Meredith Whittaker

📣 NEW w/@udbhav-tiwari.bsky.social Mapping the technical reality & privacy/security perils of pushing AI agents into our infra
We offer palliatives, but the core issues are paradigmatic: 'agency' relies on pervasive data access + ability to act w/o explicit consent.
https://www.youtube.com/watch?v=0ANECpNdt-4

2026-01-02 11:30:53 GMT

- reply

true, but at least some of their interlocutors almost certainly 'rely on big tech' OS's, so they still need to care.

2025-12-31 16:35:15 GMT

- reply

It's true, I did think we were over time, when in fact we were not over time. But we definitely didn't storm off! We stayed around by the stage for about 15 minutes talking to nice people and answering questions. Then we hung out until late, and again the next day. Hope that helps!

2025-12-25 14:14:42 GMT

Merry Christmas! May you enjoy the cinnamon nutmeg season as much as I do, with all the peace, major chord progressions, warm drinks, butterfat and sparkling this and that, whatever you believe, however work it ❤️🎄
🎁 here's a great album to get your day going https://www.youtube.com/results?search_query=oscar+peterson+live+in+tokyo+1862

2025-11-13 17:38:22 GMT

- reply

Eastern. Daylight. Time.

2025-11-13 15:27:08 GMT

Looking for a convivial convo w me & Michael Moynihan covering everything from Snowden to Babbage to why Michael actually cares about privacy to our impoverished def of "AI" and the need to expand it?
👉 7pm EDT tonight, Nov 13th, streaming + archived thereafter: https://www.youtube.com/live/ZYNJ0zpFvqA?si=f1puMnhjVgczJMp0

2025-11-11 18:27:29 GMT

- reply

Thank you! I appreciate your flagging this.

2025-11-11 18:18:30 GMT

- reply

And finally finally, here's a resources you can share and reference with more about how to detect, and protect yourself from scammers and abusers: https://support.signal.org/hc/en-us/articles/9932566320410-Staying-Safe-from-Phishing-Scams-and-Impersonation

2025-11-11 18:15:14 GMT

- reply

Finally, to help you determine the fake and malicious from the genuine, we have signposts (support.signal.org/hc/en-us/art...) in the application that can aid you in identifying fakers and phishing attempts.
We also have tools like Registration Lock to help protect against account takeovers. 6/

2025-11-11 18:15:05 GMT

- reply

If you do receive a message you think is suspicious, report it as Spam and block the sender so that they cannot contact you again. AKA basic comms hygiene to preserve your peace. 5/

2025-11-11 18:14:55 GMT

- reply

Contact with Signal (support.signal.org/hc/en-us/art...) or any Signal representative will ONLY come from an
@signal.org
email address, not from within the app.
And again, we will never ask for your PIN or verification code. And we do not reach out proactively, only in response to your requests.4/

2025-11-11 18:14:44 GMT

- reply

To be crystal clear: Signal will NEVER message you this way. Ever.
And just like with your bank details or passwords, NEVER EVER share your Signal verification code (SMS/Call) or PIN with anyone. Ever. 3/

2025-11-11 18:14:28 GMT

- reply

Right now we're hearing about increased phishing attempts that go like this:
Attackers pretend to be Signal or Signal Support, then message people and try to get them to hand over their verification code or Signal PIN. Information that can let the attacker take over the victim's Signal account. 2/

2025-11-11 18:14:17 GMT

PSA: tips to protect yourself from scams on Signal.
Every major comms platform has to contend w phishing, impersonation, & scams. Sadly.
Signal is major, and as we've grown we've heard about more of these attacks--scammy people pretending to be something or someone to trick and abuse others. 1/

2025-10-27 12:06:36 GMT

- reply

Decentralization at the level of protocol--in Mastodon's case via ActivityPub--does not mean decentralization at the level of infrastructural dependence.

2025-10-27 12:01:18 GMT

- reply

I'm sorry if it landed harsh.
First, I don't think not knowing things is inherently bad or shameful--it's where learning starts, etc. Second, there's a misunderstanding here, whoever is expressing it: decentralization at the level of a protocol--ActivityPub or w/e else--is NOT the same thing as decentralization of infra. People running mastodon instances, or Matrix servers, or other fedi systems, are also in most cases leasing infrastructure from hyperscalers to do so.

