Good morning. I'm Justin Hendrickx, editor of Tech Policy Press, a nonprofit media and community venture intended to provoke new ideas, debate, and discussion at the intersection of technology and democracy.
Earlier this month, I attended RightsCon, the big gathering of individuals and organizations concerned with human rights and technology. The sprawling event had hundreds of sessions on a wide range of themes. But one topic discussed across multiple tracks was the importance of encryption, especially to groups such as political dissidents and journalists. I helped run a workshop that asked participants to evaluate their own threat models for private communications and how they use encrypted messaging apps in practice.
During the workshop, we previewed some of the key findings and recommendations in a forthcoming report on the security and design of encrypted messaging apps that I helped write along with Caroline Cinders, Cooper Quinton, Leila Wy Wagner, Tim Bernard, and Ammy Meta. Keep an eye out for that report, which will be published on June 20th. A key panel at RightsCon featured Signal president Meredith Whitaker and the head of WhatsApp, Will Cathcart, among others, who spoke out about policies proposed in legislatures around the world that threaten the promise of end-to-end encryption to preserve the privacy of messages sent between individuals and groups.
Leaders of encrypted apps have pulled together of late to speak out against the proposed UK Online Safety Bill, signing letters and appearing at events. Shortly after RightsCon, I connected with Meredith to learn more about Signal's posture against such legislation, why she sees encrypted communications as so crucial to freedom and human rights, and how the company thinks about safety and its role in the broader digital ecosystem.
I'm Meredith Whitaker and I'm the president of Signal.
Meredith, I want to just start by putting Signal in context because I think all of my listeners know what Signal is. I would suspect that more than half of them probably have a Signal app on their phone, but many folks probably don't know terribly much about the organization itself. Give me the basics. How many users? How many employees? How is it funded?
Well, we don't give clear user numbers, but a short hack to try to deduce such for those of you into that kind of sleuthing is to go to the Play Store, and you can see that just for Android, it's been downloaded over 100 million times. So what I can say is we have many tens of millions of users across the globe, and that's wonderful because that makes us the most widely used truly private communications app in the world.
But that's not the only special thing about Signal. Signal is also a nonprofit, which in the tech industry, an industry where the dominant business model is monetizing surveillance in some form or another, it's really important to have a structure where you're not tempted or even pushed by investors or private equity companies or anyone else to prioritize profit, which often means surveillance over privacy. So the structure of the nonprofit is actually really important to ensuring that we can keep our eyes on the mission and we can keep focused on what we are here to do, which is provide a truly private means of communication in a digital ecosystem that has been hollowed out by surveillance, or built around surveillance more accurately, over the past number of decades.
In that fight, of course, Signal plays an outsized role. You have an outsized voice. But again, just for contextualization's sake, I just want my listeners to understand scale of the organization, scale of the budget. I mean, on one level, on the 990, you know, I can see that the thing is roughly pulling in what, 14 to 15 million a year in donations essentially. Roughly how many employees?
So we have a little over 40. There's give or take there, but incredibly small for an organization developing and delivering a high availability app that needs to meet the norms and expectations of messaging, or those who want to use it for ideological reasons can't use it because the friends who don't understand how it works and just want to message won't use it either. So we're, you know, we're a very small team. We're developing across multiple clients. We're about as lean as you could be for an organization developing something as expensive and labor-intensive as a messaging app that works instantly, always, everywhere.
In terms of funding, we are donor-funded with a large runway that was provided by Brian Acton. But I think what it's important to stress is it costs tens of millions of dollars a year to develop and operate Signal. And that is hosting cost. That's registration cost. That's labor cost. But it is a forever expense that goes up somewhat, not one-to-one, but it goes up in proportion to the number of users we have.
