Loading summary
Transcript45 lines
- [00:00]
Stephen Overle
Well, if you're recording that backup on your end, Graham will jump into it.
- [00:04]
Graham Brooke
Okay. Here, let me just close my Signal app, of all things.
- [00:13]
Stephen Overle
Hey, welcome back to Politico Tech. I'm your host, Stephen Overle, and I cannot get my mind off Signalgate. By now, you know the White House is in full attack mode after the Atlantic revealed its editor in chief was accidentally added to a Signal chat with cabinet officials and went on to publish the entire exchange.
- [00:35]
Caroline Levitt
We have said all along that no classified material was sent on this messaging thread. There were no locations, no sources or methods revealed, and there were certainly no war plans discussed.
- [00:48]
Stephen Overle
This is White House Press Secretary Caroline Levitt speaking to reporters on Wednesday.
- [00:53]
Caroline Levitt
As the President said yesterday, as the CIA director has testified under oath, this is an approved app. It's an encrypted app. The Department of Defense, the Department of State, the CIA has it loaded onto government phones because it is the most secure and efficient way to communicate.
- [01:10]
Stephen Overle
Were they war plans or attack plans? Was the information classified, sensitive, or something in between? If you put aside all the spin, those questions distract from what cybersecurity experts say is the real problem. This conversation never should have happened on Signal in the first place. Signal is a commercial app for sending encrypted messages, and it is widely used in Washington for private conversations, but not conversations about bombing the Houthis in Yemen before it happens. Graham Brooke used to facilitate these kinds of sensitive meetings under President Barack Obama, and he now oversees technology programs at the Atlantic Council, including initiatives on cyber statecraft, and disinformation. On the show today, Graham brings his security mind to the Signal Gate debate. Here's our conversation. Hey, Graham. Welcome to Politico Tech.
- [02:14]
Graham Brooke
It is good to be here.
- [02:16]
Stephen Overle
What a week, man. I mean, I read this story on Monday, my jaw hit the floor. It's clear that, like, the shock and awe is not. I haven't shaken it. I don't think Washington is gonna shake it. This is a story that, candidly, I think the Trump administration is gon have a hard time living down politically. What is your sort of jaw drop moment in all of this? Paint me a picture.
- [02:40]
Graham Brooke
So, Stephen, this story, I agree, our collective minds were blown as we were reading Jeffrey Goldberg's piece. Like, every single detail as he laid it out. Yeah, it just kind of built on itself. Just truly shocking. The way that I interact with this story is deeply personal because at one point, I had a job where I was an advisor at the National Security Council. My job was to do things like schedule principals committee meetings, and I'M here to tell you that we didn't schedule Principals Committee meetings via Signal or private messaging apps. We had really secure systems to do that. And so the thing to me, as somebody who's lived in that ecosystem and operated in that ecosystem and communicated professionally and coordinated professionally in that ecosystem, is just the sheer amount and the seniority of that engagement outside of that ecosystem about one of the most serious national security operational things that the US Government does. Counter terrorism operations.
- [03:46]
Stephen Overle
Yeah, I thought of the staffs of these people almost immediately. Like the folks whose job is to kind of set all this up. I mean, as you said, you used to do that. This was your line of work. How is this supposed to actually work.
- [03:58]
Graham Brooke
Extraordinarily bureaucratically, but very safely is the honest answer. It's one thing for a staffer to be like, you know, our bosses are going to connect via text or they're going to have a quick call on the thing that we can't talk about in open spaces. That's one thing. This was an entire meeting of the Principals Committee cabinet level officials. So think about the level of these officials. They all have security details, they all travel around the world consistently with secure communications. Like a whole tent that just has a secure way to communicate.
- [04:29]
Stephen Overle
A literal tent, like a physical tent.
- [04:31]
Graham Brooke
Yeah, yeah, yeah. With all sorts of stuff that we can't describe in that tent or that kind of ecosystem that they walk into, or they stop into embassies to make sure that they can securely communicate back with D.C. and each other. So just the sheer coordination of this outside of that ecosystem which the US Government spends so much resource and time making sure is secure. Again, on one of the operational things, like on a thing that changes on a minute to minute basis, a counterterrorism operation, it's just, it's shocking.
- [05:05]
Stephen Overle
I mean, setting up a whole tent, having these government systems is very secure, as you said. It also kind of sounds clunky in this like fast moving modern world we're living in when it comes to communication. Everyone I know is on Signal. I'm sure everyone you know is on Signal. It's perceived as being this app where you can have private, sensitive conversations. Is that a false sense of security?
- [05:29]
Graham Brooke
So I think for the average user, the answer is different than for a cabinet level official of the United States government that is dealing with top secret sensitive information. For you and me, Signal is super secure. Right. Signal is an app that has between what, 40 million to 70 million monthly average users. It's smaller in comparison to say WhatsApp or WeChat or Telegram or some of these other point to point communications platforms. And it's known for being kind of the most safe by default, the most encrypted by default. The stuff that you send in those messages, whether it's just text or whether it's a document or a photo or whatever, a voice note, it's meant to be more secure. Signal has made that a big part of their design and their identity as a platform.
