Waltz brushes off SignalGate questions, points finger at CISA

In congressional testimony, President Trump’s former national security adviser said his use of Signal to coordinate military operations was “driven by” cybersecurity guidance from CISA.

Former White House national security adviser Mike Waltz brushed aside criticisms Tuesday that he put sensitive military operations at risk by holding discussions about military strikes in a Signal group chat, claiming the app’s use was authorized by the federal government’s top civilian cyber agency.

In a Senate Foreign Relations Committee hearing, Waltz — who has been nominated to represent the U.S. at the United Nations — was pressed about his short tenure as President Donald Trump’s top national security official. In particular, he was grilled by Sen. Chris Coons, D-Del., for his use of the end-to-end encrypted messaging application Signal to coordinate with other officials over airstrikes on Houthi rebels.

While much of the initial attention was focused on Waltz adding journalist Jeffrey Goldberg to the chat, national security experts were also aghast by  government officials at the highest levels coordinating highly sensitive military operations using a free application.

The incident is widely viewed as contributing to Waltz’s departure just months after leaving Congress to take the role, and his subsequent shuffling to a new nomination at the U.N.

Coons referenced Waltz’s long background of public and military service, arguing he should have known better.

“In your role in the Army, in the House, as national security adviser, you have long handled classified and highly sensitive information. We both know Signal is not an appropriate, secure means of communicating highly sensitive information,” Coons said.

But Waltz was defiant in his response, not only insisting that classified information wasn’t involved — the chats involved detailed descriptions of targets, timing, aircraft and munitions that would be used — but that his use of Signal had been “driven by and recommended by the Cybersecurity [and] Infrastructure Security Agency.”

“The use of Signal is not only … authorized; it was recommended in the Biden-era CISA guidance,” he said.

Waltz was referencing a piece of 2024 guidance put out by CISA on mobile security. He later read from a portion of the guidance, which recommended using “only end-to-end encrypted communication” and to “adopt a free messaging application to secure communications that guarantees end to end encryption, particularly if you are a highly targeted individual, such as Signal or other apps.”

CISA is the federal government’s top civilian cyber agency, but has no legal authority over U.S. military or Department of Defense operations. It’s not clear why Waltz believed that voluntary guidance from the agency — which was directed to the broader public following news that the Chinese hacking group Salt Typhoon had penetrated U.S. telecommunications infrastructure — would cover sensitive military operations overseen by the White House and DOD.

A request for comment sent to CISA was not returned at press time.

Waltz further claimed that the incident was subject to investigations by the White House and DOD. While the DOD investigation is still ongoing, he said the White House review cleared him of any wrongdoing, concluding that “the use of Signal was not only authorized, it’s still authorized and highly recommended.”

Signal is considered the gold standard for end-to-end encrypted communication apps, and cybersecurity experts broadly endorse its use for a range of parties and scenarios. But the highest levels of the U.S. government and military are exceptionally valuable targets that are routinely targeted by the most advanced hacking groups and foreign intelligence services around the globe. Further, additional reporting identified that Waltz was relying on an insecure third-party clone of Signal called TeleMessage.

The DOD has multiple classified systems and Secure Compartmentalized Information Facilities (SCIFs) that are designed to secure classified or sensitive military discussions.

Coons retorted that he was “hoping to hear from you that you had some sense of regret over sharing what was very sensitive, timely information about a military strike on a commercially available app,” arguing that there have been “no consequences” for the incident.

In response to questions submitted to the White House about the investigation into Waltz and current policy on the use of Signal, spokesperson Anna Kelly responded:
“As we have said many times, Signal is an approved app for government use and is loaded on government phones. Mike Waltz will make an outstanding US Ambassador to the United Nations.”

Sen. Tim Kaine, D-Va., questioned how Waltz could claim no classified information was shared when there are separate ongoing investigations by DOD and Air Force into Secretary of Defense Pete Hegseth for his role in the chat.

“They certainly haven’t reached any conclusion that classified information wasn’t shared,” Kaine said. “Am I wrong about that?”

Waltz said he couldn’t comment on ongoing investigations but echoed previous congressional testimony from Hegseth that no names, targets, locations, units, routes, sources or methods were shared in the chats.

Rep. Garbarino: Ending CISA mobile app security program for feds sends ‘wrong signal’

CyberScoop is first to report on the letter to DHS from the chair of a cybersecurity subcommittee, which also addresses CISA’s role as lead coordinator with the…

After Signal controversy, do private conversations online exist anymore?

Intelligence chiefs insist Signal chat was a simple mistake

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure