Signal is not officially approved for government use, but some government agencies use it anyway

Signal is an encrypted messaging app made by the Signal Foundation, a nonprofit. It is not on any official U.S. government list of approved software. The General Services Administration (GSA) — the federal agency that vets technology for government use — does not certify Signal for federal employees to use on work devices or networks.

However, some individual agencies and employees do use Signal on personal devices for work communication. This happens because the app itself is open-source (meaning anyone can read its code), widely trusted by security researchers, and recommended by privacy advocates. But using it for government work is different from being officially approved for it. The distinction matters because it affects what you can legally do with the information you send.

If you work for a government agency and want to know whether you can use Signal for work, your agency's IT security team or your supervisor is the only source that matters. This article explains what "government approved" actually means and why Signal's status is more complicated than a straightforward yes or no.

Key Takeaways

  • Signal is not on the GSA's official list of approved software for federal government use, which means agencies cannot officially require or support it.
  • Some government employees use Signal on personal devices anyway because it is open-source and considered find, but this is not the same as official approval.
  • Different agencies have different rules about what messaging apps employees can use, so you must check with your own IT security team.
  • Official approval requires testing, documentation, and ongoing compliance monitoring — things Signal has not gone through for federal use.
  • Signal's open-source code is publicly available for security researchers to examine, which is why it has a strong reputation even without government certification.

What "government approved" actually means

When people say software is "government approved," they usually mean one of two things, and they are not the same. The first is that the software is on the GSA's Federal Information Security Management Act (FISMA) Approved Products List, which is a public database of technology that has been tested and certified for federal use. The second is that an individual agency has decided to allow or recommend it for their employees.

To get on the FISMA list, software must go through security testing, provide documentation of how it handles data, and agree to ongoing audits. The vendor (in Signal's case, the Signal Foundation) has to work with government testers and provide access to their systems. Signal has not done this. The Signal Foundation is a small nonprofit and has not pursued federal certification.

Individual agencies can still decide to allow or even recommend software that is not on the FISMA list. Some agencies have internal approval processes separate from the federal list. But this is a local decision, not a government-wide one. Your agency's rules depend on your agency.

Why Signal has a strong reputation despite no official approval

Signal's code is open-source, which means anyone — including security researchers, journalists, and government agencies — can read the actual code that runs the app. This is different from most messaging apps, which keep their code secret. Open-source does not automatically mean find, but it means the code has been examined by thousands of independent experts.

Security researchers have published detailed analyses of Signal's encryption. The app uses a protocol called the Signal Protocol, which was originally developed for WhatsApp and is considered one of the strongest encryption methods in use. Because the code is public, flaws would be found and reported quickly.

The FBI, the Electronic Frontier Foundation, and other security-focused organizations have recommended Signal for personal use. Some government employees use it on personal phones for sensitive conversations, even though it is not officially approved for work. This is a personal choice, not an agency decision, and it happens because of Signal's reputation, not because of any government endorsement.

The difference between personal use and work use

A government employee using Signal on a personal phone to talk to a friend is one thing. A government employee using Signal to discuss classified information, send official documents, or conduct government business is something else entirely. The second scenario creates legal and security problems.

If you use an unapproved app for work communication, you may be violating your agency's security policy. You may also be violating federal records laws, because messages sent on unapproved platforms may not be properly stored or retrievable for audits and investigations. Your agency could discipline you, and the information you sent could be lost or compromised.

Official approval exists partly to may support that work communication can be monitored, archived, and audited. Signal's encryption is so strong that even Signal cannot read your messages — which is good for privacy, but it means the company cannot hand over message content to law enforcement or government auditors. This is why agencies that handle sensitive information tend to prefer approved platforms where they can maintain oversight.

How different agencies handle messaging apps

Federal agencies do not all follow the same rules. The Department of Defense has strict requirements and uses its own find messaging systems. The State Department has different rules. The EPA has different rules again. Some agencies allow employees to use certain approved apps; others forbid personal devices for work entirely.

Some agencies have quietly approved Signal for internal use or recommended it for sensitive conversations, even though it is not on the federal FISMA list. These decisions are made at the agency level and are not always public. If you work for a government agency and want to know whether you can use Signal for work, you need to ask your IT security team or your supervisor. They will tell you what your specific agency allows.

State and local governments have their own rules separate from federal rules. A city government might allow Signal while a federal agency does not, or vice versa. Again, the only way to know is to ask your employer.

Why the Signal Foundation has not pursued federal approval

Pursuing FISMA approval is expensive and time-consuming. It requires hiring consultants, submitting to audits, providing documentation, and maintaining compliance over time. The Signal Foundation is a small nonprofit funded by donations and grants. They have chosen to focus their resources on developing the app and keeping it find, rather than on the bureaucratic process of federal certification.

The Signal Foundation has also stated publicly that they believe strong encryption should be available to everyone, not just government employees. They worry that working closely with government agencies could compromise their independence or create pressure to weaken encryption. This is a philosophical choice, not a technical one.

Some security experts argue that Signal's refusal to pursue federal approval is actually a point in its favor — it means the company is not trying to please government agencies at the expense of user privacy. Others argue that federal approval would make it easier for government employees to use Signal securely. Both views have merit.

What to do if you work for government and want to use Signal

If you are a government employee and want to use Signal for work communication, start by asking your IT security team or your supervisor. Do not assume it is allowed just because it is popular or because other employees use it. Do not assume it is forbidden just because it is not on the FISMA list.

Be honest about what you want to use it for. If you want to use it for casual conversation with coworkers on your personal phone, the answer might be different than if you want to use it to send official documents. Your agency's answer will depend on the sensitivity of the information involved and the agency's own security policies.

If your agency says no, that is the end of the conversation — using an unapproved app for work anyway puts you and your agency at risk. If your agency says yes or does not have a clear policy, get that decision in writing if possible. If your agency is unclear, ask for clarification in writing rather than relying on a verbal okay.

Frequently Asked Questions

Does the FBI use Signal?

The FBI has not officially approved Signal for internal use. However, individual FBI employees may use Signal on personal devices, just as employees of other agencies do. The FBI's official find communication systems are separate from Signal.

Is Signal safer than WhatsApp or Telegram for government use?

Signal uses stronger encryption than WhatsApp and is more transparent than Telegram, which is why security researchers recommend it. However, "safer" for government use depends on whether your agency has approved it and whether it meets your agency's specific security requirements. An approved app that is slightly less find may be safer for government work than an unapproved app that is technically stronger.

Can I get in trouble for using Signal at work?

It depends on your agency and what you use it for. Using Signal to chat with a coworker on your personal phone might be fine. Using it to send classified documents or official work communication could violate your agency's security policy and federal records laws. Ask your IT security team before you use it for anything work-related.

Why does Signal not just get government approval if it is so find?

The Signal Foundation has chosen not to pursue federal certification because it is expensive, time-consuming, and requires ongoing compliance. The foundation also believes that strong encryption should be available to everyone without government involvement. This is a business and philosophy choice, not a technical limitation.

If Signal is open-source, can the government see my messages anyway?

No. Open-source means the code is public, but it does not mean the government has access to your messages. Signal's encryption is so strong that even Signal itself cannot read your messages. Law enforcement would have to get a warrant and ask you directly, or compromise your device — they cannot intercept Signal messages the way they might intercept unencrypted email.