Why the Signal group chat was a channel design failure before it was a leak

The week

On March 24, 2025, The Atlantic’s editor-in-chief reported that he had been added to a Signal group chat of senior national security officials. Signal is a free messaging app, widely used by journalists, activists and ordinary consumers, that encrypts messages from one end to the other so that only the people in the conversation can read them. The officials in the chat included national security adviser Michael Waltz and defense secretary Pete Hegseth. They discussed the U.S. strikes on Houthi targets in Yemen carried out on March 15.

Those strikes opened a sustained U.S. air campaign against the Houthis, the Iran-backed movement that had attacked commercial shipping in the Red Sea since late 2023. The chat therefore concerned live military operations, with aircraft in the air and crews at risk. That context explains why questions about the content arrived so quickly, and why they were so pointed.

The account was precise about the sequence. The group, labeled “Houthi PC small group,” had been set up around March 11, and the journalist was added on March 13. Its membership, as later published, ran to about 19 accounts. Names on the list matched the vice president, the secretaries of state, defense and the treasury, the CIA director, the director of national intelligence and the White House chief of staff. The journalist said he initially doubted the chat was real, and left it after the strikes began on schedule.

Most people have been added to a group chat by mistake at least once: the neighborhood thread, the wrong family group, the colleague with the same first name. This time the same ordinary slip happened in a conversation about military strikes.

The White House said the chat appeared authentic. A National Security Council spokesman said the council was reviewing how an unintended number had been added to the thread. Senior officials, including the defense secretary, said no war plans or classified material had been shared. On March 25, the CIA director and the director of national intelligence told the Senate Intelligence Committee, at its annual threat hearing, that the chat contained no classified information. The House Intelligence Committee questioned them the next day.

On March 26, the magazine published further messages, including strike timing and weapons details. It said it was publishing them because officials had disputed its account of what the chat contained. The dispute over content thus became a dispute that only the record could settle. Reports said messages in the chat were set to disappear, a Signal feature that automatically deletes messages after a chosen period. The settings reported were one week and later four weeks. That feature is popular for personal privacy. For a government official, it collides with the legal duty to keep records of official business.

The legal consequences arrived within days. That week, the group American Oversight sued under the Federal Records Act, the law that requires federal agencies to preserve records of their work. On March 27, a federal judge ordered the agencies involved to preserve Signal messages from March 11 to 15. Congressional committees questioned intelligence chiefs about the chat that week.

The episode did not come out of nowhere. In December 2024, after Chinese state hackers were found inside U.S. telecommunications networks, CISA had urged highly targeted officials to use end-to-end encrypted apps for personal mobile communications. In February 2025, Google researchers had reported Russia-aligned attempts to hijack Signal accounts. And on March 18, a week before the story broke, a Pentagon memo had reportedly warned that third-party apps such as Signal were not approved for nonpublic unclassified information.

The story was told, understandably, as a story about one wrong contact. But underneath the headline was a question that applies to every public agency, and to many private organizations too. Officials reached for a consumer app because it was convenient and secure in one specific sense. What it could not do was everything else an official channel has to do. It could not keep sensitive content in the right place or make sure everyone in the conversation was who they claimed to be. Nor could it preserve the record the law requires.

Coverage of the Signal episode centered on the wrong person in the chat. That error is unlikely to recur in exactly the same form, and it applies mainly to national security officials. The failure underneath it applies to every federal, state and local agency.

Officials chose a consumer app because the approved alternatives did not meet their needs, and the consumer app could not do three things an official channel must do together. It could not enforce a boundary on what content belongs there. It could not verify who was in the conversation. It could not keep the record the law requires. Each property needs a different control, and fixing one while ignoring the others moves the risk rather than removing it.

The three properties have different owners in most agencies. Security and classification officers own the boundary. Identity and IT teams own who is in the room. Records officers and counsel own the record. Because no single office owns all three, a channel can pass one office’s review and fail the other two.

