Our Leaders Somehow Still Don’t Take Information Security Seriously

The story of the day is that Atlantic editor Jeffrey Goldberg ended up on a group text message chain discussing — before the fact — the U.S. military strikes on the Houthi pirates. (Following the paradigm rule of journalistic ethics, Goldberg kept this to himself until after the strikes, then published much of the text chain.) The message chain was on Signal, an app that is supposed to be for secure messaging, and the group included the vice president, the secretaries of state, defense, and treasury, the director of national intelligence, the head of the CIA, and national security adviser Mike Waltz.

Waltz appears to have added Goldberg to the group by accident, possibly mistaking him for someone else with the same initials. Defense Secretary Pete Hegseth, ironically, insisted in one of the messages that the group “do all we can to enforce 100% OPSEC” [operational security] to keep the plans a secret, yet Hegseth went on to (in Goldberg’s telling) send messages that “contained operational details of forthcoming strikes on Yemen, including information about targets, weapons the U.S. would be deploying, and attack sequencing.”

This leaves us asking once again the Casey Stengel refrain that has become louder with each passing year of the past several presidential administrations: Can’t anybody here play this game? Specifically, does anybody understand how to use technology without compromising security? Donald Trump, usually the last person to be credited for reticence, seems to have been the only person involved in this decision who had the good sense not to put anything in writing over his phone.

The chronic trouble of our leadership class with information security — especially of the digital variety — has led to a seemingly endless series of scandals over the past decade and a half (longer, if you count CIA Director John Deutsch’s taking home laptops with classified information, for which he ended up being pardoned by Bill Clinton). Consider just a partial list:

• The colossal 2013–15 hack of the federal Office of Personnel Management, which led to the exposure of personal information of millions of federal workers to foreign (likely Chinese) hackers and was botched by OPM management badly enough to produce a congressional investigation and resignations.
• Hillary Clinton, as secretary of state, routing official emails through an insecure private server in her home. Fallout from the Clinton story revealed lesser but also concerning use of private channels by figures such as Colin Powell. It is no exaggeration to say that the ensuing scandal probably swung the 2016 election.
• A huge hack of the Democratic National Committee’s emails, which apparently happened because former White House Chief of Staff John Podesta fell for a phishing scam. This, too, produced endless leaks embarrassing to the DNC during the 2020 election.
• Hunter Biden left and forgot at a repair shop his laptop containing all manner of incriminating and embarrassing evidence of public corruption and drug use, triggering a daisy chain of events that led to the New York Post getting its story on the laptop suppressed in one of the most notorious incidents of social media platform censorship during the 2020 election; 51 national security professionals (including several former heads of the CIA and other intelligence agencies) prostituting their credibility to declare the laptop a Russian fake (which, in turn, got their security clearances revoked); Hunter’s convictions on tax and gun charges; and his ultimate pardon.
• Trump, Biden, and to a lesser extent Mike Pence getting caught having stored classified or otherwise secret or sensitive documents at their homes, resulting in an FBI raid of Mar-a-Lago, Trump’s indictment on more than 30 federal felony counts, and Biden’s humiliating exoneration on grounds of his declining mental state by special counsel Robert Hur. Again, both the Trump and Biden stories resulted in massive, long-running scandals that bled through the 2024 election.

What I must yet again ask, at this late date, is why we can’t manage to stanch this by establishing more regular systems and protocols. I get that some of these are matters of age and generation in technology use, but Waltz is 51, and Hegseth is 44. Once Goldberg was added, it may have been hard for other recipients to notice him, but should somebody more junior not have been able to double-check all the recipients? The failure here was not even a matter of technology but of user error — still, it ought not to be that hard to just establish closed systems where one need not worry about fat-fingering a list of recipients.

Over a decade on, we seem to learn nothing.