CIA Director Reveals Signal Comes Installed on Agency Computers | Hacker News Reader

CIA Director Reveals Signal Comes Installed on Agency Computers

theintercept.com

117 pointsjbegley99 comments

A lot of tech people here are obviously unfamiliar with the history of this. They used to use Gmail for nominally unclassified communication. Several years ago they unceremoniously dropped Gmail for all purposes, without much explanation. It was mostly replaced with Signal.

I originally started using Signal almost entirely as a side effect of this transition. It was blessed as a preferred choice of the US intelligence community for unclassified comms many years ago. And a lot of classified comms if we are honest. If you worked in the US government, you needed Signal.

This isn’t a value judgement, just an acknowledgement of reality. Given this, it would be weird if they didn’t have Signal installed.

I can second this, and I'll add that other corners of the bureaucracy also like Signal. From my POV, the interesting part is that the CIA has incorporated Signal into SOP, rather than it being an ad-hoc thing.

It's probably a matter of pragmatism. People are gonna use instant messengers, might as well recommend the least bad one. I've seen it in corporate environments too. If you have locked-down workstations, there's usually some list of free software that isn't officially supported, but doesn't require special approvals.

It seems strange that the CIA isn't running their own fork of signal which uses their own servers to avoid leaking metadata.

Not really. The killer feature of Signal isn’t the encryption it’s auto-deletion.

Which any CIA fork would not be able to keep since it violates FOIA laws.

Yes, the scandal here is not just the questionable security. It is also clear intent to circumvent transparency laws which suggests they may be intending to hide the breaking of other laws.

Honest question, why is it legal to use auto deletion with Signal, but illegal to have a fork of Signal with auto deletion?

it is not legal, but that also doesnt matter when nobody can enforce it

Using signal with auto deletion is illegal. Creating a fork of Signal for CIA (or whichever) use and then deliberately not removing auto-deletion is really illegal. I think that's the thought process, at least.

I’ve seen others within the CIA say that the statements about signal being pre installed are false.

> And a lot of classified comms if we are honest

Those people should receive administrative reprimands for that, probably up to termination. If they were discussing active strikes, targets, and intelligence sources, then they should probably be indicted.

If history has taught us anything (Hillary), that's just wishful thinking from people without power and political rivals. On rational side, most likely one of their phones got hacked which caused this leak. They are high profile targets after all. At their level, exactly what's the SOPs they must follow otherwise gonna get fired? They may push for policies downstream, but policies that govern them? They can just argue for precedence (Hillary) and nothing gonna come of this.

It was my understanding that after extensive investigation there was found to be no classified material shared on that server - which checks out since emailing classified information is pretty uncommon outside of SIPRNET and the like

I don't know how they would classify gossips, opinions, deals made by a Secretary of State with or regarding the heads of foreign nations. I'm sure it's an "extensive" investigation. Haha. Democrats probably just want to sweep it under the rug, and Republicans want to use it for favors/card in this situation.

> I'm sure it's an "extensive" investigation.

This specific desire to not do unnecessary legwork, and lean on the assumptions we already hold, are the teeth of the termites that tear through society and lead to polarization.

It’s not a criticism - I couldn’t be less inclined to go through the actual searches to verify this either way.

This is just the failure state that happens an infinite number of times online every day, across the world.

At some point, the conversations start demanding a level of work that’s beyond what we are willing to put in. I can’t see any real solution for it. (Unless there’s some GAI magic wand for this.)

Congressional republicans investigated extensively and had a vested interest in finding wrongdoing.

There is a world of difference between everyday government conversations.

And discussing a country being bombed including exact times, what weapons are being used, locations of US personnel etc. And where one of the members of that group was in Moscow visiting Putin and likely would’ve been using a Russian WiFi network or cellular connection.

No reason, whatsoever, for Signal to be used in this situation.

>No reason, whatsoever, for Signal to be used in this situation.

It sounds like the exact appropriate time to use Signal. It turns out that some high ranking official's jobs involve traveling to unfriendly or hostile countries. They still sometimes need to weigh in on classified communications. It was true back when Hilary was signing off on drone targets through text, and its true today.

There are secure methods of communication that don’t involve public networks.

And don’t forget that the Pentagon was warning that “Russian professional hacking groups are employing the 'linked devices' features to spy on encrypted conversations”

https://www.npr.org/2025/03/25/nx-s1-5339801/pentagon-email-...

