Why the Signal group chat was a channel design failure before it was a leak
A journalist in a senior officials’ chat made the headlines. For agencies at every level, the durable failure was a sanctioned channel that could not set content boundaries, verify participants and keep the record at the same time.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 24, 2025, The Atlantic’s editor-in-chief reported that he had been added to a Signal group chat of senior national security officials. They included national security adviser Michael Waltz and defense secretary Pete Hegseth, and they discussed the U.S. strikes on Houthi targets in Yemen carried out on March 15. The White House said the chat appeared authentic. On March 26, the magazine published further messages, including strike timing and weapons details. Reports said messages in the chat were set to disappear. On March 25, the group American Oversight sued under the Federal Records Act, and on March 27 a federal judge ordered the agencies involved to preserve Signal messages from March 11 to 15. Congressional committees questioned intelligence chiefs about the chat that week.
Coverage of the Signal episode centered on the wrong person in the chat. That error is unlikely to recur in exactly the same form, and it applies mainly to national security officials. The failure underneath it applies to every federal, state and local agency. Officials chose a consumer app because the approved alternatives did not meet their needs, and the consumer app could not do three things an official channel must do together. It could not enforce a boundary on what content belongs there. It could not verify who was in the conversation. It could not keep the record the law requires. Each property needs a different control, and fixing one while ignoring the others moves the risk rather than removing it.
Boundary: which content belongs on which channel
Signal itself was not the problem. In December 2024, CISA had advised highly targeted individuals to use end-to-end encrypted messaging apps for their personal mobile communications. Encryption protects content in transit. It says nothing about whether the content is authorized for the device or the app. Classified military operational details belong on accredited systems, and commercial apps on phones are not accredited for them.
The same boundary problem exists far from the Pentagon. A state police agency handles criminal justice information subject to the FBI’s CJIS Security Policy. A public health department handles protected health information. A procurement office handles bid information that is sensitive before award. In each case, the agency has rules about which systems may hold which data, and staff carry phones that ignore those rules.
Effective boundary controls start with making the approved high-sensitivity channel reachable. If secure communication requires a desk, a separate device and a separate login, senior staff traveling between meetings will not use it. Agencies should map their most frequent sensitive coordination tasks, then provision a compliant path for each. Training should use concrete examples from the agency’s own work, such as which messages about an investigation or a contract award belong on which system.
Device management carries part of the load. Agencies can separate work and personal profiles on government phones, restrict which apps may run in the work profile, and block copy and paste from approved systems into unapproved ones. None of this stops a determined official, but it makes the compliant choice the default one.
Identity: who is in the room
The original error was an identity error. A contact was added to a group and nobody confirmed who it was. In an enterprise collaboration platform tied to an agency directory, group membership follows directory groups, external participants are labeled, and administrators can review access. In a consumer app, a group is whatever its creator says it is, and display names are self-asserted.
Identity risk runs in both directions. In February 2025, Google’s threat intelligence group reported that Russia-aligned actors were trying to take over Signal accounts by abusing the app’s linked-devices feature. In May 2025, the FBI warned that attackers were impersonating senior U.S. officials through text and AI-generated voice messages to gain access to the accounts of current and former officials. A channel where outsiders can be added silently, or where impersonators look identical to principals, is a channel built for these attacks.
For cross-agency coordination, the fix is federation. Agencies should configure their enterprise platforms to allow named external tenants, with external users visibly marked. Cross-agency work is exactly where officials have reached for consumer apps, because enterprise tools often stop at the agency boundary.
Record: what the agency keeps
The Federal Records Act requires agencies to preserve records of official business. Since 2014, it has required that an official who creates a record on a non-official messaging account copy or forward it to an official account within 20 days. Disappearing messages make compliance depend on each official remembering to export before deletion. That rarely happens. State and local agencies face their own public records and retention laws, often with similar duties, and counsel should confirm how each schedule applies.
Records capture works best when it is native to the approved channel. Enterprise messaging platforms can apply retention policies and legal holds centrally, so the record is kept whether or not the official thinks about it. Wrapping a consumer app with a third-party archiving client is the alternative many organizations reach for. That approach adds a new component that holds every message in one place, often outside the agency’s security monitoring. An archive is a target. It needs the same security review, logging and access control as the messaging platform it serves.
Records officers, CIOs and general counsel share this problem, and none can solve it alone. A useful joint metric is the share of business messaging that flows through channels with automatic capture, measured through device management and network data. Another is the number of approved exceptions, each with an owner and an end date.
The three properties interact. A ban on consumer apps, without a reachable approved channel, pushes officials to personal text messages, which fail on all three. An archiving add-on solves the record and opens a new security exposure. An enterprise tool that cannot reach other agencies sends officials back to the consumer app. The workable design delivers all three at once.
With hindsight
The episode had a long tail. In early May 2025, Waltz left the national security adviser role and was nominated as ambassador to the United Nations, a post the Senate confirmed in September. A photograph from a Cabinet meeting showed him using TeleMessage, a modified Signal client that archives messages. Within days, TeleMessage was reported breached and suspended its service, and in May CISA added flaws in the product to its catalog of known exploited vulnerabilities. In June, the judge in the records case declined to order recovery of messages already deleted.
In December 2025, the Pentagon’s inspector general reported that the defense secretary’s use of Signal on a personal phone for official business violated department policy. It also found the messages were not retained as federal records law requires. The inspector general described the episode as one instance of a department-wide issue.