US Attack plans from Signal

Andyross · 2025-03-26T15:32:50+00:00

At a Senate hearing yesterday, the director of national intelligence, Tulsi Gabbard, and the director of the Central Intelligence Agency, John Ratcliffe, were both asked about the Signal chat, to which Jeffrey Goldberg, the editor in chief of The Atlantic, was inadvertently invited by National Security Adviser Michael Waltz. “There was no classified material that was shared in that Signal group,” Gabbard told members of the Senate Intelligence Committee. https://www.theatlantic.com/politics/archive/2025/03/signal-group-chat-attack-plans-hegseth-goldberg/682176/

telcodad

Andyross “There was no classified material that was shared in that Signal group,” Gabbard told members of the Senate Intelligence Committee.

But she did say the material discussed was “sensitive” in nature.

Rook

At least they are “investigating” how a reporter got into the chat that he was invited to. 😆

I wonder if any Houthis were invited?

egeezer

After hearing multiple administration officials declare absolutely that there was no classified information in the texts, the Atlantic has released more of the texts it had withheld.

https://www.nbcnews.com/politics/trump-administration/atlantic-publishes-full-signal-chat-messages-showing-military-plans-us-rcna198148

Disclaimer: I post this purely for informational purposes as it relates to IT security.

Beachie

telcodad But she did say the material discussed was “sensitive” in nature.

On second thought, retracted. Carry on 🙂

Rook

Hegseth, speaking to reporters Monday, said in part: “Nobody was texting war plans.”

Maybe he can read the war plans, that were texted, in the Atlantic article?
Not sure if he has a subscription, so here’s a non-paywall link he might enjoy: Here Are the Attack Plans That Trump’s Advisers Shared on Signal

Somewhat-Reticent

Blowing smoke, veiled threat, … ?

DrStrange

Very sad. In before the lock…

Rook

DrStrange No need for a 🔒️ . The only person breaking the rules here is Astyanax.
Everybody else seems to be talking about a security breach covered in a news article.

egeezer

Rook
Sticking to the IT security topic, Signal has been a target for hackers for some time. While the significant exposure is through phishing and compromising of commercial and user level devices, other hackers are using other techniques to compromise Signal users;
https://thehackernews.com/2025/02/hackers-exploit-signals-linked-devices.html?m=1
Both NSA and DoD have issued cautionary statements regarding the use of the app.

Rook

Maybe Signal is not the most secure way to discuss attack plans. Should be a good lesson going forward.

Also, the reporter’s conduct in not sharing the attack plans was commendable.

dave

Why were they using third-party communications services?

Beachie

dave Why were they using third-party communications services?

No record of conversations, no FOIA, no open records laws and no trail. Supposedly that is.

Rook

I read that the Signal chat was set up to disappear in one week.
I’m sure these highly skilled and competent individuals would follow all applicable record-keeping laws.

HELLFIRE

egeezer Disclaimer: I post this purely for informational purposes as it relates to IT security.

In that same vein, sharing this : https://www.theregister.com/2025/03/24/signal_atlantic_security_disaster/

… Military analyst and retired Australian Army Major General Mick Ryan has described the use of the secure chat app in this matter as “appalling.” “By using Signal for such a sensitive issue, the participants demonstrate a cavalier attitude to operational security,” he wrote Tuesday, Australian time. “For a Secretary of Defense who allegedly values a war-fighting ethos, this shortfall in security is appalling. In normal times, this would see people sacked. I don’t expect that in this case though because these are not normal times.” “Why aren’t they using more secure communications that are assured by the NSA or another government communications agency?” he added. The Register understands chat tools approved and used by those agencies include features that prevent, say, journalists from participating in group chats. Other questions worth asking are why the group’s members used Signal at all, whether it’s allowed for sensitive government work, and why they set at least some of the messages to auto-delete, which may well be a violation of federal records-keeping laws. … Updated to add on March 25 A few more interesting details have emerged in the past day or so about the Signal super-SNAFU. First, it turns out the NSA warned its staff last month that Russian snoops were using Signal QR codes in phishing campaigns to trick marks into linking their devices to those controlled by the miscreants so that victims’ encrypted messages could be read. Google, for one, publicly warned everyone about this around that time. The NSA also said Signal, as well as WhatsApp, must not be used to transmit classified materials. …

I’ve been looking around and SO FAR from what I’ve found Signal has no security issues, but if it IS NOT approved for usage in this particular setting, AND it is not following proper retention policies…

The rest is E Coli, Deinococcus radiodurans and a bunch of other nasty pathogens garnishing a fresh s**t sandwich… 🙄 🙄

My Sarcastic / Cynical 00000010bits

Regards

Rook

Wow, this sounds more serious than I thought it was.

HooRU

It endangers our service members.

egeezer

HELLFIRE
With high value targets, using commercial and consumer level systems that aren’t compartmentalized creates more of an exposure to both hacking and social engineering attacks.

NIST has very specific best practices for those situations.

Sparkchaser

It’s hard for us ol’ folks to get our head around the the way security is handled.
In my various jobs I had information that was not public. One time, the info was release on TV and my wife was telling me about it. I told her, yeah I know. She ask why I didn’t tell her. I told her, she didn’t have the need to know. 😉

From the Army in the mid sixties to present, I always took it seriously.

egeezer

Sparkchaser
Same here. I’m not interested in having my clearance and job canceled.

OSINT is a funny critter. The information itself may not be classified, but the aggregate collection is classified.

bjlockie

🍿