--- title: "Encryption Isn’t Everything: Why Access Control Matters Too" description: A secure chat app can't fix poor access control. This post explores how encryption fails when identity and oversight are ignored. image: https://fenixcyber.com/hubfs/original.avif --- [Skip to main content](https://fenixcyber.com/resources/encryption-isnt-everything-why-access-control-matters-too#main-content) [![Fenix Cyber](https://fenixcyber.com/hubfs/FenixLogoWords3-1.svg) ![Fenix Cyber](https://fenixcyber.com/hubfs/FenixLogoWords3-1.svg) ![Fenix Cyber](https://fenixcyber.com/hubfs/FenixLogoWords3-1.svg) ![Fenix Cyber](https://fenixcyber.com/hubfs/FenixLogoWords3-1.svg)](https://fenixcyber.com/main-old) - Show submenu for Core Services Core Services - Managed Services - Co-Managed Services - Compliance Management - [Show submenu for All Services All Services](https://fenixcyber.com/services) - [Show submenu for Cybersecurity Services Cybersecurity Services](https://fenixcyber.com/services#cybersecurity) - [24/7 Managed Detection and Response (MDR)](https://fenixcyber.com/services#MDR) - [24/7 Identity Threat Detection and Response (ITDR)](https://fenixcyber.com/services#ITDR) - [Incident Recovery and Forensics Support](https://fenixcyber.com/services#incident-recovery) - [Vulnerability Management](https://fenixcyber.com/services#vulnerability-management) - [Patch Management](https://fenixcyber.com/services#patch-management) - [Third-Party Penetration Testing](https://fenixcyber.com/services#penetration-testing) - [Show submenu for Support & Engineering Support & Engineering](https://fenixcyber.com/services#support-engineering) - [Business Hours Remote Support](https://fenixcyber.com/services#remote-support) - [After Hours Remote Support](https://fenixcyber.com/services#after-hours-support) - [Business Hours Onsite Support](https://fenixcyber.com/services#onsite-support) - [Critical Escalations Support](https://fenixcyber.com/services#escalation-support) - [Secure Remote Access](https://fenixcyber.com/services#remote-access) - [Comprehensive User Lifecycle and Identity Management](https://fenixcyber.com/services#user-management) - [Critical Infrastructure Monitoring](https://fenixcyber.com/services#infrastructure-monitoring) - [Network Management and Monitoring](https://fenixcyber.com/services#network-management) - [Critical Infrastructure Monitoring](https://fenixcyber.com/services#infrastructure-monitoring) - [Ticketing System/Portal](https://fenixcyber.com/services#client-portal) - [IT Project Management](https://fenixcyber.com/services#project-management) - [Solutions Engineering and Implementation](https://fenixcyber.com/services#solutions-engineering) - [Managed Process Automation and Integration](https://fenixcyber.com/services#process-automation) - [Managed Procurement Services](https://fenixcyber.com/services#managed-procurement) - [Show submenu for Management & Compliance Management & Compliance](https://fenixcyber.com/services#management-compliance) - [Employee Risk Management](https://fenixcyber.com/services#employee-risk) - [Password & Secrets Management](https://fenixcyber.com/services#password-management) - [Best Practices Management](https://fenixcyber.com/services#best-practices) - [Centralized IT Documentation](https://fenixcyber.com/services#secure-documentation) - [Budget and Technology Roadmap](https://fenixcyber.com/services#budget-tech-roadmap) - [Technology Vendor Management](https://fenixcyber.com/services#vendor-management) - [Asset Inventory and Lifecycle Management](https://fenixcyber.com/services#asset-management) - [IT Process and Policy Management](https://fenixcyber.com/services#process-management) - [Policy Development](https://fenixcyber.com/services#policy-development) - [Risk and Compliance Management](https://fenixcyber.com/services#compliance-management) - [Show submenu for Data Protection & Recovery Data Protection & Recovery](https://fenixcyber.com/services#data-protection) - [Data Protection](https://fenixcyber.com/services#data-protection) - [Password & Secrets Management](https://fenixcyber.com/services#password-management) - [Disaster Recovery Planning](https://fenixcyber.com/services#disaster-recovery) - [Data Recovery Services](https://fenixcyber.com/services#data-recovery) - [Disaster Recovery Services](https://fenixcyber.com/services#business-continuity-planning) - [Business Continuity Planning](https://fenixcyber.com/services#business-continuity-planning) - [Show submenu for Infrastructure Services Infrastructure Services](https://fenixcyber.com/services#other) - [Access Control Systems](https://fenixcyber.com/services#access-control) - [Surveillance Systems](https://fenixcyber.com/services#surveillance-systems) - [Environmental Monitoring](https://fenixcyber.com/services#environmental-monitoring) - [VOIP](https://fenixcyber.com/services#VOIP) - Show