In March 2025, journalist Jeffrey Goldberg was added to a Signal group discussing U.S. military operations in Yemen. His firsthand account of the conversation identified National Security Adviser Mike Waltz’s account as the inviter. Defense Secretary Pete Hegseth shared operational information. The revelations became known as Signalgate, exposing a serious failure in how Trump administration officials handled sensitive communications.
The scandal raised questions about authorized recipients, operational security and public records. It also brought a surge of attention to secure messaging apps. Signal’s downloads rose in the days after the news, even as officials’ use of the app illustrated the limits of encryption. A tool can protect a conversation from outsiders while carrying information to someone who should never have been included.
Our earlier Signalgate breakdown covers the original disclosure and its national-security implications. This follow-up examines the download spike, institutional responsibilities and practical lessons for organizations using encrypted communication.
Key Takeaways
- The wrong recipient can receive an encrypted message without breaking its encryption.
- The Signal download spike showed immediate interest; it did not establish lasting adoption.
- Encryption does not create an exemption from applicable records duties.
- Preserving a government record and deciding whether to release it are separate questions.
- Human mistakes, malicious insiders and compromised devices require different safeguards.
- Messaging products offer different controls; no app guarantees compliance by itself.
- Strong encryption and accountable institutional use should be pursued together.
What Is Signalgate? A Quick Recap of the Scandal
The Accidental Inclusion That Sparked Global Headlines
The scandal began with a simple but consequential mistake: adding the wrong participant to a group chat. Goldberg reported receiving the group invitation on March 13. Once inside, he could read the conversation as a member, including military-operation information supplied by Hegseth.
The subsequently published messages showed sensitive operational planning before the strikes. Administration officials disputed that classified information had been shared. That dispute should be distinguished from the clear failure to control who received the discussion. A journalist’s presence in the group was a serious security problem regardless of the argument over classification.
A Second Signal Chat Raised Further Questions
On April 20, ABC News reported a second Signal conversation, citing sources familiar with it. This group reportedly included Hegseth’s wife, brother and personal lawyer. His brother and lawyer had government roles; his wife was not a Defense Department employee. Their different positions matter when assessing the disclosure, rather than treating every participant as having the same authorization.
The second report deepened questions about Hegseth’s judgment and the administration’s controls over sensitive information. Using an encrypted app did not answer whether each recipient had an appropriate role or whether that channel was authorized for the information.
Fallout and Oversight
On April 3, the Pentagon inspector general announced an evaluation of the secretary’s reported Signal use. Its stated scope included messaging-policy compliance, classification and records retention. These were concrete oversight questions, not proof that investigators had already reached findings.
Scrutiny should establish what was shared, who received it and which duties applied. Those answers are needed to identify failures in recipient controls, approved channels and preservation, and to hold the responsible officials accountable.
Why Secure Messaging Apps Drew Renewed Attention
A Download Spike After the Revelations
The public response was visible in download estimates. According to Appfigures’ March 28 analysis, Signal downloads increased by 26% on the day the news broke. Its estimates reached 193,000 the following day and 195,000 the day after, compared with a daily average of about 95,000 before the news.
Those estimates show a substantial short-term increase in downloads. Downloads are not the same as active users, sustained use or institutional adoption. The spike demonstrates increased interest after the news, while leaving open how many people continued using the app or changed their communication practices.
Privacy Interest and Institutional Readiness
The incident also exposed a tension worth examining. People seeking privacy may value an app’s ability to limit access to their conversations. An employer or public agency must ask additional questions about authorized work, account administration, records and investigations. Those needs do not disappear when employees prefer a particular app.
There is no need to treat rising interest as proof that organizations have resolved these issues. Before approving a channel, leaders should identify what information belongs there and what the organization must be able to preserve. Our Privacy & Identity Protection hub provides related guidance on controlling exposure; institutional responsibilities add another layer to those personal concerns.
