Loading summary
Transcript37 lines
- [00:01]
Justin Hendricks
Your film is now ready to be shown.
- [00:12]
Good morning. I'm Justin Hendricks, editor of Tech Policy Press, a nonprofit media venture intended to provoke new ideas, debate and discussion at the intersection of technology and democracy. Every now and again, a story that has a technology element really breaks through and drives the news cycle.
- [00:28]
Ryan Goodman
The Atlantic reporter mistakenly added to a text chain with top security officials just released the messages that have started a massive national security controversy. Jeffrey Goldberg says he was accidentally added to that chat, which he says included sensitive details about US Military strikes in Yemen.
- [00:45]
Justin Hendricks
The Atlantic reports Hegsev notified the group of a planned timeline for flights of F18 fighter jets, MQ9 Reaper drones, and Tomahawk cruise missiles that were launched for the mission. The White House today says those are not war plans, claiming the entire story is a hoax.
- [01:00]
These are shockingly detailed descriptions of the bombs that are about to fall in Yemen. And Jeffrey Goldberg is getting these details many minutes before the bombs fall. If this is not classified information, I would like the president to tell us what would count as classified information.
- [01:19]
This week, the Trump administration is reeling after the Atlantic magazine's Jeffrey Goldberg revealed that he was on the receiving end of Yemen strike plans in a signal group chat between US Secretary of Defense Pete Hegseth and other top US national security officials. User behavior, a common failure point appears to be the blame in this scenario. Inviting the wrong person into an encrypted chat group obviously compromises the security of that group. That hasn't stopped folks like Mike Waltz, the National Security Advisor, from appealing to a certain special government employee.
- [01:51]
We're going to get to the bottom of it. We've have. I just talked to Elon on the way here. We've got the best technical minds looking at how this happen happen.
- [01:59]
To discuss Signalgate, as some are calling it, on social media, I invited two individuals I've had the pleasure of collaborating with to share their expert considerations.
- [02:08]
Ryan Goodman
I'm Ryan Goodman. I'm a professor of law at NYU School of Law, co editor in chief of Just Security.
- [02:14]
Justin Hendricks
I am Cooper Quinton. I am a senior staff technologist at the Electronic Frontier Foundation.
- [02:20]
I'm pleased to have the two of you here today. I've collaborated with both of you in different ways in the past with Ryan on various projects at Just Security, where I am privileged to be on the editorial board. And Cooper Quinton. We've worked together, of course, on a report around encrypted and secure messaging applications in 2023, and we'll talk a little bit about that as we get into today. But everybody's talking about. It seems everyone in the political class is talking about signal encryption, secure messaging, or lack thereof. It's been what, 48 hours now? A little bit more than 48 hours of signal Gate since the news broke in the Atlantic at this chat conversation between various top Trump administration officials. Ryan, where are we at on this at the moment? There are already lawsuits, there are already recriminations, calls for resignations. Where would you situate this particular scandal in its arc?
- [03:12]
Ryan Goodman
So I think this scandal just got another boost today in the sense that one of the major political issues is the content of the Signal chat conversations. So in the first 12, 24 hours, the administration was denying that this included classified information or war plans. And so the Atlantic turned around and then published all the text messages that did contain that information. So that's significant in the sense that it will hurt some of the initial supporters of the administration on this. Democrats on the Hill have called for investigations, resignations and things like that. There's reporting from Axios and others that there's internal division in the administration of some trying to point the finger at Pete Hegseth because he's the one that shared the most highly classified information on the signal group. And there are definitely Republicans on the Hill that are at a minimum saying that this was a mistake and the administration should own up to it. But they don't go as far as of yet to say that this has to be investigated or people need to resign. So that's the political side, the legal side. We'll probably get into this. I did a bit of an analysis of what would be the criminal laws that would apply were there an independent Justice Department looking into this, and there's a lawsuit from American Oversight on one of the aspects that I'm sure we'll get into, which is that there's a very likely violation of Federal Records act in the use not just of this unsecure platform, but rather that they are disappearing messages is the equivalent of destroying federal documents.
- [04:57]
Justin Hendricks
I want to ask you one more question to situate us on this, given your history of covering these types of things at just security, covering various other scandals around official documents or national security secrets or that sort of thing. How would you characterize the level of the infraction here versus prior events? What are you comparing it to?