So the goal for Signal is really to be small donor-funded, and that's one of my key focuses. We want to be funded by small donations from some percentage of those tens of millions of people who rely on Signal, because we want to be accountable to those people and because we want a model that is as safe and robust as possible. We don't want to rely on the generosity of one or another institution or person because, of course, those institutions or people have the right at any moment to decide they want to do something else with their money, and we don't want to be in that position.
I should disclose that I am one of those small donors. I have the little star icon next to my account, I suppose, which indicates that I part with about $5 a month to Signal Foundation. So, doing my best, I suppose. But I of course use the app religiously.
I kind of want to go into a little bit of just the philosophy behind Signal a bit, and I don't want to spend too much on it because I know that my listeners can go and read quite a lot of material on this. But I was struck by this Anna Wiener profile of Moxie Marlinspike, one of the founders of Signal, in The New Yorker back in 2020, talked about the idea that Signal has this sort of halo of subversion. It certainly has a kind of cool, almost a kind of, I suppose, what's the word I'm looking for? Iconic, maybe, maybe punk rock kind of sensibility to the Signal brand. But is there a conceptual framework or an evolving kind of philosophy of Signal that goes beyond 'we think privacy is good'?
Well, I think Signal is cool because it's cool. It's real because it's real, right? There's a way that that contrasts really shockingly with the kind of PR-inflected comms that are meant to be as safe for everyone as possible. The kind of excuses and framings around new products and features that come out of the dominant tech companies that are clearly calibrated to sort of please advertisers or investors but are narrated as good for humanity. It is very different when you're simply able to be real about what you're doing. When you're actually able to focus on one vision, and that is privacy is good, but we can talk about why privacy is good.
Right? Power asymmetry thrives on information asymmetry. Surveillance is always a tool of the powerful to classify people into good or bad, to control people based on various interests, and can go beyond that to devastating effect. We can't look at a mass atrocity in the last hundreds of years without recognizing that that required the categorization, enumeration, and sort of monitoring of populations to accomplish.
Now, we are now in an age over the past handful of decades, you know, where mass surveillance on a scale and granularity that we've never seen before is commonplace simply as a product of our participating in the regular social and economic life. We can't get a job without having a cell phone. We're flagged as, you know, a potential suspect if we don't have a social media trail via some algorithms like this. Our lives are narrated and surveilled at an extent we haven't seen.
So what Signal is doing is saying privacy is good, but it's also saying, and here is a way to preserve the norm of privacy that was part of human communications for literally millions of years before we can mark certain dates. But let's, you know, let's choose, you know, the mid-90s when the Clinton administration put down a neoliberal policy agenda where privatization and commercialization of networked computation was core to their neoliberal aspirations, and they handed the keys to private industry to self-regulate on privacy. The surveillance advertising business model was developed, and now we have a real set of problems that at their core involve the power asymmetries of surveillance that Signal is simply working to provide a real alternative. But providing a real alternative is incredibly cool. I would say it is indeed punk rock.
I want to get a little bit into, well, the thing you just mentioned, which is kind of putting things in a bit of a historical context. When we happened to see each other last week at RightsCon in Costa Rica, we talked very briefly about this moment that we're in where encryption, privacy appear to be really under threat across the globe, even in democracies that claim to protect it and to prize free expression. I opened The New York Times on my phone this morning and saw Julia Angwin's guest essay, 'One of the Last Bastions of Digital Privacy Is Under Threat.' She appears also to be sort of framing this moment that we're in as a kind of turning point. Does it feel that way to you? Do you think you can tell which way it's going to go?
At the moment, it feels critically important, and I don't believe in inevitability. I believe in invitations to push for better futures. I have felt critical moments before. Certainly 2015, 2016, with the showdown between Apple and the FBI was a critical moment and could have gone otherwise if there wasn't concerted, organized pushback from experts who understood the stakes. I think we are in another one of those moments.