2025-10-27 11:58:37 GMT

- reply

No, because no modern and useful comms platform provides only text messaging. And if your platform doesn't provide normative features and functionality, people won't use it. And if they don't use it--even if you do--you can't use it either. The network effect rules communications effectiveness.

2025-10-27 11:26:47 GMT

- reply

We use multiple cloud providers, yes.

2025-10-27 10:55:56 GMT

- reply

I don't think you have a clear understanding of this space, but I hope you have a good time digging in and learning more.

2025-10-27 10:49:12 GMT

- reply

I don't think you have a clear understanding of what you're talking about, and it might be fun for you to look a bit more deeply into how TOR works and its dependencies.

2025-10-27 10:42:04 GMT

- reply

To conclude: my silver lining hope is that AWS going down can be a learning moment, in which the risks of concentrating the nervous system of our world in the hands of a few players become very clear. And that this can help us craft ways of undoing this concentration and creating real choice ❤️ 13/

2025-10-27 10:41:55 GMT

- reply

So, Signal does what we can to provide a service w integrity in the concentrated ecosystem we're working in. We protect your comms w end-to-end encryption, so that we can use AWS and others as a highway across which to send Signal data in ways that don’t let AWS, or anyone else, gain access. 12/

2025-10-27 10:41:46 GMT

- reply

In short, the problem here is not that Signal ‘chose’ to run on AWS. The problem is the concentration of power in the infrastructure space that means there isn’t really another choice: the entire stack, practically speaking, is owned by 3-4 players. 11/

2025-10-27 10:41:37 GMT

- reply

o, yes, Signal runs on AWS. It also runs on your phone, which runs on iOS (Apple) or Android (Google). And on Dekstop, via Windows (Microsoft). Each of these presents similar dependencies on large entrenched tech companies, and concomitant barriers and risks. 10/

2025-10-27 10:41:29 GMT

- reply

But even if Signal had the billions needed to recreate AWS, it’s not just about money. The talent to run these systems is rare & concentrated. The expertise, the tooling, the playbooks, the very language of modern SRE came out of these hyperscalers, and is now synonymous with 'the cloud.' 9/

2025-10-27 10:41:21 GMT

- reply

Meaning that infrastructure like AWS is not something that Signal, or almost anyone else, could afford to just “spin up.” Which is why nearly everyone that manages a real-time service–from Signal, to X, to Palantir, to Mastodon–rely at least in part on services provisioned by these companies. 8/

2025-10-27 10:41:13 GMT

- reply

Such infrastructure costs billions and billions of dollars to provision and maintain, and it’s highly depreciable. In the case of the hyperscalers, the staggering cost is cross-subsidized by other businesses–themselves also massive platforms with significant lockin. 7/

2025-10-27 10:41:02 GMT

- reply

This isn't ‘'renting a server.' It's leasing access to a whole sprawling, capital-intensive, technically-capable system that must be just as available in Cairo as in Capetown, just as functional in Bangkok as Berlin. Particularly given the high stakes use cases of many who rely on Signal. 6/

2025-10-27 10:40:52 GMT

- reply

Instant messaging demands near-zero latency. Voice and video in particular require complex global signaling & regional relays to manage jitter and packet loss. These are things that AWS, Azure, and GCP provide at global scale that, practically speaking, others (in the western context) don’t. 5/

2025-10-27 10:40:43 GMT

- reply

Running a low-latency platform for instant comms capable of carrying millions of concurrent audio/video calls requires a pre-built, planet-spanning network of compute, storage and edge presence that requires constant maintenance, significant electricity and persistent attention and monitoring. 4/

2025-10-27 10:40:29 GMT

- reply

The question isn’t "why does Signal use AWS?" It’s to look at the infrastructural requirements of any global, real-time, mass comms platform and ask how it is that we got to a place where there’s no realistic alternative to AWS and the other hyperscalers. 3/

2025-10-27 10:40:18 GMT

- reply

Concerning, bc it indicates that the extent of the concentration of power in the hands of a few hyperscalers is way less widely understood than I’d assumed. Which bodes poorly for our ability to craft reality-based strategies capable of contesting this concentration & solving the real problem. 2/

2025-10-27 10:40:08 GMT

📣THREAD: It’s surprising to me that so many people were surprised to learn that Signal runs partly on AWS (something we can do because we use encryption to make sure no one but you–not AWS, not Signal, not anyone–can access your comms).
It’s also concerning. 1/

2025-10-20 09:15:20 GMT

- reply

status.signal.org is updated.