submenu for By Industry By Industry - [Accounting](https://fenixcyber.com/accounting) - [Healthcare](https://fenixcyber.com/healthcare) - [Manufacturing](https://fenixcyber.com/manufacturing) - [Nonprofit](https://fenixcyber.com/nonprofits) - [Show submenu for About Us About Us](https://fenixcyber.com/about-us) - [Mission & Values](https://fenixcyber.com/about-us#our-values) - [Leadership](https://fenixcyber.com/about-us#leadership) - Why Fenix Cyber? - [Resources](https://fenixcyber.com/resources) Open main navigation Close main navigation - Show submenu for Core Services Core Services - Core Services - Managed Services - Co-Managed Services - Compliance Management - Show submenu for All Services All Services - All Services - [All Services](https://fenixcyber.com/services) - Show submenu for Cybersecurity Services Cybersecurity Services - Cybersecurity Services - [Cybersecurity Services](https://fenixcyber.com/services#cybersecurity) - [24/7 Managed Detection and Response (MDR)](https://fenixcyber.com/services#MDR) - [24/7 Identity Threat Detection and Response (ITDR)](https://fenixcyber.com/services#ITDR) - [Incident Recovery and Forensics Support](https://fenixcyber.com/services#incident-recovery) - [Vulnerability Management](https://fenixcyber.com/services#vulnerability-management) - [Patch Management](https://fenixcyber.com/services#patch-management) - [Third-Party Penetration Testing](https://fenixcyber.com/services#penetration-testing) - Show submenu for Support & Engineering Support & Engineering - Support & Engineering - [Support & Engineering](https://fenixcyber.com/services#support-engineering) - [Business Hours Remote Support](https://fenixcyber.com/services#remote-support) - [After Hours Remote Support](https://fenixcyber.com/services#after-hours-support) - [Business Hours Onsite Support](https://fenixcyber.com/services#onsite-support) - [Critical Escalations Support](https://fenixcyber.com/services#escalation-support) - [Secure Remote Access](https://fenixcyber.com/services#remote-access) - [Comprehensive User Lifecycle and Identity Management](https://fenixcyber.com/services#user-management) - [Critical Infrastructure Monitoring](https://fenixcyber.com/services#infrastructure-monitoring) - [Network Management and Monitoring](https://fenixcyber.com/services#network-management) - [Critical Infrastructure Monitoring](https://fenixcyber.com/services#infrastructure-monitoring) - [Ticketing System/Portal](https://fenixcyber.com/services#client-portal) - [IT Project Management](https://fenixcyber.com/services#project-management) - [Solutions Engineering and Implementation](https://fenixcyber.com/services#solutions-engineering) - [Managed Process Automation and Integration](https://fenixcyber.com/services#process-automation) - [Managed Procurement Services](https://fenixcyber.com/services#managed-procurement) - Show submenu for Management & Compliance Management & Compliance - Management & Compliance - [Management & Compliance](https://fenixcyber.com/services#management-compliance) - [Employee Risk Management](https://fenixcyber.com/services#employee-risk) - [Password & Secrets Management](https://fenixcyber.com/services#password-management) - [Best Practices Management](https://fenixcyber.com/services#best-practices) - [Centralized IT Documentation](https://fenixcyber.com/services#secure-documentation) - [Budget and Technology Roadmap](https://fenixcyber.com/services#budget-tech-roadmap) - [Technology Vendor Management](https://fenixcyber.com/services#vendor-management) - [Asset Inventory and Lifecycle Management](https://fenixcyber.com/services#asset-management) - [IT Process and Policy Management](https://fenixcyber.com/services#process-management) - [Policy Development](https://fenixcyber.com/services#policy-development) - [Risk and Compliance Management](https://fenixcyber.com/services#compliance-management) - Show submenu for Data Protection & Recovery Data Protection & Recovery - Data Protection & Recovery - [Data Protection & Recovery](https://fenixcyber.com/services#data-protection) - [Data Protection](https://fenixcyber.com/services#data-protection) - [Password & Secrets Management](https://fenixcyber.com/services#password-management) - [Disaster Recovery Planning](https://fenixcyber.com/services#disaster-recovery) - [Data Recovery Services](https://fenixcyber.com/services#data-recovery) - [Disaster Recovery Services](https://fenixcyber.com/services#business-continuity-planning) - [Business Continuity Planning](https://fenixcyber.com/services#business-continuity-planning) - Show submenu for Infrastructure Services Infrastructure Services - Infrastructure Services - [Infrastructure Services](https://fenixcyber.com/services#other) - [Access Control Systems](https://fenixcyber.com/services#access-control) - [Surveillance