Pentagon Advisory Highlights Concerns Over Signal Messenger Vulnerability

The Department of Defense has issued a broad advisory highlighting potential risks associated with the Signal messaging application, even for non-classified communications.

An official email dated March 18, which has been reviewed by NPR, alerts that a flaw has been discovered within Signal's security framework. The memo specifies, "Russian cybercrime groups are leveraging Signal’s 'linked devices' feature to intercept encrypted messages."

Signal's spokesperson, Jun Harada, responded to NPR stating, "We are not aware of any security flaws that we haven't already addressed in public forums."

Additionally, the Pentagon memo mentions that third-party messaging services like Signal are allowed for certain unclassified activities, yet they remain unsuitable for storing or transmitting sensitive, although non-public, data.

Recently, high-profile security figures, including Defense Secretary Pete Hegseth, were involved in discussions via the encrypted Signal platform. Notably, journalist Jeffrey Goldberg was unintentionally added to a group where confidential discussions were conducted.

In military terms, the inadvertent transmission of classified information through insecure means is known as 'slippage,' which, albeit minor, can have serious career repercussions for military personnel.

Historical documents indicate that as early as 2023, a Department of Defense memo explicitly barred mobile apps from handling even 'controlled unclassified information,' which ranks significantly lower than live military operation intelligence.

It is exceedingly rare for the heads of major defense and security branches to exchange classified military intelligence over channels known to lack adequate security.