The Atlantic releases the entire Signal chat showing Hegseth's detailed attack plans against Houthis
The Atlantic releases the Signal chat showing Hegseth's detailed attack plans against the Houthis
I’m watching the hearing now. Democrats are ROASTING them and calling for their resignations, while Republicans are asking them about China and Mexico and praising their first months in position. It’s disgusting.
The NSA explicitly advised them all against the use of Signal back in February, citing recent breaches of the platform by Russian hackers. Two of them were in Moscow at the time the strikes were communicated, one being Gabbard, the Director of National Intelligence.
Edit: The lottery assigned Judge Boasberg to their trial. It’s a good day.
We need more than resignations. We need actual punishments. Can't have them just resign and go on to be a private consultant or talking head.
Or go on to store documents in a bathroom between Russian ambassador visits
This is just the congressional investigation. The criminal trial will be heard by Judge Boasberg.
I hear non-federal prison is fun. Mix them in with gen pop while waiting in a transfer that never comes. Surely the thoughts and prayers are effective against boiling sugar water.
I'm not familiar with Boasberg, but a quick DDGing tells me he's been blocking deportations. Someone with integrity ? Can you tell me more ?
Yes. He’s the judge that Trump and congressional Republicans have repeatedly threatened with impeachment for obstructing the Executive Branch. Impeachment of a federal judge requires a 2/3 vote in the Senate, and Senate Democrats have already stated that they will not vote in favor.
He has issued injunctions on the Alien Enemies Act deportations, and is the one demanding detailed flight logs and passenger lists for the flights to El Salvador. They very much dislike him for doing his job correctly.
Roasting isn't enough, unless we're talking about doing it over an open flame.
Congress can’t charge them with a crime. They’re already scheduled for court.
Signal itself is not vulnerable. This article needs to correct itself. Signal is only vulnerable if the DEVICE THAT USES IT is compromised. Using devices that can be compromised is the issue here. Do not use that device to discuss anything confidential if you are in the government.
This is not Signal's fault at all.
There is no doubt in my mind that their phones are compromised.
They’re refusing to use government issued devices. They’re all using personals. This was an issue last time around, too. There’s a whole fucking division of the government (that I’m sure they’re hollowing out now) whose job it is to make sure people who need secure devices have them and use them.
They are compromised, it doesn’t even matter if the software on their phones is too.
But a presidential administration is required to keep classified records, and records of all meetings in general.
It may take decades of FOIA requests, but those records are SUPPOSED TO BE KEPT, not deleted forever after 7 days.
This regime using Signal is a major red flag and a permanent information black hole.
Tulsi only gave her device to Russian intelligence to install exclusive games not available in the US.
I don't see the issue here. Gabbard is known to be trustworthy. Let her play the cool games.
Signal itself is not vulnerable. This article needs to correct itself. Signal is only vulnerable if the DEVICE THAT USES IT is compromised.
I think the description of vulnerability is subjective in this case. It could be that signal is inherently more vulnerable than official channels, as Signal is a private corporation that has no motivation to disclose any failures in their security.
I don't think the article is trying to blame Signal in any way, it's just not the proper communication channel and thus utilizing it is an inherent vulnerability no matter how secure their encryption may be.
The Signal Foundation is a non-profit. The non-profit owns an LLC under the same name which publishes and develops the apps.
The software itself is open source, and licensed under AGPLv3, the same permissive license as lemmy and mastodon.
Calling them a private company with no motivation to disclose any failures in their security is pretty clearly untrue in whole.
I think the description of vulnerability is subjective in this case.
No, it really isn't. The Signal protocol enables E2EE, meaning you don't have to worry about the server infra (that is, even if you don't buy that they're using the FOSS server code they say they are, it's irrelevant). The Signal protocol is open and has been examined forwards and backwards over and over by security researchers around the world. I can't emphasize how many eyes are on this protocol because of how prolifically used it is, including by government officials worldwide. The app is FOSS, and like the protocol, it has a ton of eyes on it for the same reason. The app is a reproducible build, meaning that if Signal baited you with a fake app, it would be found out immediately.
