At a glance
- The risk: An encrypted channel can still expose sensitive plans when participant verification, device controls, tool approval, or records safeguards fail.
- The governance implication: Platform security does not establish whether a conversation is authorized; leaders must define who may participate, what may be discussed, and how the record is retained.
- The leadership takeaway: Treat consequential communications as governed decision workflows, with an accountable owner and the authority to stop a conversation using the wrong channel.
The March 2025 incident widely described as a “Signal chat breach” was not evidence that Signal’s encryption had failed. A journalist was inadvertently included in a group of senior U.S. officials discussing a planned military operation against Houthi targets in Yemen. The messages were encrypted, but the conversation still reached someone who was not meant to receive it.
A subsequent U.S. Department of Defense Inspector General evaluation, issued on December 2, 2025, examined the Secretary of Defense’s use of Signal for official business and compliance with policies governing nonpublic information, approved messaging services, classification, and records retention.
The consequential decision therefore occurred before any message was sent: was this channel, on this device, with these participants, authorized for this information? That is a governance question—not a cryptography question.
This was not a failure of encryption
Signal states that its messages and calls use end-to-end encryption. That protection is important because it limits who can read content in transit. It does not decide whether every participant belongs in a group, whether a personal device is approved, or whether the conversation satisfies an organization’s legal and records obligations.
Calling the episode a “breach” is understandable shorthand, but useful risk analysis must identify the failed control. In this case, the channel delivered messages to the group that had been assembled. The exposure arose because the membership and use of that group were not governed adequately for the sensitivity of the conversation.
This distinction matters to enterprises. If leaders blame the application alone, they may buy a different tool without correcting participant verification, information handling, retention, escalation, or ownership.
A secure tool cannot authorize a conversation
The DoD Inspector General’s report describes policy that prohibited nonapproved, non-DoD-controlled messaging services from processing nonpublic DoD information, regardless of their perceived security. It also explains that official records created through nonofficial accounts must be preserved through approved channels.
The broader enterprise lesson is not that encrypted messaging should never be used. It is that “secure” is context-dependent. A product may provide strong encryption while lacking the identity assurance, managed-device controls, data-loss safeguards, retention, legal discovery, monitoring, or administrative authority required for a particular business decision.
Illustrative hypothetical: a deal team creates an encrypted group to discuss a confidential acquisition and adds a former adviser whose contact resembles that of a current participant. The encryption can work exactly as designed while the decision boundary fails. The actual question is who owned verification and who had authority to pause the discussion.
Messaging governance must cover the full information lifecycle
Communication risk begins before a tool is selected and continues after the final message. Leaders need a control path that covers approval, participant onboarding, information classification, device posture, preservation, access removal, incident response, and eventual disposal.
A May 2, 2025 U.S. National Archives memorandum states that electronic messages created or received during agency business can be federal records even when exchanged through personal accounts on third-party applications. It also notes that personal-account records must be copied or forwarded to an official account within 20 days and that automatic deletion can conflict with recordkeeping duties. These are U.S. federal requirements, not universal obligations for every enterprise, but they illustrate why encryption alone is an incomplete control.
For regulated organizations, the corresponding obligations may arise from sector rules, litigation holds, privacy requirements, supervisory expectations, or internal policy. The control objective is the same: the organization must be able to determine what happened, who participated, what was decided, and whether the communication was authorized.
The accountability gap appears before the message is sent
Most messaging policies describe acceptable tools and prohibited behavior. Fewer make the operating decision explicit: who is accountable for choosing the channel, validating membership, and stopping the conversation when urgency begins to override policy?
Responsibility is usually distributed. Business leaders understand the sensitivity and urgency of the decision. Technology and security teams approve devices and platforms. Legal and records teams define preservation requirements. Yet distributed responsibility is not the same as accountable ownership.
A defensible model assigns a channel owner for each consequential conversation. That owner confirms the approved platform and device, verifies participants before sensitive details are shared, revalidates membership when the group changes, and escalates when the available channel cannot meet the information-handling requirement. The authority to stop the conversation must exist before the first high-risk message.
Leadership questions
- Who can approve a messaging tool and device for each category of sensitive business information?
- Who owns participant verification and revalidation before operational, customer, regulatory, or transaction-sensitive details are discussed?
- Can the organization preserve the record, reconstruct the decision, remove access promptly, and stop the conversation when the channel is unsuitable?
Closing thought
Encryption protects a communication channel. Governance protects the decision being made through it. Mature organizations do not ask a security feature to perform the work of authorization, accountability, and judgment.
Sources and further reading
- U.S. Department of Defense Inspector General: Evaluation of the Secretary of Defense’s Reported Use of a Commercially Available Messaging Application for Official Business — issued December 2, 2025.
- U.S. National Archives: Recordkeeping Requirements for Records Created on Third-Party Messaging Applications — May 2, 2025.
- U.S. National Archives: Electronic Messaging Compliance Assessment Toolkit — updated September 2025.
- Signal: official overview of end-to-end encrypted messaging.
- Related Beyond1n0 analysis: Why Most Companies Fail at Application Security—and How to Fix It and How to Reduce Your Application Security Debt.
About Gary Cheung
Gary writes about information risk, AI governance, and executive accountability. For a discussion about an AI decision or its governance, contact Beyond1n0.
