Pentagon did not conduct routine investigation on whether Hegseth damaged national security by sharing strike plans on Signal

By Zachary Cohen, Haley Britzky, CNN

(CNN) — The Pentagon did not conduct a routine investigation into the impact of Defense Secretary Pete Hegseth’s disclosure of sensitive military information in a group chat on Signal earlier this year and whether it damaged national security – in part because Hegseth never authorized it, according to multiple sources familiar with the matter.

A classification review and damage assessment would typically be initiated following any unauthorized disclosure of sensitive defense information, in part, to examine whether sources and methods or ongoing US military and intelligence operations have been compromised in a way that would require mitigation.

Hegseth did not order an assessment, two former senior officials who were working at the Pentagon at the time and a current US official with knowledge of the situation said.

After the Signal messages came to light, Hegseth, instead turned his attention inward and focused on formally investigating suspected leakers on his own staff, even threatening to polygraph defense officials he believed were disclosing potentially embarrassing details about him, multiple current and former officials said. Those threats had a “chilling effect” among DoD officials who became increasingly wary of doing anything that could be perceived by Hegseth as an attempt to undercut him, according to those officials.

The news that the Pentagon did not carry out a damage assessment or conduct an internal classification review comes days after an internal watchdog report was released that concluded Hegseth risked endangering American troops by sharing highly sensitive attack plans targeting Houthi rebels in Yemen. The sources said they’d have expected a damage assessment to be carried out separately to establish the practical implications of the Signal disclosure, in part, because the Inspector General probe had a limited scope.

“100% a breach like that would warrant a top-to bottom damage assessment by both DoD and the IC,” one of the sources, the former senior defense official told CNN, referring to Hegseth’s role in Signalgate.

The Pentagon also has no plans to investigate the incident further — even after the IG concluded Hegseth actions violated DoD regulations and risked compromising sensitive military plans, according to a source familiar with the matter.

Hegseth has mischaracterized the report’s findings, claiming “total exoneration” and “no classified information” even though the watchdog declined to weigh in on his classification authority or whether a compromise occurred – acknowledging its investigation was limited in scope, in part, because the secretary refused to cooperate.

“A damage assessment is forward-looking and focused on risk rather than personal culpability. Even without the official’s cooperation, analysts can evaluate what material was shared, who had access to it, and any potential operational or counterintelligence implications. In that sense, a damage assessment would not have been constrained by the same limitations that hampered the IG investigation,” according to Brianna Rosen, a former White House official specializing in national security and tech policy.

A senior pentagon official told CNN that the department waits for the IG report before making the determination about a damage assessment – and since the IG report found no classified info was shared, there was no need for a damage assessment.

But that is not consistent with how other current and former officials explained the process.

‘100 percent expect a damage assessment’

Inspectors general would not typically be responsible for determining whether a compromise of classified material occurred, according to Irvin McCullough, director of national security at the Government Accountability Project, who noted that is usually done by the department’s security officers through a damage assessment.

“I’d 100 percent expect a damage assessment,” McCullough told CNN. “If they did not do a damage assessment, I’d imagine it’s because the Original Classification Authority/originator determined there was no compromise,” he said.

In this case, the IG report suggests that decision would have likely been made by Hegseth.

For Hegseth’s use of Signal, a damage assessment would have examined how the information was transmitted, why it was classified at that level and assessed the risk from intelligence to what damage it could cause, the US official added.

The Pentagon’s Joint Staff and US Central Command, which carried out the strikes in Yemen, did not require Hegseth’s explicit sign-off to open an investigation, but the secretary would have been notified if they had and could have stopped it, the former senior official and the current US official also told CNN.

US intelligence agencies and the FBI similarly did not examine the broader national security implications of Hegseth using a commercial messaging app – on his personal phone – to send closely-guarded operational details about an imminent strike in Yemen despite concerns being raised that information could have jeopardized the safety of US troops and mission objectives, the sources said.

No such assessment took place after revelations that Hegseth used Signal, via his personal phone, to send detailed attack plans to other Trump officials and a reporter, despite US officials raising immediate concerns about the information’s sensitivity and his use of unsecure, non-government devices to share it, the sources said.

Multiple current and former US officials told CNN that was unusual, particularly since the Pentagon inspector general determined the information Hegseth shared was from a document marked classified at the time and spoke to witnesses who said the secretary’s use of Signal went well beyond the one group chat in question.

“Based on our review, we concluded that some information the Secretary sent from his personal cell phone on Signal on March 15, 2025, matched the operational information USCENTCOM sent and classified as SECRET//NOFORN,” the unclassified IG report states.

Former prosecutors who specialized in national security cases also told CNN that under previous administrations, investigators would have likely scrutinized whether Hegseth had used Signal for other sensitive discussions beyond the chat on Yemen strike plans.

A third former senior defense official noted, however, that the decision to conduct a damage assessment is not automatic and not uniform across cases – meaning there is not a single uniform template that must be followed in every circumstance.

“The decision to launch a damage assessment usually hinges on three factors: the extent of classified information that left controlled channels, the intelligence value that exposure might offer an adversary, and whether the incident reveals broader systemic vulnerabilities. When any of those elements are present, agencies generally err on the side of initiating an assessment because it guides mitigation responses and helps prevent future breaches,” Rosen told CNN.

Other agencies weren’t contacted

US intelligence agencies and the FBI were never contacted by the Pentagon to help assess the potential damage caused by Hegseth’s disclosure, another source familiar with the matter told CNN.

US intelligence agencies considered it the Defense Department’s responsibility to initiate a damage assessment because the Pentagon was in charge of the operation in question and details shared by Hegseth seemed to come from classified military channels. They also believed no classified information of their own was disclosed in the Signal messages revealed by the Atlantic’s Jeffrey Goldberg.

As a result, the intelligence community waited for a request to support the Pentagon’s review, but it never came, puzzling some officials who immediately identified that the details shared by Hegseth likely originated from classified material.

The IG report acknowledged Hegseth, as defense secretary, has broad authority to declassify information but also notes investigators were unable to find any documentation showing he properly did so in this case.

To properly declassify the material, Hegseth would have had to issue a formal written order notifying several top Pentagon officials of his decision at the time he claims to have made it, including the DoD general counsel, undersecretary for intelligence and CENTCOM.

Unlike the IG, Pentagon officials conducting a damage assessment, if one had been done, would have been able to examine whether Hegseth followed that process without relying solely on his cooperation, multiple current and former officials said.

In some cases, like the investigation into former national security adviser John Bolton’s handling of classified information following the publication of his book about his time working for Trump in 2020, damage assessments have uncovered evidence that led to a criminal prosecution.

Investigators within Hegseth’s own Defense Department have worked with the Department of Justice to prosecute other disclosures of sensitive military information.

Last week, the DoD and Justice Department announced that a US Air Force colonel pleaded guilty to texting classified plans about an upcoming military operation to a woman who was not authorized to receive it.

Those details included the operation’s timing, targets, methods and objectives – similar to what Hegseth shared in at least two group chats, including one with his wife, brother and personal lawyer.

In the announcement, officials said the colonel admitted he knew his personal devises were not authorized to handle classified information and that the woman was not cleared to receive it.

The Air Force colonel now faces up to 10 years in federal prison after pleading guilty to one count of unauthorized communication of national defense information.

CNN’s Evan Perez and Katelyn Polantz contributed to this report.

The-CNN-Wire
™ & © 2025 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.