from Hacker News

Mike Waltz Accidentally Reveals App Govt Uses to Archive Signal Messages

by lurkersince2013 on 5/2/25, 12:56 AM with 125 comments

  • by lurkersince2013 on 5/2/25, 1:04 AM

  • by IG_Semmelweiss on 5/2/25, 2:22 AM

    >>> overnment agencies have paid for versions of encrypted messaging apps that also have archive abilities before. In 2021, Customs and Border Protection (CBP) paid encrypted app company Wickr $700,000.

    This seems like a perfect use case to support Signal. Have large, corporate or govt entities, pay for a custom fork of the app, built by the app developers themselves.

    Why is telemessage getting the money ? Does the Signal Foundation not make it easy to do paid fork implementations ?

  • by mmastrac on 5/2/25, 1:19 AM

    > TM SGNL appears to refer to a piece of software from a company called TeleMessage which makes clones of popular messaging apps but adds an archiving capability to each of them

  • by esafak on 5/2/25, 1:39 AM

    What is the point of using Signal if you are going to let a (foreign) company intercept your communications? I guess they wanted the UX of a commercial product instead of whatever clunky app that's approved for government. Does anyone know what the alternative was?

  • by t0lo on 5/2/25, 2:18 AM

    I don't get it. Why risk secuity vulnerabilities to archive when you can just ask israel and pegasus for the archives anyway.

  • by cge on 5/2/25, 1:45 AM

    As some details:

    TeleMessage is/was an Israeli company [1], but was acquired last year by Smarsh [2], itself a subsidiary of K1 Investment Management, both US companies. It me whether the company moved. While not necessarily related at all, their terms of service also seem to explain specific arrangements for messaging in China that appear to involve disclosures to the Chinese government.

    It's unclear to me how the app works. It appears to be advertised as a fork of the Signal client which uploads all content to a remote server, thus, of course, breaking the E2E encryption, unless the archive is considered an end and the connection to it is secure. It also appears to be advertised as being the same interface as Signal.

    However, both the iOS and Android Signal clients are AGPLv3. I can't find any indication that the TeleMessage clients are anything other than proprietary. So are they going the route of giving the software and source only to paying customers under AGPLv3 (with those customers then free to distribute it)? Did they completely reimplement the client? Or are they an illegal proprietary fork?

    The first option seems unlikely, and the latter two seem rather ominous for the security of the app.

    [1]: https://en.wikipedia.org/wiki/TeleMessage [2]: https://en.wikipedia.org/wiki/Smarsh

  • by giancarlostoro on 5/2/25, 2:01 AM

  • by qingcharles on 5/2/25, 4:13 AM

    Would love to know what the message from JD means: "I have confirmation from my counterpart it's turned off."

  • by mdhb on 5/2/25, 6:48 AM

    So wait…

    They are using a Signal clone that is run by a group of Israeli intelligence officers??

    I don’t think that part of the story has broken yet properly. When you go to google maps for the address listed for that company you actually get a company called “Cyberint” which seems extremely not good.

    https://maps.app.goo.gl/L7vVHw5x4VdgS8859?g_st=com.google.ma...

    Worse.. when you take a look at the bios for the company on their website I see that it’s filled with supposedly “ex” Israeli intelligence officers including the CEO among others. https://www.telemessage.com/team/

    That seems like a MUCH MUCH bigger deal than they currently known story.

    Like several orders of magnitude bigger than the original signalgate story.

    The implication here is that a bunch of Israeli intelligence officers have maybe the best access of anyone in the world right now in that they have a real time feed of every conversation that the US national security advisor is a part of.

  • by MaxPock on 5/2/25, 5:03 AM

    Wouldn’t it be more effective for the government to develop a highly secure communication app, known only to individuals in top-level positions? This app would be discreetly installed upon appointment to a senior government role and automatically removed upon departure from office.

  • by JumpCrisscross on 5/2/25, 1:56 AM

    “On Thursday Reuters published a photograph of Waltz checking his mobile phone during a cabinet meeting held by Donald Trump. The screen appears to show messages from various top level government officials, including JD Vance, Tulsi Gabbard, and Marco Rubio.”

    Head of NatSec, ladies and gentlemen. Once the domain of Kissinger, Brzezinski, Powell and Rice. Now with the opsec of a brain-damaged cocaine dealer.

  • by cryptonector on 5/2/25, 4:16 AM

    At least this takes care of the open records issues, no?

  • by sagarpatil on 5/2/25, 5:11 AM

    So is signal safe or not?

  • by whimsicalism on 5/2/25, 3:24 AM

    > 404 Media found numerous U.S. government contracts that mention TeleMessage specifically. One for around $90,000 from December 2024 says “Telemessage (a Smarsh Co.) Licenses for Text Message Archiving, & WhatsApp and Signal Licenses.”

    A blatant AGPL violation, no? Were they using Signal in the Biden admin or do these contracts get setup in prep for the new team?

  • by janalsncm on 5/2/25, 1:31 AM

    It’s possible Mike Waltz didn’t think the archiving capability was reliable enough, so he added a journalist to the group chat.

  • by bamboozled on 5/2/25, 2:55 AM

    "He's just joking"

  • by michaelteter on 5/2/25, 6:06 AM

    Clown car.

  • by _heimdall on 5/2/25, 1:19 AM

    It seems reasonable enough that the government may have built a forked version of signal with message archiving that meets documentation requirements.

    If its an app they wanted kept under wraps, it will make the while Hegseth situation seem a lot more benign.

    I use Molly Messenger on a secondary phone that doesn't have a SIM, its a fork of Signal with a few differences related to encryption at rest. It still works with normal signal users just fine, on the other end you can't tell I have a different client. If the government has a similarly forked version you could likely still accidentally invite the wrong user in from their normal Signal app and they wouldn't know you're on a forked version with government archiving features.