www.computerworld.com
You know how IT admins are always warning employees about best practices for security? Theyre always mandating which apps to use, which to avoid and which devices can safely connect to corporate networks.You know why they do that? To keep idiot workers from going rogue and endangering corporate data and secrets.Case in point: Secretary of Defense Pete Hegseth, whos under fire this week for and its almost too stupid to be true, but it is setting up a high-level chat usingSignalfor top National Security officials to discuss a military attack. And then somehow, some way, a journalist Jeffrey Goldberg, editor-in-chief of the liberal publication The Atlantic was invited to join the secretaries of State and Treasury, the director of the CIA, and the Vice President of the United States, JD Vance, for the discussion.Now, I like serious spy shows. Give me Gary Oldman as George Smiley inTinker Tailor Solider Spyto keep me on the edge of my seat.But I cant watch those now, because the real world has gotten so stupid I can no longer suspend my disbelief.I still have trouble believing what Hegseth and company did. So does Goldberg: I could not believe that the national-security leadership of the United States would communicate on Signal, [the popular, secure messaging service] about imminent war plans. I also could not believe that the national security adviser to the president would be so reckless as to include the editor-in-chief ofThe Atlantic in such discussions with senior U.S. officials, up to and including the vice president.Believe it. Goldberg was added to the Houthi PC small group. The virtual groups purpose was to talk aboutplanning a military strike on Houthi rebels in Yemen. Goldberg wasnt asked if he wanted to be involved; he was just added. If there was a group administrator, he or she paid no attention whatsoever to what they were doing.At first, Goldberg thought this might be some kind of elaborate joke. Who would addhim, of all people, to such a group? Thenthe bombs, as discussed in the group, started falling on rebels in Yemen.Goldberg asked, essentially, what in the world these officials thought they were doing.Brian Hughes, spokesman for the National Security Council, replied: This appears to be an authentic message chain, and we are reviewing how an inadvertent number was added to the chain.He went on: The thread is a demonstration of the deep and thoughtful policy coordination between senior officials. The ongoing success of the Houthi operation demonstrates that there were no threats to troops or national security.Oh, really?What if, say, a spy were in the group instead of an editor and told the Houthi to aim what anti-air missiles they had in X direction at Y time? Or maybe move some school kids or hospital patients into the targeted areas so they could claim that the real terrorists were the Americans for killing helpless civilians.For that matter, we know from Goldberg that some things were let slip in the conversation that could have compromised American intelligence agents (read, spies) in the Middle East. Do you know what happens to spies in the Middle East? They get a date with a 7.62mm bullet, if theyre lucky.As Rep. Seth Moulton (D-MA), a Marine veteran, tweeted:Hegseth is in so far over his head that he is a danger to this countryand our men and women in uniform. Incompetence so severe that it could have gotten Americans killed.President Donald J. Trump saidhe knew nothing about what happened and downplayed it.Of course,The Atlanticthen published more details of the chat, undermining Trump and what national security officials told Congress just yesterday. Oops.Sure, Signal is a relatively secure, open-source encrypted messaging service, but itsnot approved for government use. It encrypts messages from end to end. That means only you and the people youre sending messages to see decrypted messages. That is, of course, when it works perfectly.But, you see, theres this little problem. It doesnt always work perfectly. Indeed, the National Security Agency (NSA) alerted its employees in February that Signal has vulnerabilities. The NSA also warned its employees not to send anything compromising over any social media or Internet-based tool or application and to not establish connections with people you do not know.Someone should tell the people who are, theoretically, in charge of defending the United States about this.On top of that, Google researchers have found thatRussians have recently been attempting to compromise Signal accounts. I wonder who they might be targeting?I use Signal myself. But, in no way, shape, or form should it ever be used for covert government work.There is so much wrong with this, its impossible to overestimate how bad the whole incident looks. By sheer dumb luck, no Americans were hurt by this exercise in total operations security incompetence. We cant count on always being so lucky.But I bet we can count on certain government officials to ignore the experts on security and do whatever they want.
