The leaning tower of arrogance

Well, that didn’t take long. An enterprising hacker has already penetrated whatever security that supposedly protected the third-party communications app used by Mike Waltz to send text messages on Signal to the Secretary of State, the Vice President and the Director of National Intelligence during the White House cabinet meeting last week. The hack was reported earlier today by 404 Media, the new journalism website covering cybersecurity, the intelligence and surveillance business, and other topics involving the rapidly changing terrain of the tech industry.

The hacker apparently read the coverage of the loose use of the Signal app and its cousin TeleMessage, which sells its app to government agencies and corporations which require the archiving of messages sent via communications apps such as Signal, WhatsApp, WeChat, and Telegram. The TeleMessage app is supposed to piggy-back on the other communications apps to provide secure storage of the messages on the other communications platforms, several of which can be set to delete messages after a set period of time.

The hacker, whose identity is not known to 404 Media, sent the tech website screen captures and data that “includes apparent message contents; the names and contact information for government officials; usernames and passwords for TeleMessage’s backend panel; and indications of what agencies and companies might be TeleMessage customers. One screenshot of the hacker’s access to a TeleMessage panel lists the names, phone numbers, and email addresses of CBP officials.” “CBP” refers to Customs and Border Protection, one of the agencies in charge of protecting, among other borders, our border with Mexico, which according to the Trump administration, has been regularly breached by human traffickers and drug cartels shipping the dangerous drug Fentanyl into this country where it is sold on the street and has been responsible for tens of thousands of deaths of addicts.

Apparently, the hacker set out to penetrate the TeleMessage security just to see if it could be done. “I would say the whole process took about 15-20 minutes,” the hacker told 404 Media. “It wasn’t much effort at all.”

So, what we have here, folks, is a random computer hacker, whose identity and location is not known, meaning he or she could be living in a foreign country and working for its intelligence agency or tech firm in Russia or China, casually surfing into the communications channel Signal that the Trump administration itself admits is permitted to be installed on government-issued computers and cell phones used by high level administration officials even at cabinet meetings inside the White House.

What does this mean? It means that security throughout the U.S. government, including in the Departments of State and Defense and Homeland Security, as well as the intelligence agencies overseen by the Director of National Intelligence, has been so wide open that an apparent independent civilian hacker was able to download names, phone numbers, and email addresses of government officials as well as some of the contents of text messages, including links to tweets containing video and sound clips.

The data accessed by the hacker also included information relating to crypto firms such as Coinbase and Galaxy, meaning that communications within those firms and perhaps between the firms and their clients, who have invested real dollars in the firms’ stores and trading systems of cryptocurrencies, has been breached.

Based on the reporting of information provided by the hacker to 404 Media, communications within and between U.S. government agencies, as well as members of Congress and offices and officers within the White House, should be assumed to be compromised. Trump came into office promising to use Elon Musk and his cybernauts to save taxpayer dollars as well as modernize and increase the security of U.S. government data systems. Based on this reporting, it’s going to cost at least as much as Musk claims to have saved from so-called “waste and abuse” to take back and wipe clean every government computer, data storage facility, and cell phone that has been in use since January 20.

We have known since Trump’s first administration that he refused to use an official secure government cell phone and instead through his first term in office and this term so far has used his private cell phone to communicate with everyone from golfing buddies to foreign leaders. He has been compromised for years.

Now we know that everyone who works for him has been compromised due to their use of highly insecure communications apps. The 404 Media story even identifies the Northern Virginia location of the servers and storage facilities, owned by Amazon, through which and into which TeleMessage has sent data accumulated through its piggy-backing on communications apps such as Signal, WhatsApp, and Telegram. In the intelligence business, this sort of information is known as “gold.” The hacker “was able to login to the TeleMessage backend panel using the usernames and passwords” found during the penetration of the communications systems.

When you start to see words like “usernames” and “passwords” and “login” in a story about the official communications of the United States government, you know we’re in trouble.

And the trouble we’re in is rooted in the two north-stars of everything Donald Trump has ever done in his life: a complete absence of consequences and the overwhelming presence of arrogance. That combination is the yellow brick road foreign adversaries look for when they are trying to penetrate U.S. information stores, intentions, and methods of tactical and intelligence operations.

One independent hacker, in what he or she admitted was “15 to 20 minutes,” has stripped the façade from the Trump administration’s pretense of governing and put all our military services, including 1.4 million men and women and trillions of dollars’ worth of military equipment and facilities at risk. It’s going to cost lives.