Encryption, disappearing messages and records

A few terms come up repeatedly in this story, and they are often used loosely.

End-to-end encryption. When a message is end-to-end encrypted, it is scrambled on the sender’s phone and unscrambled only on the recipients’ phones. Nobody in between, including the company that runs the service, can read it. It works like a letter sealed in a lockbox to which only the sender and recipients hold keys. The postal service carries the box but cannot open it. Signal is widely respected for doing this well.

Disappearing messages. Many messaging apps let users set messages to delete themselves after a period, from seconds to weeks. This protects personal privacy if a phone is lost or seized. It also means no copy remains unless someone deliberately saves one.

Enterprise collaboration platforms. These are the messaging and meeting tools an organization runs for its own staff, such as the chat features built into an agency’s office software. Their defining feature is that the organization, not the individual user, controls them: who can join, what is kept, and for how long.

Accredited systems. For classified information, the government uses separate networks and devices that have been formally assessed and approved for that level of sensitivity. A personal or commercial phone app is not one of them, no matter how good its encryption.

Records. Under federal law, and under similar state and local laws, information created in the course of official business is a public record. Agencies must keep it according to set schedules, and the public, courts and Congress may be entitled to see it.

These are different jobs. Encryption protects a message in transit. It does not decide whether the message should exist on that device, who is in the conversation, or whether a copy is kept. A channel can be excellent at one job and fail entirely at the others.

What “approved” means in government

Approval is a process, not a reputation. Federal agencies generally use cloud services that have been authorized under FedRAMP, the government-wide program that assesses cloud providers’ security. Defense components apply their own additional levels for more sensitive data. Classified systems go through a separate accreditation altogether.

Approval also covers management. An approved platform gives the agency an administrative console: it can add and remove users, apply retention, search content under legal process and see audit logs. Signal, by design, has no such console. Its strength for individuals, that nobody but the participants controls the conversation, is the same feature that makes it unmanageable for an institution.

Which records law applies

The chat also showed how many records regimes can meet in one conversation. The Federal Records Act governs agencies such as the Defense and State departments, the CIA and the Treasury. The Presidential Records Act governs the president’s immediate staff and advisory bodies, including the National Security Council staff. Both laws require an official who uses a non-official account to copy or forward the message to an official account within 20 days.

A single group chat with cabinet secretaries and White House staff therefore produced records under two different statutes, held by different custodians, with different rules on public access. State and local governments have their own public records acts, which vary by state. A county chat that includes a sheriff, a health director and a city police chief may involve three custodians and three retention schedules.

Boundary: which content belongs on which channel

Signal itself was not the problem. In December 2024, CISA, the federal Cybersecurity and Infrastructure Security Agency, had advised highly targeted individuals to use end-to-end encrypted messaging apps for their personal mobile communications. Encryption protects content in transit. It says nothing about whether the content is authorized for the device or the app. Classified military operational details belong on accredited systems, and commercial apps on phones are not accredited for them.

The CISA guidance and the Pentagon’s own warning were consistent once read carefully. CISA was advising individuals on how to protect personal communications from foreign interception. The Pentagon memo, as reported, addressed which channels could carry official nonpublic information. Officials who read the first as permission for the second confused protection with authorization.

The same problem outside national security

The same boundary problem exists far from the Pentagon. A state police agency handles criminal justice information subject to the FBI’s CJIS Security Policy, the rulebook that governs how criminal history and related data must be protected. A public health department handles protected health information. A procurement office handles bid information that is sensitive before award. In each case, the agency has rules about which systems may hold which data, and staff carry phones that ignore those rules.

The list goes on. State revenue and benefits agencies that receive federal tax information must follow the IRS’s Publication 1075. School districts handle student records protected by FERPA, the federal student privacy law. Federal agencies mark much of their sensitive unclassified information as Controlled Unclassified Information, which has its own handling rules. Each regime defines where data may live, and none of them lists a consumer messaging app.

