🔴 Meredith Whittaker, president of the Signal Foundation, on digital addictions and vulnerabilities

I will begin with my introductory remarks and then we can talk about the specificities of Signal.

Honourable members of the National Assembly, thank you for this opportunity to talk about privacy issues, digital sovereignty, the systemic vulnerabilities in our current technological landscape, and why the ability to verify the infrastructures that make up the infrastructure of our lives, of our institutions, is so important right now. As you know, our era is partly defined by an extreme concentration of industry never seen before. I don't have to convince you, since you are holding this hearing on the subject, that this is not just an economic question, it is also a geopolitical vulnerability and it poses a problem for our ability to govern, to recreate our states and to protect our states, our social and economic relations. To address these very serious issues, we must first understand how we got here. So I will take a few moments to summarize the economic model anchored in advertising and surveillance that has led to the extreme concentration we know today. This problem was shaped by neoliberal ideas in the 1980s and 1990s, which thought that privatization was the will of God, that markets were benevolent, and that preventing them from growing would be perverse. This set the stage for the control of our infrastructure, with, for example, the web services of Amazon, Azure, Microsoft, the cloud, the information platforms of social media such as X, YouTube, and the AI-based decision-making systems that make decisions for our states, for our institutions, and for our businesses. In Brussels, in Paris, and in many other capitals of the world, we hear many opinions about how we got here: a lack of innovation or not enough regulation, but that misses the point. The reality is that the privatization of the internet, supported by the American state, ignored the lessons learned from history and the reality of communication networks, from the post office to the telegraph or telecommunications. It made sense until we forgot that communication networks were natural monopolies, given factors such as economies of scale, very expensive assets, network effects, centralizing tendencies, and other factors. There is no practical way to create competitors, and you wouldn't want 18 telephones, each connected to a different group of friends. That's the reality. But the critical importance of information, communications, news, military commands, and why historically networks were regulated monopolies. There is a reason why communication was targeted first in military conflicts. Without communication, nothing works. But treating networks as natural monopolies was not the choice made by the Clinton administration in the 1990s when the rules for the commercialization of the internet were written. Rules that gave priority to American companies and delivered the internet to free market forces. So it is an advantage for American companies that were the first, thanks to investments in infrastructure in the United States, they were helped by American soft power, and this helps explain why there is a hyperconcentration of tech giants in the United States and, to a lesser extent, in China, because China is the only state with a large enough internal market to support such alternatives, and they excluded American technology. That is why, no matter how many billions are set aside or what frequency we talk about gigafactories, it is not possible to create new market entrants given the terms established by these giants. To repeat, we are in this situation not because of too much regulation, nor because innovation is not part of the French mindset. And it is not because there is no union of capitals, [throat clearing] it is because the monopoly and the decades-long head start of American companies have brought us to where we are today. So there you have it. That is the map we all have to look at together. It is sad, but it is better than denying it or turning a blind eye. We must face these facts without fear, because when we do, we have more clarity. We know the landscape better, and with the adjustment of our vision, we see cracks in this supposedly impenetrable fortress. So, what do I mean by that? There is still hope. There are many things that current tech companies cannot do. These are things that our economies, our financial systems, our militaries, our defense establishments, and the functioning of our democracies need. It is great to have ethical questions. Of course, we need them, but the platforms do not provide these aspects. I have probably taken too much time, but I would like to list a few opportunities we see before us to start over in a cleaner way and win through rules we create, not narratives that come from the most powerful who absolutely want to protect the status quo. There are many ways to create technology. Signal proves it, and we need many technologies we do not have. For example, we absolutely need much more attention to the insecurities in AI models and the systems that use them: data poisoning, exfiltration, and other attacks that are well documented and for which there is currently no remedy. It is only by fully understanding this reality that we can find solutions and ensure that the systems in our infrastructure do not create vectors for significant harm. In parallel, we must invest in secure development and supply chains for data and other processes that do not fit the approach of big AI companies, for which bigger is better. We must also remember the fundamental nature of technology. AI is not magic, it is not a god, it is not your friend, it is not your lover. And like any other system composed of hardware and software that requires software dependencies, it must be secured with good development practices. That is not happening currently, especially in the context of agentic AI. This is a warning, but it is also an opportunity to hold firm, ensuring that the barrier between operating systems and the application layer, between the AI agent and your Signal messages, for example, is not destroyed by a risky deployment of AI, because we need it. And of course, there is no intelligence without data. A model cannot know anything that is outside the distribution of the data it has received. So there is a need for much more robust data, scientific data for fundamental research, data that is built with a lot of attention to have methodological rigor suited to defense or health or certain industrial sectors, as well as other uses. That too is a market opening. And finally, a note on changing the rules of the game. Part of the problem is that existing companies create the world they want. The way their systems evolve does not reflect their real uses. It must be seen as an opportunity to create evaluation criteria that take real life as the operating ground and measure the performance of the model, not [throat clearing] against a similar benchmark. Because thanks to that, we will see that often it is smaller models that perform best, with the benefit of moving us away from dependence on big companies and the dominant companies of today. This list is short, it is too brief, even though it takes a lot of time and we could write a thousand theses on each of these points. So it is really just to give you a picture of all the possible trajectories to move forward. And I hope that as we move away from insecurity, we can think creatively about how to build what we really need. There are truly many ways to use technology, so many approaches, so many ways of financing, and it is imperative that we do not rely on the current leaders of technology and the world. Thank you very much.

