Perhaps they are ones that I expect the DoD has considered? As far as I know Signal is open source and no commercial arrangement is required to make use of it, putting the DoD in a position to respond in a technical capacity should there be a conflict.
In legal terms, I believe the DoD could stop any acquisition on national security groups. The US government, like many national governments, reserves that power. Signal is developed and run by a 501c3, making this a somewhat unlikely series of events.
Again, those are great points. I'm just not sure they wind up being any risks the DoD can't readily control.
Lots of things are contracted out but still run in DoD data centers with government oversight.
Me = Former DoD software engineer of 12 years.
But even so, there are a shit ton of DoD software people.
It’s called the Defense Information Systems Agency. And they’re not even the biggest in that space.
I worked there for about five years.
(I’d add here that I’m a big fan and user of matrix, while being aware of its limitations as a marketed product.)
Matrix have shipped some high profile products to clients like national governments, but there’s little hope for traction with the general public when the riot.im signup process is so unpolished, and when the most common entry point into the Matrix system brands itself with a name other than Matrix.
Signal uses the signal website and signal app for iOS and signal app for desktop and refers to the signal protocol in all it’s literature. Matrix could take a leaf out of their book!
(Perhaps licensing the trademark would be a good start?: Riot -> Matrix Riot, Synapse -> Matrix Synapse, and move the riot.im functions into a domain that has matrix in it?)
"Oh don't worry about TLS interception for the office firewall, we can break RSA anyway" is not how a bureaucracy thinks. Come on.
Conspiratorial bureaucracies operate that way. Trust no one, allow nothing that can be used to undermine...
Read Memoirs Found in a Bathtub.
The problem with the military using an off the shelf system like Signal isn't the tangible features (re: encryption, usable ux). The problem is one of control. What happens when the government gets into a dispute with Signal (say, over a warrantless wiretap) and Signal decides in protest that it will no longer have any DoD affiliated customers? What happens when, through a series of shell companies and legal loopholes, a controlling stake in Signal ends up in Chinese or Russian hands?
From the PoV of the DoD, owning the system from end to end is a feature they shouldn't compromise on, even if the other features suffer and it costs more than it otherwise would.