Leggi in ItalianoI was thinking today on the security of digital communications, starting with Signal, a messaging application that I find particularly interesting because of its apparently robust cryptographic architecture and its open-source nature. Its source code is publicly available and can be independently examined, which provides an important degree of assurance. But how far can we really trust the security of a communications system?
Anyone familiar with the history of Operation Rubicon will understand why this is not an unreasonable question. For decades, the CIA and Germany’s Federal Intelligence Service (BND) secretly controlled the Swiss company Crypto AG, which sold encryption equipment to governments around the world. These devices, apparently designed to protect confidential communications, had been deliberately weakened to allow foreign intelligence agencies to access the communications of numerous states.
Of course, there is no evidence whatsoever to suggest that anything comparable has occurred with Signal. On the contrary, its use of publicly documented cryptographic protocols, open-source code, and the possibility, at least for certain versions, of independently verifying that the distributed software corresponds to the published source code are significant safeguards.
Nevertheless, a fundamental problem remains. End-to-end encryption protects communications during transmission, but it cannot, by itself, prevent a deliberately modified application from accessing messages before encryption or after decryption. The security of a messaging system therefore depends not only on the strength of its cryptographic algorithms but also on the integrity of the software running on users’ devices and on the mechanisms governing its development and distribution.
This brings me to a question I have been asking myself for some time: why doesn’t the Italian public administration already have a nationally controlled, secure messaging system whose use is mandatory for institutional communications?
From a technical perspective, developing such a system does not require reinventing the wheel. Open protocols, well-established cryptographic technologies, and mature software solutions already exist and could be adapted to the requirements of public institutions. Maintaining a secure infrastructure, ensuring independent auditing, managing updates, and guaranteeing operational continuity are certainly demanding tasks. But this is hardly an insurmountable technological challenge.
Other European countries have already taken important steps in this direction.
France has developed Tchap, a secure messaging service for public-sector employees, operated by the Direction interministérielle du numérique (DINUM) and based on the open-source Matrix protocol. In July 2025, the French government formally established Tchap as the secure instant messaging solution for state employees. According to official figures published in July 2026, the service had already reached more than 400,000 active public-sector users.
Germany has developed BundesMessenger, building on the experience of the German armed forces and their BwMessenger platform. It also relies on the Matrix protocol and open-source technologies, allowing public authorities to retain control over their communications infrastructure. The first version for public administration was released in 2023, and the system entered operational use in 2024.
And what about Italy?
There has finally been some progress. On 4 April 2025, the Italian National Cybersecurity Agency (ACN) and the Istituto Poligrafico e Zecca dello Stato announced a cooperation agreement that included the development of a national secure messaging platform for public administration.
The ACN’s Annual Report for 2025, published in 2026, confirms that the project’s initial phase was completed. This included identifying requirements, examining existing solutions, evaluating prototypes, and conducting a feasibility study. However, the available institutional documentation does not yet establish that the system has been deployed on a general basis across the Italian public administration.
The question, therefore, seems increasingly political and organisational rather than purely technological. Once an appropriate system is available, why should its use not become mandatory for official communications within public administrations?
Naturally, special arrangements would remain necessary for classified information, which requires dedicated and appropriately accredited systems.
There is, however, another important consideration. A messaging platform operated by the Italian state would not automatically be more secure than Signal or other independently developed solutions. The history of Operation Rubicon teaches us precisely this: the problem is not simply who controls the technology, but who controls those who control it.
A national institutional messaging platform should therefore rely on open-source software, independent security audits, verifiable updates, transparent governance, and technical safeguards preventing arbitrary access to communications, including by the public authority operating the service.
Ultimately, the point is not to create an Italian version of Signal. It is to ensure that the state has access to secure, independently verifiable communication tools, operated within a governance framework that guarantees their integrity and accountability.
And, above all, once such tools have been developed, to ensure that public institutions actually use them.
Because national security should not depend solely on individual preferences when choosing a messaging application.
Sources and further reading
- Operation Rubicon and Crypto AG. Greg Miller, The Intelligence Coup of the Century, The Washington Post, 11 February 2020. Read the investigation.
- Signal’s open-source architecture. Signal’s official GitHub repositories and Moxie Marlinspike, Reproducible Signal Builds for Android, 31 March 2016. Read the technical explanation.
- France – Tchap. Direction interministérielle du numérique (DINUM), Retour d’expérience et apprentissages sur la contribution de la DINUM à la Fondation Matrix, 27 July 2026. The document describes the July 2025 government circular, Tchap’s adoption, and its more than 400,000 active users. Official French government publication.
- Germany – BundesMessenger. BWI GmbH, BundesMessenger: Security, Transparency and Responsibility. Official documentation describing the development and operational deployment of the platform. BundesMessenger – History and governance.
- Italy – ACN/IPZS cooperation agreement. Agenzia per la Cybersicurezza Nazionale, Firmata la convenzione tra ACN e IPZS, 4 April 2025. Official announcement.
- Italy – Progress of the national secure messaging project. Agenzia per la Cybersicurezza Nazionale, Relazione annuale al Parlamento 2025, published in 2026, p. 71, section 5.1, Programmi per la Pubblica Amministrazione. ACN Annual Report 2025.
