Can we use encrypted apps like WhatsApp/ Signal for discussing operational, PII, etc. purposes?

CPT Private RallyPoint Member — Thu, 31 Oct 2019 11:07:55 -0400

Can we use encrypted apps like WhatsApp/ Signal for discussing operational, PII, etc. purposes? Does What'sApp and Signal meet OPSEC? WIRED.COM recommends Signal. https://www.wired.com/story/encrypted-messaging-isnt-magic/

Encrypted Messaging Is Essential—But It Isn’t Magic

As recent events have shown, using an encrypted messaging app like WhatsApp or Signal is no privacy panacea.

Response by SrA John Monette made Oct 31 at 2019 11:14 AM

SrA John Monette — Thu, 31 Oct 2019 11:14:47 -0400

i'm going to go with "no". i wouldn't use any of those apps for communicating sensitive information, whether PII or operational details. after all, they are all based on the internet, and what happens on the internet stays on the internet.

Response by CPT Private RallyPoint Member made Oct 31 at 2019 11:15 AM

CPT Private RallyPoint Member — Thu, 31 Oct 2019 11:15:03 -0400

Someone had said only if your S2/S6 has approved them, then the answer is yes

Response by SSG Carlos Madden made Oct 31 at 2019 11:20 AM

SSG Carlos Madden — Thu, 31 Oct 2019 11:20:03 -0400

My guess is that is not unless it's approved by the DA (and it won't be).
Source AR 530-1.
https://fas.org/irp/doddir/army/ar530-1.pdf

In a sense all social media sites "own" the content users post on their networks. For example, Facebook can essentially use the images you post on Instagram and Facebook anyway they want to. So unless the DoD and you trust Facebook/WhatsApp - and I personally do not - I would caution anyone posting PII or operational information on that site that can easily be obtained by third parties.

ar530-1.pdf

Response by SFC Kelly Fuerhoff made Oct 31 at 2019 11:32 AM

SFC Kelly Fuerhoff — Thu, 31 Oct 2019 11:32:44 -0400

I wouldn't - none of that stuff is really truly secure. I mean Facebook owns WhatsApp - so there's that.

Response by LTC Eugene Chu made Oct 31 at 2019 11:44 AM

LTC Eugene Chu — Thu, 31 Oct 2019 11:44:24 -0400

No, we cannot based on both cited comments from others and recent alleged hack by Israelis

https://www.bbc.com/news/business-50230431

WhatsApp sues Israeli firm over hacking claims

Facebook-owned WhatsApp alleges NSO Group was behind a cyber-attack on phones and messages.

Response by 1SG Private RallyPoint Member made Oct 31 at 2019 2:31 PM

1SG Private RallyPoint Member — Thu, 31 Oct 2019 14:31:34 -0400

WhatsApp has been used to conduct US official communications for some time. It isn't illegal.

Response by CSM Richard StCyr made Oct 31 at 2019 3:11 PM

CSM Richard StCyr — Thu, 31 Oct 2019 15:11:29 -0400

I would say no, as they are not government systems and there's no telling who may or may not really have visibility on the data.
Our local policy boils down to; no use of non-governmental systems for transmittal of PII and you have to ensure that the system is rated for the level of classification you are transmitting .
You should contact NEC and see if those apps have certificates of net worthiness, and the S2 and 6 shops for local policies.

Response by SPC Angela Burnham made Oct 31 at 2019 3:52 PM

SPC Angela Burnham — Thu, 31 Oct 2019 15:52:15 -0400

Definitely NOT. End to end encryption is one thing, but Signal and Whatsapp are still in the middle and very capable of viewing your convos in a variety of ways.

Response by Guillermo Mainkar made Jun 9 at 2023 3:08 AM

Guillermo Mainkar — Fri, 09 Jun 2023 03:08:40 -0400

Hey there! Using encrypted apps like WhatsApp or Signal can be a good option for discussing operational and PII matters. Both apps prioritize user privacy and employ end-to-end encryption. Signal, especially, has gained recognition for its security features. However, I personally prefer WhatsUp API (https://ultramsg.com) for my work. Anyway, it's up to you. Good luck!

Response by SFC Kelly Fuerhoff made Apr 16 at 2024 12:43 PM

SFC Kelly Fuerhoff — Tue, 16 Apr 2024 12:43:17 -0400

This is over a year old; however: "In accordance with DoD Instruction 5200.48, DoD personnel will not use non-DoD accounts or personal e-mail accounts, messaging systems or other non-public DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI. In accordance with DoD Instruction 5200.01, DoD personnel will not use unclassified systems, government-issued or otherwise, for classified national security information. DoD CIO will continuously consult with all DoD Components to evaluate risks mobile applications may present to the DoD and update References (m), (n), and (o), as appropriate. " That's from a memorandum issued in October 2023 from the DoD CIO.