Signal is a messaging app that often makes headlines because it’s used by powerful people. This year, it had its moment of fame in March with “Signalgate,” when a high-level team from the U.S. Department of Defense (now named the Department of War after a recent announcement by the Trump administration) discussed an attack on Yemen on the app and accidentally added a journalist to the group.
In Spain, it gained some attention in June when, in conversations recorded by the Spanish Civil Guard, Santos Cerdán, a former high-ranking member of the governing Spanish Socialist Party (PSOE), recommended to adviser Koldo García that they use Signal for their chats. Cerdán had been utilizing the app with members of the left-wing Basque party Euskal Herria Bildu. “That’s bullshit,” García responded, apparently content with using WhatsApp. The adviser has since been called to testify on his participation in a kickbacks scandal that has rocked Spanish politics.
Meredith Whittaker, president of the Signal Foundation, the difference between Signal and WhatsApp is no trivial matter: “It’s like the difference between 10% gold mixed with 90% brass and 100% gold,” she explains on a video call with EL PAÍS, her first conversation with a Spanish-language publication since her new position was announced in 2022, after she spent time working at Google. “[With WhatsApp] you can say gold is in the ingredients, but Signal is the gold standard. Privacy is our sole focus. We do one thing and we do it very, very well, which is provide the world’s largest actually, private communications platform,” she says.
What about when that means appearing in headlines as the best app for people looking to evade justice? “That’s news about them. It’s not really news about us,” she answers. “It’s like, ‘Let’s drive this contraband over the border and use the highway.’ Is that a story about the highway or about the guys [using it]? Confusing the infrastructure with the people who use their agency to do one or another thing on the infrastructure is part of the way that a lot of bad actors weaponize privacy as the reason for bad actions, instead of going after the root causes. You can blame the road for the car driving on it, instead of looking at who is driving the car.”
Signal is an open-source app that is encrypted, run by a non-profit, and does not store unnecessary data from its users. That makes it impossible for it to respond to information requests from governments and police. “We don’t know who your contact list is. We don’t know who you’re texting. We don’t know who’s in your groups. We don’t know your profile photo. We literally cannot turn that information over, even if you put a gun to my head,” says Whittaker.
One of Signal’s founders and its chairperson is Brian Acton, who is also the creator of WhatsApp. Whittaker, who plays a role in the company’s leadership, though she does not have a CEO title, has taken on the task of making Signal’s “so-cool” technology grow. “The best part of my job is that I actually get to lead with moral clarity. I’m not trying to package corporate imperatives into a nice little wrapper and hope no one notices that we’re actually serving our shareholders and not the people who are using our services.”
She speaks easily, with a casualness that would be unthinkable from other Silicon Valley executives — but it doesn’t mean she doesn’t have a difficult task before her. Founded in 2014, Signal’s global numbers are far behind WhatsApp and Telegram, its biggest competitors. In Spain and the Spanish-speaking world, except in certain specific markets, Signal has never been among the 200 most-downloaded apps during the last month, according to statistics from Sensor Tower. But Whitaker is optimistic. Though she doesn’t have exact figures, she knows, “there is growth in Spain and across Latin America and Spanish-speaking countries. We have seen significant growth in Europe, in particular.”
The country in which Signal is considered the messaging app par excellence is the Netherlands, where it ranks among the top 10 most downloaded apps. In Europe, its main region, it also ranks highly in Germany and Switzerland, but in the rest of the countries, it still has a long way to go.
1. Network effect
A messaging app needs two people to work. No matter how many privacy-conscious users there are, if others don’t download Signal, they have no way to communicate. Whittaker is perfectly aware of this enormous challenge, the so-called “network effect”: the more people there are in your network, the more people end up joining it, and the harder it is to leave.
“That’s exactly the core challenge because ultimately, communication is not about technology. We don’t choose our communications technology because we’re purists. We choose it because we want to talk to our friends. It’s part of having a full, social life. The network effect is really powerful as a social phenomenon, not as a technical modality. Even the most ideologically committed cryptographer living in Berlin can’t use Signal if their friends don’t use it,” says Whittaker. “I am really sympathetic to people not wanting another app on their phone,” she adds.
But people change. “It happens in groups, like your soccer team will switch or you have a work chat that you want outside of the corporate system,” she continues. “There are more and more examples that are leading people to take that small pause and say, ‘You know what? I don’t want this on WhatsApp. I don’t want this on Meta’s servers. I don’t want this archived in my company’s Microsoft Teams. We’re going through a merger, maybe it’ll be weaponized against me. And then they switch to Signal.”
