Governance & Risk Management
,
Remote Workforce
‘Encryption Can’t Protect You From Stupid,’ Says Leading Cryptographer
We’re all human. Who among us hasn’t lost a thumb drive or added a journalist to a consumer-grade encrypted app group chat devoted to White House war planning and military operations?
See Also: Future-Proof Your Business: A Comprehensive Guide to Application Modernization and Development for Public and Private Sectors
The answer, of course, apparently is U.S. National Security Advisor Mike Waltz. The Atlantic editor Jeffrey Goldberg recounted Monday that he received a connection request on Signal from Waltz, becoming part of a “Houthi PC small group” on which Secretary of Defense Pete Hegseth texted a confidential war plan to bomb Houthi targets across Yemen.
To be fair, accidents play a part in the vast majority of security incidents that lead to data exposure. The most recent Verizon Data Breach Report analyzed 30,458 real-world security incidents. While 2.9% of breaches traced to privilege misuse – aka “employee betrayal” – in a whopping 68% of breaches, the cause instead traced to insiders making inadvertent mistakes.
Some accidental data breaches pose a bigger risk than others – say, to the lives of U.S. military personnel involved in an active operation.
Goldberg reported that he received on March 15 a request from someone identified as Waltz to join a group chat being hosted on the Signal messaging app, which uses asymmetric encryption to scramble messages from one end of a conversation to the other.
The discussion included missives from the U.S. vice president and other high-level officials, as well as details of “weapons packages, targets and timing” of attacks against Iran-backed Houthi targets in Yemen, in reprisal for its Red Sea ship attacks. The bombs began to fall on Yemen two hours after Hegseth shared the plans to the chat app group.
The White House has confirmed the leak. To his credit, Goldberg declined to name an active, high-level CIA official who was on the call or to release sensitive information detailed in the chat.
The discussion would have been of interest to rival nation-states, including Iran. As one former Dutch intelligence official said: Pressuring the Houthis means pressuring Iran and its nuclear ambitions.
President Donald Trump on Tuesday described the incident to NBC News as being “the only glitch in two months, and it turned out not to be a serious one.” He said that Waltz had “learned a lesson.”
How many times members of his administration used Signal to disseminate or discuss classified information, and in what settings, isn’t clear.
Why in the world were high-level Trump administration officials using a consumer messaging app for such sensitive discussions? Some have suggested officials may be trying to evade government rules pertaining to official records, including emails, chats, voice messages and texts.
Since 2023, U.S. law has explicitly required government agencies to retain official for “between 15 and 30 years, or after declassification review, whichever is later.”
What’s covered includes “electronic messages sent or received on personal devices that meet the definition of a record,” such as emails, voice messages, texts and chats, says a 2023 bulletin from the U.S. government’s National Archives and Records Administration. “These messages must be forwarded or copied to an official account within 20 days.” Whether or not the participants have yet done so isn’t clear.
One bright spot is that many experts don’t believe Signal itself has been penetrated by foreign intelligence services. Even so, some users and their devices are still very much being targeted in ways that don’t require cracking the app itself.
No Need to Crack Encryption
Google’s Threat Intelligence Group last month warned that Russian nation-state hackers have been targeting Ukrainian users of Signal through phishing attacks designed to abuse the ability to synchronize their message history across multiple devices. The researchers said the social engineering attacks presaged more widespread, global efforts to trick Signal users into revealing their messages.
Another vulnerability, of course, is that encryption can’t combat carelessness.
“Putting aside for a moment that classified information should never be discussed over an unclassified system, it’s also just mind-boggling to me, all these senior folks were on this line, and nobody bothered to even check security hygiene 101,” Democratic Senator Mark Warner of Virginia, also the vice-chair of the Senate intelligence committee, said Tuesday at the start of an annual hearing into global threats posed by China, Russia, Iran and North Korea.
The challenge of keeping classified information secret is well known. That’s why all war-planning discussion and coordination is meant to be held only in a sensitive compartmented information facility, retired Gen. Barry R. McCaffrey told MSNBC on Monday night. The White House situation room features a SCIF, as does Trump’s Mar-a-Lago Florida residence. Portable versions are also available.
Almost every type of digital device – smartphones, smart watches, thumb drives and anything that can transmit or receive in any way – gets confiscated well before anyone gets into a secure environment, and well before they’re near the actual SCIF, due to the operational security risk it poses, McCaffrey said.
“The point is @signalapp doesn’t need to be penetrated by anyone – and I don’t believe it has – if you’re daft enough to invite unauthorized people to join your group chat,” said Alan Woodward, a computer science professor at England’s University of Surrey. “Same as if your phone has spyware. Why do you think mobiles are banned from SCIFs?”
Besides helping to prevent foreign intelligence agencies from eavesdropping, access to a SCIF is tightly controlled, meaning anyone who’s there has been verified as being who they say they are.
Failing to confine war planning and operations to a SCIF appears to be one major failing tied to White House’s Signal group chat debacle. Adding a journalist to the group chat was another.
“Encryption can’t protect you from stupid,” said Matthew Greene, a professor of cryptography at Johns Hopkins University.
That’s the point, though. We’re all human. We regularly make mistakes; OpSec is difficult. That’s why governments create careful rules and procedures, especially around classified information, as well as develop and maintain expensive facilities and communications equipment to keep adversaries from listening in. That’s what they’re there for.