Take a mid-sized county. Its sheriff’s office, health department and purchasing office all use the county’s enterprise email and chat. But the sheriff’s command staff coordinate overnight incidents through a consumer messaging group because the county chat app is slow to open on a phone and does not reach the neighboring city’s police department. The health director texts her deputies about outbreak cases from her personal phone while traveling. No one here acts with malice, yet all of it moves sensitive information outside the systems the county has approved for it.

Making the approved channel reachable

Effective boundary controls start with making the approved high-sensitivity channel reachable. If secure communication requires a desk, a separate device and a separate login, senior staff traveling between meetings will not use it. Agencies should map their most frequent sensitive coordination tasks, then provision a compliant path for each. Training should use concrete examples from the agency’s own work, such as which messages about an investigation or a contract award belong on which system.

The mapping exercise is concrete. For each recurring task, write down who takes part, how urgent it is, what kind of information it involves and where participants are when it happens. A sheriff’s overnight incident coordination is urgent, involves criminal justice information, includes outside agencies and happens on phones. That description points directly to the controls the channel needs.

Device management and labels

Device management carries part of the load. Mobile device management software lets an agency control its phones centrally. Agencies can separate work and personal profiles on government phones, so official apps and data live in a walled-off section. They can restrict which apps may run in the work profile, and block copy and paste from approved systems into unapproved ones. These controls will not stop a determined official, but they make the compliant choice the default one.

Enterprise platforms add a second layer. Sensitivity labels can mark a chat, a channel or a document as holding criminal justice or health information. Data loss prevention rules can then warn or block when someone tries to share labeled content outside the approved boundary. The rules need tuning, since aggressive blocking pushes staff back to personal phones.

The speed objection

The strongest objection is speed. Senior officials coordinating a crisis need to reach each other in seconds, often from cars, airports or homes. Accredited systems for classified material are, by design, harder to reach. Officials will argue that a secure-enough app in hand beats a perfect system in a locked room.

The objection is real, and it is an argument for investment rather than exemption. Where the work is classified, the answer is mobile access to accredited capabilities for the small number of people who need it, plus the discipline to wait for them. Where the work is sensitive but unclassified, a well-configured enterprise app on a managed phone is as fast as a consumer app. The gap the objection describes is mostly a gap in provisioning.

Identity: who is in the room

The original error was an identity error. A contact was added to a group and nobody confirmed who it was. In an enterprise collaboration platform tied to an agency directory, the central list of staff and their roles, group membership follows directory groups, external participants are labeled, and administrators can review access. In a consumer app, a group is whatever its creator says it is, and display names are self-asserted. Anyone can call themselves anything.

Most of the time that works well enough, because members recognize one another’s names and the group stays small. It fails precisely when someone unexpected joins and nobody checks, which is what happened in March.

A nineteen-member group makes the problem worse. In a three-person thread, an unfamiliar name stands out. In a group of nineteen senior officials and their staff, each member assumes someone else knows who the newcomer is. Large groups spread responsibility for membership so thinly that nobody holds it.

Attacks that use the same gap

Identity risk runs in both directions. In February 2025, Google’s threat intelligence group reported that Russia-aligned actors were trying to take over Signal accounts. They abused the app’s linked-devices feature, which lets a user connect a computer or tablet to their phone’s account. A trick that links an attacker’s device to a victim’s account lets the attacker read along unnoticed. In May 2025, the FBI warned that attackers were impersonating senior U.S. officials through text and AI-generated voice messages to gain access to the accounts of current and former officials. A channel where outsiders can be added silently, or where impersonators look identical to principals, is a channel built for these attacks.

The linked-devices attack works through a QR code, the square barcode a phone camera reads. Linking a new device normally means scanning a code the app displays. Attackers disguised linking codes as group invitations or security alerts. A victim who scanned one connected the attacker’s device to their account, which then received copies of new messages.

