The Signalgate Saga: When a ‘Secure’ Clone Exposed War Crimes and Plaintext Chats

Months later, Waltz was caught discreetly checking what appeared to be Signal messages under the table during a cabinet meeting. It later emerged that he was not using Signal at all, but a knock-off called TM SGNL. Shortly afterward, TeleMessage — the company behind TM SGNL — was hacked (twice), allowing attackers to access archived Signal messages in plaintext before the service was taken offline.

This talk covers the entire Signalgate saga: from Mike Waltz accidentally inviting a journalist into a group chat discussing alleged war crimes, to subsequent denials before Congress, to the history of TeleMessage — an Israeli firm founded by a former intelligence officer — and its surprising customer base, including Trump officials, U.S. Customs and Border Protection, and cryptocurrency companies.

I will demonstrate how TeleMessage archives messages from Signal, WhatsApp, Telegram, and WeChat in a fundamentally insecure way. I will present my analysis of the TM SGNL source code, showing that the company’s claims of end-to-end encryption were false. Finally, I will walk through the trivial exploit used by hackers to extract data from TeleMessage’s archive servers, and explain how I analyzed hundreds of gigabytes of memory dumps containing chat logs from TeleMessage customers.

This session will be presented by Micah, a coder, independent security researcher, and journalist. He develops open-source privacy and security tools and has extensive experience working with journalists and whistleblowers. He is the former Director of Information Security at The Intercept and the author of Hacks, Leaks, and Revelations, a practical guide to analyzing hacked and leaked datasets. He is deeply critical of the technofascist trajectory shaping today’s digital infrastructure.

We promise you: this is a session you do not want to miss.

Meld deg på HackCon#21 - 2026.