Signal: hacked or misconfigured? What the leak reveals

Signal, the 'secure' messenger that leaks like a sieve

On 26 May 2026, El Mundo reported that the Signal conversations of certain Spanish public officials had been intercepted. The story, which does not specify how, has peine the debate about the real security of the encrypted messaging app. But what looks like a new case of mass surveillance hides nuances that the official version prefers to overlook.

Intercepting is not decrypting

The first technical fact is obvious: nobody has broken Signal's encryption. What has been intercepted are screenshots, trojans or internal leaks. The difference is no small matter: if the encryption were vulnerable, we would be facing a worldwide security hole. If it is simply a screen capture, the problem is opsec, not cryptography. And here the numbers speak for themselves: a trojan like Pegasus costs millions, but a well-placed screenshot is worth no more than a tip-off.

The geopolitics of data

Some claim the information came from the American intelligence services. The awkward question: why would they share it? The most plausible answer is that they preferred to see it in a Spanish newspaper before it ended up on social media, where control of the narrative slips out of their hands. The geopolitical calculus weighs more than technical security.

The human factor: the opsec of Spanish politicians

Where software fails, the user fails. A public official with a badly configured phone, without deleting logs or with Pegasus inside is almost a constant. The operational security (opsec) of Spain's political class has been compared, without irony, to that of Mexican drug lords who build their own darknets. If you really want to spy on someone, there is no need to break Signal: it is enough to plant a trojan or pay an informant. And that is cheaper and safer for the spy.

So what now?

The leak leaves more questions than answers. Signal remains technically secure as long as the device is clean and the user is not a digital disaster. But the lesson is that no encryption protects against an informer or an ambient microphone. The debate is no longer whether you are being spied on, but how and by whom.

Related discussions in the forum

• El Jueves magazine finally publishes a cover about current corruption. · 81 replies
• Three migrant boats will accompany the POPE in Tenerife. · 59 replies
• It turns out a doctor scalded a 16-month-old girl with boiling water, causing her death in Seville. · 114 replies
• The absurdity of Spain's university entrance exam · 154 replies