CIA Director Reveals Signal Comes Installed on Agency Computers

https://theintercept.com/2025/03/25/signal-chat-encryption-hegseth-cia/

by jbegley • 1 year ago

117 69 1 year ago

theintercept.com

czk• 1 year ago

https://archive.is/9LqJN

John Ratcliffe mentions it here: https://youtu.be/mz1sLlpee80?t=87

jandrewrogers3• 1 year ago

A lot of tech people here are obviously unfamiliar with the history of this. They used to use Gmail for nominally unclassified communication. Several years ago they unceremoniously dropped Gmail for all purposes, without much explanation. It was mostly replaced with Signal.

I originally started using Signal almost entirely as a side effect of this transition. It was blessed as a preferred choice of the US intelligence community for unclassified comms many years ago. And a lot of classified comms if we are honest. If you worked in the US government, you needed Signal.

This isn’t a value judgement, just an acknowledgement of reality. Given this, it would be weird if they didn’t have Signal installed.

ryukoposting• 1 year ago

I can second this, and I'll add that other corners of the bureaucracy also like Signal. From my POV, the interesting part is that the CIA has incorporated Signal into SOP, rather than it being an ad-hoc thing.

serviceberry• 1 year ago

It's probably a matter of pragmatism. People are gonna use instant messengers, might as well recommend the least bad one. I've seen it in corporate environments too. If you have locked-down workstations, there's usually some list of free software that isn't officially supported, but doesn't require special approvals.

twobitshifter• 1 year ago

I’ve seen others within the CIA say that the statements about signal being pre installed are false.

LPisGood4• 1 year ago

And a lot of classified comms if we are honest

Those people should receive administrative reprimands for that, probably up to termination. If they were discussing active strikes, targets, and intelligence sources, then they should probably be indicted.

ConfusedDog3• 1 year ago

If history has taught us anything (Hillary), that's just wishful thinking from people without power and political rivals. On rational side, most likely one of their phones got hacked which caused this leak. They are high profile targets after all. At their level, exactly what's the SOPs they must follow otherwise gonna get fired? They may push for policies downstream, but policies that govern them? They can just argue for precedence (Hillary) and nothing gonna come of this.

threeseed6• 1 year ago

There is a world of difference between everyday government conversations.

And discussing a country being bombed including exact times, what weapons are being used, locations of US personnel etc. And where one of the members of that group was in Moscow visiting Putin and likely would’ve been using a Russian WiFi network or cellular connection.

No reason, whatsoever, for Signal to be used in this situation.

hackinthebochs2• 1 year ago

No reason, whatsoever, for Signal to be used in this situation.

It sounds like the exact appropriate time to use Signal. It turns out that some high ranking official's jobs involve traveling to unfriendly or hostile countries. They still sometimes need to weigh in on classified communications. It was true back when Hilary was signing off on drone targets through text, and its true today.

8note2• 1 year ago

how different is it really though?

the US government is lookjng to reduce its global influence; making everything public is great

gibson_l6s2• 1 year ago

There are record retentions laws the very existence of Signal should be a violation. This is why nothing is goin to happen because they are all Breaking THE LAW anytime deletion is on

lenerdenator• 1 year ago

Nice feather in the cap.

But do they send the really sensitive stuff over it?

Or, rather, do the competent people send really sensitive stuff over it?

jandrewrogers3• 1 year ago

In theory no. In practice yes. That is not unique to any administration.

LPisGood4• 1 year ago

I would bet my bottom dollar that Sec Def, Sec State, and CIA director have never planned strikes in a Signal groupchat in any prior administration, including Trump 1.

threeseed6• 1 year ago

Note this is your opinion only.

There has never been any reporting that previous administrations have discussed war plans over a non US government platform before.

jaysonelliot• 1 year ago

Does this mean the CIA is not subject to the Federal Records Act, or does it mean they're simply flaunting the law?

deelowe2• 1 year ago

In every instance where I've been privvy to government partnerships, the version of the solutions we deployed were modified to meet regulatory standards.

timewizard2• 1 year ago

The "Houthi PC small group" was set to have it's messages to be automatically deleted after expiration.

threeseed6• 1 year ago

There is zero chance that Signal has been modified for the US government.

snowwrestler• 1 year ago

The practice began during President Joe Biden’s administration and had the official approval of CIA records management officials, Ratcliffe said, as long as “any decisions that are made are also recorded through formal channels.”

There is a tension in the interpretation of text messaging. Is it a written record like an email, which is stored and archived? Or is it more like voice conversation; ephemeral and generally not recorded or archived?

For a long time the default behavior of messaging apps was to just hold onto all messages indefinitely. This led a lot of folks in law enforcement to think of them as permanent written records.

