2,044 events on record Subscribe September 10, 2026
Standing Record home The Standing Record A non-partisan record of US democratic norms —
and the events that erode them.

White House used unvetted TeleMessage Signal clone for records after Signalgate; May 2025 hack exposed CBP staff data

After the original Signalgate incident exposed deleted official Signal messages in violation of federal records law, senior officials including then-National Security Advisor Mike Waltz adopted TM SGNL, a modified Signal clone from Israeli company TeleMessage, without National Archives review. On May 4-5, 2025, hackers exploited a flaw that routed messages to the vendor's server as plain text, exposing U.S. Customs and Border Protection staff communications and stealing a large cache of files, prompting TeleMessage to suspend service.

Part of: Signalgate and the Absence of Accountability

Jurisdiction
Federal
Location
Washington, D.C.

Abuses documented

Actors

After the original "Houthi PC small group" Signalgate incident exposed that officials' Signal messages had been deleted in violation of Federal Records Act preservation requirements — CIA Director John Ratcliffe reportedly retained none of his messages from that chat — the White House turned to TM SGNL, a modified version of Signal sold by Israeli company TeleMessage that claims to archive messages for records-retention purposes. Photos in late April and early May 2025 showed then-National Security Advisor Mike Waltz using the app during a cabinet meeting; other senior officials, including Vice President JD Vance, DNI Tulsi Gabbard, and Secretary of State Marco Rubio, were also reported to be using it. American Oversight documented that the platform was never evaluated by the National Archives for federal record-keeping compliance and that it undermined Signal's own encryption by routing a copy of every message to a TeleMessage-administered server as plain, unencrypted text — contradicting the company's end-to-end encryption marketing claims.

On May 4-5, 2025, hackers exploited this flaw: one breach accessed communications belonging to U.S. Customs and Border Protection employees, and a second stole a large cache of files, prompting TeleMessage to suspend service. Sen. Ron Wyden's May 6, 2025 letter to Attorney General Bondi called TeleMessage a "shoddy Signal knockoff," raised False Claims Act and counterintelligence concerns given the company's foreign ownership, and demanded a DOJ investigation.

Why we recorded this

After the original Signalgate chat exposed that officials' messages had been deleted in violation of federal records-preservation law, the White House adopted TM SGNL, a modified Signal clone from an Israeli vendor, without any National Archives review for record-keeping compliance. The tool undermined Signal's own encryption, routing a copy of every message to the vendor's server as plain text — the opposite of what a records-preservation fix should do — and was hacked within days, exposing government communications. This shows officials responded to a documented records-law failure with an unvetted product that made the underlying security and preservation problems worse, not better.

Sources

  1. TeleMessage, a modified Signal clone used by US government officials, has been hacked — TechCrunch primary accessed July 9, 2026
  2. Letter to Attorney General Bondi re: TeleMessage — U.S. Senate (Sen. Ron Wyden) primary accessed July 9, 2026
  3. Messaging app used by Trump official suspends operations after reported hack — CNBC investigative accessed July 9, 2026
  4. There's a Solution for the Trump Administration's Record-Keeping Failures — And It's Not TeleMessage — American Oversight secondary accessed July 9, 2026
  5. Photo appears to show Mike Waltz using Signal-like app that can archive messages — NBC News secondary accessed July 9, 2026

See also