- [05:17]
Ryan Goodman
There is in some ways no comparison. I've never seen anything like this in my life. And so much so that I can give an example of a past criminal case that is not anywhere near the magnitude of this one, in a certain sense of what happened. But in fact, a senior member of the administration at the time was going to be charged. John Deutch was the head of the CIA in the 1990s. It's discovered after he leaves office when they're cleaning up his home office, that he's been using his personal computer device for classified information. The Justice Department, under Attorney General Janet Reno basically declines to prosecute or indict. I think just sweeping it under the rug. There's an outcry on the Hill that does not match the way that other people are treated when they mishandle classified information. And she's pressured to appoint a special prosecutor. The special prosecutor recommends indictment under the very part of the Espionage act that would apply to the signal gate that we're just experiencing now, which is gross negligence in the handling of national defense information. And in fact. So that's the recommended indictment of the head of the CIA, former head of the CIA. And they actually get from him a plea agreement. And the story ends with the following, which is, it's a Friday. They don't get the plea signed plea agreement to the court on time. And the next day is Saturday, the last day of the Clinton administration. And on the last day of the Clinton administration, he surprises the justice department by pardoning Mr. Deutsch. But it shows you how far it got. And so I think that's, to me, the greatest equivalent. And it really is the legal frame that's most relevant under the criminal law, which is the gross negligence in the mishandling of national defense information. And I keep saying the word national defense information. It does not matter whether or not it was classified. So that's a red herring. We can get into that. Unlikely that this information was classified. But that's. That shows you where we're at.
- [07:16]
Justin Hendricks
Cooper, I want to bring you in here as someone who has trained people on secure messaging, who has thought a lot about encryption, both from a design perspective, but also from an engineering perspective. You're seeing lots of headlines go past about signal. You're seeing memos about signal vulnerabilities apparently sent at the Pentagon, which I know signal is attempted to correct the record on. I don't know, what were your first thoughts when you saw this situation start to unfold?
- [07:40]
I mean, my first thought is that it's just funny in one sense and it's horrifying in another sense. Right? It's horrifying because war is always horrifying. But it's hilarious how bad these like signal can't save you from your own screw ups, right? There's nothing that any secure messenger can do to save you from, from adding a reporter to your group chat and not vetting the members of your group chat. Right. That's just not a problem that technology can solve. And I actually, I want to roll us back a little bit, Ryan. You used a term of art that was that this is, this was not a secure platform. And I know that there's a specific meaning behind that, but I don't want to, I don't want to leave listeners confused. Signal is a very secure platform and this makes secure platform for end encryption. However, it's not a, it's not platform that should be used for sharing classified info. Can you just unpack what you mean a little bit there, Ryan, by secure platform? Sure.
- [08:42]
Ryan Goodman
I think the same term might mean different things in our different sectors. So inside the US Government, if you say you're on an unsecure line, right, or you're on an unsecure platform, you basically are saying, we're not in a classified system. We're not in secret, we're not top level. We're using a commercial app on its own terms. So I understand from, yeah, I understand that from your perspective in your sector, it is a form of secure messaging, but the same word is used differently.
- [09:12]
Justin Hendricks
You can classify. Documents should be shared on servers that are meant to handle classified documents or within a scif, Right. A secure compartmentalized racing facility, not on private sector chat apps, even if those apps are secure in the cybersecurity sense, 100%. But yeah, I think the overall, my biggest takeaway here is that Signal is a fantastic application. They've really done amazing things with cryptography. They've really done an amazing job of making it easy to use and having as few ways to shoot yourself in the foot as possible. Right. But nobody can stop you from, you know, adding people that, that you shouldn't have added to your group chat. Right. If that's what you do, right. Like, it's up to you to verify that the members of your group chat aren't working for the Atlantic. And that's, I think, that nobody should take away from this, that Signal is insecure. What you should take away from this if you work in government, is that you should continue to use the appropriate networks and facilities for sharing classified information. Although, you know, personally, I have no problem with this. If government workers want to keep adding journalists to their group chats, that's fine by me.