The approach in the quote above treats them more like a voice conversation. Anything of significance should be written down in an official way, even if it originated over messaging.

beezle• 1 year ago

Anything of significance should be written down in an official way, even if it originated over messaging.

So in the group chat discussing code word material, who was responsible for making the written record? Perhaps that should have been one of the questions today?

Likewise, if it is true that they are using it on a regular basis at CIA HQ I can pretty much guaranty you that it is being used in a manner that is a substitute for email which would be required to be saved in entirety.

baranul• 1 year ago

Very good question. It appears it doesn't matter what the law says, but is more a matter of who is going to enforce or prosecute.

albert_e• 1 year ago

Sorry to be pedantic

flaunting

I believe you meant to say flouting

bediger4000• 1 year ago

This is just an attempt at damage control over the Goldberg-in-the-chat thing, isn't it?

timewizard2• 1 year ago

Damage control for the insane Senate hearings today.

refurb• 1 year ago

Amazing how the Senate can hold a hearing for something happened yesterday, but are apparently helpless to hold hearing about the dozens of other things that actually impact American's lives like housing, healthcare, etc.

epistasis3• 1 year ago

Signal can be used to arrange meetings, but secret materials like war plans need to be in SCIFs

Everybody that saw that usage of Signal and didn't shut it down should face the normal consequences, in addition to the consequences that a leader undergoes for such terrible decision making.

Someone12343• 1 year ago

SCIF is a physical place, not a communications mechanism.

I believe the DoD can use applications in the JWICS suite of tools to communicate up to top secret level information. With the DCS platform for only Secret level communications.

However, these tools are on dedicated networks and dedicated machines. I suspect the reason for Signal usage here is that they were using their personal smartphones, which would never get on the JWICS or DCS networks.

epistasis3• 1 year ago

Sending war plans around on signal to mobile phones guarantees that the information is reviewed outside of a SCIF. So what's the significance of pointing out that a SCIF is a place and not a network?

Further, one of the members of the group chat was in Russia at the time, because he's the special envoy to Russia, which means that the communication was likely viewed visually by cameras if he were to open the signal chat on his phone.

It's hard to understand this level of incompetence from supposedly "senior" people that are running our government. I would hope that any company would fire people like this immediately. But because they are politicians, they are apparently unfirable.

(And this is entirely ignoring the only reason we know this is going on, that they added a journalist to the chat, one that they claim is particularly unreliable, further damaging the opsec credibility of the politicians.)

gibson_l6s2• 1 year ago

Seems the government IT security and application training people are subpar to say the least. I would never have given any body an public app like signal by nature it is breaking the record retention law for ANY government communications. So guess what? nobody is getting busted or arrested or every user gets busted and arrested. Its like giving monkey's hand grenades'.

colmmacc• 1 year ago

I'm not saying this in humor, I'm genuinely curious ... how do they handle Signal's absence of FIPS validation and FedRamp certification? Signal isn't even capable of being FIPS validated, the core cryptography is off NIST piste.

dmix• 1 year ago

This failure should highlight the primary risk in infosec is always adherence by the human element, not whether you spent an extra $10B on a gov software contractor who checked the right checkboxes.

jaredledvina• 1 year ago

100% agree, as someone subjected to the trials of FedRAMP High and DoD IL-5 audits, how is Signal the go to when there's programs for getting SaaS services approved for unclassified communications already in place. Framed selfishly, why the heck are we even bothering with these frameworks if folks are just yolo'ing messages onto Signal? If we've got to suffer through FIPS-validated crypto, DISA STIGs, etc. shouldn't the messaging platform used at least meet par?

derbOac• 1 year ago

There was a lot of chatter on Bluesky earlier about what devices and systems were and should have been used in this particular case, and whether or not some of the testimony given was truthful or accurate.

https://www.cbsnews.com/news/nsa-signal-app-vulnerabilities-...

This Intercept article I think is a little misleading as it's taking something said in testimony at face value, and not really contextualizing it well. Some of these issues are raised in the piece a bit, but to me it reads a little strangely, like a lot of context and background is missing.

cakealert• 1 year ago

There are certain times where compliance is waved off for the simple reason that even the enforcers don't comply and no one wants to inconvenience themselves.

raggi• 1 year ago

dedramp

rich_sasha• 1 year ago

Serious question: how would it be different if JD etc al used a "proper" secure comms app? Perhaps it would be harder to add a random journalist, but they could still accidentally add the wrong government official (maybe).

ttyprintk• 1 year ago

Such an app would have access to the DoD global address list in Exchange. It would also encourage a handshake akin to “are you in a place where you can securely talk?” which would have taken the Russian envoy out of the chat.

monocasa• 1 year ago

Reminder that the CIA funded Signal in the first place through the National Endowment for Democracy.

CIA Director Reveals Signal Comes Installed on Agency Computers

Related Stories