2025-10-20 09:14:58 GMT

- reply

as always.

2025-10-20 08:20:37 GMT

- reply

we don't.

2025-10-20 08:18:37 GMT

- reply

2025-10-20 08:00:15 GMT

PSA: we're aware that Signal is down for some people. This appears to be related to a major AWS outage. Stand by.

2025-10-20 07:59:43 GMT

- reply

thanks for the advice

2025-10-16 14:53:01 GMT

LOL all morning picturing some finance quant slouched at his desk prompting Dalle, like, "make me a picture of pikachu having sex with the Apple logo" or whatever tf those guys use these things for, then throwing up his hands like "WHY WON'T THIS FIND ALPHA?!"
https://www.bloomberg.com/news/articles/2025-10-15/ken-griffin-says-genai-fails-to-help-hedge-funds-produce-alpha
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/115/384/407/937/692/325/original/42b667a09508e273.png

2025-10-09 11:43:51 GMT

- reply

So we remain vigilant & deeply grateful to our allies.
For Signal, Chat Control is an existential threat. If we were *forced* to choose between building surveillance into our services or keeping our integrity, we would choose integrity & leave the market. We hope it never comes to this. 7/

2025-10-09 11:43:41 GMT

- reply

The technical consensus is clear: you can't create a backdoor that only lets the "good guys" in. However they're dressed up, these proposals create cybersecurity loopholes that hackers and hostile nations are eagerly waiting to exploit. 6/

2025-10-09 11:43:31 GMT

- reply

The reality is that scanning any content before it is encrypted negates the very purpose of encryption and is a dangerous backdoor. No amount of tinkering or word games can change that inescapable reality. 5/

2025-10-09 11:43:22 GMT

- reply

We must be wary of "new" proposals that allow scanning of "known content" while claiming to protect privacy by proscribing "indiscriminate" surveillance. We must also look out for those that mandate only scanning for “hashed images or videos.” 4/

2025-10-09 11:43:13 GMT

- reply

The war is not over, however. Now we move to the European Council, where the issue is unresolved. We expect closed-door negotiations to engage in rhetorical arbitrage--claiming to support privacy by using word games and bespoke definitions--while in practice undermining it. Tedious and dangerous 3/

2025-10-09 11:42:57 GMT

- reply

Defending privacy isn't easy. Those in power always want more access +more info. It's especially hard when emotionally charged args are used to advance surveillance
❤️ to those doing the work!
https://social.bau-ha.us/@CCC
https://d-64.social/@d64eV
https://mastodon.social/@chatcontrol
And many others <3 2/

2025-10-09 11:42:00 GMT

We're so relieved to see Germany reaffirm its opposition to the dangerous Chat Control proposal--the one that would mandate mass scanning of communications.
Germany's long been a solid champion of privacy, and the news that it was considering backing mass surveillance was alarming. 1/

2025-10-06 07:12:01 GMT

📣 Germany's close to reversing its opposition to mass surveillance & private message scanning, & backing the Chat Control bill. This could end private comms-& Signal-in the EU.
Time's short and they're counting on obscurity: please let German politicians know how horrifying their reversal would be.
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/115/325/969/160/391/750/original/2c653bbe34e65965.png
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/115/325/969/172/169/700/original/e041bcfcab8a52c7.png

2025-09-22 13:07:24 GMT

- reply

TY for this post. Of course, it's important that meek prescriptions don't substitute for complete treatment of big problems. Here, or elsewhere.
Which is why I was careful to frame these remedies as "the minimum necessary" that must accompanied by other, more fundamental changes
Why did I focus on these minimal changes? Because there's a word limit AND for Signal this isn't a thought exercise. These changes are needed NOW or Signal ceases to be able to function

2025-09-09 17:39:18 GMT

- reply

Here's a free link: https://archive.is/2025.09.09-134109/https://www.economist.com/by-invitation/2025/09/09/ai-agents-are-coming-for-your-privacy-warns-meredith-whittaker

2025-09-09 11:49:55 GMT

📣 NEW -- In The Economist, discussing the privacy perils of AI agents and what AI companies and operating systems need to do--NOW--to protect Signal and much else!
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/115/174/179/299/509/965/original/c07b002e61be0789.png
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/115/174/182/449/412/106/original/7c6fee416d0042d9.png

