Skip to content

Not yet reviewed by a lawyer. Sourced information, to be confirmed.

Signal groups: organising while limiting leaks

Key points

  • Public announcement group → airlock group to meet in person (suggested by anyone, announced by a secretary) → vetted trusted group → team sub-groups.
  • Open door, with no voucher: airlock → "cleaned" airlock → acting together → vouchers → HR second check → trusted group (see watching them act).
  • Graduated trust: a vetted secretary, one voucher and a second check by HR for the trusted group; two vouchers for a sensitive sub-group. Never through a group link or QR code, except for the public group (announcements, nothing sensitive): people are added by username, from a private conversation.
  • No vetting stops a determined leak: write nothing you wouldn't want read out in police custody.
  • Before joining: a short activist name, also used in person; number hidden from everyone; disappearing messages, in every group from its creation.
  • Someone gets taken away: remove them from all their groups straight away, as a precaution.
  • Compromised group: if you know where the leak is, remove it and the group carries on; if not, move out and re-invite people one by one.

An encrypted messenger like Signal protects your messages in transit, not against someone inside the group or a seized phone. How you organise your groups, however, can limit what a leak or a seizure reveals.

Where to start?

Find what concerns your role

Do you organise groups? Say what your role is (secretary, HR, keyholder, recruiter), then what you want to do: the menu takes you straight to the right part of this guide. Works offline.

I am a new member (discovering the groups)

I am a group member

I am a secretary

I am HR

I am a keyholder (admin)

I am a recruiter

Before you start

Encrypting is legal, but it can be turned against you

Using Signal is not an offence. In the so-called "8 December" case, the DGSI describes the defendants as having adopted "clandestine behaviour" with encrypted applications, Tails and Tor, and that wording recurs very often in the file, according to La Quadrature du Net, which analysed it before the trial.1 The seven defendants were convicted in December 2023 of terrorist criminal association.2 Neither source says encryption was judged to be an offence: it is cited as an indicator. This is a serious case and very far from an ordinary demonstration, but it shows you can be read back: write nothing you would not want quoted, and do not count on encryption to protect you from a hostile reading.

Assume someone is reading

An in-person meeting keeps out the curious, trolls and the far right, not a well-prepared undercover officer or someone who talks after police custody. Written messages are evidence: knowingly taking part in a group that prepares violence or damage is punishable by one year in prison and a €15,000 fine, even if nothing happened.3 In the groups: logistics, mutual aid, public information. Everything else is not written down.

This guide is public: adapt it

The police can read it too, and that is not a problem: your security does not rest on keeping the method secret, but on what is written nowhere here (who is in which group, your IDs, the register, meeting places, who your HR and keyholders are). Change the role names, labels and group naming scheme rather than copying the guide's: on a seized phone, they won't immediately point to your key people.

The groups

  1. Public group (one per city) → people join through the public group's link (the one exception: it holds nothing sensitive) or are added directly by a secretary or a recruiter; only admins (keyholders and secretaries) post: announcements, date, declared location, links to the guides.
    • To move on to an airlock group: set up your settings, make yourself known to a recruiter, write privately to a secretary (by username) to be added to an airlock group announced in the public group with its date and time of day, or suggest one.
  2. Airlock group (temporary) → suggested by any member of the public group, created and announced by a secretary, for one in-person meeting, then, if needed, a rendezvous at an action organised by others; only the time and place are written there, and it stays open while people await a decision.
    • To move on to the trusted group: an in-person meeting with a secretary (settings, QR code scanned), several actions where vetted members watch you, one voucher, then HR's second check, who add you to the trusted group by username, from the airlock (see watching them act).
  3. Trusted group (vetted, MVT-CTY-4K9-General) → logistics, mutual aid, public information; nothing illegal.
    • To move on to a sub-group: a real need in the team, a period in the trusted group, and two vouchers if the sub-group is sensitive; the sub-group's keyholder adds them.
  4. Sub-groups by topic, in the same family (same ID) → each only sees what concerns its team:
    • 4K9-Medic
    • 4K9-Legal
    • 4K9-Logistics

The trusted group and its sub-groups are the vetted groups, and a family sharing the same ID (see naming groups). A malicious person who gets into one sub-group does not see the others. Next to the funnel, the temporary group, for an action day or a mobilisation, leads nowhere: it is disposable.

Two ways into the trusted group: the open path (public group, airlock, meeting in action, vouchers, HR's second check) and co-option (a vetted member proposes someone they know, often the same day). See the two ways in: diagram, table and detail of each route.

The roles

Nobody holds every role, and roles rotate. And no group brings together every key person (see coordinating).

