Signal President Meredith Whittaker: 10 Years of Encryption, Why AI and Surveillance Are Inseparable, and Building an Alternative to Big Tech
A decade ago, WIRED ran a story about a quiet industry shift: two little-known, rough-around-the-edges encryption tools, RedPhone and TextSecure, were merging to launch a new project called Signal. Since that July 2014 launch, Signal has evolved from a niche cypherpunk curiosity—built by an anarchist coder, run by a scrappy small team crammed into a single San Francisco office, spread by word-of-mouth among privacy-obsessed hackers—to a full-fledged, mainstream encrypted communication giant. Hundreds of millions of people have downloaded the app to date; even Drake name-checked it in his 2022 track Major Distribution, rapping: “Text me on the Signal, don’t call me.” Billions more rely on Signal’s open-source encryption protocols every day, built into major platforms like WhatsApp.
That underdog origin story reads like a classic startup cliché, but Signal defies nearly every Silicon Valley norm. It is a donation-funded nonprofit, has never accepted venture capital, offers its full service for free, runs no ads, and collects almost zero user data—all while competing directly with tech giants and winning. At a moment when Elon Musk has proven that nearly no privately owned communication platform is immune to the whims of a single wealthy owner, Signal stands as a counterexample: proof that venture capitalism, surveillance capitalism, even capitalism itself, are not the only paths forward for tech.
Over its 10-year history, no Signal leader has embodied this anti-establishment identity as publicly as Meredith Whittaker. Signal’s president since 2022, Whittaker is one of the tech industry’s most prominent critics: during her time at Google, she led mass walkouts protesting the company’s discriminatory employment practices and spoke out against its military contracts. She co-founded the AI Now Institute to examine AI’s ethical risks, and has become a leading voice arguing that artificial intelligence and mass surveillance are inherently intertwined. Since taking the helm at the Signal Foundation, her core mission has been to secure long-term, independent funding to keep Signal viable for decades—with zero compromises and no corporate entanglements—so it can serve as a blueprint for an entirely new kind of tech ecosystem.
Whittaker was based in Paris for the summer of 2024, but I caught up with her during a quick trip back to her home city of New York. Sitting in a Brooklyn café, we dug into a topic the outspoken privacy executive rarely discusses publicly: her own unusual path from Google manager to Silicon Valley’s most prominent gadfly. The full, edited interview is below.
Andy Greenberg: Is it okay to mention here that we planned to talk on Signal’s actual 10th anniversary, but had to reschedule after you were hospitalized for food poisoning?
Meredith Whittaker: Yeah, that’s totally fine.
AG: Okay. You’re not exactly a privacy pioneer in the same vein as Signal co-founders Moxie Marlinspike or Brian Acton…
MW: Well, for one thing, I’m a woman.
AG: That’s true! But also, neither of them would ever let me bring up something that personal in print. They’re far more guarded about their public personas. It feels like you’re a very different kind of leader for Signal.
MW: Our core beliefs overlap a lot. We all share a clear analysis of surveillance capitalism and the danger of mass surveillance in the hands of powerful actors. But when it comes to guarding my personal life: I am a private person. There’s very little personal information about me online, because I’ve had an instinct since I was young not to overshare. But that comes from a long-standing habit and an understanding of the risks, not some ideological requirement for purity.
AG: You’re also far more visible publicly than anyone who has ever led Signal.
MW: That’s true. But Signal is in a completely different phase right now, too.
AG: How so?
MW: To start, Signal launched 10 years ago as a brilliant hacker project pushing back against a dominant business model that almost everyone celebrated back then.
AG: What model is that?
MW: Surveillance. The surveillance business model.
AG: Right. And what phase is Signal in now?
MW: Now Signal is established critical infrastructure. It’s used by dissidents, journalists, militaries, CEOs, anyone who needs to share private, confidential information. So we’re in a different place now where we need to be out front. We can’t let other people tell our story for us. It’s time to define who we are ourselves.
AG: Before we get into that, let’s back up: you spent this summer in Paris. Why Europe, why France? Is that a personal choice, or a Signal choice?
MW: It’s a Signal choice. We’re focusing on growing our presence in the EU, expanding our user base, and exploring potential partnerships. I think any responsible tech company right now needs to plan for flexibility, given how volatile the global geopolitical environment is right now.
AG: Are you talking about planning an exit route, in case of a second Trump administration?
MW: It’s bigger than that. There are a lot of different possible futures on the table right now.
AG: Let me put it another way: the US has a presidential election coming up. Are you planning for a new administration—whether Democrat or Republican—and the possibility that Signal may need a new base?
MW: I’ll just say this: we’re always aware of shifting political tides. Since governments in the US and around the world have not always been friendly to encryption, we’re actively planning for jurisdictional flexibility. That’s no secret.
AG: Does Pavel Durov’s recent arrest in France give you pause about building that flexibility in the EU? Does it make sense to look to Europe when the Telegram founder was just arrested there?