- [10:32]
Cooper, let me just ask you one more set of questions. Just, just maybe to dig a bit Deeper signal, as you say, is end to end encrypted. So from end point to endpoint, you can be sure that no one's looking at that message. There are other ways that people can get access to information on encrypted messaging apps that occur at those endpoints. What are the types of concerns would you have about individuals like the Secretary of Defense or the National Security Advisor communicating in this way over presumably mobile phone devices? What other types of security concerns might that create?
- [11:08]
Yeah, so the main thing that people need to understand about signal is, is that messages are encrypted from my phone to your phone in such a way that signal can't read them as they go through their servers. The government could not read them off of signal servers even with a warrant. Right. Even if they really wanted to. But if somebody has access to your phone, they can read those messages the same way you can by looking at them with their eyeballs. Right? Because the messages have to be decrypted for you to read. Now, there's a lot of ways that you can get access to somebody's phone, right? You can look over their shoulder while they're reading their messages, right? You can find out their password and unlock their phone, right? You can use forensic tools that police have like a cellebrite or great key device to unlock phones, and then you can read the messages, right? That way you can also use malware. Installing malware on somebody's phone is a way that governments often gain access to people's private encrypted communications, right? Things like Pegasus malware or they've recently written about malware for parallel solutions, right? That was going after WhatsApp messages, which was also end to end encrypted. A concern about national security folks using these devices for the communications is that it makes it much more likely that their devices will get targeted by malware. And there's a lot of countries that have espionage capabilities that have the capability to target people's phones that would be very interested in knowing what Pete Hegsev is talking about or what other high level cabinet officials are talking about. So that makes for a very juicy intelligence target for foreign intelligence. And I think it's safe to assume that's something that many countries are now going to be going after.
- [12:58]
Ryan, this is another topic that just security covers all the time. Seems like the conversation really around spyware has just exploded just in these last few months. I was just at rightscon in Taipei. There was a whole track essentially of conversations about spyware, including just security contributors who presented There is this a dimension we're seeing play out right now in the conversation around this particular scandal or just the potential technical dimensions of the compromise of secrets here?
- [13:26]
Ryan Goodman
So not yet in a sense that I think the conversation both on the Hill and then in media has been unsophisticated, very superficial. They're just like almost getting their heads around. Could somebody have added Jeffrey Goldberg, the journalist, without them having Mike Waltz's device? So that's, that's the level we're at. And then the other one that we're at, which is interesting because it's starting to get deeper and deeper there. And it's a little bit about what Cooper's just saying that it is the case that government, some government employees are authorized to use signal. And the CIA Director Ratcliffe said that yesterday in the Senate hearing and then it just came up this morning in the House hearing that the head of nsa, General Howe, said he encourages the use of signal among his employees and their families. And this is interesting in the sense that I think one of the initial, maybe correct me if I'm wrong, but I think one of the initial misimpressions that was given is that people saying, hey, look at this, the Pentagon last week and the NSA last month warned their people about use of signal because of its vulnerabilities. And the answer is it's a little bit more complicated. They actually are warning them because they know that they are using that signal and it's just saying know that it's vulnerable. And then the one question that they're not asking, this is the follow up question. Nobody on the Hill has asked it yet, as far as I know. I haven't tracked every moment of the hearing this morning, but what are they using it for? So it. Cooper, would you think that it's okay that the NSA tells their employees and their families to use signal because it is better than imessaging or whatever, regular messaging if they're going to talk about where they're traveling to and their next vacation spot and things like that, and that's proper and appropriate and it's actually better to be on signal for them or. But just lo and behold, never, obviously classified information.
- [15:32]
Justin Hendricks
Yeah, yeah.
- [15:32]
Ryan Goodman
Or does it create the vulnerability that you're describing as well, which is that maybe some adversaries would say, hey, those folks are using signal. That makes me think that they're a.