Systems](https://fenixcyber.com/services#surveillance-systems) - [Environmental Monitoring](https://fenixcyber.com/services#environmental-monitoring) - [VOIP](https://fenixcyber.com/services#VOIP) - Show submenu for By Industry By Industry - By Industry - [Accounting](https://fenixcyber.com/accounting) - [Healthcare](https://fenixcyber.com/healthcare) - [Manufacturing](https://fenixcyber.com/manufacturing) - [Nonprofit](https://fenixcyber.com/nonprofits) - Show submenu for About Us About Us - About Us - [About Us](https://fenixcyber.com/about-us) - [Mission & Values](https://fenixcyber.com/about-us#our-values) - [Leadership](https://fenixcyber.com/about-us#leadership) - Why Fenix Cyber? - [Resources](https://fenixcyber.com/resources) - [Contact us](https://fenixcyber.com/contact) [Free Cyber Risk Assessment](https://fenixcyber.com/benchmark) [Contact us](https://fenixcyber.com/contact) [Free Cyber Risk Assessment](https://fenixcyber.com/benchmark) [Blog](https://fenixcyber.com/resources) Tags - [trust](https://fenixcyber.com/resources/tag/trust) - [transparency](https://fenixcyber.com/resources/tag/transparency) - [AI](https://fenixcyber.com/resources/tag/ai) - [Access Control](https://fenixcyber.com/resources/tag/access-control) - [leadership](https://fenixcyber.com/resources/tag/leadership) - [nonprofit](https://fenixcyber.com/resources/tag/nonprofit) - [Automation](https://fenixcyber.com/resources/tag/automation) Search - [trust](https://fenixcyber.com/resources/tag/trust) - [transparency](https://fenixcyber.com/resources/tag/transparency) - [AI](https://fenixcyber.com/resources/tag/ai) - [Access Control](https://fenixcyber.com/resources/tag/access-control) - [leadership](https://fenixcyber.com/resources/tag/leadership) - [nonprofit](https://fenixcyber.com/resources/tag/nonprofit) - [Automation](https://fenixcyber.com/resources/tag/automation) [trust](https://fenixcyber.com/resources/tag/trust) [transparency](https://fenixcyber.com/resources/tag/transparency) [Access Control](https://fenixcyber.com/resources/tag/access-control) [Encryption](https://fenixcyber.com/resources/tag/encryption) ## Encryption Isn’t Everything: Why Access Control Matters Too **End-to-end encryption is great — unless you hand the encrypted channel to someone who shouldn’t be in the room.** That’s not a hypothetical. That’s what happened when senior U.S. officials used Signal — a secure but informal consumer messaging app — to coordinate live military operations and accidentally included a journalist in the conversation. The now-infamous group chat revealed real-time plans for U.S. airstrikes in Yemen. The journalist, unsure whether the messages were legitimate, observed the conversation silently as high-ranking officials discussed timing, targets, and policy implications. No one in the chat noticed he didn’t belong. The airstrikes unfolded almost exactly as described — and the outsider remained in the group throughout. This wasn’t espionage. It wasn’t a cyberattack. It wasn’t even particularly sophisticated. It was a textbook case of **access control failure** — made worse by the fact that it was entirely preventable. ## **They Chose the Wrong Channel** It’s important to understand what didn’t happen here: they didn’t lose control of a secure system. They **chose not to use one**. The federal government — and especially the national security community — has access to some of the most rigorously secured communication infrastructure in the world: classified networks, SCIFs, identity-bound collaboration tools, encrypted voice systems, and multi-layered authentication protocols. These are the systems designed for precisely this type of discussion — and more importantly, **they’re designed to prevent exactly this kind of mistake**. But none of those systems were used. Instead, a group of senior officials opted for Signal. Yes, it offers strong end-to-end encryption. But it’s also a consumer app, designed for ease of use, not enterprise-grade authentication or classified communications. And it allowed a phone number — belonging to a member of the press — to be added without any verification, oversight, or follow-up. Signal didn’t fail. The users did — not just by trusting the wrong number, but by **bypassing every system built to protect them from themselves**. ## **Access Control Isn’t Optional — It’s Foundational** Encryption protects data in motion and at rest. But **access control governs who gets to see it at all**. Without it, encryption is just a lock on a door that’s already wide open. Security professionals often emphasize “Zero Trust” as a model. But it’s not just about network architecture — it’s a mindset. It means validating identities before granting access, not after a mistake is discovered. It means designing systems that treat human error as inevitable — and prevent it from becoming a breach. In this case, there were no