2. Why WhatsApp and Telegram are different
Whittaker speaks fluently about the privacy failings of WhatsApp and Telegram. WhatsApp, which uses Signal’s technology, doesn’t hesitate to compromise its users’ security in exchange for more functions, like a chatbot or ads.
“WhatsApp is just distinct from Signal. They license our technology because our technology is the best, but they only encrypt the contents of messages using our encryption. They collect a huge amount of intimate metadata: your contact list, profile photo, and who you’re talking to. Say you were my oncologist — they would have a record of the fact that you and I began talking at a certain point, the frequency of our conversations, and who else we might be talking to. That could piece together a very intimate picture that, say, if you wanted to deny me a job because of health risks, would be a pretty clear indicator that you should do that,” she explains.
The problem with Telegram is different. Its features go far beyond messaging, making it more similar to a social network. It applies encryption only to very specific parts of its services. “This is the problem with technical claims: there aren’t that many people who can validate them. And because of the hype and the myth-making in technology, it’s sadly way too easy for marketing to replace substance, and that’s exactly what’s happened with Telegram.”
She continues: “They have a compelling, if slightly shady, origin story, and they make claims that simply aren’t backed with technical facts. Sadly, too many people assume that they’re telling the truth. And this makes me very angry because people get killed. They use Telegram, they assume that it’s private, that it’s rights-preserving, and we’ve heard directly from people that their group chats got picked up, that they were targeted by authoritarian regimes. All because Telegram was willing to say in their marketing things that weren’t true about their products.”
3. Governments against privacy
The fundamental right to privacy requires constant battle against “incredibly powerful corporations whose entire objective function, their economic model, the DNA of how they operate and how they produce profits, is built on collecting and monetizing data,” says Whittaker. “In addition to adversarial governments who can’t resist engaging in magical thinking that pushes them to believe they should undermine encryption for their own benefit, so their intelligence agencies can spy on the ‘bad guys’ in ways that ultimately nullify privacy for everyone else. And that’s a really, really big battle to be taking on as a small organization like ours,” she adds.
4. Signal won’t stop until it’s forced to
The European Union has to decide in the next few weeks if it will force applications to weaken encryption and review all messages to detect child pornography, in an initiative called Chat Control. Signal has already announced that it won’t make any changes to its app. The question is whether, forced to do so, it will choose to leave a country or region. “We take our responsibility with people who rely on us really seriously. So that is not a threat we make lightly. We’re happy for the time being that Chat Control has not advanced, but we are concerned that it could pass,” says Whittaker.
That concern is particularly based on a lack of understanding of technology’s very real capabilities. “We are concerned that a mixture of illiberal forces, combined with a deep misunderstanding of technology, and with irresponsible AI hype that is convincing people that AI is a magic wand that can do everything could conspire to result in the passage of a bill like this,” she says.
What would the foundation do in that case? “We would continue to operate as long as we could. Similar to how we do in Iran, similar to how we’ve done in response to being blocked in Russia, working with our community to set up proxies so that people who are within these regions have access to Signal. ”
That’s particularly important, she says, “because if you put a hole in a network,” that can have consequences for all users. “Say that the Spanish government was forcing us to choose between undermining encryption in a way that would pollute Signal and make it dangerous for everyone, or leaving the market. That means everyone in the world who has a contact in Spain they need to talk to, they can no longer communicate. If the choice were between undermining encryption, undermining our privacy promises in a way that harmed anyone who uses the Signal network, or leaving the market, we would leave the market in a heartbeat,” she explains.
5. Extra income
Signal can operate thanks to user donations, from small amounts to gifts from billionaires. It’s like the Wikipedia of messaging. But now, it’s trying out extra paid features, like the option to save encrypted messages, photos, and videos in the cloud. Up until now, all that took place on the user’s device itself. “This is a first for us. It is not a flashy new business model; this is one more way we’re thinking about how to cover the very significant costs of running a real-time large-scale communication platform,” says Whittaker.
6. The problem with AI
Signal will not be adding an AI chatbot à la Meta: “WhatsApp does not need an AI agent. It’s a scam. But Mark [Zuckerberg] said you need an agent, so there has to be an agent, like it or not.” And as to whether AI agents, which take action on behalf of the user, could be a threat to privacy, Whittaker says: “We are not working on building an AI agent. We are working to protect Signal from the invasion of AI agents that threaten privacy and that are being implemented in irresponsible ways, as in what happened with Microsoft Recall.”