Consumer apps offer some defenses. Signal lets users compare a “safety number” to confirm they are talking to the right person, and shows the list of linked devices in its settings. Both depend on each user checking, every time. An enterprise platform moves those checks to the institution: devices must be registered, sign-in requires strong authentication, and administrators can see and revoke sessions.

Group hygiene

Small habits close much of the identity gap. Each group should have a named owner who answers for its membership. Groups that handle sensitive work should be kept as small as the task allows, and closed when the task ends. Membership should be checked whenever a new name appears, by the owner and not left to whoever notices. Enterprise platforms can enforce some of this, for example by limiting who may add outsiders, but the habit matters on any platform.

Federation for cross-agency work

For cross-agency coordination, the fix is federation. Federation means connecting two organizations’ enterprise platforms so that each can talk to the other while each still controls its own users. Agencies should configure their enterprise platforms to allow named external tenants, with external users visibly marked. Cross-agency work is exactly where officials have reached for consumer apps, because enterprise tools often stop at the agency boundary. In the hypothetical county, federating the county platform with the neighboring city’s police department would remove the main reason the sheriff’s command staff use a consumer group at all.

Federation needs governance of its own. Someone must decide which outside organizations are trusted, review that list each year and remove partners who no longer need access. Group owners should confirm membership on a schedule, especially for groups that include outsiders. A label that says “external” is useful only if people notice it.

Strong sign-in, by type of agency

Federal employees generally sign in with PIV cards, the smart-card credentials issued under a 2004 presidential directive. Those cards work well on desktops and less well on phones. Agencies have added phishing-resistant mobile options, such as hardware security keys or device-bound passkeys, to fill the gap.

Most state and local governments do not issue PIV cards. They can reach a similar standard with security keys or passkeys tied to managed phones. CISA’s December 2024 guidance urged highly targeted people to adopt phishing-resistant authentication of this kind and to stop relying on codes sent by text message. For a county, issuing keys to its forty most senior and most targeted staff is a modest project with a large effect.

Impersonation needs a procedural answer as well as a technical one. Staff should know that a request to move a conversation to a new app, or a voice message from a senior official asking for action, is verified by calling back on a known number. Senior officials should agree to be verified this way and not take offense.

Record: what the agency keeps

The Federal Records Act requires agencies to preserve records of official business. Since 2014, it has required that an official who creates a record on a non-official messaging account copy or forward it to an official account within 20 days. Disappearing messages make compliance depend on each official remembering to export before deletion. That rarely happens. State and local agencies face their own public records and retention laws, often with similar duties, and counsel should confirm how each schedule applies.

The 2014 amendments also made an intentional violation of the forwarding rule a basis for disciplinary action. The National Archives has long advised that text and chat messages can be federal records, depending on their content, the same as email. Whether a message is a record turns on what it says and why it was sent, not on which app carried it.

How state courts have treated personal devices

State courts reached similar conclusions years earlier. In 2015, Washington’s Supreme Court held that a public employee’s text messages about official business could be public records even on a personal phone. In 2017, California’s Supreme Court held that officials’ communications about public business on personal accounts can be public records under that state’s law.

Those rulings put the burden on the employee and the agency together. The employee may have to search their own phone and attest to what they found. The agency has to have a process for asking. Neither works well if the messages were set to disappear.

Losses that come from device management

Records can also disappear through ordinary IT work. In 2022, it emerged that the Secret Service had lost text messages from January 2021 during a planned replacement of agents’ phones. The loss became the subject of an inspector general inquiry and congressional scrutiny. No consumer app was involved. The records were lost because nobody had connected the device migration to the retention duty.

The point for any agency is that records capture has to be designed into device life cycles. Phone refreshes, carrier changes and app upgrades should each have a records step, signed off by the records officer, before old devices are wiped.

Native capture, legal holds and archives

Records capture works best when it is native to the approved channel. Enterprise messaging platforms can apply retention policies and legal holds centrally. A retention policy keeps messages for a set period; a legal hold freezes them indefinitely when litigation or an investigation is expected, as the judge’s preservation order did in this case. When these are built into the platform, the record is kept whether or not the official thinks about it.

