KYIV, Ukraine — The encrypted messaging app Signal has reportedly ceased responding to inquiries from Ukrainian law enforcement regarding Russian cyber threats, a development that has raised concerns among officials in Ukraine. Serhii Demediuk, deputy secretary of Ukraine’s National Security and Defense Council, indicated that this change is inadvertently bolstering Moscow’s intelligence operations. He emphasized that Signal has become a favored tool for Russian espionage activities aimed at Ukrainian military personnel and government officials.
“With its inaction, Signal is helping Russians gather information, target our soldiers, and compromise government officials,” Demediuk stated during the Kyiv International Cyber Resilience Forum. The U.S.-based nonprofit platform, known for its strong privacy stance, has yet to address these allegations publicly and has not responded to requests for clarification.
Demediuk speculated that the shift in Signal’s engagement might be influenced by political instability in the United States, suggesting that cooperation could potentially resume in the near future. He noted that Ukraine had utilized “an official communication channel” to alert Signal about the misuse of the app by Russian actors, including phishing attacks and account takeovers aimed at Ukrainian users. Previously, Signal had been responsive to such communications, but that is no longer the case.
“This is a threat to us,” he remarked. “When a messenger we trusted and relied on fails us, it becomes a problem.” Ukraine, along with Western cybersecurity experts, has previously issued warnings about attacks orchestrated by Russia-linked threat actors via Signal. A report from Google’s security team in February highlighted that Russian state-backed hackers are increasingly targeting Signal accounts, particularly those associated with Ukrainian military and government personnel, to extract sensitive information that could support Moscow’s military objectives.
In these cyber incursions, hackers typically employ phishing messages to compromise targeted devices with spyware. Another tactic involves exploiting Signal’s legitimate “linked devices” feature, which allows simultaneous use of the app across multiple devices, thereby enabling real-time message delivery to both the victim and the attacker.
Alternative to Telegram
In light of these challenges, Ukrainians have increasingly turned to Signal as a safer alternative to Telegram, a messaging app founded by a Russian national and believed to be exploited by Russian intelligence for data collection and influence operations. Following the arrest of Telegram’s founder, Pavel Durov, in France—who has faced scrutiny for various offenses related to his platform—Demediuk noted an improvement in the app’s cooperation with law enforcement.
Earlier this month, Telegram announced updates to its terms of service, indicating that it would begin disclosing the IP addresses and phone numbers of users who violate its rules in response to valid legal requests. Despite the ongoing risks associated with Telegram, Demediuk expressed skepticism about the feasibility of blocking the app in Ukraine, stating that such a move would only serve as free advertising. Instead, he advocated for user education regarding the inherent risks of using the platform.
Ukraine has previously restricted the use of Telegram on official devices utilized by state and security officials, military personnel, and employees of critical infrastructure facilities.
U.S.-Ukraine Cooperation
The dynamics of U.S.-Ukraine cooperation have also been influenced by recent shifts in American foreign policy. The freeze on U.S. foreign aid and changes in the Trump administration’s approach to the conflict in Ukraine have notably impacted the country’s cyber and information warfare capabilities. In March, U.S. Cyber Command suspended planning for offensive cyber operations against Russia, a move aimed at fostering negotiations between the two parties. This was followed by a temporary halt in intelligence sharing with Ukraine, which was later reinstated after Kyiv agreed to a proposed 30-day ceasefire with Russia.
The foreign aid freeze has further hindered Ukraine’s counter-disinformation efforts, with international programs supported by American agencies like USAID being put on hold. Local cyber officials have described this as a “significant threat” to the operations of independent media and fact-checking organizations. In January, Meta, the parent company of Facebook and Instagram, announced changes to its content moderation policies, replacing third-party fact-checkers with a “community notes” system that empowers users to assess content accuracy.
In response to these shifts in U.S. policy, Ukraine is actively seeking new partnerships within Europe and exploring opportunities in its domestic market. “We are returning to the idea that we must always seek alternatives—for communication and information exchange,” Demediuk concluded.