I think there are an array of forces that are troublingly aligned against the right to privacy or the right to communicate digitally outside of the mass surveillance of governments and corporations. And to be honest with you, one of the reasons I decided to take this job was I saw this moment on the horizon. This has been building for a while, and I didn't think there was much that was more important I could be doing than doing everything I could to ensure that Signal was safe and that we could meet this moment and continue to provide people a real private communications option.
Your voice has been prominent in the last few weeks. You've had op-eds. You've had appearances. You've been attending events like RightsCon. When you survey the landscape at the moment, where are the kind of policy environments where you're most concerned? I mean, it seems like the UK clearly is the place where you've put a lot of your effort lately, but it's not just the UK.
Yeah. I mean, the UK is the closest to potentially being ratified. So we've certainly been focused on the UK. And of course, as you know, Justin, as somebody who's also working in this space for a long time, one law passes and it's copy-paste, right? The power of the precedent is huge here. And the UK would be the first to implement a law that allows one of their government agencies to mandate client-side scanning, which is effectively mass surveillance that would scan every message you sent before you sent it against an opaque database, judging whether it's acceptable speech or not.
Whether or not that judgment was correct, whether or not there was a malformed AI system in the background making spurious predictions or determinations would be hard to know, but those are really the stakes. And if that passes and the UK becomes precedent, it becomes easy for any other country to point to, you know, well, the UK did it, and the UK certainly is a democracy. So how can you say that this is a move toward authoritarianism? And then, you know, you're effectively moving in a direction where you're eliminating the possibility for private digital communications.
Extraordinarily stark when you look to the EU, of course. We've seen this leaked document recently published in Wired that seemed to expose the different member states' perspectives on encryption. Spain perhaps going in a particularly worrying direction politically, certainly on one end of the spectrum there, proposing essentially the outlaw of end-to-end encryption in its borders. Spain also, I think, set to take over the presidency of the EU next year. What's your perspective on what will happen in the EU? Are you able to tell, or is it a little more up in the air?
Yeah, I mean, it feels more up in the air, and you also have a number of countries who are not aligned with eliminating or undermining privacy. So many of the northern states. So there's a clearer divide there. But I do want to caveat this, like, I'm lucky to work with a coalition of experts. I work with folks at EDRi. I work with Open Rights Group in the UK. You know, I talk to a number of other people who are much closer on the ground in the day-to-day political discussions than I am. That's just not something that, as a small org based in the US primarily with a lot of other duties, that I'm able to do.
So that's the type of question I would actually ask them because I would prioritize their expertise and really just their instinct on how the nuts and bolts of politics gets done. But my impression is the UK is closer and we need to watch that carefully, and that's where we have been applying pressure based off the advice of a lot of the folks we work with. And the EU is farther away but nonetheless extremely concerning. And to be clear for everyone, our position on both is the same. We simply will not undermine the privacy promises we make to the people who rely on us, and we will never participate in a regime that would force us to adulterate or weaken our encryption.
You mentioned at RightsCon that if in fact the UK were to introduce some requirement for client-side scanning or otherwise interfere in the function of encrypted messaging apps, that you might have to revert to offering the service in the same way that you might in a country where it is in fact banned. So perhaps a proxy like in Iran.
Yeah, I mean, we would do anything we could to get the people in the UK access to the right to private communications, right? We're pretty agnostic there, right? We do recognize that in moments like the uprisings in Iran, or in moments where the UK government may move forward mandating mass surveillance and undermining the rights of privacy, that that decision doesn't necessarily represent the people in those countries, and that those people still have the rights of privacy. So in the case of Iran, we worked with our community who set up proxy servers that helped people who had Signal installed in Iran bypass the block. And we would certainly explore that and other options in the UK. Our commitment is to the people in the UK, and our commitment is to ensure they can exercise their right to privacy.
I suppose there is at least some defense or some good thing about the reality that the US is essentially kind of unable to pass much of anything when it comes to technology, yet encryption seems to be perpetually under the target here. Is there a backup plan if in fact the US goes in the wrong direction?
