"We are currently clean on OPSEC": Why JD Can't Encrypt

2026-04-21

AI Summary

Despite the widespread adoption of end-to-end encrypted messaging systems such as Signal, the 2025 Signalgate incident revealed their inability to ensure holistic information security in real-world contexts. This study integrates formal methods with socio-technical analysis, employing applied pi-calculus for the first time to model secure communication within high-stakes political settings. It introduces the concept of “illusory security” to elucidate how power asymmetries, tool misuse, and procedural circumvention undermine operational security. Through formal verification, case studies, and geopolitical impact assessment, the work demonstrates that even with improved usability of encryption tools, ordinary users’ message confidentiality remains inadequately protected. The findings further caution that ineffective encryption practices may precipitate severe geopolitical consequences.

Technology Category

• Philosophy and Ethics of AI: Privacy & Security
• Game Theory and Economic Paradigms: Imperfect Information
• Application Domains: Security

Application Category

• Security and Privacy: Applications of cryptography
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

We analyse the 2025 Signalgate leak of sensitive US military information by the Trump administration, addressing why confidentiality was violated (messages leaked to the press) in spite of encryption (Signal), to deepen the socio-technical considerations when designing and deploying encryption. First, we use applied pi-calculus to formally model the boutique secure facility setup requested by the US Defence Secretary, to prove that a leak would not be prevented. We then examine how using a secure channel might still not give overall information security, as, in this case, power imbalances between personnel and officials led to the application of cryptography that compromised their operational security. We look at how cryptographic tools may have instilled a false sense of security, and led officials to "overshare". We then apply this analysis to the Trump administration's general desire to burn through political, legal, and now technical process, and demonstrate geopolitical harms that may arise from such ineffective use of cryptography in a brief use case. We conclude that, even with advancements in usability of cryptographic tools, genuine message security is still out of reach of the "average user".

Problem

• encryption
• information leakage
• operational security
• socio-technical factors
• confidentiality

Innovation

• applied pi-calculus
• socio-technical security
• operational security (OPSEC)
• cryptographic usability
• false sense of security