A security breach in an unofficial version of the encrypted messaging app Signal has raised concerns about the vulnerability of communications within the highest levels of the US government, according to a report by tech site 404 Media.
The app, TeleMessage, which mimics Signal’s functionality, was reportedly used by former National Security Adviser Mike Waltz, as indicated by a Reuters photograph showing him using the app during a cabinet meeting. The vulnerability exploited by the hacker highlights potential security risks associated with using unofficial communication platforms for sensitive government discussions.
Waltz was ousted Thursday, several weeks after the eruption of a scandal over his creation of a Signal group to share realtime updates on U.S. military action in Yemen. The chat drew particular attention because Waltz, or someone using his account, accidentally added a prominent journalist to the group.
The revelation that Waltz was using TeleMessage, which appears to have a similar interface and functionality as Signal, has only heightened the concerns over the security of his communications.
404 Media quoted the hacker – who didn’t identify themself – as saying that they had broken into TeleMessage’s backend infrastructure and been able to intercept some of its users’ messages. 404 Media said the hacker provided them with material, some of which the news site was able to independently verify.
Mike Waltz, US national security adviser, during a lunch with US President Donald Trump and Norway’s prime minister Jonas Gahr Store (EPA)
The publication said that the hacker did not intercept messages from Waltz or other Trump cabinet officials.
Reuters could not independently verify the report. Messages seeking comment from TeleMessage and its corporate owner, Portland, Oregon-based Smarsh, were not immediately returned. Messages seeking comment from Waltz and the White House also weren’t immediately returned.
Signal is an end-to-end encrypted messaging platform whose technology is meant to frustrate hostile surveillance.
Smarsh’s product TeleMessage, which the company is in the process of rebranding as Capture Mobile, is designed to capture the messages once they’ve been decrypted so they can be preserved and stored. That kind of additional functionality can be useful for complying with government rules on document retention but if poorly implemented it can introduce security risks.
A Signal spokesperson told Reuters earlier this week that the company “cannot guarantee the privacy or security properties of unofficial versions of Signal.”