It could be that signal is inherently more vulnerable than official channels, as Signal is a private corporation that has no motivation to disclose any failures in their security.
They're a corporation, sure, but in the sense that they're a 501(c)(3), not a for-profit. Signal would have every incentive to disclose a failure in "their security" (where here that means their app or the protocol; again, what's happening on the servers literally, provably, mathematically doesn't matter). For a privacy org like this, it's in their best interest to immediately report any problems that might compromise privacy.
I don't think the article is trying to blame Signal in any way, it's just not the proper communication channel
Agreed. But here, I agree it's not the proper channel 1) because it's on their personal devices which the person you're responding to clearly stated and 2) a Signal chat (likely intentionally on their part) bypasses crucial records keeping laws. A known vuln for example is if someone has access to your phone, they can link their own personal device and read your messages as they come up. But again, that requires access to your phone, which becomes problematic if and only if you're using your own personal device rather than a secure government one.
and thus utilizing it is an inherent vulnerability no matter how secure their encryption may be.
No. Again, that's not an inherent vulnerability. Using it on their personal devices is, but unless you can come up with a vulnerability in the app itself or the protocol itself, then you're just agreeing with the person you're replying to.
Signal is a publicly available app that provides encrypted communications, but it can be hacked. It is not approved for carrying classified information. On March 14, one day before the strikes, the Defense Department cautioned personnel about the vulnerability of Signal, specifically that Russia was attempting to hack the app, according to a U.S. official who was not authorized to discuss the matter publicly and spoke on the condition of anonymity.
One known vulnerability is that a malicious actor, with access to a person’s phone, can link his or her device to the user’s Signal and essentially monitor messages remotely in real time.
This reads to me like Signal has weaknesses. Also, just so everyone is aware:
The Signal Technology Foundation, commonly known as the Signal Foundation, is an American Non-profit organization founded in 2018 by Moxie Marlinspike and Brian Acton. Its mission is to "protect free expression and enable Secure communication through Open source Digital privacy". Its subsidiary, Signal Messenger LLC, is responsible for the development of the Signal messaging app and the Signal Protocol.
Signal is an open-source, encrypted messaging service for instant messaging , voice calls, and video calls . The instant messaging function includes sending text, voice notes, images, videos, and other files. Communication may be one-to-one between users or may involve group messaging.
Vance responded a minute later: “Excellent.” Thirty-five minutes after that, Ratcliffe, the CIA director, wrote, “A good start,” which Waltz followed with a text containing a fist emoji, an American-flag emoji, and a fire emoji.
You cannot make this shit up
They're like a bunch of frat boys trying to outdo each other in their edgy hot take. They're creating their own tiny echo chamber where it is cool to hate on other Western countries and admire Russia.
Signal is a publicly available app that provides encrypted communications, but it can be hacked.
This is misleading statement that will only confuse people who want to use a secure messenger.
To clear things up with anyone who's not technically inclined: Anything can be theoretically hacked. Signal has not been hacked and has no history of being compromised.
The Signal "hacks" that linked people's Signal client to devices that aren't theirs were sophisticated phishing/spoofing attacks. The equivalent of getting someone to click a malicious link via email because it looked like the real thing.
A reminder that you still need to do your due diligence even when using a secure service. Technology alone cannot completely protect you.
Not particularly technically inclined so this question may be stupid, but suppose an intelligence service found some backdoor into Signal, wouldn’t they try to keep that information hidden from Signal? So in theory the chat could be vulnerable already?
You dont just find backdoors in real encryption. They're placed there intentionally. Signal already had governments demanding backdoors and they said no.
To add to the other comment and give an analogy: say you're concerned that I secretly possess keys to the back door of your house and I can freely come and go. It's technically possible. But two questions are important; how come you've never seen me in your house or any signs I've been there? And secondly, why do me and my friends keep asking you to give us your back door key?
to add even more to what's already been said, even if Signal's infrastructure was compromised and they could see messages traveling through their servers, each one is encrypted, the keys are rotated with every message (cracking one, which is nearly impossible, doesn't give you access to previous or future messages), and thanks to Sealed Sender, only the recipient knows who a message came from. There are many other layers that they've engineered to ensure they can't know anything about you, like private contact discovery, using secure enclaves, remote attestation, etc.
