In February 2020, European Commission agents received a communication encouraging them to use the messaging service Signal. The Signal messaging service is an open source and fully encrypted alternative to proprietary solutions.
Switching to Signal
In early February, an internal message was sent to European Commission agents notifying them that "Signal has been selected as the recommended application for public instant messaging.". The solution will be used for external communication between Commission staff and people outside the organization. Signal is a messaging application, developed in 2013 by privacy activists. Messages and calls exchanged via the application are fully encrypted and the maintenance of the open source software is supported by a non-profit foundation, Signal Technology Foundation. This interest for the Signal messaging service happened after the European institutions were affected by several communication privacy incidents. Additionally, in December 2019, the UK Conservative Party encouraged its MPs to switch to Signal both for security and operational reasons. All Conservative MPs could not be in the Party’s group chat due to the high number of participants.
In an interview to Politico, the cryptography expert from the University of Leuven, Bart Preneel estimates that "[Signal] is like Facebook's WhatsApp and Apple's iMessage but it's based on an encryption protocol that's very innovative. […] Because it is open source, you can check what's happening under the hood".
More information on Signal
The Signal open source software is written in JavaScript, TypeScript and CSS and published on GitHub under a General Public Licence v3.0 (GPLv3). In particular, the clients are published under the GPLv3 license, while the server code is published under the GNU Affero General Public License v3. The software contains the following features:
- Voice and video calls to other Signal users;
- Text messages, files, voice notes, pictures, GIFs, and video messages to other Signal users;
- Group messaging;
- Set deletion timers for messages on both the sender and the received devices.
All communications to other Signal users are free of charge and automatically end-to-end encrypted. The keys that are used to encrypt the user's communications are generated and stored at the endpoints, that is to say by users, not by servers. To verify that a correspondent is really the person that they claim to be, Signal users can compare key fingerprints (or scan QR codes).
References