- [15:41]
Justin Hendricks
More valuable target for not government work. For things that are not subject to foia. Right. For things that are not classified information. Yeah. Government employees should absolutely be using signal. Right. I. It is far better than the alternatives. Right. Far better than sending unencrypted chats. Right. If you're sending unencrypted messages to your family, China is already going to have those because they, because of the hacks that they did into all of the major telcos. Right, the salt typhoon hacks. So, yes, absolutely. I think it's great that government employees are using Signal. I actually think it's great that NSA and other agencies are encouraging them to use Signal with, for their communications with their families and stuff. And I think that everybody should be doing this. I think that vulnerabilities are actually a bit overblown. I wouldn't call these vulnerability as a term of art in my space. Right, Vulnerability. These don't rise to the level of vulnerabilities. There are precautions you can take to make your Signal account more secure from takeover. Yeah, there's an issue where, like some Russian actors are phishing, trying to fish people's, like access to people's signal accounts basically through a QR code. And this is something that Signal has addressed. This was something that started in the war in Ukraine. But I think that calling it a vulnerability is a bit overblown. But there are some settings, like what I saw was NSA advising people to check these, a few specific settings to make that sort of phishing much harder. But again, that's, That's a phishing attack, right? That relies on phishing attacks. I think that phishing attacks don't necessarily. You can't say, because I phished your account on Gmail. Gmail is insecure, right? Like it's that you fell for the phishing attack. Not that Google is inherently insecure, but yeah, overall, I think I have no problem with government workers using single not for work. Right. If you're using it for work, then that's where it becomes a problem for me with regard to the, with regard to government transparency and things like that.
- [17:50]
So, Cooper, I haven't been through all of the messages that have been published today at the Atlantic in terms of the types of material that's being shared. What I have seen, I haven't yet seen any instances, for instance, where folks are sharing URLs, but one thing I wanted to ask you about in particular is whether in the case of sharing URLs, that that potentially opens up a vulnerability, or maybe I should say not a vulnerability, but a potential vector like phishing or other mechanisms that might create a complication for people in the situation that these individuals are certainly in, where foreign intelligence Agencies are almost certainly attempting to follow their communications.
- [18:28]
Yeah. So one, There is one issue that we pointed out in our report with Link previews on Signal, which is where when you send a link, it displays a, like a graphical preview of that link. Right. And the issue there, I. So I recommend that people turn those off if they're concerned about security, because the issue there is that those, those link previews are fetched by Signal when you send them. Right? So they're fetched by your Signal client when you send them and generated on your Signal client and they reveal to the person who controls the link that you are using Signal, right? That your. Your IP address and the fact that you're using Signal. And then if that link is unique, right. If it has a tracking ID at the end of it, right. Question mark, Share ID equals blah, blah, blah. Right. You can, like you see on Instagram messages, when other people click that link, they can then they are then associated with you and it could be known by the person controlling that link that you shared that link on Signal and who you share that link with. And so you could use that to identify who your network on Signal is. Right. And possibly identify like, specific groups or things like that. Again, this is not a vulnerability, but this is a. That's the term of art, right? And Signal is still by far the most, in my opinion, the most secure messenger of its class. But there are. The tickle here is that there are steps people can take to increase the offset within Signal, right? From big things like not adding reporters to your Signal chat, to small things like turning off link previews and setting a. Setting a pin in Signal so that somebody can't transfer your account over to a new phone without your knowledge. I think that there's. I think that there's a number of things you can do to make your Signal experience even more secure. Overall, I don't want to scare people away from Signal. It's still, I think, by far the best option. I realized that I hadn't answered what I think was a really good question for Ryan is that does installing Signal on your phone make you more of a target for hacking? Right? I don't think that's the case at all. Right. If you are somebody who is important in national security, like you, you make a good target for hacking, regardless of whether you're using Signal or SMS messages. Right. I don't think that it makes it like, more likely that you're going to get. That your photo is going to get targeted because you're using a specific app. What Makes it more likely to get targeted is who you are. Right. And what you do in the world.
- [21:04]
Ryan, I'm just going to ask you a last question about the contents of the communications. Just what I've seen so far. I think there's ultimately, like, an extremely dystopian aesthetic to these messages. Seeing US Officials celebrate the murder of individuals from the sky with emojis and fire symbols and things of that nature. I don't know. Is there anything in that that you would care to comment on? Just the nature of the communications, what it reveals about the way we're doing business.