MW: First off, Telegram and Signal are completely different apps with completely different purposes. Telegram is a social media app that lets one person reach millions of followers at once, and it doesn’t offer meaningful privacy or default end-to-end encryption. Signal is exclusively a private, secure communications tool with no social media features at all. We’re talking about two entirely different things.
And as of today [August 27, 2024], there are still too many unanswered questions and too little concrete information about the specific reasons for Durov’s arrest for me to give an informed comment. On the broader question: let’s be honest, no country on earth has a perfect record on encryption. But there are also champions of private communication and free expression everywhere, including in the French government and across Europe. Those of us who have fought for privacy for decades know this is an ongoing battle, with allies and opponents in every place. Prioritizing flexibility isn’t the same as putting one jurisdiction on a pedestal. We’re clear-eyed about the challenges we face no matter where we operate, and we see a huge amount of support and opportunity in Europe.
Even within Europe, there are big differences between countries: Germany is considering a law that would require end-to-end encryption, while Spain has led the charge to weaken it. It’s not a monolith.
AG: What does the upcoming US election mean for Signal’s operations and growth?
MW: We’ve seen consistent upward growth no matter what. Public awareness of privacy risks has never been higher, and political volatility always drives more people to join. Ukraine used to be one of our smallest markets, but it’s now one of our top five after Russia’s invasion. That’s just one example. We also get growth spurred by what we call Big Tech fuckups: when WhatsApp changed its terms of service a few years back, we got a flood of new users. After Zoom announced it would scan all user calls for AI training, we saw a huge jump in desktop downloads. We expect more of that.
We also get big surges when major institutions mandate Signal. In 2020, the European Commission endorsed Signal as the only messaging app they recommended for all members. That led to an entire organization switching over at once. Elections can be moments that drive that kind of shift. But more often than not, our job isn’t to predict those moments—it’s to be ready for them. It feels like 40 years of history is unfolding every other week right now.
AG: Going back to your point about Signal entering a new phase: what will be different for Signal at this stage? Are you focused on getting to a billion users, the same goal most Silicon Valley firms chase?
MW: I mean… yes. But not for the same reasons. For almost the opposite reasons, actually.
AG: That tracks. I don’t think anyone at Signal has ever as openly emphasized that Signal is the opposite of every other big tech platform—the only major communications app that’s not a for-profit business.
MW: We don’t have a rigid party line at Signal, but I think we should be proud of who we are and make sure users understand the real differences that matter to them. It’s not nothing that WhatsApp spends millions of dollars on billboards advertising itself as private, when the core privacy infrastructure they use is the Signal protocol that we built.
We’re glad WhatsApp integrated our protocol, don’t get me wrong. But let’s be real: it’s no accident that WhatsApp and Apple spend billions of dollars marketing themselves as privacy-focused. Privacy is incredibly valuable to users. And who is the gold standard for privacy? That’s Signal.
I think people need to reframe how they see the tech industry: understand that surveillance is core to its entire business model, then see how Signal stands apart, and recognize that we need to expand the space for this alternative model to grow. Having 70 percent of the global cloud market controlled by just three companies is simply not safe. Look at what happened when Microsoft and CrowdStrike took down half the world’s critical infrastructure, all because CrowdStrike cut corners on quality assurance for a goddamn kernel update. Are you kidding me? That’s completely insane when you think about who’s trusted to steward these critical systems.
AG: So your main focus is preserving Signal’s current role as an alternative?
MW: Preserving and growing. This isn’t some stagnant museum piece. It’s a growing project that’s poised to double, then triple in size. Our user base has grown steadily for years, and I think that growth will keep going as geopolitical volatility continues and a new generation grows up more aware of the risks of letting Big Tech control critical infrastructure.
My job is to make sure Signal has the space to grow, and to line up the people who need to pay attention, who need to contribute, who need to get behind this vision to make it happen.
AG: As Signal has gone mainstream, what about the original hacker community that was its first core audience? I talk to a lot of hackers who now say “Signal is done, it has a backdoor, intelligence agencies cracked it, you should use my obscure, ultra-secure alternative instead.” How do you respond to that, and how do you deal with constantly having to prove a negative—that there’s no backdoor or hidden vulnerability?
MW: I’d push back that this is some widespread stylish view among hackers. Overall, we have a great relationship with the security research community, and we work closely with them. What you’re describing is just a small number of loud, immature so-called “security researchers” (that’s in quotes). That kind of discourse is really disappointing to me, it shows a total abdication of responsibility.
What makes me really frustrated is when this overclaiming, selfish fame-seeking lines up with state actors that want to move people away from private communication onto less secure platforms. We have desperate civil society groups, human rights organizations, journalists calling us immediately after one of these claims goes viral, panicking that Signal is unsafe and saying they’re moving their entire teams to some alternative that’s actually far less secure.
There are real, existential stakes here for people all over the world. 99 percent of those users can’t independently verify random claims from random researchers, but they take them seriously because this is a life-or-death issue for them.
AG: I think we’re talking partly about Elon Musk here. He stoked this recently when he vaguely alluded to “known vulnerabilities” in Signal in a post on X.
