With ICE and CBP roaming the streets, united community action is more important than ever right now — from local mutual aid groups to school safety patrols. Known for its privacy features and end-to-end encryption, the Signal messaging app has become a popular platform for organizing these community groups.
Signal can be a great tool for private messaging, but it’s at its best if you know how to use all the privacy options. Not all of these options are automatic or even immediately obvious; there are also some best practices that are helpful for participating in and leading group chats.
Signal and your First Amendment rights
As you’re assembling your mutual aid group chat or creating your neighborhood ICE watch group on Signal, remember your First Amendment rights don’t go away just because you’re using Signal. That should go without saying, but recent comments from FBI director Kash Patel may have some would-be Signal users confused or concerned about their legal rights to use Signal and what they can discuss on it.
“People have a First Amendment right to observe, document, and communicate information about law enforcement activity,” senior staff attorney at the nonprofit Electronic Frontier Foundation (EFF) F. Mario Trujillo tells The Verge. “There is nothing about using Signal that changes that. There is a gulf between protected First Amendment activity on the one hand and unlawful threats or physical violence on the other. The government has consistently conflated the two.”
As Trujillo points out, Signal is no different than any other communication channel or messaging app as far as your First Amendment rights go. Signal’s security features simply make it a better choice than other messaging apps for anyone who’s (rightfully) concerned about their data privacy, but still wants to organize nonviolent community action with their neighbors.
You have rights, but the administration is regularly violating those rights. There are privacy settings and best practices that can help mitigate existing risks.
Signal is free to download and use on Android, iOS, Windows, Mac, and Linux. All you need to create an account is your phone number, which you’ll be asked to verify when you’re first setting up the app. After that’s confirmed with a code texted to you, you can set up your profile. Signal asks for a first name, but a last name isn’t required, so you can choose to only add your first name or use a pseudonym. This is your “profile name” and the name other users will see in Signal chats.
You should also create a username when you’re getting set up. If you don’t have one, your phone number will function as your username – adding a username to your account allows you to keep your number hidden (though additional measures need to be taken to keep it private: see below).
To create or change your username, tap your profile icon in the top left to go to your Signal settings, then tap it again in the settings menu. This will take you to your profile settings page where you can set a username and change your profile name, photo, bio, and badges (for new users, the username slot is usually an “@” symbol with a blank space or “username” after it).
Next, there are a few things you’ll want to adjust in your privacy settings:
- Set phone number visibility to “nobody.” Setting both “who can see my number” and “who can find me by number” to “nobody” will prevent other Signal users from seeing your phone number at all.
- Turn on screen locking. This setting will automatically lock Signal after a certain amount of time when you leave the app or lock your phone, so you’ll need to use your phone’s biometrics (fingerprint or Face ID), pin, or password to unlock the app again. (We recommend turning biometrics off.)
- Turn on screen security. This will block whoever is using your phone from taking screenshots inside the Signal app, replacing any attempted (or accidental) screenshots with a black screen. Keep in mind, this doesn’t stop other users from screenshotting your conversations, only you or whoever is using your phone.
- Turn on incognito keyboard (Android only). Some keyboards can track your typing activity. This setting will help prevent that in the Signal app.
Additionally, you can turn on disappearing messages by default in new chats from the privacy settings menu. You can also adjust the amount of time disappearing messages are visible on all devices, ranging from 30 seconds to four weeks, or a custom time limit. It’s a good idea to have disappearing messages turned on, but you can always manually turn this on and off for individual chats depending on how your community groups use Signal.
If you’re concerned about someone seeing the Signal app on your homescreen, you can disguise it as a generic news, notes, or weather app by going to “Appearance” in the app’s settings and selecting “App icon.” You can change the icon on both Android and iOS, but only on Android will the name under the icon also change. On iOS, the app will still be labelled “Signal” regardless of its icon, unless you manually hide app names for all your apps in your homescreen settings.
Similarly, if you’re concerned about your IP address being exposed, turning on “Always relay calls” in your advanced privacy settings will hide it during calls on Signal.
Using Signal to run private group chats
Community organizing on Signal can range from a small group chat for nextdoor neighbors to plan carpooling to a protest, to large group chats for sharing alerts about law enforcement activity. The best way to run the group chat will depend on its size and, more importantly, whether you know everyone in the group. It can be easy to accidentally let an unwanted guest into any group chat, as last year’s Signalgate incident highlighted, so some precautions will come in handy.
When you set up a new group chat, you can choose to require admin approval for all new members, meaning you (or other users you’ve designated as admins) need to manually allow new members into the group. If you have this turned off, anyone who’s invited or has the group chat link can join.
