# Hegseth Signalgate (March 11–24, 2025) On **Tuesday, March 11, 2025**, National Security Adviser **[[Mike Waltz]]** created a **Signal group chat** titled "**Houthi PC small group**" — Principals Committee shorthand for the most senior national-security advisory body — to coordinate the imminent **U.S. military strikes on Houthi targets in Yemen**. The chat included **Defense Secretary [[Pete Hegseth]]**, **Vice President [[JD Vance]]**, **Director of National Intelligence [[Tulsi Gabbard]]**, **CIA Director [[John Ratcliffe]]**, **Secretary of State [[Marco Rubio]]**, **Treasury Secretary [[Scott Bessent]]**, **National Security Council Chief of Staff Brian McCormack**, and approximately a dozen other senior national-security principals. Through a **contact-saving error** at the White House — Waltz had inadvertently saved the phone number of *Atlantic* editor-in-chief **[[Jeffrey Goldberg]]** under the contact label of National Security Council spokesperson Brian Hughes; when Waltz subsequently added "Hughes" to the chat, he had in fact added Goldberg — Goldberg was **silently included as a participant** on March 13. Goldberg observed the Principals-Committee deliberation over the next two days. On **March 15, 2025 at 11:44 a.m. Eastern**, Hegseth posted a **"TEAM UPDATE"** that included **specific timing for U.S. warplane launches**, **sequencing of strikes**, the **anticipated location of the "Target Terrorist,"** and **"WHEN THE FIRST BOMBS WILL DEFINITELY DROP"** — text Goldberg subsequently characterized as **operational war plans of the type ordinarily classified at the Secret/NOFORN level**. The schedule Hegseth transmitted ran from **12:15 p.m. Eastern** — F-18 launch of the first strike package, 31 minutes after his post — through a 1:45 p.m. trigger-based strike window to **2:15 p.m.**, the point at which he wrote that the first bombs would definitely drop. Goldberg verified the chat's authenticity, exited the group, and on **Monday, March 24, 2025**, published "**The [[Trump Administration]] Accidentally Texted Me Its War Plans**" in *The Atlantic*. The Trump administration's initial response — including specific Hegseth and Trump denials that classified information had been shared — produced *The Atlantic*'s follow-up publication of the **full Signal thread** on **March 26, 2025**, including the previously withheld operational details. The episode matters for the KB as **the most consequential single operational-security breach in modern American national-security history**, and as the **clearest single demonstration that the second Trump administration's senior national-security personnel were operating outside the institutional opsec frameworks that had previously constrained executive-branch national-security deliberations**. The operational impact — that an *Atlantic* journalist had silently observed Principals-Committee-level deliberations over imminent U.S. military action — would, under any prior post-WWII administration, have produced **immediate removals of the responsible officials**, **substantial criminal-investigative response under the [[Espionage Act]]**, and **operational reconstitution of the affected national-security protocols**. The Trump administration's actual response — initial denials, subsequent partial admissions, no senior-personnel removals through March 2025, and deflection of responsibility through 2026 — produced the opposite: a **demonstration that the institutional accountability framework for opsec violations had been substantially neutralized**. The episode is, in this sense, the **operational counterpart in the national-security domain** of the [[J6 Mass Pardons]]: institutional-accountability frameworks that had operated for decades produced no operational consequence under the second Trump administration. ## Chronology The narrative below carries the detail; this is the skeleton, extended past the publication to the **personnel consequences**, which arrived nine weeks later and fell mainly on people who had not made the mistake. For the full six-phase chronology — including the second family chat, the confirmation vote, and the Inspector General's timing — see [[Signalgate Timeline]]. | Date | Event | |---|---| | 2017–2024 | [[Jeffrey Goldberg]] interviews Waltz repeatedly in his journalistic capacity; Goldberg's number ends up in Waltz's contacts | | Early–mid March 2025 | Waltz's phone saves Goldberg's number **under NSC spokesperson Brian Hughes's contact label** — later established by a White House IT forensic investigation | | **2025-03-11** | [[Mike Waltz]] creates the Signal group **"Houthi PC small group"** with [[Pete Hegseth]], [[JD Vance]], [[Tulsi Gabbard]], [[John Ratcliffe]], [[Marco Rubio]], [[Scott Bessent]], NSC chief of staff Brian McCormack and roughly a dozen others. [[Alex Wong]], the principal deputy national security adviser, is named in the chat as the official to stand up a follow-up "tiger team" | | **2025-03-13** | Waltz adds "Hughes" — and thereby adds Goldberg, silently | | 2025-03-13 → 03-15 | Goldberg