Signal Audit Gives Whistleblower Channel 100% Privacy, Marks Retaliation Outside Scope

An internal board audit has awarded a channel used by whistleblowers a perfect privacy score after reviewing Signal-to-Signal encryption, Signal’s stated inability to access messages or calls, usernames replacing phone numbers, verified safety numbers, and automatic key verification. The checklist treats the channel as the protected environment and the people moving through it as unmeasured conditions.

Signal says Signal-to-Signal messages and calls are end-to-end encrypted and unavailable to the service, and the audit accepts that statement as a complete measure of channel privacy. During a live test, a source sent an encrypted message from a phone just before a work shift. The message’s contents remained unavailable to Signal. The audit did record the source’s badge scan, a supervisor waiting by the entrance, and a request for the source to come upstairs. Those entries were transferred to a gray page titled “OUTSIDE SCOPE.”

Device compromise, metadata exposure, impersonation, social engineering, and workplace retaliation were marked “outside scope.” The auditor moved each concern to a tray labeled CONTEXT, where the form provided no field for an answer. The score continued rising without requiring a name, a device inspection, or a plan for what happened after disclosure.

The score then became an intake gate. The board retired the human-review step that asked how a source could proceed safely, who might notice the contact, and what support existed after disclosure. The replacement form asks whether the exchange was Signal-to-Signal, whether a username replaced a phone number, and whether the safety number was verified. Once those boxes are checked, a clerk stamps APPROVED before the disclosure is routed to anyone capable of reading it.

To formalize the result, the board ordered a certificate marked “100% PRIVATE.” The framed certificate now hangs at the intake desk, separating clerk from source: its words face the clerk, and its blank back faces the source.