Encrypted Messaging and Compliance: Existing Duties Still Apply
Government Records Do Not Depend on the App
Federal recordkeeping guidance already addressed electronic messaging well before Signalgate. NARA’s 2015 guidance on managing electronic messages covered chat, text and similar tools, including agency-business messages sent through personal accounts or devices. An agency’s choice of communication technology does not, by itself, remove its records obligations.
The governance problem is therefore more serious than a novel app escaping an outdated rulebook. Officials and agencies need arrangements that preserve required records and restrict sensitive discussions to appropriate channels. A disappearing-message setting cannot substitute for a retention decision made under the applicable rules.
FOIA and Public Records: Preservation Is Not Disclosure
A missing archive can frustrate a records request, but that practical failure is not a legal exemption for encrypted messages. Whether a particular record is subject to federal FOIA depends on the agency-records framework and relevant exemptions. DOJ’s explanation of FOIA also distinguishes federal executive-branch agencies from state and local government, which operate under different public-records laws.
Preserving a record does not mean it must be released without restriction. Classified information and other exempt material may lawfully be withheld. The essential distinction is between keeping records as required and deciding what can be disclosed in response to a request. Conflating those steps obscures both security and accountability.
Private-Sector Records and Proportionate Oversight
Regulated businesses also face existing duties. In its August 2023 action against 11 Wall Street firms, the SEC described failures to preserve required business communications sent through channels including iMessage, WhatsApp and Signal. The enforcement concerned records that firms were required to keep, not a general ban on encrypted communication.
Organizations should define approved channels, retention arrangements and access responsibilities before sensitive work moves into them. They should also distinguish business records from employees’ unrelated private conversations. Clear boundaries are more useful than assuming that either unrestricted app use or indiscriminate monitoring solves the problem.
Security Isn’t Just Privacy: Operational Risks of Over-Reliance
Encryption Does Not Authorize a Recipient
End-to-end encryption addresses an important security problem, but it does not decide who ought to receive a message. Once the wrong person joins a conversation, the app can deliver messages securely to that person. Similarly, a person reading a message on a compromised device presents a different problem from someone intercepting it during transmission.
This is why encryption needs operational discipline around it: verify participants, use an authorized channel and consider the information being discussed. The organization’s policy must make those decisions understandable before an urgent conversation starts.
Human Error and Malicious Insiders Are Different Risks
Errors and intentional misuse create different security problems. Verizon’s 2024 Data Breach Investigations Report distinguishes non-malicious human involvement, internal actors and deliberate privilege misuse. The report’s human-element measure excludes malicious privilege misuse; mistakes and deliberate insider abuse should not be treated as the same problem.
Accidental invitations, intentional misuse and stolen access call for different responses. Training can help people check recipients; access controls limit who can participate; investigation procedures help establish what happened after an incident. Treating every mistake as malicious, or every insider problem as a training issue, weakens the response.
Controls and Evidence Have Limits
Signal does provide user-facing controls. Its 2020 description of new groups documents administrators, member management and permissions. Its safety-number guidance explains contact key verification. These features are useful, but they do not amount to a complete enterprise archiving or employee-account-management system.
Minimal service-side data can complicate an investigation without making all investigation impossible. Recipient devices, retained messages and properly configured organizational archives may provide different evidence. Institutions should understand those limits before adopting a tool, rather than discovering them during a crisis. The Cybersecurity Basics hub offers related foundations for layered protection.
Signal, Session and Other Apps: Different Models
Signal’s Strengths and Limits
Signal’s encryption and group controls serve important privacy purposes. Signalgate does not establish that those protections were broken. It shows why choosing a respected app cannot settle questions about approved uses, authorized participants and records. A consumer messaging tool and a governed institutional communication system are different responsibilities, even when they overlap.
Session’s Metadata-Minimizing Design
The Session authors’ whitepaper, revised in 2024, describes end-to-end encryption, decentralized storage and onion routing designed to minimize metadata leakage without requiring a phone number. That is a more careful description than saying the system eliminates all metadata.