Wrapping a consumer app with a third-party archiving client is the alternative many organizations reach for. That approach adds a new component that holds every message in one place, often outside the agency’s security monitoring. An archive is a target. Gathering every sensitive conversation into one store creates exactly the prize an attacker wants. It needs the same security review, logging and access control as the messaging platform it serves.

The financial industry had already tried this route. Starting in late 2021, the SEC and the Commodity Futures Trading Commission brought a long series of cases against broker-dealers and other firms. Their staff had used WhatsApp, Signal and text messages for business without keeping the records their rules require. Penalties across the sweep ran into the billions of dollars. Many firms responded by buying archiving add-ons that capture messages from consumer apps. Government agencies looking for a quick fix were reaching for a market built for that enforcement wave.

The costs of keeping everything

Retention has costs that agencies should weigh honestly. Every retained message may have to be searched in response to a public records request or a lawsuit. A county that captures all staff chat will spend more time on records requests. Retention schedules exist so that transitory messages can be deleted lawfully once their short retention period ends.

The goal is lawful retention, not maximum retention. Many schedules distinguish substantive records from transitory ones, such as a note that someone is running late. A well-configured platform applies the right schedule automatically, so the agency keeps what it must and disposes of the rest on time. That beats both disappearing messages and keeping everything forever.

What an inspector general or auditor will ask for

When an inspector general, a state auditor or a court looks at an agency’s messaging, the requests are predictable. Agencies that can produce the following quickly are in a far better position than those that cannot.

• The retention and legal hold settings on each approved messaging platform, with the date each was last changed.
• Evidence that a legal hold was tested and worked, such as a log from a drill.
• An inventory of agency phones and the apps installed on them.
• The written policy on personal devices and accounts, and records showing staff were trained on it.
• Any forwarding of messages from personal accounts, as the 20-day rule requires for federal officials.
• The register of exceptions, with owners and end dates.

Each of these documents is easy to produce if the platform was designed for records from the start. They are very hard to reconstruct after a lawsuit has been filed.

A shared metric for three offices

Records officers, CIOs and general counsel share this problem, and none can solve it alone. A useful joint metric is the share of business messaging that flows through channels with automatic capture, measured through device management and network data. Another is the number of approved exceptions, each with an owner and an end date. Both are numbers an agency head or an elected oversight body can follow without technical training.

How the three properties interact

The three properties interact, and this is where well-meaning fixes go wrong. A ban on consumer apps, without a reachable approved channel, pushes officials to personal text messages, which fail on all three. An archiving add-on solves the record and opens a new security exposure. An enterprise tool that cannot reach other agencies sends officials back to the consumer app. The workable design delivers all three at once.

Each common fix can be scored against the three properties.

• Ban consumer apps, change nothing else. Boundary improves on paper. Identity and record get worse as traffic moves to personal texts and calls.
• Add an archiving wrapper to the consumer app. The record improves. The boundary is unchanged, identity is unchanged, and a new concentrated target appears.
• Deploy an enterprise app without federation. Boundary, identity and record improve inside the agency. Cross-agency work stays on consumer apps.
• Enterprise app, federated, on managed phones, with native retention. All three improve together. This is also the option that takes longest and needs the most coordination.

Remove any one of the three and the arrangement fails, usually in the direction of whatever is most convenient for a busy official at eleven at night. Each proposed fix therefore has to be judged against all three properties rather than only the one that prompted it.

The case for consumer encryption

A serious counter-argument holds that consumer end-to-end encryption is safer than enterprise platforms. Enterprise systems keep messages on servers the provider can read, and those servers get breached. In 2023, a China-based group accessed the cloud email of officials at the State and Commerce departments through a flaw in Microsoft’s systems. A federal review board later criticized the security failures behind it.