2025-08-11 16:00:21 GMT

New Sunday Times profile in which I succeed, like a fencer in a 2hr marathon match, in fending off Qs abt my personal life & consistently turning focus back to my work & ideas.
(Contra the interviewer's claim, many ppl do know me! They're called friends, & you know who you are ❤️)
https://archive.is/BtZD0
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/115/010/961/492/550/501/original/6b4b655169714bc5.png

2025-08-03 08:38:21 GMT

- reply

here it is https://www.politico.com/newsletters/digital-future-daily/2023/12/01/5-questions-for-meredith-whittaker-00129677

2025-07-30 13:57:22 GMT

- reply

2025-07-11 18:26:18 GMT

- reply

No worries! This means that we, at Signal--the ones developing the app--should be able to opt-out as Signal. To say, "no data access for you, Agentic AI." Instead of leaving that to each person who uses Signal (which invites the issues you rightly name--the fact that one person ultimately makes that choice for more than themselves, in a way that could still compromise their interlocutors' privacy).

2025-07-11 18:23:14 GMT

- reply

this is why we're calling for developer-level opt outs, among other things. Not just per-user consent/opt-in.

2025-07-11 17:44:02 GMT

Yes, I did sound the alarm on agentic AI's privacy threat, and rightly so.
https://observer.com/2025/07/signal-meredith-whittaker-agentic-ai-risk/

2025-07-02 11:09:01 GMT

- reply

Nope :)

2025-07-02 10:59:39 GMT

So happy to be joining Burda Media's board of directors! I love a steep learning curve, and this one--schooling up on media business models & opportunities to (re)shape media's relationship to tech--couldn't be more exciting & consequential. Thrilled to contribute ❤️
https://www.burda.com/en/news/meredith-whittaker-joins-burdas-board-directors/

2025-07-01 15:00:30 GMT

- reply

It's going to be recorded <3

2025-07-01 14:36:57 GMT

- reply

Not anymore!

2025-07-01 14:36:10 GMT

How to be classy, how to be cute, how to actually walk the walk...
Love you for this [@cloudflare](https://cloudflare.social/@cloudflare ) ❤️
www.nytimes.com/2025/07/01/t...

2025-06-30 13:00:26 GMT

A big humble thank you to [@time](https://flipboard.com/@time ) and @npub1muz…n2nn for featuring Signal and me in your roundup of 2025’s most influential companies. An honor to serve alongside an incredible group of people backed by a rad movement ❤️
https://time.com/collections/time100-companies-2025/7289620/signal/

2025-06-25 14:32:56 GMT

- reply

Hi, yes, we're aware. We did this to address Microsoft's privacy invasion, and wish we had better tools available. See more: https://signal.org/blog/signal-doesnt-recall/

2025-06-25 14:31:03 GMT

- reply

I didn't.

2025-06-19 08:11:24 GMT

- reply

for telling your investors "we integrated AI"

2025-06-19 08:06:20 GMT

- reply

Source: https://www.theguardian.com/technology/2025/jun/18/whatsapp-ai-helper-mistakenly-shares-users-number

2025-06-19 08:01:02 GMT

'Meredith,' some guys ask, 'why won't you shove AI into Signal?'
Because we love privacy, and we love you, and this shit is predictable and unacceptable. Use Signal ❤️
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/114/708/972/829/166/537/original/16c1b7d0b90a66fe.png

2025-06-16 15:28:59 GMT

Use Signal. We promise, no AI clutter, and no surveillance ads, whatever the rest of the industry does. <3
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/114/693/745/217/544/725/original/7dbefe76d0d3e3e2.png

2025-06-09 11:46:49 GMT

- reply

Here's our approach https://signal.org/blog/signal-doesnt-recall/

2025-06-03 13:53:15 GMT

- reply

I will! That would be great

2025-06-03 13:52:32 GMT

Happy pride month! Especially to my trans friends <3

2025-05-28 09:39:26 GMT

📣 Tomorrow, Sat May 29, Nuits sonores, Lyon France!
I'm coming dance, I'm coming to party, I'm coming to eat, but first I'm sitting down to talk about tech, privacy, Signal, and what it takes to make a world worth living in <3
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/114/584/788/032/698/666/original/ff0b4bb1a2fa5432.png
https://s3.eu-central-2.wasabisys.com/mastodonworld/media_attachments/files/114/584/788/660/729/218/original/9ff16c8141660d5f.png

2025-05-21 17:00:05 GMT

📣 The rushed integration of AI into everything is a major threat to privacy, as we've been saying.
Microsoft Recall is a great (not great!) example of exactly why--it screenshots everything on your desktop, to give AI the data to tell you...what you were doing on desktop.
So, Signal took steps to protect you and everyone using Signal on Windows 11 from Recall's hunger for (Signal) data.
Read more about how we navigated, and why we need to ecosystem to a lot more 👇
https://signal.org/blog/signal-doesnt-recall/

2025-05-21 08:42:34 GMT

- reply

It's been busy and I haven't been on most of my accounts in a moment but here, proof of life.

