An encrypted messaging app used by Mayor Mike Johnston to communicate, specifically about the illegal immigration crisis in Denver, is not authorized for use on city-owned devices, according to the city’s technology department.

“Technology Services governs the appropriate reviews, approvals, procurement, licensing, and management of all software and applications assets licensed by the city,” said Amanda Weston, a spokesperson for Denver Technology Services. “Signal is not an approved city application for city-issued devices. It is not prohibited on personal devices.”

Application downloads on city-issued devices can be prevented when necessary, Weston added.

In the case of Mayor Johnston’s “Strike Force” chat group, city officials said the signal app was not blocked from city-issued phones, so some employees did not realize the app was not approved.

Most of participants in the chat were not using city-owned devices, according to Jordan Fuja, who speaks for Johnston’s office.

“We were made aware (of the city-issued phones) this week,” Fuja said. “Because the app was not blocked from being downloaded and not listed in the use agreement, staff was unaware the app was not approved. We are immediately addressing this issue.” 

Under Denver’s policy, city-related communications conducted on personal phones and devices remains subject to open records and retention policies.

Signal users can turn on the app’s auto-delete function, which means no records for retention — even for communications that deal with city business.

Attorney Steven Zansberg, a First Amendment lawyer who has represented the interests of media companies in litigation, concluded that Johnston and his aides violated Colorado laws after reviewing records obtained by CBS News Colorado, which reported about Johnston and his aides using the auto-deletion software. 

Officials said the decision to use the popular app was prompted by how President Donald Trump’s administration “could have significant impacts on how Denver operates.”

“Staff occasionally use Signal as an easy alternative to regular text messaging, Fuja said. “Local government has a responsibility to communicate effectively and be aware of everything going on in the city on a daily basis. In a large organization where individuals use different operating systems (iPhone, Android) and receive hundreds of texts and emails a day, Signal allows people to efficiently receive real time updates and share information.”

Fuja said the app is not used to make policy decisions or issue directives that affect city business. 

“Just like any other text messages or emails, the (Signal) communications are subject to CORA,” she added.

Critics of encrypted messaging apps argue that they offer security, they tend to skirt open records laws meant to preserve transparency in government decision making.

“What an insult to every citizen and taxpayer,” Jon Caldara, president of the Independent Institute said. “Turns out our mayor is a politician after all; he campaigned saying he’d run a transparent administration, then acts like Nixon hiding the tapes.”

In a statement posted on its website, America First Legal, a conservative legal group closely tied to the Trump administration, said it was “no coincidence” that a CBS News Colorado investigation found Johnston and his staff began using Signal shortly after the legal group filed open records requests over Denver’s handling of the immigrant crisis.

At the state level, the government’s technology policy allows its use for employees.

“Signal is not by default downloaded onto Governor’s Office devices, but it is an allowable communications tool as per Office of Information Technology security review,” Shelby Wieman, a spokesperson for the governor, said in a statement to The Denver Gazette. “Individual employees are permitted to download and use it as long as they follow OIT’s Acceptable Use Policy.

While the policy doesn’t specifically address the use of apps like Signal, it instructs state employees with government issued equipment to only access the internet to conduct “state business,” such as communication with business associates, research, online training, obtaining relevant news or information, professional networking and listening to legislative or committee hearings associated with the users agency or work mission.

The policy warns users to have no expectation of privacy while using state resources or technology and that all electronic communications sent to and from state-assigned accounts become state property. Additionally, the policy clarifies that electronic communications pertaining to state business — even those sent from personal devices and accounts — are subject to the Colorado Open Records Act.

Wieman didn’t categorically answer whether the governor’s aides or staffers are using the app. The governor’s office also did not address questions about the use of any auto-delete functions, open records violations or if there were any concerns regarding accident leaks of sensitive information.

Wieman said the governor’s office “is committed to ensuring data security, privacy, and transparency.

Signal is one of many end-to-end encrypted messaging apps growing in popularity among government officials. Along with direct messaging, it can also be used for phone calls and video calls.

The Trump administration has come under fire after U.S. national security leaders inadvertently added a journalist in a group chat about upcoming military operations in Yemen.

Cybersecurity experts said while the app “does, pretty much, what it says it will do,” Signal and other private-sector messaging apps can lull users into a false sense of security.

Experts also pointed to vulnerabilities with losing a phone, as well as the potential risks with phishing scams targeting specific Signal users. 

Weston, the department spokesperson, said Denver, like all government organizations, is subject to repeated cyberattacks on a daily basis. She said the department prioritizes employee education regarding the appropriate use of city technologies, approval processes required for procuring or accessing hardware and software, and cyber security and data privacy protocols.

“City employees sign a technology use agreement annually that outlines expectations for appropriate use of city devices,” she said. “Employees who deviate from the expectations outlined in the agreement are held accountable by their agency leadership and any potential disciplinary action would be handled at that level.”