That argument is right about one property and silent on the other two. Server-side access is what makes retention, legal holds and administrative control possible. Agencies can reduce the risk with strong provider security requirements, encryption keys they control and close monitoring. For the most sensitive conversations, the answer is accredited systems, not consumer apps. The trade-off between protecting content from the provider and keeping the record is real, and it should be made deliberately for each tier of information.

The stakes go beyond the legal. When officials communicate through channels that fail these tests, the consequences show up as exposed operational details, lost public records, litigation, inspector general reviews, hearings and damaged public trust. For state and local governments, the same failure can mean a public records lawsuit, a compromised investigation or a procurement protest. The cost of getting the channel right is modest by comparison.

Fixing one county’s channels in a year

Return to the hypothetical county and suppose its new administrator decides to fix the problem properly over, say, a year.

Step one is honest discovery. The administrator asks the CIO, the records officer and the county attorney to find out, without blame, how staff actually coordinate sensitive work. Device management data shows which messaging apps are installed on county phones. Short interviews with the sheriff’s command staff, the health director and the purchasing manager reveal why. The answers are rarely about secrecy. They are about speed, reach and habit: the consumer app opens instantly, it reaches the city police, and everyone already has it.

Discovery should also cover personal phones used for county business, which device management cannot see. A short, confidential survey and the records officer’s knowledge of past public records requests usually show where official messaging lives. The point of this step is a map, not discipline.

Step two is fixing the approved channel before banning anything. The CIO makes the county’s enterprise chat app available in the work profile of every county phone and sets it to stay signed in securely. The CIO also federates it with the city police department and the regional hospital, with outside participants clearly marked. Now the approved tool does the job the consumer app was doing.

This step usually needs money. Some staff who use personal phones for county work will need county phones, or a managed work profile on their own device with a stipend. Security keys for senior staff, licenses for the enterprise platform and staff time for federation all appear in the budget. The county board should see the cost alongside the exposure it removes.

Step three is setting the boundary in simple language. The county publishes a one-page guide with examples drawn from its own work. Criminal justice information stays in the sheriff’s approved systems; patient details stay in the health department’s systems; bid information stays in the procurement platform; everyday coordination goes in county chat. Staff can remember a page of examples far better than a policy manual.

Step four is making the record automatic. The records officer applies retention schedules to county chat and tests that the county attorney can place a legal hold within an hour. Disappearing-message settings are switched off for official channels. The records officer also adds a records step to the phone replacement process, so no device is wiped before its content is captured.

Step five is measuring and following up. Each quarter, the CIO reports the share of business messaging that flows through captured channels and the list of open exceptions. When a department head asks for an exception, it comes with an owner and an end date.

The steps require no exotic technology or large budget. What they require is leadership attention, cooperation among the CIO, records officer and counsel, and a willingness to make the compliant path the easy one.

How the plan changes for other governments

A federal agency follows the same steps with more constraints. Its platforms must carry the appropriate federal authorizations, its classified needs require separate accredited systems, and the National Archives sets the records framework. A large state agency sits in between, often bound by a statewide platform choice made by the state CIO. A small town may have no CIO at all and depend on a county or state shared service. For the town, the most important step is choosing a shared platform that already has retention configured, rather than building its own.

Making the compliant path the easy one

Agencies that have taken this episode to heart tend to share several features.

• An approved messaging channel that works well on a phone and opens as quickly as a consumer app.
• Clear, example-based guidance on which kinds of information belong on which system.
• Federation with the partner agencies staff most often need to reach, with outside participants clearly labeled.
• Phishing-resistant sign-in for senior and highly targeted staff, and a call-back rule for unusual requests.
• Automatic retention and legal hold on the approved channel, so record keeping does not depend on memory.
• Government phones with separate work profiles and restrictions on which apps may handle official data.
• A records step in every phone replacement and platform migration.
• A short list of exceptions, each with an owner and an end date, reviewed regularly.

