technology

Not to say that decentralization solves everything, but I see all of these centralized "but we do E2EE tho" apps as deeply flawed. Especially when they require phone numbers to sign up. You are just WhatsApp without Facebook's bad reputation! Assuming they are completely above board (not intelligence ops in themselves, but subject to legal pressure), we can take their word that there are no plaintext records the government can subpoena, but as a centralized service, they construct essentially one point the government needs to watch. They can correlate when messages are going in with when messages are coming out to assemble graphs of communications networks. With subpoena power, they can trivially figure out who the individual nodes are in those graphs, who they are communicating with, what their location is (they have your phone number), and with zero-day attacks at their disposal, they can exfiltrate the plaintext from end-user devices - if the social network information doesn't provide enough insight for them to roll up troublemakers without needing to burn these.

There is an old manta among cryptographers and Free Software advocates that "there is no such thing as security through obscurity." I'm calling bullshit. While it is not a substitute for sound cryptography, the clever application of stenography goes a long way. Every day you can avoid being noticed is a day the investigation has been delayed. Every investigation which gets started late, or never starts at all, creates blind-spots to the state. Public key cryptography is a crucial tool, but there is a hyper-fixation on it while alternate methods are overlooked. Classic practices of tradecraft, like one time pads, dead drops, hiding messages inside innocuous mediums. The discipline to opt for radio silence instead of constantly dinging the "Revolution HQ" server with you E2EE messaging app as you roam from WiFi access point to WiFi access point. The pre-arrangement of signaling procedures, where an innocuous post on a mediocre blog, a classified ad with the correct words in it, or the arrangement of flower pots on a balcony can let somebody know it is time to move to phase 2, or establish a meeting in a predetermined location, or retrieve a package from a specific garbage can on the Hudson River Greenway.

These apps are actually much more secure when being used by police and state officials. In this case, they don't need to worry about investigators with subpoena power. The threat model is simplified to the cryptographic fundamentals, and the security of the devices implementing them. Foreign intelligence is still a threat, but they don't have the blanket physical access to these networks that the US security state does.