Roles for organising the Signal groups

These roles keep the Signal network running (recruitment, onboarding, moderation, security):

Role What they do What they don't do Admin in Signal
Recruiter Talks about the movement at protests, on roundabouts, at public meetings; points people to the public group and the airlock groups Validate; vouch for their own recruits; write anything down about them No
Secretary (already-vetted member) Coordinates the meeting end to end: announces the airlock group in the public group, comes to it, helps everyone set up Signal; validates once the conditions are met; cleans the airlock group and adds HR to it; stays the newcomers' contact Validate without a voucher; add anyone to the trusted group (HR do the adding); keep an attendance list Of the airlock group they run, and of the public group to announce meetings there
HR ("human resources") Like at work: do the second check on validated people and add them to the trusted group; receive doubts; decide on removals in pairs (within a short delay after a preventive pause); settle cases when a secretary hesitates Run airlock groups; decide a removal alone; be keyholders of every group Yes, of the trusted group
Keyholder Holds a group's keys: watches over its configuration (message timer, permissions, no link except for the public group), adds and removes; keeps an eye out for unusual arrivals and interactions and reports them to HR. HR are keyholders of the trusted group Add someone who hasn't been validated; go to an action with their keyholder phone Yes, at least two per group
Moderation Reminds people of the charter, deals with issues privately Accuse anyone in the group No
"Lost group" lead Triggers the compromised-group procedure, alerts the local legal team Discuss an arrest in writing Depends on the group

Roles useful at protests

These protest roles operate during protests according to your needs. They are shared out among the members already there, according to each person's skills and availability, and can change from one action to the next: you don't recruit for a role. Each relies on a sub-group (Medic, Legal…) and on a guide on this site:

Role What they do What they don't do Learn more
Medic First aid: gas, injuries, fainting Medical procedures (stitching, removing fragments); giving medication First aid
Legal Observes arrests, lawyer contacts, follows up people arrested Replace a lawyer Police custody
Field watch Reports, from public space, where gas is being fired, where a line is advancing or pulling back, which streets are closed and which way out is clear; short factual messages ("gas on X street, exit clear on Y side") in a Veille sub-group Point out, photograph or describe an officer; urge people to go towards a line or round it to confront it; note down people; act outside a declared demonstration Dispersal, warnings and kettling · First aid
Protection and de-escalation Spots tension, talks, helps people out of a kettle, accompanies vulnerable people Carry anything that could pass for a weapon; respond to provocation Dispersal, warnings and kettling · Kit and what to wear
Documentation Films arrests and violence, keeps the evidence Publish without blurring protesters Film the police
Support Listens and accompanies after a hard moment Play therapist Mental health
Logistics Transport, food, water, storage Store equipment that could pass for a weapon Getting there and back
Build Banners, placards, equipment Equipment that could pass for a weapon Signs, banners, flags and leaflets · Kit and what to wear
Communication Visuals, announcements, social media Repost far-right content Communicating at a protest · Social media

Field watch: the framework. This role is for getting out in time and avoiding gas, not for confrontation. In the texts we read, we found nothing banning the reporting of a deployment's position from public space; that is not a guarantee. Two limits:

  • knowingly taking part in a group that is preparing violence or damage is punishable by one year in prison and a €15,000 fine,3 and written messages serve as evidence: the same message can read differently in a hostile context;
  • sharing information that identifies or locates a person in order to expose them to a risk is punishable by 3 years in prison and a €45,000 fine, or 5 years and €75,000 if the person holds public authority.4

So report zones and directions, never people. Use a dedicated sub-group with disappearing messages.

Key vocabulary and concepts

  • Voucher: a vetted member who really knows a new person (outside the airlock group: friend, colleague, neighbour, or seen in action at several protests) and vouches for them, privately, to the secretary.
  • Activist name: the pseudonym used on Signal and in person.
  • Register: the list, kept by two or three people outside the groups, of active and lost groups and of who is in which group.
  • Fallback point: a regular place and time, agreed in person, to meet up if the groups go down.
  • Precautionary removal: removing someone from their groups as a precaution, for example when they are arrested.
  • Leak: the person or phone through which an outsider gets into a group.

In this guide

When Signal is not enough

  • No network: Briar works over Bluetooth or local wifi, without a phone number (communicating at a protest).5
  • No phone number: Element (Matrix) (Matrix) works with a simple account ID and suits large spaces organised into rooms.
  • Shared documents: CryptPad, encrypted, no account required.
  • The most sensitive matters: in person, without phones (left in another room, or switched off and kept away).

Organising a protest · Communicating at a protest · Phone

Next : As a member

In one of these situations? organising a protest · new to the Signal organising groups

Sources

Each note links to the source of the information. Most sources are in French. Laws change: check the date of the source and, if in doubt, ask a lawyer.

  1. La Quadrature du Net — Criminalization of encryption: the 8 December case (5 June 2023) · AI-sourced on · awaiting human check ↩

  2. Politis — "8 December case": the worrying conviction of activists as terrorists (22 December 2023; in French) · AI-sourced on · awaiting human check ↩

  3. French Criminal Code, art. 222-14-2 (group formed to prepare violence or damage) · AI-sourced on · awaiting human check ↩↩

  4. French Criminal Code, art. 223-1-1 (sharing information that identifies or locates a person) · AI-sourced on · awaiting human check ↩

  5. Briar — How it works · AI-sourced on · awaiting human check ↩

SOS