- [06:21]
Stephen Overle
And so why is it not secure enough for these folks? Like, what are the risks that still exist there?
- [06:26]
Graham Brooke
So encryption is encryption, right. From a technological standpoint, if a thing is encrypted, then by definition it gets sent to point A, to point B, and it's secure. In between those two points, there's different levels of encryption. Encryption is just basically more math. If it's more encrypted, there is more math that goes into making sure that that transaction or that transfer of data is more secure. And so things can be more or encrypted. It's not like an automatic binary. And the level of security, both from a physical security standpoint and an operational security standpoint and a technical standpoint for the systems that the US Government uses for its most sensitive information, is far more than you get on a commercial app. And so, just to put this in very specific context.
- [07:18]
Stephen Overle
Yeah.
- [07:19]
Graham Brooke
The ecosystem by which these government officials are communicating with that very, very sensitive information, you go into a physically secure place, you get onto technically secure systems, and you engage and coordinate that way. Now, with signal, I'm sitting in an open office in downtown D.C. that you could probably walk into, and I can pick up my phone right now, my personal device, and text you on signal. And that message is like, probably nobody's gonna get. But at the same time, there aren't entire governments trying to get whatever message I'm sending you about like coordinating drinks next week. Right, Right.
- [08:02]
Stephen Overle
Well, honestly, all I could think about reading this story was like, China, Russia, Iran, China, Russia, Iran. I don't know how many conversations I have had with cyber experts over the last many years talking about how all these adversarial governments are trying to hack exactly the kind of people who are in this group chat.
- [08:20]
Graham Brooke
Right. And unless, since I've been in government, at least unless the guidance has changed, you can't get outside apps on your government phone. And so I was in government in the, in the time when we switched from Blackberries to iPhones and we got these brand new iPhones that have all this functionality, a really cool camera that works better than other devices and all this stuff. And they bought these iPhones and then they took away a lot of those capabilities, like the fancy stuff on the iPhone that you would get the iPhone for in the first place. And I'm here to tell you that I could not download signal for sure. WhatsApp, Instagram, like any social media platform, any of the fun apps that you might want to get on a phone like that is not allowed on a government device, which would indicate that if they were using Signal to coordinate a Principals Committee meeting, that that app was either made an exception to be on their government phone or was on their personal device, which is a whole different security risk.
- [09:26]
Stephen Overle
What does that open up? I mean, obviously those phones don't exist then on government systems, or they're not as heavily guarded as a government device would be.
- [09:35]
Graham Brooke
Right. And that's in particular because it's not a security risk to like, text your family about your kid's swim meet. It is a security risk to coordinate a counterterrorism strike against the Houthis in Yemen, especially for a collection of national security officials that are spread out all over the world, including, at least in one case with one of those individuals in that group thread who was in Moscow physically. And so if you don't think that a country like Russia is surveilling your personal device while you are in that country, then you're probably not reading the brief on what Russia is capable of doing.
- [10:19]
Stephen Overle
Well, let's talk more about this particular conversation as it was recounted in the Atlantic, because reading through it, just like you kind of every other paragraph, I was like catching my breath. But there were two big issues that stuck out to me. You know, first, you had National Security Advisor Mike Waltz accidentally including a journalist in this group chat, which, you know, in some ways is like the most relatable problem in the world. Right. Like, we. We've all been there. Right, Right. The other problem, though, is like you had Defense Secretary Pete Hegseth sharing detailed war plans in this chat. What do you see as kind of the biggest offense here?
- [10:58]
Graham Brooke
So I think that there's two categories of things. The first is pure risk for national security sensitive information. And that's a little bit what we've been talking about. So that's number one, that just pure information risk, the operational security risk. And then the second thing to me that is really important is just the good governance Signal as a platform is a really out front advocate of encryption as a protection of free speech.
- [11:26]
Stephen Overle
Hmm.
- [11:26]
Graham Brooke
And I think that's a really important point because There are any number of laws for public officials who have to communicate official business in places that are correct for our transparency laws. And so at the White House, all of these officials are subject to a thing called the Presidential Records Act. And that means when you are working for the president, you have to be able to record the history of the decisions that you are making for not only historical purposes, but also for oversight. And if officials are engaging on a commercial platform that isn't an official government platform by which they do official business, then it would indicate that they do not want scrutiny on how they're communicating about these really, really big government decisions that they are making.
- [12:19]
Stephen Overle
Especially signals on app where messages can disappear. Right. You can set that. And I did have that thought about, you know, what this means for kind of the narrative of this administration, like what communication is lost or is happening on, you know, platforms where it's not being documented in the official record. I mean, walk that out for me. I mean, what does that mean, bigger picture, longer term?