An anonymity-oriented design is a reason to evaluate an app against a particular threat model, not a guarantee that it is ideal for every activist, whistleblower or workplace. Users and organizations still need to consider device security, recipients and their own operating practices.
Telegram, Threema and Wickr
Telegram’s ordinary cloud chats differ from its device-specific, end-to-end encrypted Secret Chats. Calling every conversation on the service equally encrypted would miss that distinction. Threema described all of its communications as end-to-end encrypted in its 2023 group-call announcement. For Threema, it is likewise necessary to distinguish data kept on a user’s device from data retained by the provider; its data-storage explanation is more specific than a blanket claim that no contact data exists.
AWS’s July 2023 Wickr retention announcement describes configurable organizational retention. That capability depends on the product and setup. Self-destructing messages alone do not establish compliance, and a product’s available features do not prove that an organization has configured them correctly.
Choosing Based on Use Case
There is no one-size-fits-all solution. Organizations must evaluate the information involved, the people who need access, their retention duties and the evidence they may need after an incident. Compare specific capabilities rather than labeling an app universally “enterprise ready” or “noncompliant.” The right fit depends on both the technology and the institution’s controls.
What Comes Next? Policy, Oversight and the Future of Messaging
Enforce the Duties Already in Place
Signalgate creates a strong case for reviewing official messaging practices. Agencies should assess approved channels, participant verification and preservation requirements under the responsibilities they already have. Leaders need to explain how those responsibilities are met when sensitive work moves into a messaging app.
The same principle applies to organizations outside government. Name who owns the policy, how exceptions are handled and what staff should do if sensitive information reaches the wrong conversation. A policy that cannot guide an actual decision is unlikely to help in a time-sensitive exchange.
Privacy and Accountability Need Deliberate Design
Policymakers and developers should pursue strong privacy and accountable institutional use together. This requires deciding which records need preservation, who may access them and how to prevent unnecessary collection. Retention and access arrangements should be documented and assessed for both their accountability benefits and their security consequences.
For government, the test is especially demanding: protect sensitive information while meeting lawful records duties. Trump administration officials’ failures should lead to scrutiny of their choices and controls. Weakening encryption would not correct the decision to include an unintended recipient.
Conclusion
Signalgate was more than a security lapse; it was a high-profile warning about judgment and governance. When sensitive military discussions reach an unintended recipient, the consequences are political, operational and potentially severe. Encryption cannot make that recipient appropriate or relieve officials of their responsibilities.
The download spike placed secure messaging apps at the center of a wider debate about privacy, policy and power. The tools we use must be matched by the systems we build around them. Encryption is not a substitute for judgment, policy or oversight.
For more analysis of emerging technology and cybersecurity, subscribe to the Quantum Cyber AI newsletter.
FAQ
Was Signal actually breached in Signalgate?
The disclosures described an unintended participant receiving messages as a group member. That is different from evidence that Signal’s encryption was broken. The central failure was controlling who received a sensitive discussion and whether the channel was appropriate.
Are encrypted messages subject to FOIA or public-records laws?
Encryption does not itself create an exemption. Applicable preservation duties, agency possession or control and lawful disclosure exemptions must be considered separately. Federal FOIA and state or local records laws also have different scopes.
Which secure messaging app is best for enterprise use?
There is no universal answer. Identify authorized uses, account controls, required retention and investigation needs, then assess the specific product and configuration. Available compliance features are not a guarantee of compliant use.
What rules apply to official encrypted messaging?
Existing federal records guidance already covered electronic messages, including agency-business messages on personal accounts or devices. Other legal and security requirements depend on the institution, information and activity. A new app does not erase those obligations.
Can using Signal or Telegram create problems in a sensitive role?
Yes, if the use violates applicable security, records or workplace requirements. The relevant questions concern the information, recipients, approved channel and preservation duties, rather than the app’s name alone.