What is Signal, the messaging app Donald Trump's team used to share war plans?
(Left to right) Vice president JD Vance swears in Pete Hegseth to be secretary of defence as his wife Jennifer Rauchet holds the Bible and Hegseth's children watch in January. Top national security officials for US President Donald Trump, including his defence secretary, texted war plans for upcoming military strikes in Yemen to a group chat in a secure messaging app that included the editor-in-chief for The Atlantic. File photo: AP/Rod Lamkey, Jr
Top Trump administration officials used messaging app Signal to share war plans and mistakenly included a journalist in the encrypted chat, spurring calls by Democratic lawmakers for a congressional investigation into the security breach.
Under US law, it can be a crime to mishandle, misuse or abuse classified information, though it is unclear whether those provisions might have been violated in this case.
Signal is an open-source and fully encrypted messaging service that runs on centralised servers maintained by Signal Messenger. The only user data it stores on its servers are phone numbers, the date a user joined the service, and the last login information.
Users' contacts, chats and other communications are instead stored on the user's phone, with the possibility of setting the option to automatically delete conversations after a certain amount of time. The company uses no ads or affiliate marketers, and doesn't track users' data.
Signal also gives users the possibility to hide their phone number from others and use an additional safety number to verify the safety of their messages. The app does not use US government encryption or that of any other governments, and is not hosted on government servers.
The messaging app has a "stellar reputation and is widely used and trusted in the security community", said Rocky Cole, whose cybersecurity firm iVerify helps protect smartphone users from hackers.
"The risk of discussing highly sensitive national security information on Signal isn't so much that Signal itself is insecure,” Cole added.
Actors who pose threats to nation states, he said, "have a demonstrated ability to remotely compromise the entire mobile phone itself. If the phone itself isn't secure, all the Signal messages on that device can be read."
Signal is a secure messaging service that uses end-to-end encryption, meaning the service provider cannot access and read private conversations and calls from users on its app, therefore guaranteeing its users' privacy.
Signal's software is available across platforms, both on smartphones and computers, and enables messaging, voice and video calls. A telephone number is necessary to register and create an account.
Unlike other messaging apps, Signal does not track or store user data, and its code is publicly available, so security experts can verify how it works and ensure it remains safe.
Signal President Meredith Whittaker on Tuesday defended the app's security, saying: "Signal is the gold standard in private comms."
She added in a post on X: "WhatsApp licenses Signal’s cryptography to protect message contents for consumer WhatsApp."
Signal was founded in 2012 by entrepreneur Moxie Marlinspike and Whittaker, according to the company's website.
The non-profit Signal Foundation currently oversees the app.
Signal is not tied to any major tech companies and will never be acquired by one, it says on its website.
Widely used by privacy advocates and political activists, Signal has gone from an exotic messaging app used by dissidents to a whisper network for journalists and media, to a messaging tool for government agencies and organisations.
Signal saw "unprecedented" growth in 2021 after a disputed change in WhatsApp's privacy terms, as privacy advocates jumped off WhatsApp on fears users would have to share their data with both Facebook and Instagram.
Reuters lists Signal as one of the tools tipsters can use to share confidential news tips with its journalists, while noting that "no system is 100 percent secure".
"Although Signal is widely regarded as offering very secure communications for consumers due to its end-to-end encryption and because it collects very little user data, it is hard to believe it is suitable for exchanging messages related to national security," said Ben Wood, chief analyst at CCS Insight - alluding to the breach involving top Trump aides discussing plans for military strikes on Yemeni Houthi militants.