observes Principals-Committee-level deliberation, including Vance's reservations and Hegseth's dismissal of them | | **2025-03-15, 11:44 a.m. ET** | Hegseth posts a "TEAM UPDATE" with launch timing, strike sequencing, the target's anticipated location, and when the first bombs would drop | | **2025-03-15, 12:15 p.m. ET** | **F-18s launch (1st strike package)** — 31 minutes after the post. Hegseth's message had laid out the full schedule: 1:45 p.m. trigger-based first strike window opens, **2:15 p.m. "THIS IS WHEN THE FIRST BOMBS WILL DEFINITELY DROP"** | | **2025-03-24** | *The Atlantic* publishes Goldberg's account, withholding the most operationally specific details. Hegseth: "Nobody was texting war plans." Trump: "I don't know anything about it" | | **2025-03-25** | Press Secretary Karoline Leavitt calls the content "not classified" and "not war plans"; Waltz says "I take full responsibility" and does not resign | | **2025-03-25** | [[Senate Armed Services Committee]] opens a bipartisan inquiry | | **2025-03-26** | *The Atlantic* publishes the **full thread**, including the withheld operational detail — the denial pattern's self-inflicted wound | | **2025-03-27** | [[Roger Wicker]] and [[Jack Reed]] jointly request a DOD [[Inspector General]] evaluation | | April 2025 | [[American Oversight]] sues under the [[Federal Records Act]] over the chat's auto-delete setting; a court orders the named officials to preserve all March 11–15 Signal messages | | **2025-04-02** | [[Laura Loomer]] meets Trump in the Oval Office with a dossier naming national-security officials as disloyal, [[Alex Wong]] among them | | **2025-04-03** | [[Timothy Haugh]] is relieved as [[NSA]] director and [[US Cyber Command]] commander; deputy director [[Wendy Noble]] removed; six NSC staffers fired. **No stated cause for any of them**. The **same day**, acting DOD IG Steven Stebbins announces the Signal evaluation | | **2025-04-20** | The *New York Times* reports a **second** Signal chat — "Defense | Team Huddle" — in which Hegseth shared March 15 strike detail with his wife, his brother, and his personal lawyer [[Tim Parlatore]] | | **2025-05-01** | Waltz and Wong both leave the NSC. Waltz is nominated **U.N. ambassador**; Wong receives nothing. **Robert Gabriel Jr.** succeeds Wong | | **2025-09-19** | The Senate confirms Waltz as **U.N. ambassador, 47–43** | | **2025-09-22** | Wong is named the first Global Chief Strategy Officer of **[[Hanwha Group]]**, the Korean defense and shipbuilding conglomerate | | **2025-12-03 → 12-04** | The **DOD Inspector General report** finds the information Hegseth posted **had been marked SECRET**, could have imperiled U.S. forces, and that he violated DoD regulation by using a personal phone — contradicting the administration's denials. It **declines to decide** whether he had declassified the material first | | Through 2026 | Hegseth remains Defense Secretary. No Espionage Act investigation is opened. [[Joshua Rudd]] is confirmed to the vacant NSA/CYBERCOM post on **2026-03-10**, eleven months after Haugh's removal | > [!note] Correction, 2026-09-10 > An earlier version of this page stated that the strikes "began approximately 35 minutes after the Hegseth post, at 12:15 p.m." That conflated the **launch** with the **strike** and misstated the interval. Per the published thread: the post was at 11:44 a.m., 12:15 p.m. was the F-18 launch of the first strike package (31 minutes later), 1:45 p.m. opened the trigger-based strike window, and 2:15 p.m. was when Hegseth wrote the first bombs would definitely drop. The operational point is unchanged and if anything sharper — the message went out **two and a half hours** before the bombs, which is exactly the window in which a leak is most dangerous. > [!note] Correction, 2026-09-21 > An earlier version of this page dated the DOD Inspector General announcement to **2025-03-26**. That conflated three separate events: *The Atlantic*'s full-thread publication (March 26), the **Wicker–Reed letter requesting** an evaluation (March 27), and the acting IG's **announcement** of the evaluation (April 3) — which fell on the same day as the Haugh and Noble removals. The chronology above now separates them. Added in the same pass: the April 20 second-chat report, the September 19 confirmation vote, and the IG report's actual findings. > [!important] Who paid > Waltz created the chat, added the journalist, said he took full responsibility, and became a U.N. ambassador. Hegseth posted the strike timing and is still Defense Secretary. The people who lost their jobs were a four-star general with no allegation against him, his career-civilian deputy, six NSC staffers, and the deputy who had been assigned to run the follow-up meeting. **Accountability did not fail to arrive — it arrived, and it arrived sideways.