I prefer not to speculate on hypotheses because the geopolitical situation is very volatile and all the factors at play. But what I can say is that we will go very, very far to ensure that Signal is available to everyone, everywhere, and that, whatever the jurisdiction, we are ready not to obey orders that could go against our mission and our technological integrity, which guarantees our mission.

Thank you for this question. Very briefly, to talk about Signal. So it is the largest private communication platform. Our only objective, our obsession, is to provide a meaningful way to communicate privately in a world where more and more of our lives are under surveillance by large technology companies. For us, private communication is a fundamental human right, and democracy and a meaningful life are not possible without it. We exist to protect this right, and we do so by providing an open-source tool. It is software and essential protocols that protect privacy. The Signal encryption protocol is the standard for messaging encryption. And when we introduced it in 2013, it represented an advance in encryption practices and in applied cryptography. It is used not only by Signal but also licensed by others to protect the private nature of communication. In addition to this protocol that protects messages, what you say on Signal to your friends, to your colleagues, we also do everything we can to protect metadata. It is a somewhat mysterious word, but it applies to highly sensitive information: who you talk to, when you talk to them, what your profile information is, who belongs to your group chats. These are very, very important pieces of information. When did you start talking to a therapist? You contacted a divorce lawyer, an oncologist? When did that happen? And so for us, metaphorically, we rewrote the stack to move away from the industry norm of sharing and collecting data to serve technology, so that it would be possible to collect as little data as possible. So, how to do it? This also answers the question of why there is only one Signal in a world that so desperately needs this type of technology. By the way, I mentioned it a little bit in my introduction: the economic engine of the technology industries is data collection. You model the data and you sell these results to companies, and so you send them, you send them to make gains, and that is how you make money in an industry that is extremely expensive to run. And Signal recognizes that this economic norm, this economic imperative, is a threat to the mission and the right that we are here to defend. And so we are a non-profit, which means we are not governed by the economic imperative. We do not have a board of directors pushing us to make money. We do not have speculative funds or other funds that want investments, investors who want us to produce revenue, which in this industry ultimately pushes them to collect data for particular commercial purposes. So I don't need, you don't need to trust me. [laughter] I believe I can argue very well, but that means nothing when talking about something as fundamental as our key infrastructure. That is to say, it should be the norm that we can validate, that we can verify with access to the technical fundamentals, because trust is not only placed in Signal, but in all the infrastructures and all the other elements that make up Signal, and it is much too precious not to be defended and must not be under the decision-making power of a board of directors or investors. We are not simply open source. It is not simply something you can look at if you have the time. But over the past 10 years, we have built a reputation in the technical community as being truly the gold standard. That means there is a whole ecosystem that is functioning. We can at that moment not simply put data in an online library. We have a whole infrastructure that means we have trust, but not simply because of opinions. That is to say, if hackers manage to do something, they know they will have a job with us. And so you don't need to take my word for it, and that is not what I am looking for. There is all the possible evidence.

