Debate on secure communication tools in the EU Parliament

The European Parliament has once again urged its MEPs and staff to use the messenger service Signal for work-related communication, according to an internal email obtained by Politico. It states, among other things, that MEPs should use "the Parliament's proprietary solutions", Teams and Jabber, when possible, and only Signal when the two are not available. Back in 2020, the European Commission made a similar recommendation, advising its staff to switch to Signal for secure communication.

Element CEO and co-founder of Matrix in particular, Matthew Hodgson, sharply criticized the recommendations to heise online. The two corporate solutions are "a dubious choice" for the European Parliament. Microsoft Teams is owned and "controlled by a US provider and is not even end-to-end encrypted". According to Hodgson, this is "still an isolated, vendor-locked platform that is of little help when it comes to secure communication between different governments".

Signal not open, but secure

Raphael Robert, head of Phoenix R&D and co-author of the encryption protocol Messaging Layer Security (MLS), can understand the recommendation for Signal, as security is a strong focus there. However, Signal has been criticized for the fact that it is not possible to operate the service yourself. According to Robert, users are also "dependent on the decisions of the Signal team", as he told heise online. For more sovereignty, the services would have to be operated by the users themselves. The fact that Signal is operated in the US cloud, has its headquarters in the US and is therefore not independent is repeatedly criticized.

According to Robert, the challenge with Matrix and Element, on the other hand, is that there is no clear focus on a target group, as the company is aimed at large companies, governments and, in some cases, end consumers. For example, the TI Messenger in the healthcare sector and the Bundeswehr Messenger are based on the Matrix protocol. This means that it can be used by everyone, but with some restrictions. With other messenger services such as Wire, sovereign use is not readily possible. Threema is a solid alternative and is now also available as open source, but cannot be self-hosted.

Recommendation follows Salt Typhoon attacks

The recommendation came after it became known that a group of cybercriminals linked to China called Salt Typhoon had carried out large-scale attacks on US and global telecommunications providers. In mid-February 2025, it was reported that the group was still active and had compromised five other telecommunications providers. According to Politico, the email referred to an "increase in threats to commercial telecommunications infrastructure and certain incidents targeting major telecommunications companies, primarily in the US". The risk of manipulation or interception of unsecured communications via public networks has therefore increased.

(mack)