“Strictly speaking, Signal is hardly to blame for once again finding itself at the center of a debate regarding IT security lapses. Suspected Russian hackers may have potentially intercepted the communications of numerous high-ranking German politicians conducted via the messaging app. According to *Der Spiegel*, those affected included Bundestag President Julia Klöckner, Education Minister Karin Prien (both CDU), and Housing Minister Verena Hubertz (SPD).
In recent months, German and foreign security agencies have repeatedly warned of a phishing campaign targeting Signal users. In these attacks, perpetrators pose as the messenger’s support team, for instance, and request login credentials. They appear to have specifically targeted the Signal accounts of politicians, government officials, diplomats, military personnel, and journalists. With these credentials, hackers can—among other things—add additional devices to the Signal account, thereby secretly reading conversations or even locking out the actual owners entirely in order to communicate with other contacts or compromise them as well.
Thus, the attackers did not hack the Signal app itself or exploit a technical vulnerability; instead, they targeted the users. In fact, Signal remains one of the most secure messaging apps available. By default, all messages, calls, and group chats are end-to-end encrypted using the Signal Protocol. This ensures that neither the service provider nor third parties—such as telecom carriers, intelligence agencies, or hackers who have compromised a Wi-Fi router—can access the content. Even NSA whistleblower Edward Snowden once recommended the service.
Although Signal is an American service, unlike WhatsApp or other competitors, it pursues no commercial interests; instead, it is backed by the non-profit Signal Foundation. The foundation’s mission is to ensure the continued availability of secure communication.
Nevertheless, calls to ban politicians from using Signal are mounting. On Monday, for example, Bundestag Vice President Andrea Lindholz (CSU) urged the federal government and the Bundestag—via the newspaper *Bild*— to stop using the service. "We should consider banning Signal on official devices used by MPs and Bundestag staff," said Lindholz. Citing concerns about digital espionage, the EU Commission also recently instructed its senior officials—according to media reports—to immediately shut down a Signal group used for internal communication. Signal has since announced updates intended to make things more difficult for phishing actors.
No one questions the security of the encryption protocol itself. The issue is rather that Signal is designed for end consumers rather than for use in commercial or government sectors. Critics argue that Signal was not developed to meet the requirements of the public sector—specifically regarding employee verification and precise mechanisms for controlling access to digital resources, data, and systems.
In March 2025, the US government faced criticism after senior officials exchanged confidential information via the messaging service—including details about a planned US strike against Houthi militias in Yemen. However, the editor-in-chief of the US publication *The Atlantic* was inadvertently invited to the chat group and was able to read the sensitive messages.
Control over so-called metadata is another key issue. Even with full encryption, metadata can reveal details such as who communicated with whom and when. Critics of Signal point out that preventing cyber-espionage is significantly easier within closed environments.
Consequently, numerous European nations—including Germany, France, the Netherlands, and Belgium—are developing their own messaging apps for secure use within government agencies. In March, Belgium began rolling out "Beam," a messaging app developed by the state-backed company Belgian Secure Communications; it is slated for use by approximately 750,000 public sector employees. Germany is collaborating with two private-sector providers should actually have rendered Signal or WhatsApp obsolete long ago.
One example is Wire, a Berlin-based software company founded in 2012. Its shareholders include the Schwarz Group—known for the discount retailer Lidl—which is also pursuing ambitious plans in the digital sector through its Schwarz Digits division. Bundestag Vice President Lindholz is also calling for a switch to Wire, noting that it offers a "significantly higher" level of security. The Bundestag is making Wire available available for official purposes. "But now everyone actually needs to use it," said the CSU politician.
Messages sent and calls made via Wire are end-to-end encrypted by default; the software's source code is publicly accessible. Since 2022, the federal government has been testing a version specifically tailored to its needs, known as "Wire Bund." The Federal Office for Information Security recently officially approved Wire for use with information classified as "Restricted" (Verschlusssachen – nur für den Dienstgebrauch), thereby enabling much broader deployment. "To be certified by the BSI for confidential communication within ministries, we had to undergo three years of testing and have our code audited," Wire CEO Benjamin Schilz told the *F.A.Z.* last December. Schilz says that a security breach like the one experienced by the US government would not have happened with Wire. "Our app is not only secure as a product but also takes user behavior into account," the Wire CEO explains. For instance, if all members of a chat group are authorized to handle documents classified as "Restricted – For Official Use Only," a green banner is clearly displayed to them. As soon as a user joins or is invited who lacks this authorization, the banner turns red.
However, Wire is not the only security-focused messenger used within the federal government. BWI, the IT service provider for the Bundeswehr (German Armed Forces), has developed its own messenger based on the Element platform. Information classified as "Restricted – For Official Use Only" is also transmitted via "Bwmessenger." Element is based on the Matrix protocol—an open communication standard that enables decentralized chat, video, and IP telephony.
All Matrix-based applications can communicate with one another. More than 25 governments worldwide have adopted Matrix-based systems. NATO’s messenger is also based on Matrix. Unlike Wire, for example, Matrix-based messengers operate in a decentralized manner. A user's data does not reside on a third-party server, and the user retains full control over the software running on their own server. If one organization's server fails, the rest of the network continues to function. This is intended to prevent millions of users from suddenly losing the ability to communicate due to technical issues.
The fact that there are two separate solutions within the federal government has drawn criticism. After years of rather sluggish implementation, momentum for high-security alternatives to Teams, Slack, WhatsApp, and Signal currently appears to be strong.
Yet, regardless of whether politicians use Signal, Wire, or Element, one fundamental rule of IT security remains holds true: The biggest entry point for hackers remains the human factor.” [1]
1. Schlägt jetzt die Stunde der Signal-Alternativen?: Signal gilt als einer der sichersten Messenger der Welt. Im Zuge der Spionageaffäre um deutsche Politiker werden nun trotzdem Rufe nach Alternativen laut. Welche es gibt und was sie können. Frankfurter Allgemeine Zeitung; Frankfurt. 29 Apr 2026: 21. Von Maximilian Sachse, Frankfurt
Komentarų nėra:
Rašyti komentarą