Thank you. I heard three questions in your remarks and I want to be sure I answer them correctly. But if it doesn't exactly match what you want, [growl] please tell me because I want to be precise. So the first question: it is not enough to be open source. You are absolutely right. That is the reason why I mentioned the ecosystem that validates and truly underpins Signal. So that is why we have it, and we would like Apple to allow this on iOS, and obviously that would be interesting. That is the reason why we check vulnerability dependencies and that we really try to push things to the limit. But what I want to say is that it is the foundation that matters. You must have open source and all the mechanisms that exist to be sure that real verification is possible and exists not only for Signal but also for other infrastructures and platforms. That is the answer to my first question. Secondly, on the question of what happens if Signal no longer has funding, that is not yet the case, and I have [growl] no intention of running out of funding. I believe the answer is that if there is no more funding, well, nothing can exist. But we are in a rather strange situation as Signal. We are key infrastructures for governments and militaries around the world. We are really the main system for anyone who has something confidential to share, whether it is people working in law, humanitarian work, or governments, and they use Signal because we are the gold standard. And then we also have an ecosystem that can be valued in the market system and in businesses, startups for example, and at that point, if we get there, we will really be worth billions and billions and billions given our reputation, our role. And so my hypothesis is that we can push to ensure that those who benefit from access to this platform may want to fund it, but that does not answer the main problem. How is it that something as virtuous and necessary as Signal is not the system that prevails? Because you see, this shows that there is an economic bias, but it also explains other things, namely how we ensure an infrastructure that is truly necessary and how we continue in the way it should be. So then, the dependencies, I already mentioned at least implicitly in my introduction, these dependencies are not replaceable. We can talk about federations, for example, but federations also have their pathologies. How do you make sure that a person who goes on vacation, how do you make sure you have edge coverage around the world? You need edge servers to make sure there are no lost packets and lost octets. You see, in the 90s, the ingredients were put in place to allow a certain number of companies, a handful of companies actually, to grow in a monopoly structure. And so we use their servers because we must do so to ensure our coverage can be global. We don't have billions of dollars a year to replicate and copy their infrastructures, their servers, etc. But what we have is rigorous encryption that ensures that even if we use these servers and these companies' servers, these platforms cannot access your precious data. Only you have the possibility, the keys, to access this Signal, this Signal platform.

Thank you for this question. Again, in my introduction, one of the things I wanted to emphasize was that I do not see a medium-term way to replicate the monopolies' infrastructures. We are not just talking about AWS infrastructure, we are talking about Amazon Marketplace, we are talking about economies of scale, we are talking about companies that have in fact created the water in which things swim. They defined the process, the standards, what it means to be a programmer, and we build applications for a given environment using a language, for example, for Apple, which will work in an environment. So there are dependencies that were able to grow over a number of decades, and you cannot simply replicate that with economies of scale, with global coverage, and the billions and billions needed to keep this massive system running. So I do not believe the goal should be to magically find a way to replicate all of that. I believe it is yet another example of European failure, and it is an example we do not need. I believe there are ways, as I have established, to look at these infrastructures and the way these structures and infrastructures harm us. We must look at the viability brought by Signal, and there are ways to do it. It is simply a question of security. I believe the United States should also demand it. I believe everyone should demand it, because there was the situation a year ago where the systems completely collapsed. Everything went down. Why was there no more electricity? Why? Because there was a total dependence, which is an example showing that we need much more robust systems. And I believe that states, as major clients of these companies, should ask, demand this. But on the other hand, there is a lot of room to try to change or at least modify the system and a number of elements that exist in these platforms, and to look at smaller-scale models that could in fact better match what we ask of these systems. And to understand what that means, what does it mean for a model and a system to succeed in the task it is asked to perform, and in a more specific way? And that answers our question, and it is not up to the technology company to build something that does not necessarily and precisely match what people want.