That's quite ridiculous. What about the security of the phone they are using? When Hillary was signing off on drones via text, that was incredibly stupid and it remains true today.

Nothing is binary, everything is a tradeoff. Her texts didn't mention specifics so presumably anyone eavesdropping wouldn't have been able to identify the exact context. It's reasonable for high level officials to weigh the cost vs benefit. When you're one or two steps away from the president, you have a lot of leeway.

Yeah, you don't discuss war planning over an insecure phone. The OP talked about "in this situation", so no, you don't do that. And at least one member of that Signal chat was in Russia.

When you are one or two steps away from the President, you should be even more careful.

how different is it really though?

the US government is lookjng to reduce its global influence; making everything public is great

There are record retentions laws the very existence of Signal should be a violation. This is why nothing is goin to happen because they are all Breaking THE LAW anytime deletion is on

Signal can be used to arrange meetings, but secret materials like war plans need to be in SCIFs

Everybody that saw that usage of Signal and didn't shut it down should face the normal consequences, in addition to the consequences that a leader undergoes for such terrible decision making.

SCIF is a physical place, not a communications mechanism.

I believe the DoD can use applications in the JWICS suite of tools to communicate up to top secret level information. With the DCS platform for only Secret level communications.

However, these tools are on dedicated networks and dedicated machines. I suspect the reason for Signal usage here is that they were using their personal smartphones, which would never get on the JWICS or DCS networks.

Sending war plans around on signal to mobile phones guarantees that the information is reviewed outside of a SCIF. So what's the significance of pointing out that a SCIF is a place and not a network?

Further, one of the members of the group chat was in Russia at the time, because he's the special envoy to Russia, which means that the communication was likely viewed visually by cameras if he were to open the signal chat on his phone.

It's hard to understand this level of incompetence from supposedly "senior" people that are running our government. I would hope that any company would fire people like this immediately. But because they are politicians, they are apparently unfirable.

(And this is entirely ignoring the only reason we know this is going on, that they added a journalist to the chat, one that they claim is particularly unreliable, further damaging the opsec credibility of the politicians.)

Pretty sure one of their phones are hacked... They like to be mobile. SCIF would be counterproductive. After Hillary and this, I think they really need to invest more into a secure mobile comm program...

> So what's the significance of pointing out that a SCIF is a place and not a network?

It was a confusing Apples Vs. Oranges comparison. A SCIF and Signal were contrasted with one another, like they were providing the same or similar facilities.

There are permissible chat applications that support Top Secret tier information which is actually akin to Signal (e.g. JWICS, DCS, platforms). A SCIF is a secure place, you still need communications technology to get information to and from different remote secure locations inc. SCIFs to even hold those meetings.

Both are chat rooms.

A SCIF is a place. It may be a meeting room, but it could also be an entire building with multiple desks. Signal is a service/app. Apples and Oranges.

So both are chat rooms.

There was no confusion there. Yea, one is a room and one is a means of communication on mobile devices, but nothing was said that implied differently.

Mostly replying to emphasize the second line part of this that seems to get skipped over in a lot of the discussions

> one of the members of the group chat was in Russia at the time, because he's the special envoy to Russia, which means that the communication was likely viewed visually by cameras if he were to open the signal chat on his phone

One of the members of the Signalgate chat, Witkoff, was in Moscow meeting with Russian leader Vladimir Putin. Just after midnight Moscow time, the chat named an active CIA intelligence officer; according to a Telegram post by Sergei Markov, Witkoff and Putin were in a meeting until 1:30 a.m. [1]

[1] https://www.cbsnews.com/news/trump-envoy-steve-witkoff-signa...

Seems the government IT security and application training people are subpar to say the least. I would never have given any body an public app like signal by nature it is breaking the record retention law for ANY government communications. So guess what? nobody is getting busted or arrested or every user gets busted and arrested. Its like giving monkey's hand grenades'.

I'm not saying this in humor, I'm genuinely curious ... how do they handle Signal's absence of FIPS validation and FedRamp certification? Signal isn't even capable of being FIPS validated, the core cryptography is off NIST piste.

This failure should highlight the primary risk in infosec is always adherence by the human element, not whether you spent an extra $10B on a gov software contractor who checked the right checkboxes.

