Signal Is Private, Sure, but Not That Private

Another day, another security breach, but this time it's going down in the group chat. On Monday, The Atlantic's editor-in-chief, Jeffrey Goldberg, reported that he had been added to a Signal conversation with Trump administration officials—including Defense Secretary Pete Hegseth, Vice President JD Vance, Secretary of State Marco Rubio, and National Security Advisor Michael Waltz—who were discussing highly sensitive "operational details" about impending attacks in Yemen.

Signal is a secure messaging app, but as a publicly available service, it's not meant for coordinating military operations (the U.S. government doesn't allow its use to communicate classified information). Here's what Signal is great for—and the limits to the privacy it ensures.

When you should use Signal

Signal is a free, open-source messaging app with end-to-end encryption, allowing users to keep conversations (including text, images, audio and video messages, and calls) private and safe. It's one of our top picks for secure communication, and its privacy and security settings and open-source protocol are lauded by the Electronic Frontier Foundation as well as many data security experts.

In addition to end-to-end encryption, Signal has a disappearing messages function, which deletes chats after a set period of time, as well as features like photo blurring, hiding your phone number by default, and other security settings to protect your identity and your data.

All of these factors make Signal an excellent choice for communication you want to keep private, whether you're transmitting personal or sensitive information or are engaging in activism or otherwise want to know that no one but you and the intended recipient can read your messages. If you're an iPhone user, you can make Signal your device's default messaging app. (Signal used to support SMS/MMS on Android, allowing you to use it as your default messenger, but removed that functionality in 2022.) But there's still a couple of sticking points to keep in mind.

Signal still has privacy risks

While Signal is an excellent tool for encrypted communication, it doesn't guarantee absolute privacy for classified information, such as that related to matters of national security.

As recent events show, users can be added to group chats—mistakenly or on purpose—leaving open the possibility that your messages will be exposed to someone not meant to see them. You should verify the identity of everyone included your threads before sending sensitive information to them, and consider utilizing Signal's group chat settings to require approval of new members or restrict who can add members to the thread.

If private information is being shared, you can also verify a contact's safety number to ensure they are who you think they are.

But even if you maximize all of Signal's security settings, the mobile device you're using could be compromised by spyware, as Apple has warned users in more than 150 countries. These campaigns attempt to install invasive malware on smartphones to capture users' location, data, and activity—defeating any encryption benefit Signal offers in the process. Bad actors are most likely to target high-profile politicians, activists, journalists, and others who have access to classified or sensitive information.

Additionally, Signal can also be downloaded and accessed across multiple devices, including a desktop app, where data may be stored less securely or compromised by malware.

Finally, there's always the possibility that your device could simply be swiped, leaving your data open to whoever can unlock it (a good reason to enable disappearing messages).

With that in mind, while installing Signal is a good place to start, it shouldn't be the entirety of your privacy routine. If you have an iPhone, here are a few additional steps you can take to keep your data secure—perhaps our government officials could benefit from going through this checklist, too.