On March 13, Mike Waltz, the US national security adviser, created a group chat on his mobile phone using an app called Signal, calling it “Houthi PC Small”. From the outset, then, this was a forum for discussion at the highest level: PC stood for the principals committee, a group of the most senior officials dealing with national security.
Eighteen people in the group chat fit that description, from Pete Hegseth, the secretary of defence, to the bosses of the US intelligence community. Unfortunately for him, Waltz added a 19th Signal user; Jeffrey Goldberg, the editor of The Atlantic magazine, a liberal despised by President Trump and his team. The national security adviser has since claimed that Goldberg’s phone number may have been mistakenly stored in his contacts under someone else’s name.
The fallout from this decision led to the biggest crisis of the new Trump administration to date.
Why should the Signal content have been classified?
From Waltz’s first message to the group, on the morning of March 14, the sensitivity of this dialogue was apparent: “You should have a statement of conclusions with taskings per the president’s guidance this morning in your high side inboxes.” The “high side inboxes” are government-secured email accounts used for secret or classified communication.
Immediately group participants were giving insights into the reasons for striking the Houthi rebels in Yemen, whether to do it sooner rather than later, and their general contempt for European allies. It was a window into how the individuals at the top of the US security establishment think and behave behind closed doors. For this reason, the US government classifies as top secret minutes of principals committee meetings.
“The policy deliberations noted in the chat are, in the intelligence business, even more important to a hostile adversary than the tactical military info,” Marc Polymeropoulos, a former senior CIA officer for 26 years, told me. “The Russians would care far more about factions within the administration, where they stand, so they could then manipulate their own active measures campaigns.”
On March 15, the day after that policy discussion, Hegseth sent a message detailing the attack plans nearly three hours before the first aircraft were due to strike. It specified that F/A-18 jets launched from an aircraft carrier, Tomahawk cruise missiles, and at least one MQ-9 drone would be used. Much criticism has focused on this message.
For example, one US Navy aviator noted, “you don’t want to telegraph you’re about to arrive on someone’s doorstep; that’s putting your crew at risk”. The threat is real: the Houthis have succeeded in shooting down several US drones and crewed aircraft belonging to the Saudi-led coalition that previously operated in Yemen.
Advanced warning of imminent strikes might also have allowed them to send important members of their leadership into hiding or deep bunkers. The director of the CIA had revealed to the Signal group they were being targeted in a message on March 14 when he said a delay to strikes would allow the agency, “to identify better start points for coverage of the Houthi leadership”.
Is Signal encrypted?
Any visitor to the App Store will see that Signal’s makers boast that it is “built for privacy”. It uses an end-to-end encryption system considered quite robust by cybersecurity experts. This is why hackers attack the phone itself rather than trying to intercept the encoded chat.
However, since the emergence of an Israeli-developed spyware program called Pegasus several years ago, governments have regarded messaging apps as unsafe. Pegasus was initially configured to hack WhatsApp, being installed via links embedded in messages sent to the target phone.
Although many consider Signal to be more secure, particularly against attacks by criminal or non-state groups, it has been the subject of recent warnings by the National Security Agency, America’s huge eavesdropping organisation. One of these says Russian hacking groups have malware that hijacks a feature of the app that “allows the chat and voice messenger applications to be used on multiple devices concurrently”.
The use of wi-fi or Bluetooth connections requiring physical proximity to the target in order to hack or monitor their mobile phones has meant that security agencies are particularly sensitive about the use of devices abroad in countries deemed to be hostile.
• Tracked: Trump’s approval rating
Were any of the users abroad when the chat took place?
As soon as the story broke, journalists started to scrutinise where members of the Houthi PC Small group had been during these exchanges.
Tulsi Gabbard, the director of national intelligence, had been visiting Japan and Thailand. But had she used her personal mobile during these visits? It was not clear from Signal. More importantly, one member of the group — Steve Witkoff, President Trump’s peace envoy to the Middle East — had been in Moscow. And late in the afternoon of March 15 he had chipped in on the Signal chat with a series of triumphant emojis following the strike in Yemen.
Given the advanced capabilities of Russia’s intelligence services, the visit might have provided the perfect hacking opportunity.
Witkoff himself, however, quickly took to social media to point out that while in Moscow, “I only had with me a secure phone provided by the government for special circumstances when you travel to regions where you do not want your devices compromised”. By the time he used his own phone to post in the Signal group, he was no longer in Russia.
Will this damage intelligence relationships with allies?
This is a key question now: how far will it damage intelligence-sharing relationships? In a message following the strike, Waltz posted on the Signal group “the first target — their top missile guy — we had positive ID of him walking into his girlfriend’s building and it’s now collapsed”. Inevitably an adversary would ask themselves how the national security adviser knew this: was it from orbiting drones, or perhaps someone on the ground watching?
The Wall Street Journal has reported that a Yemeni asset of the Israelis provided some of that information, and that their officials were understandably worried about the risks that the leak posed.
Intelligence people suggest that it is the sharing of human reporting, where lives are in danger, that is most likely to be affected. That said, they set this in a context broader than “Signalgate”: there is already a nervous atmosphere, they argue, as a result of the Trump administration’s messaging on Russia generally, and its appointment of people to key positions who have previously endorsed conspiracy theories
The latest leak “reinforces a trend of caution rather than being a crisis on its own,” says Matthew Savill, an expert at the Royal United Services Institute (Rusi) think tank in London and a former UK defence intelligence official. As in certain key areas of defence, such as nuclear submarines, British intelligence agencies — particularly the eavesdroppers of GCHQ — are plumbed into a long-term dependent relationship with the US.
Any abrupt changes in this could harm all concerned since GCHQ and the NSA divide the world up in terms of who does what and share a large proportion of what they find out. Since signals intelligence gathered by these partners provides the great majority of the secret information consumed by the British government, it is a relationship that has to be maintained. And in information security nobody is perfect.
Does everybody make these mistakes?
In 2011 a British special forces team escorting an MI6 officer in Libya were captured by hostile forces. Instead of personal mobiles they were using secure laptops with the latest crypto on them: alas, they had taped the passwords to their keyboards.
These days much political business across the western world is done by WhatsApp or Signal, despite all the warnings about Pegasus and other spyware. Waltz and his colleagues may have had secure desktops and swept facilities for holding classified teleconferences but once they were on the go, the desire to communicate quickly and the convenience of using a personal mobile trumped security.
How should this have been done?
“All security personnel, all officials, must behave as if their phone is hacked and enemy actors have access to all of their information,” says an Israeli information security consultant. Having made such a success of hacking themselves, the Israelis are generally regarded as among the better practitioners of communications security.
There is no perfect answer, but a reliance on face-to-face meetings and devices protected by strong cryptography are the best defence. The “principals” just have to accept certain limits in their freedom to communicate, say the cyber experts.
Instead, Waltz and the others made an unforced error. “At CIA,” Polymeropoulos believes, “a case officer obtaining such information on one of our adversaries’ plans and intentions would get an intelligence medal.”