- [12:43]
Graham Brooke
Well, it means it's harder to have oversight on really important counterterrorism decisions. It means that if something were to go wrong with that decision, then we have different branches of government that are designed to create checks and balances. And if they are not, they being the executive branch, are not communicating official business in official places, then it lessens the ability of the two other branches of government to have oversight over their activities. They are evading oversight or they are evading transparency that is required by law. And so this is a pretty big screw up from all of those security reasons that we just went through. And there should be oversight. But if the communication is happening in places that disappear by design, then it will diminish our ability to have oversight or insight into how this administration made a decision to literally take lives away. Right. One of the most important decisions that a government can make is a military operation.
- [13:48]
Stephen Overle
Right.
- [13:48]
Graham Brooke
And if you do not have the ability to articulate why or how that decision was made, then the American people lose their ability to have oversight of what their government is doing on their behalf.
- [14:02]
Stephen Overle
There was something you were talking about earlier, and I want to just revisit quickly. And that's the juxtaposition of like setting up a tent and having all this secure equipment to communicate on. Right. Versus like pulling my phone out of my pocket and sending a text over signal. You know, you, when you were in government, like you said, had to adapt. You know, you get an iPhone and all these cool features are stripped away. There is an annoyance and an inefficiency factor to that, I imagine. Right. Especially if you've come from outside government, you're used to communicating much faster. How much is that kind of a symptom of the problem here? Does that itself lead to bad governance? Is like the technology itself just not good enough?
- [14:41]
Graham Brooke
Like, is it too clunky? Yeah, for sure it's annoying. And big policy decisions move both fast and slow. For the listeners that haven't really studied how the National Security Council works, the National Security Council is intended to coordinate foreign policy decisions.
- [14:57]
Stephen Overle
Right.
- [14:58]
Graham Brooke
Some of those foreign policy decisions are immediate, like whether to take a strike, whether to do a counterterrorism operation in Yemen against the Houthis. That's a fast burning situation. Others are really, really long and deliberative. Whether the US is going to enter into a trade agreement or whether, whether the US is going to negotiate a big deal to change how we work with allies and partners. That happens over time. And in any scenario, the way by which we communicate and have to make decisions and keep those decisions secure and keep our ability to make those decisions secure has to be able to adjust fast and slow.
- [15:38]
Stephen Overle
Right.
- [15:38]
Graham Brooke
Which sometimes that's super annoying. And it's also the cost of doing business at that level of sensitivity and that level of classification. And so could it be less clunky? For sure, literally everything could be less clunky. There's a whole team at Apple that's trying to make like the most minor of minor updates to the iPhone to make it like way cooler. I'm sure there's a team at Signal that's working right now to make sure that Signal is like working better.
- [16:07]
Stephen Overle
Right.
- [16:08]
Graham Brooke
Same for government communication systems. And they've got a lot of work to do. At the same time, it's the responsibility of those users, especially in government, especially public officials, to play by the rules that we, that we set up.
- [16:23]
Stephen Overle
You know, I'm curious what you're looking at going forward because, like, this is a story that has everything, right? It's a bit absurd. It's got national security implications, it's got high profile officials, you know, behaving badly. It's sort of like the kind of thing that Washington is going to sink its teeth into and not let go. What's something that, like, you're paying attention to a ripple effect that people are not watching and they should be.
- [16:48]
Graham Brooke
That's a really good question. I think the main thing that will likely be underreported from here on out because it'll be kind of less transparent, is the ongoing security impact of the leak itself. And so those initial risks of, okay, do we have officials using commercial platforms on their personal phones to communicate sensitive issues? That will change the behavior of our adversaries and how they target us. It will change the behavior of allies and how they communicate with us. And it could change the way the interagency works or the way that the US Government itself works, knowing that that is a key vulnerability that they could face as officials are making decisions that are teed up by a large national security apparatus. So I think that's an extremely difficult thing to measure, and it's an extremely difficult thing to monitor and say, okay, well, X happened and so Y changed. But as we kind of go into this season of Oversight, which I think is totally appropriate, by the way, a conversation about how this happened and why it happened, the impact of how it changes our adversaries behavior towards us and our allies behavior towards us, is going to be underreported and really important for our national security officials to understand.
- [18:11]
Stephen Overle
Wallace and Graham, you were the right person to have break this all down for us. Appreciate you being here on Politico Tech.
- [18:17]
Graham Brooke
Happy to do it, Stephen. It's good to talk to you.
- [18:20]
Stephen Overle
That's all for today's Politico Tech. If you enjoy Politico Tech, please subscribe and recommend it to a friend or colleague. And for more tech news, subscribe to our newsletters, Digital Future Daily and Morning Tech. Music in our show comes from the mysterious Breakmaster Cylinder. Our managing producer is Annie Reiss. Philip Frobos helped produce today's episode. I'm Stephen Overle. See you back here on Monday.