The Guardian's Exclusive On The Signal Chat

The Guardian ran an "exclusive" yesterday that had nothing new on a two week old story but continued to get everything wrong:

According to three people briefed on the internal investigation, Goldberg had emailed the campaign about a story that criticized Trump for his attitude towards wounded service members. To push back against the story, the campaign enlisted the help of Waltz, their national security surrogate.

Goldberg’s email was forwarded to then Trump spokesperson Brian Hughes, who then copied and pasted the content of the email – including the signature block with Goldberg’s phone number – into a text message that he sent to Waltz, so that he could be briefed on the forthcoming story.

. . . According to the White House, the number was erroneously saved during a “contact suggestion update” by Waltz’s iPhone, which one person described as the function where an iPhone algorithm adds a previously unknown number to an existing contact that it detects may be related.

The mistake went unnoticed until last month when Waltz sought to add Hughes to the Signal group chat – but ended up adding Goldberg’s number to the 13 March message chain named “Houthi PC small group”, where several top US officials discussed plans for strikes against the Houthis.

The Guardian story then repeats Waltz's initial explanation that Goldberg’s number had somehow been “sucked” into his phone and seems to use the complex chain of contact updates outlined above to lend support to the story.

The problem is that the Guardian's version -- which appears to have been planted by Waltz allies within the White House -- simply doesn't fly. For starters, it implies that Signal is just a text messaging app:

Waltz also appears to have also engendered some sympathy from inside Trump’s orbit over the group chat because the White House had authorized the use of Signal, largely because there is no alternative platform to text in real time across different agencies, two people familiar with the matter said.

Previous administrations, including the Biden White House, did not develop an alternative platform to Signal, one of the people said. As a temporary solution, the Trump White House told officials to use Signal as they had done during the transition instead of regular text-message chains.

But there are other text messaging apps, inclulding WhatsApp, Telegram, Messenger, and Viber. The important thing about Signal is that it has a strong commercial-level security feature. According to techradar,

What sets Signal apart is its robust privacy features: it’s regarded as the benchmark for secure mobile communications. Which makes Signalgate all the more ironic, even though it has little to do with the app's technical security.

All messaages are encrypted on the sender's phone, transmitted over the web in encrypted form, and decrypted on the receiver's phone. But in order for the text to be decrypted, the app must be on the on the receiver's phone. As I noted a week ago, Signal would have had to be installed on Goldberg's phone, which would have involved:

• Downloading Signal to the phone and running the install program
• Registering a phone number and waiting for a verification code
• Entering the verification code and finishing the onboarding process
• Editing a user profile and notifying a chat admin of it.

There is no way this could have happened just by "including the signature block with Goldberg’s phone number" into a text message mistakenly sent to Waltz by Brian Hughes. Goldberg, someone on Goldberg's staff, or possibly someone on Waltz's staff, would have had to have access to Goldberg's phone, installed Signal on it, registered the phone with Signal, verified it, and then created or edited a Signal user profile for Goldberg, notifying Waltz, or someone on Waltz's staff, that this was Goldberg's profile.

Then Waltz, or someone on Waltz's staff, would have had to add Goldberg's profile, knowing it was Goldberg, to the Houthi chat. There is no way around this -- after all, this is strong commercial-level security. At least two people had to be involved, likely more than two, and there are presumably audit trails of every action. This is, for instance, the level of security banks use in things like wire transfers.

The Guardian story indicates there was some sort of internal forensiuc investigtion at the White House. The Guardian's use of the term "forensic" suggests the investigation involved auditors qualified to investigate fraud. It's hard to imagine the technical details of how Signal is installed and a phone is registered and a specific user profile added to the chat on Signal itself weren't part of that forensic investigation.

It's also hard for anyone not to conclude that someone on Waltz's staff was fully aware of what was done and for what purpose, namely, to damage the Trump administration's image by leaking information to a hostile journalist. I'm inclined to believe just one point in the Guaridan story:

Trump briefly considered firing Waltz over the episode, more angered by the fact that Waltz had the number of Jeffrey Goldberg, the editor of the Atlantic – a magazine he despises – than the fact that the military operation discussion took place on an unclassified system such as Signal.

But Trump decided against firing him in large part because he did not want the Atlantic and the news media more broadly to have the satisfaction of forcing the ouster of a top cabinet official weeks into his second term.

Trump isn't stupid. Right now, he's keeping his friends close and his enemies closer. The Guardian story seems to come from Waltz and Waltz allies:

When Trump left the White House on Thursday, he was joined aboard Marine One by his chief of staff, Susie Wiles, his personnel chief, Sergio Gor, and Waltz, which aides took as a show of support for the embattled national security adviser.

Trump has learned important things about Waltz and Waltz's staff from this episode. Waltz, I think, is the stupid one here.