100% agree, as someone subjected to the trials of FedRAMP High and DoD IL-5 audits, how is Signal the go to when there's programs for getting SaaS services approved for unclassified communications already in place. Framed selfishly, why the heck are we even bothering with these frameworks if folks are just yolo'ing messages onto Signal? If we've got to suffer through FIPS-validated crypto, DISA STIGs, etc. shouldn't the messaging platform used at least meet par?

There was a lot of chatter on Bluesky earlier about what devices and systems were and should have been used in this particular case, and whether or not some of the testimony given was truthful or accurate.

https://www.cbsnews.com/news/nsa-signal-app-vulnerabilities-...

This Intercept article I think is a little misleading as it's taking something said in testimony at face value, and not really contextualizing it well. Some of these issues are raised in the piece a bit, but to me it reads a little strangely, like a lot of context and background is missing.

There are certain times where compliance is waved off for the simple reason that even the enforcers don't comply and no one wants to inconvenience themselves.

Does this mean the CIA is not subject to the Federal Records Act, or does it mean they're simply flaunting the law?

In every instance where I've been privvy to government partnerships, the version of the solutions we deployed were modified to meet regulatory standards.

The "Houthi PC small group" was set to have it's messages to be automatically deleted after expiration.

There is zero chance that Signal has been modified for the US government.

I don't know the specifics of signal. Can you elaborate?

> The practice began during President Joe Biden’s administration and had the official approval of CIA records management officials, Ratcliffe said, as long as “any decisions that are made are also recorded through formal channels.”

There is a tension in the interpretation of text messaging. Is it a written record like an email, which is stored and archived? Or is it more like voice conversation; ephemeral and generally not recorded or archived?

For a long time the default behavior of messaging apps was to just hold onto all messages indefinitely. This led a lot of folks in law enforcement to think of them as permanent written records.

The approach in the quote above treats them more like a voice conversation. Anything of significance should be written down in an official way, even if it originated over messaging.

>Anything of significance should be written down in an official way, even if it originated over messaging.

So in the group chat discussing code word material, who was responsible for making the written record? Perhaps that should have been one of the questions today?

Likewise, if it is true that they are using it on a regular basis at CIA HQ I can pretty much guaranty you that it is being used in a manner that is a substitute for email which would be required to be saved in entirety.

Very good question. It appears it doesn't matter what the law says, but is more a matter of who is going to enforce or prosecute.

Sorry to be pedantic

> flaunting

I believe you meant to say flouting

https://archive.is/9LqJN

John Ratcliffe mentions it here: https://youtu.be/mz1sLlpee80?t=87

This is just an attempt at damage control over the Goldberg-in-the-chat thing, isn't it?

Damage control for the insane Senate hearings today.

Amazing how the Senate can hold a hearing for something happened yesterday, but are apparently helpless to hold hearing about the dozens of other things that actually impact American's lives like housing, healthcare, etc.

Some of the people were already set to appear. This was not a scramble to get answers.

The article release was timed so that they'd have to answer questions about it.

Nice feather in the cap.

But do they send the really sensitive stuff over it?

Or, rather, do the competent people send really sensitive stuff over it?

In theory no. In practice yes. That is not unique to any administration.

I would bet my bottom dollar that Sec Def, Sec State, and CIA director have never planned strikes in a Signal groupchat in any prior administration, including Trump 1.

What about over a PSTN?

Probably. https://en.wikipedia.org/wiki/STU-III

I'm a little surprised that encrypted voice fits through PSTN. like, logically voice can fit, and encryption shouldn't change message size, but plaintext (plainspeech?) voice over PSTN is/was analog, while the ciphertext is digital. I wonder if the quality suffered.

I honestly wouldn’t know but I also wouldn’t be surprised if they did. DC lives in its own universe with its own rules.

Note this is your opinion only.

There has never been any reporting that previous administrations have discussed war plans over a non US government platform before.

That's... not what they said.

They did say that “really sensitive stuff” was being shared on Signal.

Which really only includes things like war plans.

Serious question: how would it be different if JD etc al used a "proper" secure comms app? Perhaps it would be harder to add a random journalist, but they could still accidentally add the wrong government official (maybe).

Such an app would have access to the DoD global address list in Exchange. It would also encourage a handshake akin to “are you in a place where you can securely talk?” which would have taken the Russian envoy out of the chat.

Reminder that the CIA funded Signal in the first place through the National Endowment for Democracy.

dedramp

Reply on news.ycombinator.com