Waltz's Use of Messaging Platform Raises New Security Questions

New York Times

02-05-2025

Michael Waltz got himself in trouble with the White House when, as national security adviser, he inadvertently added a journalist to a sensitive chat on Signal, a commercial messaging app.
Now, as he leaves that job, he has raised a new set of questions about White House use of the encrypted app. A photograph of him looking at his phone on Wednesday during a cabinet meeting makes it clear that he is communicating with his colleagues — including the secretary of state and the director of national intelligence — using a platform originally designed by an Israeli company that collects and stores Signal messages.
This discovery of the new system came when a Reuters photographer, standing just over Mr. Waltz's left shoulder, snapped a photo of him checking his phone.
He was not using a privacy screen, and when zoomed in, the photo shows a list of messages and calls from several senior officials, including Vice President JD Vance and Steve Witkoff, the special envoy who is negotiating on three fronts: the Israel-Hamas talks, the increasingly tense dance with Vladimir V. Putin about Ukraine and the Iran nuclear talks. Secretary of State Marco Rubio and Tulsi Gabbard, the director of national intelligence, are also on his chat list.
While the app that Mr. Waltz was seen using on Wednesday looks similar to Signal, it is actually a different platform from a company that advertises it as a way to archive messages for record-keeping purposes. That is critical, because one concern that came up when senior officials were using the app was whether it complied with federal record-keeping rules.
One of Signal's benefits is that it is both encrypted and can be set to automatically delete messages. But while that is a feature for users seeking secure communications, it is a problem for the National Archives, as it seeks to retain records.
It is not clear if Mr. Waltz began using the alternative app when he became national security adviser or after a nonprofit watchdog group, American Oversight, sued the government for failing to comply with records laws by using Signal.
While the real version of Signal gets constant security updates and messages are kept encrypted until they reach a user's phone, security experts question how secure the alternative app is.
'This is incredibly dumb,' said Senator Ron Wyden, the Oregon Democrat who is a longtime member of the Senate Intelligence Committee. 'The government has no reason to use a counterfeit Signal knockoff that raises obvious counterintelligence concerns.'
Cybersecurity experts said the platform that Mr. Waltz was using is known as TeleMessage, which retains copies of messages, a way of complying with the government rules. The screen in the photograph shows a request for him to verify his 'TM SGNL PIN.' Time stamps indicate that the communications were as recent as the morning of the cabinet meeting.
TeleMessage, founded in Israel, was purchased last year by Smarsh, a company based in Portland, Ore.
The TeleMessage platform accepts messages sent through Signal, and captures and archives them.
Security experts said the use of the TeleMessage raised a number of questions. Some said it appeared that the company had in the past routed information through Israel, which is renowned for its electronic spying skills.
But a Smarsh representative said data from American clients did not leave the United States. Tom Padgett, the president of Smarsh's enterprise business, said the collected information was not routed through any mechanism that 'could potentially violate our data residency commitments to our customers.'
Mr. Padgett also said the information was not decrypted while being collected for record-keeping purposes or moved to its final archive. Security experts said that whenever information is de-encrypted, security vulnerabilities could be introduced. 'We do not de-encrypt,' Mr. Padgett said.
Smarsh representatives took issue with the idea that their platform was a modified version of the Signal app. They said their platform simply allowed financial institutions and governments to capture communications on various channels to comply with record-keeping regulations.
But cybersecurity officials said questions remained about how the TeleMessage platform worked, and what vulnerabilities it could introduce into Signal communications.
Signal is built on open-source code, which allows other organizations to make their own version that uses the same encryption. But Signal Messenger, the company that makes and controls the app, does not support alternative versions and actively tries to discourage their use.
Mr. Waltz's use of TeleMessage was reported earlier by the publication 404 Media. According to the publication, the U.S. government contracted with TeleMessage in December 2024 to archive Signal and WhatsApp messages. Smarsh representatives said they have worked with the federal government for a decade but declined to discuss specific contracts.
It is not clear if the U.S. government audited TeleMessage to determine how it handles the messages and whether it might break or damage the end-to-end security of Signal. Representatives of the National Security Council staff did not immediately respond to requests for comment. Smarsh representative said they allowed security audits.
Mr. Wyden said the U.S. government and the Navy had developed secure communications tools that comply with record-keeping rules. Using the modified version of Signal is far less secure, he said.
'Trump and his national security team might as well post American battle plans on X at this rate,' Mr. Wyden said.
In response to reports of the photo, Steven Cheung, the White House communications director, said in a social media post that 'Signal is an approved app that is loaded onto our government phones.'
As part of the lawsuit filed by American Oversight, government officials have submitted statements saying that the Signal messages from the chat Mr. Waltz created to discuss strikes on the Houthi militia in Yemen are no longer retrievable.
Chioma Chukwu, the interim executive director of American Oversight, said she had concerns about the use of the modified app.
'The use of a modified Signal app may suggest an attempt to appear compliant with federal record-keeping laws, but it actually underscores a dangerous reliance on unofficial tools that threaten national security and put our service members at risk,' she said. 'Americans have a right to transparency and to know their leaders are following the law, not hiding behind unauthorized workarounds.'