identity confirmations. No roster checks. No access policies. The participants in the group chat operated on assumed trust and informal norms — in a context where even the appearance of a compromised channel should have halted the conversation immediately. ## **Design for the Mistake — Not the Ideal** In secure systems, **the user is never the last line of defense**. Whether it’s a misdirected email, a misconfigured permission, or a wrong number added to a chat, most security failures stem from assumptions: - “I thought that number was someone on the team.” - “I didn’t recognize the initials, but didn’t want to ask.” - “We needed to move fast.” The truth is: if a communication channel doesn’t make it difficult to invite the wrong person — and easy to notice when you have — it’s not suitable for sensitive operations. In high-trust environments, verification must be deliberate, not implicit. Secure systems anticipate friction. They don’t optimize for speed at the cost of visibility, accountability, or sanity checks. ## **The Real Lesson** This breach didn’t expose a technology flaw. It exposed a failure to respect process — and the quiet danger of informality creeping into operational security. The officials involved **had access to better systems**. More secure. More controlled. Systems specifically built to manage the kind of coordination they needed. But they sidestepped all of it — and in doing so, they lost control over one of the most sensitive decisions a government can make. Encryption, no matter how robust, is only one part of a secure communication strategy. Without access control, oversight, and identity validation, it’s little more than a false sense of safety. In the end, the mistake wasn’t technical. It was human. But it was also preventable — and that’s what makes it worth learning from. Tags: [trust](https://fenixcyber.com/resources/tag/trust) [transparency](https://fenixcyber.com/resources/tag/transparency) [Access Control](https://fenixcyber.com/resources/tag/access-control) [Encryption](https://fenixcyber.com/resources/tag/encryption) ![Chase Carlton](https://app.hubspot.com/settings/avatar/b9c439fa49b2f75bdee3c37fb570bf4c) **[Chase Carlton](https://fenixcyber.com/resources/author/chase-carlton)** Mar 26, 2025 1:17:54 PM [Follow me on my website](https://www.fenixcyber.com) [Follow me on LinkedIn](https://www.linkedin.com/in/chasecarlton) ## Related Articles [![Protecting Client and Donor Data in an Era of Uncertainty](https://fenixcyber.com/hs-fs/hubfs/ChatGPT%20Image%20Oct%207%2c%202025%2c%2011_15_12%20AM.png?width=500&height=500&name=ChatGPT%20Image%20Oct%207%2c%202025%2c%2011_15_12%20AM.png) Protecting Client and Donor Data in an Era of Uncertainty Chase Carlton • Oct 7, 2025 11:25:36 AM](https://fenixcyber.com/resources/protecting-client-and-donor-data-in-an-era-of-uncertainty) [![Do You Really Own Your Backups? The Hidden Truth About Backup Portability](https://fenixcyber.com/hs-fs/hubfs/DALL%C2%B7E%202025-02-14%2017.18.51%20-%20A%20split-featured%20image%20comparing%20two%20backup%20solutions.%20On%20the%20left%2c%20a%20dark%2c%20closed%2c%20locked%20environment%20symbolizing%20being%20trapped%20by%20an%20MSP%E2%80%94dim%20lightin.webp?width=500&height=500&name=DALL%C2%B7E%202025-02-14%2017.18.51%20-%20A%20split-featured%20image%20comparing%20two%20backup%20solutions.%20On%20the%20left%2c%20a%20dark%2c%20closed%2c%20locked%20environment%20symbolizing%20being%20trapped%20by%20an%20MSP%E2%80%94dim%20lightin.webp) Do You Really Own Your Backups? The Hidden Truth About Backup Portability Chase Carlton • Feb 14, 2025 5:19:33 PM](https://fenixcyber.com/resources/do-you-really-own-your-backups-the-hidden-truth-about-backup-portability) [![Fenix White Logo 3-1 SVG](https://fenixcyber.com/hubfs/Logos/Fenix%20White%20Logo%203-1%20SVG.svg)](https://fenixcyber.com/main-old) - [Home](https://fenixcyber.com) - [Services](https://fenixcyber.com/services) - [About](https://fenixcyber.com/about-us) - [Resources](https://fenixcyber.com/resources-old) 2026 Copyright Fenix Cyber Solutions, Inc. All rights reserved. Site built with Sprocket Rocket & HubSpot. [Privacy policy](https://fenixcyber.com/privacy-policy) [Terms](https://fenixcyber.com/tos) - ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Chase Carlton", "url" : "https://fenixcyber.com/resources/author/chase-carlton" }, "dateModified" : "2026-03-10T22:35:09.870Z", "datePublished" : "2025-03-26T19:17:54.000Z", "headline" : "Encryption Isn’t Everything: Why Access Control Matters Too", "image" : [ "https://fenixcyber.com/hubfs/original.avif" ], "mainEntityOfPage" : { "@id" : "https://fenixcyber.com/resources/encryption-isnt-everything-why-access-control-matters-too", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://fenixcyber.com/hubfs/FenixLogoWords3-1.svg" }, "name" : "Fenix Cyber Solutions, Inc." } } ```