- [21:32]
Ryan Goodman
So just in answering the question, coming from another, like, hat that I wear as a matter of law, I'm not sure I'd sign on to the word murder if we're in an armed conflict with the Houthis and the like. But everything else that you said, yeah, there's something very distasteful and unusual that we've. And we've all gotten a deep insight into it. And I know from a colleague who works with people on the ground in Yemen that they're reading these text messages in a different way that I think maybe some Americans are like, good God, is this how you consider our lives? You know, because there's also potential for civilian casualties, all sorts of things like that. And on the Hill today, I thought it was a poignant remark that one of the members on the Hill with military experience and background said there's just also, like, a lack of sobriety in these text messages. I don't know if they were trying to do a little hit on Hegseth that way, but the idea that they're sharing emojis and the like, and there's certainly this, like, weird ass. That's what I was gonna say. I shouldn't pause back slapping. And it does also give you this feel of, like, new people to the administration. And there they are with immense. To take people's lives. And it seems like there's an element to which there. There's like an elixir to that rather than the opposite approach, which is to understand the sober nature and the gravity of those kinds of decisions and what's being done. So, yeah, I thought that was another aspect of this that we should not lose sight of, because there are other dimensions to the scandal that are also important. But this is one, too, and perhaps.
- [23:20]
Justin Hendricks
That goes too far using that word. But I will say there is one instance at least, where a single individual is apparently being targeted, and it's noted that he was targeted when walking into his girlfriend's building and the entire building was flattened. So hard to know exactly what the scenario was. There seems like an extraordinary amount of force. And of course there's a likelihood of innocent bystanders, civilians being targeted along the way. Last thought as we close, what will the two of you be looking for the next couple days on this? Cooper, is there any technical dimension to this that you're looking for more information on or. Ryan, what are you watching on the legal side? Cooper, you first.
- [23:59]
Yeah. What I'm hoping doesn't happen is that I'm hoping that people don't look at this and go, obviously I shouldn't use SIGNAL and move to less secure alternatives like God forbid, Telegram. Right. Null is definitely still the, the best option for, for most people for secure messaging. And it is very secure. Right. The like. And I wish people would stop using the term vulnerabilities for the issues that, that have been erased, because these are like things you can do to improve even more your security within signal, but they are not vulnerabilities. So that's the main thing that I'll be looking for is people, people wrongly yelling about signal is compromised or SIGNAL is vulnerable because it lets you add journalists to your classified group chats. Right. And that's, that's not the takeaway here. I think the takeaway should be that like, SIGNAL is so good that even high ranking members of government are tempted to use it for classified conversations, which they of course shouldn't be doing. And I think that should be the focus here. Right. Is that this is an inappropriate use of SIGNAL by the government. Not that, not that signal. I don't think that SIGNAL should really even be the focus of the conversation here. Right. The focus should be that this is not how classified conversations are supposed to happen. Yeah.
- [25:19]
Ryan Goodman
And I guess I just say briefly that I'm thinking about any form of accountability in somebody having to resign. And maybe Pete Hegseth will be scapegoated in a certain sense because he's most responsible, it seems, for sharing the most highly classified information that's now for everybody in the world to see. And is there enough pressure in the administration also? Just there's so many institutional effects of this kind of breach that I think are super damaging to US national security, which is how do you then continue to educate the workforce to respect highly classified information and secure systems and things like that when they see their higher ups doing this kind of thing and getting away with it? So I think that's another reason why there needs to be some kind of real reckoning. And I imagine that's in the heart of hearts of many members of Congress. But whether or not they can break out of their tribes to do something for the country on this, that's what I'm looking for.
- [26:18]
Justin Hendricks
As a last thing, I want to. I started out by saying that this is incredibly funny and it is in some sense. Right. But we should also not lose sight of the fact, as you said, Justin, that this is actually. There are people dying in Yemen because of this. Right. And this is a. This is the latest strike in sort of a US Proxy war that's been going on there for. Since the last decade. Right. Where thousands, tens of thousands of people have died, millions of people have been brought to the brink of starvation. And like you said, even in this strike, they brought down an entire apartment complex. It's almost certain that there are civilian casualties involved in that, and we shouldn't lose sight of that. That this is something that we can sit about and read here in America, but it means actual bombs dropping on people in Yemen.
- [27:08]
Ryan Cooper, thank you very much.
- [27:10]
Thank you for having us on.
- [27:11]
Thank you. That's it for this episode. I hope you'll send your feedback. You can write to me at JustInEchPolicy Press. Thanks to Ryan Goodman and Cooper Quinton. Thanks to my co founder Brian Jones, and thank you for listening.
- [27:42]
Ryan Goodman
Tech Policy Press.