The failures are equally familiar.

• Banning without replacing. Prohibiting consumer apps without offering something as convenient drives use underground.
• Confusing encryption with compliance. A secure app is not automatically an approved one for sensitive content or record keeping.
• Bolting on an archive. A third-party archiving tool can satisfy the records requirement while creating a new, concentrated security risk.
• Stopping at the agency boundary. If the official channel cannot reach partners, staff will find one that can.
• Keeping everything forever. Over-retention raises the cost of every records request and lawsuit without improving compliance.
• Exempting senior leaders. The most senior officials are often the most targeted and the least constrained. Controls should apply to them first, not last.

Where official messaging actually happens

1. What channels do our senior staff actually use to coordinate urgent, sensitive matters after hours, and do we know or are we guessing?
2. Does our approved messaging tool work as quickly and easily on a phone as the consumer apps people prefer?
3. Can our approved tool reach the partner agencies we most often coordinate with, and are outside participants clearly marked?
4. Are messages on our approved channel retained automatically, and can we place a legal hold on them quickly if a court or investigator asks?
5. What share of our business messaging flows through channels with automatic capture, and how many exceptions are open?

With hindsight

The episode had a long tail, and almost every part of it touched one of the three properties described above.

Within weeks, the boundary question widened. In April 2025, The New York Times reported a second Signal chat in which the defense secretary had shared details of the same strikes with a group that included his wife and brother. The Pentagon’s inspector general had already opened an evaluation of the secretary’s use of the app, announced in early April at the request of senators on the Armed Services Committee.

In early May 2025, Waltz left the national security adviser role and was nominated as ambassador to the United Nations, a post the Senate confirmed in September. A photograph from a Cabinet meeting showed him using TeleMessage, a modified Signal client that archives messages. The record-keeping problem, it turned out, had been addressed with exactly the kind of archiving add-on that concentrates sensitive messages in one place.

TeleMessage was the sort of product the financial industry had adopted to answer the SEC’s off-channel messaging cases. Its version of Signal, called TM SGNL, copied messages to an archive server so they could be retained. That design solved the record problem by creating a second copy outside Signal’s end-to-end encryption.

Within days, TeleMessage was reported breached and suspended its service. On May 12, CISA added a flaw in the product to its catalog of known exploited vulnerabilities, the government’s list of security weaknesses that attackers are actively using, followed by two more in July. The archive had become the target, much as the boundary-identity-record framework would predict.

The identity threats also continued. The FBI’s May 2025 warning about impersonation of senior officials, by text and AI-generated voice, showed attackers exploiting the same habit the chat revealed. Officials were used to being contacted on personal apps by people they believed they knew. That habit was the opening.

In December 2025, the Pentagon’s inspector general reported that the defense secretary’s use of Signal on a personal phone to send sensitive nonpublic information violated department policy. It noted that unapproved apps and devices make it harder to retain records as the law requires. It made no recommendations specific to the secretary because, it said, his use of Signal was only one instance of a department-wide issue.

According to the unclassified version released on December 4, the information he shared came from a document marked classified at the time. The report said sending it on an unapproved app risked compromising the mission and endangering personnel. The inspector general did not decide whether the information had been properly declassified, noting the secretary’s authority to classify and declassify. The secretary gave written answers but declined an interview and did not provide his phone.

That department-wide finding is the one most worth carrying forward. The inspector general framed the problem as institutional rather than personal. In any agency, individual discipline is not enough. If the approved channel is harder to use than the consumer alternative, people will drift to the consumer alternative. The organization will then carry the boundary, identity and records risks whether or not anyone is ever added to the wrong chat.

One part of the original argument needs refining in hindsight. It treated an archive as a records fix with a security cost attached. TeleMessage showed that the cost can arrive within days of public attention. It also showed that an archive can undo the encryption that made the original app attractive. A records solution has to be judged as a security product first.

The fix is a design decision that leaders own, rather than a reminder memo to staff.