** ## The Founding Story ### The Pre-Signal Context The use of the commercial encrypted-messaging application **Signal** for U.S. national-security deliberations was, by 2025, substantially more common than prior administrations had permitted, but operated under specific institutional constraints. The Biden-era and earlier-administration framework had been: **Signal may be used for unclassified senior-leadership coordination but must not be used for deliberation over classified operational matters**, which were restricted to **Sensitive Compartmented Information Facilities (SCIFs)** and the secure-communications infrastructure operating under **NSA-managed encryption frameworks**. The Hegseth-Waltz Signal chat violated this institutional constraint. The operational deliberations — including U.S. military timing, target identification, force-disposition decisions — were being conducted on a **commercial application** running on **personal devices**, outside the secure-communications infrastructure of the federal government, with **no formal recordkeeping** under the Presidential Records Act, and with **automatic message deletion** enabled (a PRA compliance question that subsequent congressional investigation produced). The Signal chat's existence itself was therefore a **substantive institutional anomaly** before Goldberg was inadvertently added. The Goldberg inclusion transformed the institutional anomaly into a **substantive operational-security crisis**. ### The Contact-Saving Error (Approximately Early-to-Mid March 2025) The forensic-investigation reconstruction of how Goldberg's phone number became associated with Brian Hughes's contact label has substantially relied on the **White House information-technology office investigation** (conducted in late March 2025) and on Goldberg's subsequent characterization. The principal documented finding: > "A forensic investigation by the White House information technology office determined that Waltz had inadvertently saved Goldberg's phone number under Hughes' contact information, and Waltz then added Goldberg to the chat while trying to add Hughes." The contact-saving mechanism by which the error occurred has not been definitively established in public reporting. The leading hypothesis: Goldberg had previously contacted Waltz in his journalistic capacity (Waltz, a former Florida congressman, had been a frequent Goldberg interview subject through 2017–2024); Waltz's phone had received the message; in subsequent contact-management actions, Goldberg's number was inadvertently relabeled with Hughes's name. When Waltz subsequently typed "Hughes" into the Signal contact-search interface in March 2025, the displayed result was Goldberg's number under Hughes's label. The contact-saving error is operationally significant in establishing that the breach was **accidental rather than malicious**, but the operational implication — that a journalist had silently observed Principals-Committee deliberations over imminent military action — does not depend on the breach's intent. ### The Two-Week Silent Observation (March 13–15, 2025) Between March 13 and March 15, 2025, Goldberg observed the Principals-Committee deliberation. The content Goldberg subsequently published included: - **Strategic deliberation** over whether and when to strike Houthi targets - **Vance's position** expressing reservations about the operation's strategic logic - **Hegseth's response** dismissing the Vance reservations and pushing for operational execution - **Specific operational details** including launch timing, sequencing, and target identification - **Substantial profanity and informal tone** characteristic of the chat's commercial-application register rather than the substantive-deliberation register of formal Principals-Committee meetings Goldberg's editorial choice — to **silently observe rather than alert the participants** — was operationally consequential. The choice produced a substantive evidentiary record of the deliberation that subsequent administration denials could not credibly refute. Goldberg's characterization of his editorial choice: he initially assumed the chat was a hoax or test; only as the operational details accumulated did he conclude that the chat was authentic; by the time he had concluded authenticity, the strikes had occurred and the operational-security concern had been realized. ### The Atlantic Publication (March 24, 2025) On **Monday, March 24, 2025**, *The Atlantic* published Goldberg's account: "**The Trump Administration Accidentally Texted Me Its War Plans**" — the title that became the operational shorthand for the episode. The article included quotations from the chat but **withheld the most operationally specific details** (the exact timing, target identification, force disposition) on Goldberg's judgment that publication of those details could compromise ongoing U.S. operations. The Trump administration's response was operationally significant in its **denial pattern**: - **Hegseth (March 24, 2025):** "Nobody was texting war plans, and that's all I have to say about that." - **Trump (March 24, 2025):** "I don't know anything about it. I'm not a big fan of *The Atlantic*." - **White House Press Secretary Karoline Leavitt (March 25, 2025):** Characterized the content as "**not