Military chat leak | Signalgate: Proof that security & compliance risks are a cultural problem

Signalgate: Proof that security & compliance risks are a cultural problem

Earlier this week, news broke that a journalist for The Atlantic was accidentally invited to a group chat which apparently revealed top secret details of an impending military operation to bomb Yemen.

If, somehow, you missed that story, the group chat included, among others, the Vice-President, JD Vance; Pete Hegseth the head of the DoD (Department of Defense) and Michael Waltz the President’s National Security Advisor. Dubbed 'signalgate' by world media, Trump has opted instead to use the term 'glitch.'

Whatever you want to call it, this debacle is perhaps the highest-profile example we have ever had about what happens when leaders play fast and loose with the need for a culture of security.

Ironically, while the qualifications for such high level roles might be questionable in the case of former TV host Hegseth, Waltz is a decorated special forces veteran with plenty of experience of closed loop comms procedures. Oh, and as already mentioned, he is National SECURITY Advisor. And yet, he is the one that included the journalist, Jeffery Goldberg in the chat.

But don’t worry, he has vowed to “get to the bottom” of the matter. Thing is, by being the guy that added Goldberg into the chat, it looks very much like HE is the bottom of it. So don’t expect that to be a long investigation.

The plot, as if it wasn’t already thick enough (in all senses of the word) has congealed a bit further with the revelation that a Pentagon memo, sent a day or two after the Yemen attack, but six days before The Atlantic's story broke, warned that the Signal app may be vulnerable to hacking by outside parties (Russians, Chinese, Iranians etc.) and should not be used to discuss classified information. But then, a memo to that effect had already been sent in 2023.

Make no mistake, as much as the Trump administration might try to convince everyone there’s nothing to see here, it has revealed a disturbing level of security negligence.

Why a culture of safety and security matters

While there are fans of the Trump administration’s bold rewriting of the rule book with regards to foreign policy, employment law (and the law generally), annexing other territories and other, yet to be revealed policy surprises, what has just happened demonstrates loud and clear, that rules, guidelines and procedures are in place for a reason. Particularly when it comes to matters of national security, something of a sacred cow for any administration and, crucially the American electorate.

Given that Signal had already been identified as a security risk, it’s either a failure of compliance, training or, more difficult to fix, and much more likely, it’s a cultural problem.

It seems that any rules already in place are regarded by the administration as being part of the old order which they are trying to disrupt, so following them is considered optional at best. Moreover, if they were to concede that these rules matter then they have to concede that the rest of them also matter. It would matter, for instance, that Elon Musk does not have security clearance yet is able to view classified data, employment law around Federal job cuts would matter and there’s some small print about not starting armed insurrections too.

A great many companies, particularly in the tech sector, take pride in labelling themselves disruptors, and it is an approach that can lead to technological breakthroughs, new business models, and exciting new consumer product sectors.

If that attitude bleeds into other aspects of work, however, then it becomes a problem. It becomes the wrong kind of disruption. The bad kind.

There will always be rules and procedures in any workplace that employees find irksome and unnecessary, but they usually know which ones are important enough to ensure the smooth running of the organisation and the general gaiety of nations. Smart leaders know which ones to obsess about.

When you’re operating in a culture that trivialises compliance, mocks procedure and thumbs its nose at the notion of any rules-based order, however, then one crisis after another is the only assured outcome.

Be the first to comment.

Sign up for a FREE myGrapevine account to have your say.