Signal Vindicated: Denver Experts Spotlight Human Error in Chat Leak

Signal Vindicated: Denver Experts Spotlight Human Error in Chat Leak

Summary

• Human Error, Not Hacking: Two Denver cybersecurity experts say the leak of a government Signal group chat came from a person being added by mistake.
• Signal Itself Held Up: Neither expert saw any sign that Signal’s encryption was compromised.
• Experts Weigh In: A University of Denver cybersecurity professor and a Denver encrypted-messaging startup founder spoke to Denver7.
• Broader Implications: Secure tools still depend on how people use them.

What the Denver Experts Said

The March 2025 leak of a Signal group chat among senior Trump administration officials led some critics to question the encrypted messaging app itself. A journalist from The Atlantic had been added to the chat by mistake. Two Denver cybersecurity experts told Denver7 that Signal was not to blame.

Why Experts Trust Signal

Nathan Evans is a teaching associate professor and faculty director for cybersecurity programs at the University of Denver’s Ritchie School of Engineering and Computer Science. He has worked in cybersecurity for nearly 20 years and said Signal is well respected in the field.

“It’s created by a very well-respected cybersecurity researcher, and that brings a lot to the game,” Evans said. “If somebody on the street was going to say, ‘What should I use for encrypted messaging?’ I would probably say Signal’s your best bet.”

A Mistake in Who Got Access

Evans believes the leak came down to human error. Someone was given access to a group chat they should never have been in. The app did what it was built to do.

“It’s not that Signal was compromised or that Signal has security issues,” he said. “It’s just that people were using something when they weren’t supposed to, and it was really just a mistake of giving somebody access to the group messages that wasn’t supposed to have access to it.”

A Startup Founder’s View

Tanner Haas, a Denver entrepreneur and founder and CEO of Freedom Chat, a new encrypted messaging app, agreed. “It has nothing to do with their encryption,” Haas said. “The encryption is sound.”

Haas said Freedom Chat would add a feature in response to the leak. In a chat marked top secret, adding a new member would require approval from every other member of the group, a guard against someone being added by accident.

The Policy Question

Democrats pointed out that Signal is not approved for sensitive military intelligence. The Trump administration argued the conversations did not contain sensitive information.

Most people agree the journalist should never have been in the chat.

For organizations, the lesson is practical: strong encryption protects messages in transit, but it can’t stop users from inviting the wrong person. Clear rules about which tools are approved for sensitive work, and checks on who gets added to group chats, matter as much as the technology.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.