WASHINGTON (Reuters) -The unofficial version of Signal used by Donald Trump’s former National Security Adviser Mike Waltz has been hacked, tech site 404 Media said Sunday, raising further concern over the security of the communications exchanged at the highest levels of the U.S. government.
404 Media said the hacker exploited a vulnerability in TeleMessage, a Signal-like application which a Reuters photograph appeared to show Waltz using at a cabinet meeting on Wednesday.
Waltz was ousted Thursday, several weeks after the eruption of a scandal over his creation of a Signal group to share realtime updates on U.S. military action in Yemen. The chat drew particular attention because Waltz, or someone using his account, accidentally added a prominent journalist to the group.
The revelation that Waltz was using TeleMessage, which appears to have a similar interface and functionality as Signal, has only heightened the concerns over the security of his communications.
404 Media quoted the hacker – who didn’t identify themself – as saying that they had broken into TeleMessage’s backend infrastructure and been able to intercept some of its users’ messages. 404 Media said the hacker provided them with material, some of which the news site was able to independently verify.
The publication said that the hacker did not intercept messages from Waltz or other Trump cabinet officials.
Reuters could not independently verify the report. Messages seeking comment from TeleMessage and its corporate owner, Portland, Oregon-based Smarsh, were not immediately returned. Messages seeking comment from Waltz and the White House also weren’t immediately returned.
Signal is an end-to-end encrypted messaging platform whose technology is meant to frustrate hostile surveillance.
Smarsh’s product TeleMessage, which the company is in the process of rebranding as Capture Mobile, is designed to capture the messages once they’ve been decrypted so they can be preserved and stored. That kind of additional functionality can be useful for complying with government rules on document retention but if poorly implemented it can introduce security risks.
A Signal spokesperson told Reuters earlier this week that the company “cannot guarantee the privacy or security properties of unofficial versions of Signal.”
(Reporting by Raphael Satter and AJ Vincens; Editing by Michael Perry)
