Don’t Blame Signal: The Breach Wasn’t Their Fault

Generated by AI, reviewed by a human. 

In the latest episode of Security Now, Steve Gibson sheds light on a high-profile data breach that has led to significant confusion—and unfairly dragged the Signal messaging platform into the spotlight for the wrong reasons.

The controversy stems from a modified version of Signal’s open-source code that was developed by a U.S. government contractor. This derivative app, named TM SGNL, was designed for internal agency use and was not affiliated with or approved by the Signal Foundation. Unfortunately, TM SGNL lacked the robust security architecture of the original Signal app. It had been significantly altered, resulting in a far less secure messaging system.

Earlier this year, TM SGNL was compromised in a data breach that exposed sensitive communications from multiple U.S. government agencies. Rather than clearly identify the insecure clone as the source of the breach, many headlines and news reports referred simply to “Signal,” creating the false impression that the widely trusted secure messaging platform had failed.

In reality, Signal was never involved in the breach. Its infrastructure, encryption model, and application remained untouched and uncompromised. The only connection was that Signal’s freely available open-source code had served as the starting point for TM SGNL’s development. From there, the contractor made critical changes—removing safeguards and weakening security measures—which ultimately led to the app’s vulnerability.

This situation highlights a recurring challenge in tech journalism: the distinction between an original open-source project and derivatives built from it is often lost in reporting. When high-profile platforms like Signal are named in stories where they played no operational role, public trust in privacy-focused tools can erode unnecessarily.

Steve Gibson takes time in the episode to walk through the timeline of the TM SGNL breach, clarifying what the app actually was, how it deviated from Signal, and why the breach should never have been framed as a failure of Signal itself. The takeaway is clear: strong encryption and open-source transparency are not to blame here—poor implementation and miscommunication are.

This segment is a must-listen for anyone interested in privacy, secure communications, and the nuances of open-source development. But it’s only one part of an information-packed episode. The show also explores dormant Magento plugins weaponized after six years, confusing behaviors around browser logins, a powerful new speed test tool from Cloudflare, and the latest progress on SpinRite.

You can hear the full breakdown and more on Security Now #1024, available now on TWiT.tv or wherever you get your podcasts.