An attempt by senior Trump administration officials to discuss sensitive military plans in the Signal encrypted messaging app turned into a teachable moment in endpoint security when one of those officials mistakenly added The Atlantic’s editor in chief to that group chat.
As the headline of Jeffrey Goldberg’s story posted Monday sums up things: “The Trump Administration Accidentally Texted Me Its War Plans.”
In the piece, Goldberg recounted how accepting a Signal connection request on March 11 from a user called Michael Waltz—the same name as Trump’s national security adviser—led to him being added to a “Houthi PC small group” chat. He then witnessed discussions between members of this principals’ committee about military responses to attacks by Houthi militants in Yemen.
The participants in this chat appeared to include officials as high-ranking as Vice President JD Vance and Secretary of Defense Pete Hegseth. Goldberg recounted the latter pledging “to enforce 100% OPSEC” (operational security), followed by banter about how European nations owed the US for its actions to defend shipping lanes in the Red Sea from Houthi drones and missiles.
The Best Amazon Spring Sale Deals You Can Get Now
*Deals are selected by our commerce team
The Atlantic’s EIC, having accepted that this chat probably wasn’t some elaborate spoof, then realized that strikes carried out by US forces against Houthis on March 15 were only hours away after Hegseth posted a “TEAM UPDATE” in the Signal chat that included “information about targets, weapons the US would be deploying, and attack sequencing,” Goldberg says.
Goldberg, who has reported on military and national-security issues for decades and earlier served in the Israeli Defense Forces as a prison guard, observed in the story that an American adversary could have exploited the details Hegseth shared “to harm American military and intelligence personnel, particularly in the broader Middle East.”
Goldberg’s story shares such gleeful reactions to the March 15 attacks as Waltz replying in pictogram form with fist, American flag, and fire emoji.
The journalist wrote that he removed himself from the Signal group—which should have automatically notified Waltz—and still did not get any feedback about his presence there until he emailed multiple members and other Trump administration officials Monday morning to ask why he had been added and if the White House normally discussed military plans in that app.
“This appears to be an authentic message chain, and we are reviewing how an inadvertent number was added to the chain,” a National Security Council spokesman told Goldberg.
During a Monday-afternoon appearance at the White House with Louisiana Gov. Jeff Landry (R), President Trump answered a question about Goldberg’s story by saying it was all news to him.
“I don’t know anything about it,” Trump said before commenting that “I’m not a big fan of The Atlantic.” He brushed aside a follow-up about whether using Signal instead of established government communications systems could have compromised the attack: “Well, it couldn’t have been very effective, because the attack was very effective.”
Signal’s combination of end-to-end encryption and extensive scrubbing of metadata generally earns this open-source app exceptionally high grades among secure messaging apps, but any system is only as secure as its least trusted endpoint.
How Waltz or whoever had access to his copy of the app could have added Goldberg by mistake remains unclear but does seem possible. You can add somebody to a group chat by a phone number or a username; if that somebody does not have a profile picture set in the app, their avatar in the chat will only consist of their initials in a circle.
Does This Break Government Rules, and Does Anyone Care?
What does seem clear, both from Goldberg’s story and subsequent comments by national-security experts, is that these conversations should not have happened in Signal at all by longstanding government rules. The usual physical venue for discussing secret military plans is a SCIF (sensitive compartmented information facility), in which participants aren’t even allowed to bring personal smartphones.
Recommended by Our Editors
Prior statements from President Trump would suggest tough consequences for the people involved in this episode, while Trump’s prior conduct would suggest nothing will happen.
In 2016, candidate Trump frequently called Democratic candidate Hillary Clinton not just unqualified but deserving of jail time for her use of a private mail server for personal correspondence while serving as President Obama’s Secretary of State.
During his first term, however, President Trump’s administration exhibited no small amount of cyber hubris that concluded with staffers taking dozens of boxes of classified documents from the White House to Trump’s estate in Mar-A-Lago, Fla., after his term ended in 2021.
That led to criminal charges that were slowly moving towards a trial in Florida after a long series of delays caused by rulings from Judge Aileen Cannon. But then, the judge, whom Trump had appointed in November 2020, dismissed the case in July 2024, after which Trump’s return to the presidency ensured it would go no further.
“This isn’t the first time senior officials have used data access how they see fit, where rank can counter the rules for everyone else in the system,” emailed Bryson Bort, founder and CEO of the Arlington, Va., security firm Scythe and a West Point graduate. “But, these rules are there for a reason.”
Noting that such earlier breaches of classified data as the “Vault 7” leaks of CIA hacking tools happened despite officials complying with rules that demanded “a more careful vetting of who can access information than simply adding a phone contact to a Signal group,” Bort offered a warning: “In the wrong hands this can get US service members killed.”
Get Our Best Stories!
This newsletter may contain advertising, deals, or affiliate links.
By clicking the button, you confirm you are 16+ and agree to our
Terms of Use and
Privacy Policy.
You may unsubscribe from the newsletters at any time.
About Rob Pegoraro
Contributor
