Counterintelligence and Canary Traps

Computer security is fun if you have a mind to enjoy it. Even regular intelligence and counterintelligence is fun, at least when something interesting is happening. (I've seen lots of highly classified information over the years, and I promise you, most of it is better than Ambien.)

Of course, this week's attempt at hysterical "Trump's people are morons" is based on the "leak" of a Signal chat that included Jeffrey Goldberg of The Atlantic on a chatroom conversation among a bunch of senior administration officials.

It has, of course, caused a lot of consternation among people who would like nothing better than to have something Donald Trump's people did about which to be consternated, not least of them Jeffrey Goldberg of The Atlantic, but also Trump's political opponents both inside and outside Congress.

Just to be fair, I'd include Goldberg, who was editor-in-chief of The Atlantic when it was pushing the "Russia collusion" and "pee tape" stories, among those political opponents.

In any case, Goldberg's story was full of wink-wink nod-nod without mentioning anything that actually was classified. The best he can say is that something might conceivably have been classified.

Since this erupted, we've had a lot of other information come out. In particular:

• Signal is an authorized channel for unclassified information.

Signal was recommended by the Cybersecurity and Infrastructure Security Agency (CISA) on December 18, 2024. This guidance came as part of a push for senior government officials and other high-risk individuals to use end-to-end encrypted messaging apps, following telecom breaches like the "Salt Typhoon" attacks linked to Chinese hackers. CISA specifically highlighted Signal as a secure option for protecting sensitive communications across mobile and desktop platforms.

• This wasn't a classified conversation.

• In fact, it wasn't even sensitive, because they were talking about things that had already been said in public.

• When they got to something that would be classified, they explicitly said they needed to take it to a higher level. So they knew what was and wasn't sensitive.

• It wasn't Mike Waltz who brought Greenberg onto the call; it was one of Waltz's staff.

Now I'm going to introduce you to a term of art in intelligence and counterintelligence. A "canary trap" is when you expose information in a channel that you suspect has been compromised. Canary traps originally came from the use of canaries as air quality detectors in coal mines. The canary singing was reassurance that the air was not being fouled in ways that humans wouldn't notice. So you put the information out, and you make sure the details are identifiable. Then, if the information shows up in an unexpected venue, you know how it got there.

So here we have a situation where interesting but unclassified information is being shared among a bunch of administration principals, and it leaks to a known opponent of the Trump administration who also, by some coincidence, has been very pointed in objecting to Pete Hegseth.

To me, this really smells like a canary trap. Some actual unclassified information is disseminated on a channel you suspect may have been compromised, and you listen for the canary to sing. It's certainly possible that it was just a screwup, but since the people involved — other than Goldberg — were clearly aware that some of what they wanted to talk about should be taken to more secure channels — the "high side" — it seems unlikely.

So it sounds to me like the canary has sung. Watch for quiet news that someone on Waltz's staff has moved on to another position, probably with much less access to sensitive communications.