What to know about Signal, the chat app US officials used to share attack plans

U.S. officials are reportedly shocked by a bombshell report in *The Atlantic*, which alleges that senior members of President Trump’s cabinet inadvertently sent detailed operational plans regarding U.S. military strikes in Yemen to a group chat a reporter had accidentally joined. The incident has brought scrutiny to Signal, the encrypted messaging platform involved.

Signal is an open-source, private communication app that supports direct messages, group chats, and voice and video calls. It uses end-to-end encryption to ensure all user communications are secure, preventing third parties from viewing or eavesdropping, similar to other popular chat services like WhatsApp. In other words, anything sent on Signal is encrypted, and only the sender and recipient (or group recipients) possess the decryption keys.

Signal also offers other features, allowing users to host group calls with up to 40 people, create group chats with up to 1,000 members, share statuses, and send disappearing messages. Signal's encryption protocol is also open-source, meaning anyone can publicly inspect, adopt, use, and even modify it. Originating in the U.S. in 2012, the app is supported by the Signal Foundation, a non-profit organization funded by donations rather than advertisers or investors, which claims it values "privacy over profit."

Signal is available for download on most mobile and desktop devices in Australia. Users need to register using a phone number, verification code, and PIN, and must be at least 13 years old to use its services. Users can choose to add more information, such as a profile picture and an "About Me" section. While end-to-end encryption remains a powerful security tool, it is not entirely foolproof. Stealing encryption keys or accessing data before encryption still pose threats, and endpoints may be compromised. Metadata, including contextual information about participants, dates, and times, may also be exposed. Nevertheless, for average users, everyday conversations generally remain secure. Signal states that it "never sells, rents, or monetizes your personal data or content in any way."

Signal cannot decrypt or otherwise access the content of your messages or calls. Only encrypted tokens are stored on its servers and are solely used for transmitting messages and establishing calls. Users can also choose to provide their contacts for easy access and connection to other users on their phones. All users can manage their personal information in Signal's app settings. Any personal data shared with Signal's support team will be retained to research issues and contact individuals regarding their cases.