MW: It’s troubling to see people like Musk jump on that bandwagon. Musk was a longtime Signal supporter—he tweeted that he used Signal back in 2021, right? He was a fan. So I don’t know what changed. What I do know is that, as far as we can tell, his claim was completely baseless. There’s no credible report that backs it up. But that still cost me two nights of no sleep just dealing with the fallout on Twitter, because we had to take it seriously—it freaked out a lot of people.
AG: As Signal has gotten more mainstream, I find myself using it for totally trivial, everyday stuff: sending videos, whole albums of photos of my kids, whatever. And I always think, I’m just costing Meredith more money right now.
MW: Andy, it’s an honor. [Laughs.] It’s truly an honor to carry your photo slideshows and videos.
AG: But all that data storage and bandwidth is really expensive for a nonprofit. WhatsApp can absorb those costs because they make money off your data. Does Signal risk being the dog that caught the car—getting way more users than it can afford to support?
MW: It’s a net positive for us. Encryption relies on network effects: our whole goal is that anyone, anywhere can pick up their phone and use Signal to talk to anyone else.
We’re well-funded right now. We’re a nonprofit—not because we want to survive on loose change people throw in a hat. We’re a nonprofit because this organizational structure is the only one that lets us stay focused on our mission at this point in history. In our industry, profit comes from monetizing surveillance, or selling services to companies that do. There is no existing business model for privacy on the internet that doesn’t compromise that core mission.
Signal is a nonprofit because a for-profit structure would inevitably lead to pressure: one of my board members goes to Davos, talks to a guy, comes back and says we need a profit-generating AI strategy. Or another board member gets nervous that our revenue isn’t hitting targets and says “maybe we can start collecting metadata, maybe we can dial back our privacy focus”—because for a traditional for-profit, the primary goal is always revenue and growth. And privacy in a surveillance-driven economy will always get in the way of those goals.
Right now, we’re working to grow the Signal model into something sustainable long-term. The amount of money we need isn’t huge by tech standards—we’re actually very lean compared to most big tech operations. And we want to prove this model can work as a template that other organizations can adopt, to build alternative infrastructure and apps that push back against the concentrated surveillance business model that dominates tech today.
AG: This is a rude question, but when I looked at your 990 tax form, I saw you pay yourself less than many of your senior engineers.
MW: That’s correct. And our goal is to pay people as close to Silicon Valley market rates as possible, so we can recruit top senior talent—since we can’t offer equity. We pay our engineers very well. [Leans playfully toward the recording phone.] If anyone out there is looking for a job, we pay very, very well.
AG: It feels taboo to even talk about this, but it really highlights how unusual Signal is.
MW: Look, it highlights that we’re building a model that works in opposition to the near-hegemonic model we’re competing against. Of course it looks weird—we’re not following the norm.
AG: I don’t think most nonprofits pay engineers as well as you do.
MW: Yeah, but most critical global tech infrastructure isn’t run by a nonprofit. Name another nonprofit tech organization that ships critical real-time global communication infrastructure that works reliably every day. There isn’t one.
This isn’t a theoretical research project. We’re not sitting around dreaming of a perfect future. We have to deliver something that works right now. If our servers go down, I need an engineer who will get up in the middle of the night to fix whatever the problem is. So we have to operate like a tech company in some ways to do what we do. That makes sense.
AG: Let’s talk about your career path. You wrote in your first blog post after becoming president that you’ve been a Signal supporter from the very start, even used RedPhone and TextSecure back in the day. Is that true?
MW: It is.
AG: I tried those apps back when they launched, and they were pretty janky! I’m impressed you were using them back then.
MW: I was in tech, right? All the cool people in tech were already using them.
AG: And you were at Google at that time?
MW: Yeah, I was at Google then.
AG: Honestly, what was someone like you doing at Google back then?
MW: Have you ever heard of needing money to pay rent, Andy? [Laughs.] Have you ever lived in a society where you have to work for an employer to get money to live?
AG: Fair enough! But you’re such a vocal critic of Silicon Valley and surveillance capitalism now that it’s hard to picture…
MW: I’m not anti-tech.
AG: That’s fair. So how did you end up at Google in the first place?
MW: I have degrees in rhetoric and English literature from Berkeley. I went to art school my whole life. I wasn’t looking for a job in tech. I didn’t even care that much about tech back then, but I graduated from Berkeley and I had no money, so I needed a job. I put my resume on Monster.com—for Gen Z, that’s the old-school version of LinkedIn.
I was interviewing with publishing houses, and then Google reached out to me for a role called… what was it, consumer operations associate?
AG: Consumer operations associate?
MW: Yeah. I had no idea what that even meant. It sounded like a generic business job, so I set up a Gmail account to reply to the recruiter. Then I went through eight interviews, two weird IQ tests, and a writing test. It was a wild gauntlet.
AG: What year did you start?
MW: I started in July 2006. It turned out “consumer operations associate” just meant a temp in customer support. No one told me that. I was shocked by the whole place: why is the expensive juice free? I’d never been in an office environment like that. Back then, Google had just hit an inflection point, had a couple thousand employees, and there was this real cultural belief that they’d figured out how to