This is an article about an article. The original Atlantic article that contains the messages themselves is here
Classification breakdown: https://bsky.app/profile/secretsandlaws.bsky.social/post/3llburtsvnk2m
I will say a prayer for perjury convictions 🙏
They'll just investigate themselves and find nothing.
At 11:44 a.m. eastern time, Hegseth posted in the chat, in all caps, “TEAM UPDATE:”
The text beneath this began, “TIME NOW (1144et): Weather is FAVORABLE. Just CONFIRMED w/CENTCOM we are a GO for mission launch.” Centcom, or Central Command, is the military’s combatant command for the Middle East. The Hegseth text continues:
- •“1215et: F-18s LAUNCH (1st strike package)”
- •“1345: ‘Trigger Based’ F-18 1st Strike Window Starts (Target Terrorist is @ his Known Location so SHOULD BE ON TIME – also, Strike Drones Launch (MQ-9s)”
Let us pause here for a moment to underscore a point. This Signal message shows that the U.S. secretary of defense texted a group that included a phone number unknown to him—Goldberg’s cellphone—at 11:44 a.m. This was 31 minutes before the first U.S. warplanes launched, and two hours and one minute before the beginning of a period in which a primary target, the Houthi “Target Terrorist,” was expected to be killed by these American aircraft. If this text had been received by someone hostile to American interests—or someone merely indiscreet, and with access to social media—the Houthis would have had time to prepare for what was meant to be a surprise attack on their strongholds. The consequences for American pilots could have been catastrophic.
The Hegseth text then continued:
- •“1410: More F-18s LAUNCH (2nd strike package)”
- •“1415: Strike Drones on Target (THIS IS WHEN THE FIRST BOMBS WILL DEFINITELY DROP, pending earlier ‘Trigger Based’ targets)”
- •“1536 F-18 2nd Strike Starts – also, first sea-based Tomahawks launched.”
- •“MORE TO FOLLOW (per timeline)”
- •“We are currently clean on OPSEC”—that is, operational security.
- •“Godspeed to our Warriors.”
We are currently clean on OPSEC
holy shit, the IRONY!
"Nothing classified"
It was so clean. (/s for those immune to sarcasm)
The problem doesn't even seem to be the hacking but how easy it is to gain access to a chat. I didn't look into how the editor got invited but think of how easy it is to get a random number invited to a signal group chat. It doesn't take much social engineering to slip a number in there with this chaotic oh no wait DISRUPTIVE administration. No authentication required. Just send a mail to xXshitlord2006Xx@doge.boys with the text "Oy bro, send group invite"
The people who pulled this off, lol. They probably hacked Waltz his (private?) phone, replaced the number of some high level official with the number of the Atlantic guy, and then just sat back and relax. Watch this shit show unfold.
No-one "pulled this off". Walz fucked up.
This is called "proportionality bias", believing that a major event must have had major planning behind it.
It doesn't. They're just dumb and fat fingered the wrong recipient to add to the chat on an app and phone that they shouldn't have been using in the first place!
Perfect example of hanlons razor
Not really. Accidentally / due to stupidity adding the chief editor of a critical magazine on the administration is just too perfect to be a coincidence.
With Kash Patel on the case, we can be rest assured hell for absolutely nothing about these idiots.
👊🇺🇲🔥
LMAO I can't
Then whinging about messaging is hilarious to me. It's not like they have ever been good at it it's just their portion of the electorate has been eating lead paint and accepts basically anything.
European here: we did not ask for your help, we do not particularly want you to bomb the houthis (or anyone in the Middle East for that matter).
... You want shipping through the Suez.
Do you have the text of the 'did not go unnoticed' article, as it is paywalled for me
Have European leaders been living under a rock? The U.S. leaders have been pretty clear about Europeans countries freeloading and have told them to their faces repeatedly.