Signal archiving tool Trump officials used suspends services after hack claims
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Aïda Amer/Axios
A Signal archiving tool the Trump administration relied on has suspended operations after two reported hacks, according to several news reports.
Why it matters: The suspension is just the latest in a series of events that highlights how poor security controls are putting high-value American secrets at risk.
Driving the news: Last week, Reuters published a photo of now-former national security adviser Mike Waltz using a Signal-like messaging app, called TeleMessage, that archives messages sent on the encrypted messaging app.
- On Sunday, 404 Media published a story about a hacker who claims they were able to hack into TeleMessage in about "15-20 minutes."
- The hacker walked away with names and contact information for government officials, usernames and passwords for TeleMessage's backend panel and indicators for which companies are using the service, according to 404 Media's report.
- NBC News also reported Monday it had received information from a different hacker saying they were also able to break in and download a large cache of files.
What they're saying: "TeleMessage is investigating a potential security incident," a spokesperson for Smarsh, which owns the app, told CNBC in a statement.
- "Out of an abundance of caution, all TeleMessage services have been temporarily suspended. All other Smarsh products and services remain fully operational," the spokesperson added.
State of play: Israel-based TeleMessage has since wiped its website.
- Screenshots of the company's website from April 8, as seen on the Internet Archive's Wayback Machine, show that the service publicly claimed it could help capture messages in Signal, Telegram and WeChat.
- Now, each company webpage redirects to the same sparsely filled homepage that erases all mention of Signal and Telegram.
Threat level: Even before the 404 Media report, security experts were warning that TeleMessage appeared to tamper with Signal's end-to-end encryption since it would allow a message to be retrieved after being stored somewhere else.
Between the lines: Several companies already offer secure messaging tools that could help officials archive messages without breaking encryption.
Go deeper: How Trump's team could've planned the Houthi strikes without Signal
