This as-told-to essay is based on a conversation with Timothy H. Edgar, a 53-year-old cybersecurity expert who advised the director of national intelligence during the George W. Bush administration and advised former President Barack Obama on privacy issues in cybersecurity policy. It’s been edited for length and clarity.
I worked in the intelligence community for six years during the Bush and Obama administrations, advising on matters relating to cybersecurity and privacy.
When I first read The Atlantic article detailing the Signal chat discussion about military strikes in Yemen among top national security officials in the Trump administration, my first thought was how remarkably reckless and foolish these leaders were.
Signal is a perfectly great encrypted app for people to engage in all sorts of conversations, but it’s not designed for classified conversations. We’re talking about the most sensitive kinds of conversations that top officials have.
The entire conversation was clearly classified. The policy discussion reveals important information about top officials — what their thinking is about a sensitive foreign policy issue. There’s no doubt that’s classified and needs to be protected. The operational details are obviously highly classified.
The semantic debate playing out between the White House and journalists over whether these were war plans or attack plans completely misses the point. In many ways, attack plans are more sensitive than war plans, because war plans are plans, right? They might happen. They might not.
This was an order to military forces in the field to conduct active operations that were disclosed to a journalist two hours before they took place. It’s just completely obvious that this would endanger the lives of military personnel if it had gotten into the wrong hands. And, obviously, we had a journalist in the form of Jeff Goldberg from The Atlantic mistakenly added to the chat, and he handled the information responsibly, but it could have been anyone in somebody’s contact list.
It’s just completely inconceivable. Mistakes happen, to be clear, but this conversation should never have been taking place on anyone’s personal or government device no matter what app they were using, no matter how secure the app was.
Related stories
Business Insider tells the innovative stories you want to know
Business Insider tells the innovative stories you want to know
Signal is encrypted, but the phone is not secure
Signal uses the same encryption that the US government uses to protect classified information. That’s not the point.
The point is that it’s a commercial platform on which the US government has no control over vulnerabilities. But far more importantly, it’s the phone that makes it dangerous. The phone is not secured.
That’s why you take your phone and you put it in a locker before you go into the Situation Room. Before you go into any classified space at the Old Executive Office Building, you take your phone out of your pocket and lock it because some foreign government might have planted a piece of malware that turns it into a listening device.
That was true 15 years ago. And hackers are far more sophisticated these days.
We have very sophisticated malware that can subvert phones and other mobile devices without you having to click on any links, and which basically just gives the adversary complete access to what’s on your phone, as if they were using your phone.
The main thing is that you don’t talk about highly sensitive, classified information on those devices. That’s why we have millions of dollars invested in creating secure communications for top officials, both devices and also processes.
Top officials need to worry about physical security. It’s not just about the device. It’s not just about the hacking. It’s about making sure that you are in a physically secure location. It is literally what the Situation Room is for — to have the conversation that they had on a commercial app on unsecured devices.
Think about that famous photo of the raid against Bin Laden with all those cabinet officials around the table in the Situation Room, watching in real time as forces were out there conducting that operation during the Obama administration. That was basically what the Trump officials were doing — only they were doing it on Signal.
One of the questions we should be asking is how many other principles committee groups have been discussed on Signal because this looks like this is something they’re routinely doing.
It’s wild there were no consequences
The fact that it didn’t result in any consequences — that’s sort of wild. That’s kind of like, I took the nuclear codes, and I left them in Starbucks, and then I went back 15 minutes later and found them, and thank goodness nobody got them. Then thinking: “Well, I guess it wasn’t a problem because nobody got them.” That’s just nuts.
Hillary Clinton got in trouble for using her personal device to send unclassified emails. A few of them were later found to contain classified information. People were upset about this in the national security world — not just in the right-wing media.
But now we’re talking about real-time chatting on a commercial app with a principals committee meeting of the National Security Council. That’s about as sensitive as they get.
To be clear, I’m someone who has criticized over-classification. I have written a book, actually, about the Snowden revelations, in which I criticize the way in which some of those programs were kept from the American public and should have been disclosed earlier.
This Signal chat is not even remotely a close call.
It should have never happened in the first place.
The White House did not immediately respond to a request for comment.
