Hi Meredith, how are you?
Hi, I'm doing well. How are you doing, Emma?
I'm good, thanks for being here with me. So I think everyone probably knows, but just in case, can you just give us the quick rundown: what is Signal, and how is it different from other tech companies and other communications platforms?
A quick rundown is hard on that one, but Signal is the most widely used actually private messaging service in the world. So it's core infrastructure for militaries, for governments, for boardrooms, for human rights workers, for journalists, for anyone who has something important to say that they could be at risk if it were disclosed, if it were surveilled, if it were used to classify and categorize them. Yeah, we're also a nonprofit. We are also coming, or we're, we passed our 10-year anniversary, so we are, we're a lot of things. But you know, core infrastructure for private communication that has set the gold standard for encrypted comms for over a decade is maybe the shortest version I can come up with.
Got it. And you said the most widely used — how many people are on Signal now?
We don't give that number, but it's hundreds of millions.
Hundreds of millions. Okay, so you've been spending a lot of time in Europe recently. What is bringing you here, and what are your priorities here?
Well, you know, communications networks in this day and age need to be global, right? I need to be able to place a call from Kingston, Jamaica, to Helsinki, Finland, and I need that call to go through, and that needs to be private. And I need to have friends in both places who both use Signal and participate in our encryption, or that call won't go through. So it's really important to us that we explain our global network, remain a global platform, and that we diversify our base of support and begin to understand the really vibrant tech ecosystems that have been happening and are only growing outside of Silicon Valley.
Yeah. So when you look around the region here, what partners do you have your eye on? Who are you interested in working with?
Well, we are interested in growing privacy awareness. We are interested in letting people know that we have rewritten the stack, so to speak, up and down, and open sourced a lot of that work. So if you're looking to implement privacy-preserving tech for your communications service, we may have built something that you can reuse. And we're interested in really driving home the value of private communications in a world that is not getting less volatile, to be diplomatic about it.
Yeah. On that note, what do you see happening? Why is privacy so important right now and becoming even more important?
Well, look, privacy has always been important. I think we have been bamboozled, mystified — whatever adjective we want to use — into taking our eye off the ball. And I think we're in what we might call on the internet the 'find out' period in privacy, right? We've seen breach after breach after breach, years of breaches. You store the data, it gets leaked — that's pretty much the rule. We have seen governments partnering with large tech companies to exfiltrate data, to use that for surveillance and various ends. And if we're going to get very real about it, there's a woman living in prison right now in the United States because Meta turned over her messages that showed she was accessing abortion care and dealing with the aftermath in the state of Nebraska after the Supreme Court ruled that states could make that illegal. So I think, you know, when we talk about privacy, a lot of times in the past I've heard reflexes like, 'Look, that's for criminals. I don't have anything to hide.' And one of the points we've got to make now is, I would say most of the human rights organizations who rely on Signal for life-or-death communications are criminals in one or another state in the world, because their work, the people they're representing, the causes they're representing — whether it be access to health care or LGBTQ rights or whatever else a state might decide to criminalize — have made them criminals. So this is not a static category, and this is not a low-stakes game. And, you know, it is hard to swim against that stream because we have had about 30 years in tech where we've kind of taken our eye off that ball, where we have assumed that, you know, there's some magical tech, that there's some sort of magic in tech that is just created via innovation, and that there isn't surveillance at the heart of this business model, that pulling a huge amount of intimate data, unprecedented in human history, into the hands of a handful of companies who now control platform infrastructures, cloud infrastructures, etc., is somehow going to lead to beneficial outcomes. And, you know, now what we see is we have a huge amount of very dangerous data that is leaked, that is breached, that is turned over to hostile actors in the hands of a handful of actors. And it's really time to pull the rug out from under this model and actually get back to real innovation, right? I'm tired of white-labeling cloud APIs and calling that a startup. I actually want to build tech. And there's a huge amount of tech over here to build that needs a business model, it needs to be capitalized, and it needs to exist if we're going to be able to live in a world where our digital tools actually respect us, respect democracies, and respect a livable future.
Yeah, thank you. Well, a lot to come back to there. And let's talk about the business model more. But first, on this point about, you know, how someone using Signal could be criminalized anywhere — when you have that conversation with regulators around the world, are they receptive to your argument? Are they still very concerned about not being able to access information they feel they need?
Well, look, I think it depends on the regulator. I think a lot of times, when you're talking with government folks generally, you're dealing with people who are already overworked, who have oftentimes a lot of insecurity, almost a lot of shame around their own lack of understanding of tech, and thus an unwillingness sometimes to ask the dumb questions, to approach these topics with open skepticism — oh, sorry, this did trip me up — and who haven't actually thought through these implications. You know, when I talk to regulators in London, where we fought the Online Safety Bill very hard, which would mandate a backdoor in encrypted communications, they didn't understand, until I laid it out in many cases, that backdooring Signal in London also created a backdoor for Ukraine, in the context where the Ukrainian military relies on Signal, because every point in a network touches every other point in a network — that's kind of the definition of a network. So you can't have a parochial law that gains you a handful of political points and only applies to your little district, that isn't actually poisoning the well for everyone. And this has been a challenge for tech regulation generally, but is a particular existential threat on a lot of these laws that seem well-meaning — you know, 'let the good guys look in to see what the bad guys are doing, and thus the world is healed.' That's a, you know, very simplistic argument to begin with, and it doesn't work when we're talking about encryption, when we're talking about these fundamentally undermining backdoors that are being proposed.
Yeah. What impact have you seen of that legislation in the UK? Have you seen those concerns about privacy that you warned about?
Well, you know, there's a long story, it's fairly boring. We got this sort of very awkward compromise where basically scanning could be permitted — and the subjunctive is doing a lot of heavy lifting here for the grammar nerds — could be permitted if it were found to be technically feasible without undermining privacy, which is a kind of, you know, it's a weird contradiction. But that 'technically feasible' is really important there, because ultimately it's not feasible ever. You know, Apple tried to build this, they had to pull it off the market because it was clear actually this creates a core vulnerability. So we got a weird — I think British people have described this to me as a very British type of thing — is you sort of like, no one has to lose face, you just have a very self-contradictory paragraph in the middle of the law. And then there's a bunch of other items in the Online Safety Act that have frankly given Ofcom, the regulator tasked with enforcing them, a lot of headache and a lot of work to do.
