

https://thehackernews.com/2025/02/hackers-exploit-signals-linked-devices.html And this is just the latest. I’d imagine there’s information that is closer held about other vulnerabilities.
It’s really not as secure as one would want for government communications. It’s good enough for activists because for most, there is security through obscurity. Governments, though, are targeted and known quantities with very public facing people. An adversary can pop an official’s phone with relative ease. An activist, though, is generally mostly anonymous, so if the government wants to go after that individual, they have to find them first, which is harder.
And that’s just looking at message content. Even without the content, metadata is insanely valuable. You can infer a lot just from who is in a chat and the frequency of messages. Just seeing that cabinet officials were in a chat that started getting that much activity would put any adversary on guard.
All that is to say that while Signal’s encryption is good (hell a ton of modern encryption algorithms came from NSA itself), the app itself is not good enough for a government. If an activist group gets enough power, it would be prudent for them to move to a different, more secure platform if they’re worried about the full weight of the nation-state coming down on them. That is to say, a police department doesn’t have the resources to do anything meaningful with even just metadata, but the FBI is a whole different story.
TL;DR: Signal is good, but not great, and it is certainly not up to the task of protecting actual government communications.
In short, yes, sort of.
However, I don’t want it come off that Signal is bad by any means. It’s the right choice for most people. I use Signal, and I really like it, in fact, but I know it’s limitations. I’m not as familiar with SimpleX, but after a quick look at their GitHub, it does have extra privacy over Signal. The kicker is that it looks like an open network (if I misunderstood something in the code, please someone correct me) that anyone can join. While that’s great for accessibility, it opens up attack surface. Even still, that will work for most people.
The key issue in this story is that the cabinet was using an open network with known vulnerabilities. They should have been using secure government comms. Is the encryption any better than Signal? Probably not (like I said above, NSA itself designed a bunch of our encryption algorithms). But it’s a closed network where only authorized users can be on it.
In the end, for most uses Signal is good, SimpleX is a bit better. Matrix can also be good if proper precautions are used in accessing it. The government, though, shouldn’t be using these open networks for classified communications; it’s really poor OPSEC for them. Also, a resistance group is not the government, so operating more clandestinely on more common messaging platforms is a good choice. When a resistance group may want to rethink that communications strategy is when they get large, powerful, and organized enough to operate more or less in the open with impunity. If a resistance group can be a de facto government, then it may be time to migrate to a closed network that is fully under your control. Most groups never get to that point, though.
ETA: Choosing a communications system can seem tough, but it’s really just a matter of knowing the capabilities and limitations of the tool. You’d think the government would be better at that.