Is Signal a Security Risk to Your Business?

The Atlantic’s Editor-in-Chief was added to a government group chat on messaging app Signal, which is raising security concerns about where sensitive military conversations take place.

Signal is a privacy-focused messaging app, which helps its users avoid being tracked. The President of the Signal Foundation, Meredith Whittaker, has described the app as the “gold standard of private comms” and outlined Signal’s central security principle, which includes end-to-end encryption. The app also boasts impressive security features such as profile picture blurring and disappearing messages. Despite these measures, there are still concerns about how appropriate Signal is for sensitive government conversations.

However, the app remains a solid choice for businesses looking for added privacy and security, and below, we’ve outlined the best ways you can bolster your defenses while using Signal.

What is Signal and Who Owns It?

Signal was the app used by US government officials to discuss military plans, sparking concerns around its suitability for highly sensitive conversations. Signal is an open-source messaging service used by an estimated 40-70 million users per month.

It is owned by the Signal Foundation, a US non-profit that relies on donations and grants for funding rather than advertising, putting user privacy at the center of its business model. Its co-founders are Moxie Marlinspike and Brian Acton, the latter who founded WhatsApp.

The company’s focus on privacy and security has earned it a great reputation among cybersecurity experts and journalists. Its end-to-end encryption allows only the sender and receiver to view messages, so the only information the company has on its users is the date an account was added and the date said account was last used.

Growing Concerns Over Security

While Signal’s security measures are strong, it is still not considered an appropriate tool to house sensitive military conversations, such as the one Atlantic Editor-in-Chief Jeffrey Goldberg found himself in the middle of this week.

Added to a group chat, Goldberg was subject to US plans to bomb Houthi targets across Yemen, including weapons packages and targets. He also read discussions about perceptions of European “free-loading” and America’s role in “bailing out” Europe.

There are certainly concerns about government security in these cases. Especially since certain features of Signal, such as disappearing messages, could be in violation of federal law that requires official government records to be kept.

Tips for Using Signal in Your Business

Signal is otherwise a very secure messaging app. Beyond its end-to-end encryption and disappearing message feature, the app is open-source, meaning it can be continually checked by experts to prevent hacks.

However, if you are concerned about security when using the app, here are our tips for using Signal in your business:

• Location: Phones can be less secure than computers because of how often we use them. If possible, avoid opening the Signal app on public transport, or keep it restricted to an antivirus-protected computer.
• Features: Take advantage of features such as disappearing messages, profile picture image blurring and an incognito keyboard.
• Link previews: Disable link previews through Settings > Privacy in order to reduce the risk of tracking or phishing scams.
• Verification: Verify safety numbers before sharing sensitive information, allowing you to make sure you are communicating with the correct person.
• Device: Consider using a secondary phone number when you sign up.
• Security: Always choose a strong PIN and consider using biometrics to access the app.