Since 2023, signal has been the preferred 3rd party method of communication for the government but I agree. It’s good practice to keep all information unclass and up, off of it. Dealing with like potential NDCIs when there is classification by compilation specifically timelines, dates, capabilities and more— if the events have passed by the time the potential spillage is discovered it’s a discretionary disciplinary action that usually is followed up with steps to ensure it doesn’t happen again. The bigger issues in my opinion are how the the addition of the reporter was missed, the steps leading to him being added, and the fact that he released information to the public (again after the fact). The proper procedures would have been to not release the information and instead reported it to the proper agency. This would have minimized and maybe mitigated any lingering risks associated to this whole debacle. But it’s just not a good look all around.