Signal is the most private messaging app, but staff say it has no plans to prevent misuse

The announcement of a change to the WhatsApp privacy policy saw many users looking for the most private messaging app to use instead. Signal and Telegram were the prime candidates in cross-platform apps, with the former having the strongest privacy protections, as no personal data is linked to users.

Apple was subsequently sued by a former US ambassador for allowing Telegram on the App Store after it was used by hate groups to threaten violence, and now existing and former Signal employees have expressed concern that the not-for-profit messaging app is failing to address the same issue …

Background

The background to the story has two elements. First, WhatsApp privacy changes. Second, right-wing social networking app Parler ceasing to operate.

WhatsApp privacy changes

When WhatsApp was sold to Facebook for $19B, the messaging app promised not to share data with its new parent company. It later did a U-turn on this, but did allow users to opt-out if they wished. That changed earlier this month, when the company changed its privacy policy again, to remove the opt-out.

WhatsApp subsequently delayed the change to give the company time to try to better explain its plans, but by that time the damage had already been done: More than five million people switched to Signal in the days following the controversy.

Parler ceasing to operate

Right-wing social network Parler was shown to have been extensively used by rioters to plan the attempted coup at the Capitol. The vast majority of the online coordination leading up to the attack appears to have been done on Parler. That led to Apple and Google removing the app from their respective stores, and to many other companies ceasing to do business with the company.

That took the app and website offline, and while the company made alternative arrangements, the reality is that only a few guest posts now exist.

Former Parler users have been seeking alternative platforms, and appear to have mostly switched to Telegram groups. It was this that led to the lawsuit against Apple on the grounds that Telegram now hosts hateful content.

The most private messaging app unprepared

Signal employees, both past and present, believe that the app is ill-prepared for similar adoption by extremists. The Verge reports.

Signal’s rapid growth has also been a cause for concern. In the months leading up to and following the 2020 US presidential election, Signal employees raised questions about the development and addition of new features that they fear will lead the platform to be used in dangerous and even harmful ways. But those warnings have largely gone unheeded, they told me, as the company has pursued a goal to hit 100 million active users and generate enough donations to secure Signal’s long-term future.

Employees worry that, should Signal fail to build policies and enforcement mechanisms to identify and remove bad actors, the fallout could bring more negative attention to encryption technologies from regulators at a time when their existence is threatened around the world.

They say that CEO Moxie Marlinspike appears content to wait until the issue is already a problem, rather than taking preemptive action now.

During an all-hands meeting, an employee asked Marlinspike how the company would respond if a member of the Proud Boys or another extremist organization posted a Signal group chat link publicly in an effort to recruit members and coordinate violence.

“The response was: if and when people start abusing Signal or doing things that we think are terrible, we’ll say something,” said Bernstein, who was in the meeting, conducted over video chat. “But until something is a reality, Moxie’s position is he’s not going to deal with it.”

Bernstein (disclosure: a former colleague of mine at Vox Media), added, “You could see a lot of jaws dropping. That’s not a strategy — that’s just hoping things don’t go bad.”

Like other messaging apps that use end-to-end encryption, Signal has no way to see the content of messages, but it can see when extremist groups post links to Signal groups. That doesn’t yet appear to have happened, and Marlinspike says he is prepared to remove groups altogether if they are misused.

The full piece is an interesting read.

Photo: Rahul Shah from Pexels