"We are currently clean on OPSEC": Why JD Can't Encrypt

• URL: http://arxiv.org/abs/2604.19711v1
• Date: Tue, 21 Apr 2026 17:34:53 GMT
• Title: "We are currently clean on OPSEC": Why JD Can't Encrypt
• Abstract summary: We analyse the 2025 Signalgate leak of sensitive US military information by the Trump administration.<n>We look at how cryptographic tools may have instilled a false sense of security, and led officials to "overshare"<n>We conclude that, even with advancements in usability of cryptographic tools, genuine message security is still out of reach of the "average user"
• Score: 1.1724565818034947
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: We analyse the 2025 Signalgate leak of sensitive US military information by the Trump administration, addressing why confidentiality was violated (messages leaked to the press) in spite of encryption (Signal), to deepen the socio-technical considerations when designing and deploying encryption. First, we use applied pi-calculus to formally model the boutique secure facility setup requested by the US Defence Secretary, to prove that a leak would not be prevented. We then examine how using a secure channel might still not give overall information security, as, in this case, power imbalances between personnel and officials led to the application of cryptography that compromised their operational security. We look at how cryptographic tools may have instilled a false sense of security, and led officials to "overshare". We then apply this analysis to the Trump administration's general desire to burn through political, legal, and now technical process, and demonstrate geopolitical harms that may arise from such ineffective use of cryptography in a brief use case. We conclude that, even with advancements in usability of cryptographic tools, genuine message security is still out of reach of the "average user".

Related papers

• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• Security Is Not Enough: Privacy in Encryption Regulation and Lawful-Surveillance Protocols [0.0]
  This article argues that security is not enough to fully capture what is at stake in government exceptional access to encrypted data.<n>A richer understanding is needed both to assess policy and to guide research on lawful-surveillance protocols.
  arXiv  Detail & Related papers  (2026-02-28T23:41:22Z)
• Functional Encryption in Secure Neural Network Training: Data Leakage and Practical Mitigations [45.88028371034407]
  We present an attack on neural networks that uses Functional Encryption (FE) for secure training over encrypted data.<n>One approach ensures security without relying on encryption, while the other uses function-hiding inner-product techniques.
  arXiv  Detail & Related papers  (2025-09-25T19:56:05Z)
• Defeating Prompt Injections by Design [79.00910871948787]
  CaMeL is a robust defense that creates a protective system layer around the Large Language Models.<n>To operate, CaMeL explicitly extracts the control and data flows from the (trusted) query.<n>To further improve security, CaMeL uses a notion of a capability to prevent the exfiltration of private data over unauthorized data flows.
  arXiv  Detail & Related papers  (2025-03-24T15:54:10Z)
• Secure Semantic Communication With Homomorphic Encryption [52.5344514499035]
  This paper explores the feasibility of applying homomorphic encryption to SemCom.<n>We propose a task-oriented SemCom scheme secured through homomorphic encryption.
  arXiv  Detail & Related papers  (2025-01-17T13:26:14Z)
• Privacy-preserving server-supported decryption [2.2530496464901106]
  We consider encryption systems with two-out-of-two threshold decryption, where one of the parties initiates the decryption and the other one assists. Existing threshold decryption schemes disclose to the server the ciphertext that is being decrypted. We give a construction, where the identity of the ciphertext is not leaked to the server, and the client's privacy is preserved.
  arXiv  Detail & Related papers  (2024-10-25T06:47:53Z)
• Trustless Distributed Symmetric-key Encryption [0.6597195879147557]
  We focus on the symmetric-key setting, allowing both threshold encryption and threshold decryption. Previous work relies on the presence of a trusted third party. We propose to remove the requirement of a trusted third party by designing a dealer-free setup.
  arXiv  Detail & Related papers  (2024-08-28T20:56:30Z)
• Privacy Aware Memory Forensics [3.382960674045592]
  Recent surveys indicate that 60% of data breaches are primarily caused by malicious insider threats. In this research, we present a novel solution to detect data leakages by insiders in an organization. Our approach captures the RAM of the insiders device and analyses it for sensitive information leaks from a host system.
  arXiv  Detail & Related papers  (2024-06-13T11:18:49Z)
• CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models [49.60006012946767]
  We propose CodeChameleon, a novel jailbreak framework based on personalized encryption tactics. We conduct extensive experiments on 7 Large Language Models, achieving state-of-the-art average Attack Success Rate (ASR) Remarkably, our method achieves an 86.6% ASR on GPT-4-1106.
  arXiv  Detail & Related papers  (2024-02-26T16:35:59Z)
• EmojiPrompt: Generative Prompt Obfuscation for Privacy-Preserving Communication with Cloud-based LLMs [34.77734655124251]
  EmojiPrompt performs generative transformation, obfuscating private data within prompts with linguistic and non-linguistic elements.<n>We evaluate EmojiPrompt's performance across 8 datasets from various domains.<n>EmojiPrompt's atomic-level obfuscation allows it to function exclusively with cloud-based LLMs.
  arXiv  Detail & Related papers  (2024-02-08T17:57:11Z)
• Bugs in our Pockets: The Risks of Client-Side Scanning [8.963278092315946]
  We argue that client-side scanning (CSS) neither guarantees efficacious crime prevention nor prevents surveillance. CSS by its nature creates serious security and privacy risks for all society. There are multiple ways in which client-side scanning can fail, can be evaded, and can be abused.
  arXiv  Detail & Related papers  (2021-10-14T15:18:49Z)
• Backdoor Attack against Speaker Verification [86.43395230456339]
  We show that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification.
  arXiv  Detail & Related papers  (2020-10-22T11:10:08Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.