded on a gov-controlled system. But the auto-delete-after-1-week messages from Signal would never be recovered (unless someone is logging all that data and in the future will be able to crack it).

fragmede 2y ago
There is No Such Agency doing that, and definitely not in Utah https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center

nightfly 2y ago

Can't follow FOIA requests if there is no record of the conversation existing

hypeatei 2y ago
I doubt FOIA is even a concern considering this is classified information. I think they're more worried about investigations by a future DOJ or by a future Congress since they can look at this information (if it's not deleted, that is)
- mpalmer 2y ago
  FOIA requests can be made against formerly-classified information. But it's beside the point; any(?) non-classified information/communiques in government are subject to FOIA. Plenty of non-classified info in that chat and the ones we still aren't privy to.
  - zzrrt 2y ago
    I think the idea is they would configure Signal to delete messages after a few weeks, which bypasses FOIA because the records may not exist by the time someone requests them.
    - iAMkenough 2y ago
      Doesn't "bypass" FOIA, it violates it. Even if the app is configured to do it for them automatically, they're actively deleting public records and violating the law by doing so.
  - chipsa 2y ago
    Not all unclassified can be FOIA’d. There are exemptions to FOIA, that aren’t “it’s classified “. And there are things that aren’t “records” according to DoD records management regulations, and so would not be FOIAble, because they wouldn’t be a record to get.
- nkozyra 2y ago
  > I doubt FOIA is even a concern considering this is classified information A bit of a conundrum then since multiple folks in the admin said it wasn't classified.

Cthulhu_ 2y ago

Lack of oversight, too much power, failing checks and balances. It's not unique either; the former prime minister of the Netherlands, Rutte, insists on using a Nokia phone and plain text messages, refusing to divulge what is in those messages and deleting them as there's limited space, thus not adhering to any archival requirements.

nindalf 2y ago
Plaintext SMS in the year of our lord 2025. People will do literally anything other than following the fucking law and recording their correspondence.

ungreased0675 2y ago

Because a secure government messaging platform doesn’t exist. The DoD is horrible at buying modern software. Still not an excuse, because the people with the power to fix it are using Signal instead.

khafra 2y ago
You can joke about Microsoft Teams not being a real messaging platform, but running it on a network that's physically separated from the Internet is quite effective at keeping random journalists out of your chat groups.
- codedokode 2y ago
  But how do you connect to this network from a mobile phone, for example, when playing golf?
  - sterlind 2y ago
    install teams on your phone? you'll need to cave a bit and allow VPN access from the phone to the Teams server, though.
  - khafra 2y ago
    In practice? You are issued a special, secure phone expressly for connecting to the network which is not physically connected to the internet. Many details of e.g. CsfC are unclassified; you can read the architecture pdfs.
spacebanana7 2y ago
Reminds me of how the British government runs on WhatsApp.
NetRunnerSu 2y ago
German government seems to be trying the Matrix network.

Hamuko 2y ago

My guess that the actual secure government messaging services are a pain to use vs. Signal that's on your phone in your pocket, and these people don't really value security over their own convenience. They did share some of the details over actual secure systems ("you should have a statement of conclusions with taskings per the Presidents guidance this morning in your high side inboxes"), but I guess when the attacks were starting, it was easier to just blast them on Signal.

philk10 2y ago

One of the guidelines from Project 2025 was to do this

tjarrett 2y ago
Are you sure? I was shocked by this comment and Googled it... https://www.snopes.com/fact-check/signal-project-2025/ https://www.snopes.com/fact-check/signal-project-2025/

billfor 2y ago

Because CISA recommended it and it’s preinstalled on some government phones. https://www.bleepingcomputer.com/news/security/cisa-urges-switch-to-signal-like-encrypted-messaging-apps-after-telecom-hacks/ https://www.bleepingcomputer.com/news/security/cisa-urges-sw...

Raudius 2y ago
That only explains that Signal was considered safe and allowed on their phones not that it was an authorized medium for sharing confidential information.

mft_ 2y ago

Genuine question: I get that there’s usually an expected/different process, and (obvs) the ability to add the wrong person is a problem (!) but is there a fundamental practical reason that their using Signal is/was a problem?

saulpw 2y ago
The reason that there's an "expected" process is because the people who were hired to think deeply about security got together and, for a bunch of reasons including "(obvs) the ability to add the wrong person is a problem", decided that the process should be something other than Signal. I'm not sure if we know all of the reasons they made that decision, but I think we can infer a few: - all communication must be stored for legal purposes - all communication must be on secure government hardware - the entire security infrastructure must be operated by the government Which of these aren't fundamental and practical?
- mft_ 2y ago
  Thanks for your interesting reply. Some of this is what I was getting at with "fundamental" and "practical": > all communication must be on secure government hardware > the entire security infrastructure must be operated by the government ...only matter practically, if the Government hardware and infrastructure are guaranteed to be more secure than the alternative, also considering the fallibilty of the users. And while I appreciate that iPhones and Signal likely aren't infallible, I'm not sure we know what level of absolute trust to place on Government-supplied hardware or infrastructure provided by whoever got the contract?
shitpostbot 2y ago
Signal is end-to-end encrypted. One end is the Signal app on your phone. The other end is the Signal app on their phone. The Signal app is developed by people, using computers. Both of those things can be compromised, neither of them are under the perview of the U.S. security agencies. I would put the market value of a backdoor into all Senior White House communications as certainly >$10B, and probably >$100B, limited only by how long the buyer believed it would be a reliable source of intel. (it may be better to offer it as a subscription service.) At that point everything should be assumed to be compromised until demonstrated to a reasonable degree of confidence that it's probably safe. A random install from an app store is not that.

AndrewKemendo 2y ago

Former Intelligence officer here. Cause SIPR, JWICS, GIANT etc… are nearly impossible to access - to the extent where for SCI info (which is arguably the level of data they were passing) they constrain you to having to communicate in a certified SCIF The SecDef has a bunch of SCIFs but even NSC staff don’t to the same degree. People pass TS/SCI data outside of the system regularly - congress is notorious for this and I have personally had multi year operations shut down because a congressman talked about it at a hearing. I know of plenty of parking lot “SCIF” and sneakernet SCI conversations because time was an issue The reality is this admin doesn’t care about the structures that the national security community is statuatorily mandated to use, but there’s nobody that is going to do anything to them about deviating. Classified networks suck to use, anyone who can get around it does. The fact that its the secdef and nsc and they got busted just demonstrates that they view their behavior as more important than the system. Left to the viewer to determine if thats a good tradoff

zamadatix 2y ago
SCIF (Wikipedia): A sensitive compartmented information facility (SCIF /skɪf/), in United States military, national security/national defense and intelligence parlance, is an enclosed area within a building that is used to process sensitive compartmented information (SCI) types of classified information.
- RichardCA 2y ago
  The recent PBS Frontline on the Jack Teixeira / Discord leaks provides an excellent primer on how classified systems work these days. https://youtu.be/AkgkBEuEHwU https://youtu.be/AkgkBEuEHwU
oyashirochama 2y ago
The thing is, it's up to the official classification officer to decide on how far is too far for classification down and this administration loves to short man everything so likely they decided it wasn't an issue, but it is, and someone should be blamed in my opinion since that is that official's job. You can go around legally too just ask what is and isn't considered classified by derivative.

foundart 2y ago

According to the article: “ the White House had authorized the use of Signal, largely because there is no alternative platform to text in real time across different agencies, two people familiar with the matter said.”