If you want to make sure you can confirm you know who all of the people in your group are, you should have admin approval turned on. You can still use the group chat link feature to invite new members, but they won’t be allowed into the chat until an admin gives them the green light. This is ideal for small and medium-size groups.
In this case, there are a few ways you can “vet” new members and confirm everyone in the group is who they say they are. The first and often easiest method is by adding new members in person. If it’s someone you know already, you can meet up to exchange Signal usernames. You can also require that multiple current members of the group vouch for a new member before allowing them to join.
In a comment to The Verge, Thorin Klosowski, a security and privacy activist at the Electronic Frontier Foundation, also recommended keeping an eye on your members list: “For small to medium-sized group chats, it’s very useful to check periodically to ensure you know everyone inside that chat. For large group chats where you don’t know every person, some communities may want to treat that more like a ‘semi-public’ channel and not discuss anything confidential.”
If you want to use your Signal chat for something “semi-public” like community announcements, you can leave admin approval turned off so anyone who’s invited or has the link can join. However, in this case it’s probably a good idea to turn off chat permissions for other users in the group. Everyone in the group will be able to see messages, but only admins will be able to post them.
Using Signal to run public group chats
Signal’s end-to-end encryption makes it more private and secure than most other messaging apps, but you should still be mindful of what you say on it and who you’re talking to.
With open, public group chats, it’s especially important to be cautious about what you’re posting. As Abigail LP, program manager for the digital security and source protection program at the nonprofit Freedom of the Press Foundation, said in an interview with The Verge: “Signal is a great tool because of its strong end-to-end encryption, but that doesn’t stop anyone from downloading and joining big public chats that have no security protocols or procedures.”
They added a good rule of thumb for Signal in general, but especially when it comes to group chats: “If you wouldn’t say it in court, don’t say it in one of those chats.”
This is important to keep in mind since you never know if a user in a large public group chat might not be who they claim to be or might be a bad actor taking screenshots and recording the contents of the group chat. Even if you know everyone in a group chat, there’s also the possibility that someone’s phone could get lost or confiscated by law enforcement, or even the possibility that their Signal account could get hacked, such as with a malicious QR code for adding a linked device to their account.
Best practices for safer Signal use
It’s also worth remembering that Signal could be forced to comply with data requests from law enforcement and government agencies (they publish notices of those requests when this happens). However, in the event of a subpoena, Signal wouldn’t be able to turn over the contents of your messages. Due to its end-to-end encryption, even Signal does not have that data.
As Freedom of the Press Foundation’s Abigail LP tells The Verge, your Signal messages “only live on your device and the receiver’s device.” They added that if Signal is subpoenaed, “the only thing they can return to the government are users’ phone numbers, the date that they created their account, and the date of last use,” meaning the date a user most recently opened the Signal app.
With that said, there are a few ways you can make your communication on Signal more secure. For instance, you can use safety numbers to verify your connection security with people you’re talking to. A safety number is a unique code for each DM conversation on Signal that should match for both users. Verifying safety numbers can help prevent “man-in-the-middle” cyberattacks, where a hacker inserts themselves into a DM and poses as one of the users in the chat.
You can view the safety number for a Signal DM by tapping the other user’s profile icon. This will show the unique code for your chat and a QR code you can scan if you’re verifying your safety number in person. If you’re not able to meet in person, you can also compare safety numbers over video chat. As long as the codes match, you’re good to go. If the safety number for one of your chats ever changes, you’ll be notified of it so you can confirm it again.
Similarly, using Signal’s nicknames feature can help you keep track of trusted contacts. You can set your own nickname for other users by tapping their profile icon. Anyone can change their profile name at any time, so creating nicknames for your contacts can help avoid confusion. Only you will see the nicknames you set for other users, so you can change these to whatever is most useful or recognizable for you.
Additionally, remember you can toggle disappearing messages on or off whenever you want. It could be helpful to have disappearing messages turned off in organizing group chats so everyone’s on the same page about your schedule or meeting plans, but if you ever want to share sensitive information, you can temporarily turn disappearing messages on. Everything you say after turning on disappearing messages and before they’re turned off will disappear after the set amount of time.
Freedom of the Press Foundation’s Abigail LP also suggested using Signal to take photos and videos with less metadata (which can reveal info like your location). Signal saves less metadata when you take photos and videos in its app compared to most phones’ default camera apps. Even if you don’t need to share a photo with someone else, you can use Signal’s note-to-self feature to send it to yourself and save it with minimal metadata.
If you do need to send photos and videos to other people in Signal, there’s an option to send them as “view once media,” meaning they’ll disappear after the first time the receiver sees them. This doesn’t prevent screenshots, though.
Ultimately, these settings and best practices will make your chats safer, but a lot depends on whether your group members are trustworthy and are able and willing to keep their devices safe.
