New York
CNN
—
If you hadn’t heard of Signal before Monday, chances are you have now.
The secure messaging app, available for iPhones and Android devices, has long been popular with journalists because of its robust privacy features. But the Atlantic’s editor in chief, Jeffrey Goldberg, revealed on Monday that he had been added to a group chat with President Donald Trump’s Cabinet members about military strikes on Yemen – raising serious national security concerns.
While Signal offers more privacy perks compared to other messaging apps, it’s not meant for sharing classified government and military information. Some factors are beyond the app’s control – such as who the user is contacting, and whether the devices running the app are secure.
“In the specific case of Signal, messages may be secure when they are in transit between phones, but once they reach the recipient, security can indeed fail,” Matthew Mittelsteadt, a technology policy research fellow for the Cato Institute, said in an emailed statement to CNN.
However, if you use the app as intended, there are a lot of protections built into Signal to help prevent conversations from falling into the wrong hands.
What is Signal, and what makes it private?
Unlike other popular messaging apps, Signal is operated by a non-profit called the Signal Technology Foundation rather than a for-profit tech giant like Meta, which owns popular messaging apps like Instagram and WhatsApp, or Apple, whose iMessage platform is available across the company’s devices.
Still, the process of using Signal is similar to other messaging apps; you can send individual messages, create group chats, make phone calls and even post disappearing “stories” like those available on Instagram and Snapchat. There are no ads or trackers on Signal either, and you can set messages to disappear after a certain amount of time, from as quickly as 30 seconds to as long as four weeks.
Communications on Signal, including Signal Stories and your user profile, are end-to-end encrypted by default. That means the data is scrambled in transit and can only be seen by the sender and recipient. Signal can’t access the content of messages or calls, nor can it see display names or profile pictures, according to its privacy policy and support page.
“If you show up with a warrant or a subpoena (to Signal), they have almost nothing about you that they can hand over,” Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, told CNN last month.
Message history is stored on a user’s device rather than in Signal’s servers, although it does queue messages on its servers to be delivered later for devices that are temporarily offline.
Signal also has something called a “safety number,” which is a code assigned to an individual that helps you verify messages are going to the intended recipient.
Some of these features, like end-to-end encryption, have become increasingly common in messaging apps. But it’s the combination of these privacy tools that makes Signal stand out from other apps.
Other apps that offer end-to-end encryption may still have access to different types of information, like non-encrypted contacts, Daniel Kahn Gillmor, a senior staff technologist for the ACLU’s Speech, Privacy, and Technology Project, said in a previous CNN interview.
Signal is available on the iPhone’s App Store and the Google Play Store for Android devices. You must have a phone number capable of receiving a text message or phone call, since a verification code is required to set up your profile. However, you can choose to hide your phone number when connecting with others on the platform.
Tapping the message icon in the top right allows you to start a new message. From here, you can search for contacts in your phone’s contact list that are on Signal, or find someone by their username or phone number.
If you get a new phone, you need your old device to transfer your message history since conversations are stored on your device.
Once you’re on Signal, you can manage conversations by tapping the recipient’s name at the top of the screen. From there, you can view their safety number, choose to have messages disappear after a certain amount of time, give the contact a nickname or mute notifications.
If you’re really concerned about privacy, there are more granular features to dig into, such as the ability to hide the Signal app’s contents when switching between apps on your phone.
While features like these can help prevent messages from being sent to the wrong contact, once you’ve hit the send button, the recipient will see it unless you delete or edit it before they view it.
“One thing people frequently don’t understand about end-to-end encrypted apps, is that your communications are encrypted so no one in the middle can see them,” Galperin said in a previous CNN interview. “But the person you’re talking to can still see them.”