classified**" and "**not war plans**" - **National Security Adviser Mike Waltz (March 25, 2025):** "I take full responsibility" — but did not resign The denial pattern's operational error was that it produced *The Atlantic*'s **follow-up publication on March 26, 2025** of the **full Signal thread**, including the previously withheld operational details that the administration had characterized as "not classified." The follow-up publication established that the administration's denial pattern had been false: the withheld details were operationally specific war-plan information, and the administration's characterization of them as unclassified was inconsistent with the operational practice of how comparable information had been classified in prior administrations. ### The Subsequent Investigations The episode produced multiple parallel investigative responses: **1. [[Senate Armed Services Committee]]** (March 25 onward): Bipartisan investigation; substantial Republican-senator concern over the opsec implications. **2. DOD [[Inspector General]] evaluation** (requested by [[Roger Wicker]] and [[Jack Reed]] on **March 27, 2025**; announced by acting IG Steven Stebbins on **April 3, 2025**; report published **December 3–4, 2025**): The report, with Goldberg himself commenting publicly on NPR, found that the information Hegseth posted **had been marked SECRET**, that its disclosure could have imperiled U.S. forces had an adversary intercepted it, and that Hegseth violated DoD regulations by conducting official business on a personal phone — contradicting the administration's initial denial pattern and the sworn March 25 testimony. Hegseth **declined to be interviewed**. The report expressly **declined to determine** whether he had declassified the material before sending it, noting he held the authority to do so; the administration read that non-finding as exoneration. **3. Federal court litigation** (initiated April 2025 by [[American Oversight]]): Litigation under the [[Federal Records Act]] naming Hegseth, Gabbard, Ratcliffe, Bessent and Rubio — the last in his capacity as acting Archivist of the [[National Archives]] — over whether Signal messages are federal records and whether the chat's automatic deletion violated recordkeeping requirements. The court ordered preservation of all March 11–15 Signal communications. See also [[Presidential Records Act]]. **4. Department of Justice consideration of Espionage Act predicate**: considered but not pursued; the Trump-administration DOJ under Attorney General [[Pam Bondi]] did not initiate criminal investigation of the administration officials involved. The investigations produced documentary findings but no operational personnel consequences through 2025. **Mike Waltz** was subsequently moved out of the National Security Adviser role (to U.N. Ambassador-designate position) in **May 2025**, in what the administration characterized as a routine reassignment but what was widely understood to be a Signalgate-related consequence. **Hegseth** remained in the Defense Secretary role through 2026 despite substantial subsequent investigative findings. ## The Substantive Operational Implications The Signalgate episode produced operationally significant findings across several institutional domains: ### Opsec Framework Integrity The episode established that the **opsec framework** that had operated continuously across post-WWII U.S. national-security deliberations — that operational deliberations occur in SCIFs with secure-communications infrastructure and formal recordkeeping — had been **substantially abandoned** at the most senior level of the second Trump administration. The implication is that **adversary intelligence services with access to commercial communication systems may have substantially greater access to U.S. national-security deliberations** than the prior framework had assumed. ### Presidential Records Act Compliance The Signal chat's automatic message deletion produced Presidential Records Act compliance concerns. The PRA requires that "documentary materials" produced by the President and senior staff be preserved and ultimately deposited with the National Archives. The operational implication of the Signal chat's auto-deletion is that **substantial Principals-Committee deliberation occurred outside the PRA recordkeeping framework**, with implications for historical accountability and for future-administration policy review. ### Senior-Personnel Accountability The episode established that the **post-WWII institutional accountability framework** under which senior national-security officials had been removed for less serious opsec violations (the **John Deutch CIA-laptop incident** in 1996, the **David Petraeus extramarital-affair classified-information incident** in 2012, the **[[Hillary Clinton]] private-email-server cycle** in 2015–16) **had been substantially neutralized**. The operational implication is that future opsec violations by Trump-administration senior personnel are operationally unlikely to produce personnel consequences. ## The