2025-05-21 08:42:02 GMT

- reply

Almost... Thank you for being patient!

2025-05-21 08:41:44 GMT

- reply

I'm close to publishing, way behind schedule but hopefully soon!

2025-03-14 11:53:11 GMT

- reply

We don't officially work with any gov, Ukraine or otherwise, and we never stopped. We're not sure where this came from or why.

2025-03-11 07:55:24 GMT

FULL KEYNOTE -- me + Guy K at SXSW on why privacy is a fundamental guarantor of a gorgeous, good life (not an absence, not a vacuum, not abstract). And how AI threatens privacy. And why Signal is so special and why you should use & love & support it ❤️
https://www.youtube.com/watch?v=AyH7zoP-JOg

2025-03-09 14:03:28 GMT

I did. Because it does.
https://techcrunch.com/2025/03/07/signal-president-meredith-whittaker-calls-out-agentic-ai-as-having-profound-security-and-privacy-issues/

2025-02-26 13:08:16 GMT

- reply

Oh my goodness. I haven't revisited this in so long...

2025-02-18 12:48:37 GMT

- reply

We're loud when there's talk of breaking encryption and undermining the robust privacy guarantees that those who rely on Signal require. We've been more than clear on our position there.

2025-02-07 07:01:50 GMT

- reply

WA would need to meet our v high privacy/security bar

2025-02-06 20:22:18 GMT

- reply

We will never weaken encryption, add a backdoor, bow or scrape, etc. We would rather shut down or leave a market. Our position does not change based on jurisdiction.

2025-01-26 10:36:39 GMT

- reply

I won't be at fosdem but I hope those who are have a great time

2025-01-25 10:42:58 GMT

- reply

we certainly want to understand how Signal can be a comfortable place that works for everyone. I suggest [email protected] or our community forum. The team that reads our support@ emails are real, wonderful people who work full-time for Signal and help us understand what's working and what we can fix (bc we don't collect analytics, etc.). Ocf we can't address everything, and there are often deep reasons why a change isn't possible in a privacy preserving way. But we want to know!

2025-01-16 19:29:56 GMT

- reply

Also interested in the answer to this question

2025-01-12 11:15:25 GMT

- reply

Thanks for flagging this! And this sounds really frustrating. I'll flag this for our product and dev teams.

2025-01-11 17:16:43 GMT

- reply

I'll be publishing the text with a bibliography soon (when I finish cleaning up the document)

2025-01-09 16:57:32 GMT

- reply

Basically, I'm calling for this https://www.wired.com/story/the-beginning-of-the-end-of-big-tech/

2025-01-09 14:13:46 GMT

Not lost on me that it's nonprofit tech, https://app.watchduty.org, showing up & actually working in the midst of the LA fires (donate to them!)
Meanwhile platforms fail to surface key news, vital info is paywalled...
As I've been saying, we need a new tech paradigm, yesterday!

2025-01-08 17:22:27 GMT

- reply

I am still working on cleaning it up and getting the bibliography in order, but should be out in the next few weeks, published in partnership with CCC. I'll post when it's out there!

2025-01-08 17:18:27 GMT

- reply

thanks for being there!

2025-01-08 16:53:50 GMT

- reply

Thank you for watching and engaging <3

2025-01-06 23:40:56 GMT

This is desperate product manager trying to ship something to meet a company OKR they don't understand and don't believe in coded
https://www.404media.co/instagram-begins-randomly-showing-users-ai-generated-images-of-themselves/

2025-01-06 10:39:41 GMT

- reply

this is really beautiful. Thank you for taking the time to write it!

2025-01-03 14:11:04 GMT

- reply

Arguably fake users making fake content we click on, that clicks on us, is fraudulent traffic. And allegations of funny accounting, boring on/constituting fraud have been leveled at Meta for years. Since Meta owns the 'data' and the process of creating it, with almost no accountability, it's not clear to me that this is a bright line that won't be (hasn't already been) crossed.