Through-Line | Strand | How the episode connects | |--------|--------------------------| | [[2025 Inauguration and First Wave EOs]] (January 2025) | The institutional-restructuring framework within which the episode occurs; the Hegseth and Waltz appointments were among the most operationally consequential first-week-staffing decisions | | [[USA PATRIOT Act]] (2001) | The post-9/11 surveillance and national-security framework whose opsec assumptions the episode substantially undermines | | [[Mueller Report Release]] (April 2019) | The first-term episode in which formal investigative-finding apparatus had been politically neutralized by counter-narrative; Signalgate is the second-term analogue in the operational-security domain | | [[Lafayette Square Bible Photo Op]] (June 2020) | The first-term episode in which institutional-constraint dynamics had produced subsequent Esper/Milley regrets; the Signalgate Hegseth/Waltz dynamic produced no equivalent senior-officer-driven institutional pushback | | Mike Waltz reassignment (May 2025) | The most operationally significant personnel consequence of the episode; substantially less consequential than what comparable prior-administration episodes would have produced | | [[DOGE Establishment]] | Contemporary operational pattern of senior-figure-driven institutional norm departures | | Hillary Clinton email cycle (2015–16) | The first-term-period analogue in which similar opsec violations had produced substantial political-electoral consequences for a Democratic political figure; the Signalgate episode produced no equivalent consequence for Republican principals | ## Legacy The Hegseth Signalgate is, in 2026, the **most consequential single operational-security breach in modern American national-security history**. The operational impact — that an *Atlantic* journalist had silently observed Principals-Committee deliberations over imminent military action; that the administration's response pattern had substantially refused operational accountability; that no senior personnel were removed in the immediate aftermath — produced one of the clearest demonstrations of the second Trump administration's departure from post-WWII institutional national-security frameworks. The longer-arc reading: the Signalgate episode demonstrates that **substantive operational-security frameworks operate not as fixed institutional structures but as conventions that require institutional enforcement to remain operative**. The post-WWII opsec framework had been operative because senior personnel who violated it had faced operational consequences (career-ending; criminal-investigative; political); the second Trump administration's demonstration that comparable violations would not produce comparable consequences is the operational signal that the framework's enforcement convention has been substantially eroded. The implication for future U.S. national-security deliberation is that **the opsec framework that operated continuously from approximately 1947 through 2024** has, as of 2026, no longer obviously operative as a constraint on senior-personnel behavior. The KB pattern: **institutional frameworks operate as the convention-enforcement product of consistent accountability practice over time**; the absence of accountability practice substantially erodes the framework even when the formal rules remain in place. The Signalgate episode is one of the clearest case studies in the second Trump administration's operational demonstration of this principle. ## See Also - [[Signalgate Timeline]] — the six-phase chronology, from the contact-label error to the 2026 aftermath - [[Pete Hegseth]] — Defense Secretary; principal participant in the chat - [[Tim Parlatore]] — Hegseth's personal lawyer and Navy JAG; recipient in the second Signal chat - [[Federal Records Act]] · [[Presidential Records Act]] — the records statutes the auto-delete setting ran into - [[American Oversight]] — plaintiff in the records litigation - [[Operational Security (OPSEC)]] — the framework the chat abandoned before Goldberg was added - [[Mike Waltz]] — National Security Adviser; created the chat; inadvertently added Goldberg - [[JD Vance]] — Vice President; participant in the chat - [[Jeffrey Goldberg]] — *Atlantic* editor; inadvertently included as silent observer - [[Donald Trump]] — President; denial-pattern participant - [[2025 Inauguration and First Wave EOs]] — The institutional-restructuring framework - [[USA PATRIOT Act]] — The post-9/11 national-security framework whose opsec assumptions the episode substantially undermines - [[Mueller Report Release]] — The first-term analogue of institutional-accountability-framework neutralization - [[Lafayette Square Bible Photo Op]] — The first-term institutional-constraint-dynamics analogue - [[Heritage Foundation]] — Provided supporting institutional infrastructure for the administration's response framework - [[Movement Conservatism]] — The coalition whose institutional response to the episode was operationally supportive of the administration's denial pattern