ScatterChat was an encrypted instant messaging client that the Hacktivismo group released on 22 July 2006 at the H.O.P.E. Number Six conference in New York City. It was discontinued long ago, gets no security fixes, and you should not rely on it today. It tried to give activists behind national firewalls encrypted chats, encrypted file transfers and built-in Tor routing in one package that non-technical users could manage. In November 2026 most people meet that need with Signal, which is actively maintained and has had its protocol studied by independent cryptographers, together with Tor Browser from the Tor Project. The EFF’s Surveillance Self-Defense guides are a good place to start choosing between them.
This page is an independent guide. It is not affiliated with Hacktivismo or the ScatterChat developers. The documentation notes and FAQ below date from 2006 and 2007 and are kept as history, with corrections where facts have changed.
Documentation
The ScatterChat developers published an official User’s Guide in three formats. It was available as an HTML webpage, as a PDF document, and as a live wiki that readers were invited to proofread and improve. The project put a lot of weight on documentation because it was aimed at users with little technical background.
The project also published technical specifications for its cryptographic protocol and for the API of its cryptography engine. Those documents are now useful mainly for historical and academic interest. They are not a model for new designs, because independent researchers found flaws in the protocol (see the security section below).
Frequently asked questions from the original project
The questions below come from the project’s own FAQ in 2006 and 2007. The answers have been rewritten in plain English and describe the project in the past tense.
Why wasn’t ScatterChat a Gaim plugin?
The developers said several of the security features they wanted could not be built on top of Gaim’s plugin API. To make traffic analysis harder, ScatterChat turned off typing notifications when encryption was on. It also encrypted file transfers in secure mode and added built-in Tor support. The developers promised more advanced features later.
ScatterChat was described as a “friendly fork” of Gaim. The plan was to re-synchronise it with the upstream Gaim code from time to time. The project did no general development on Gaim itself and did not present itself as a competitor.
The maintainer said he was open to merging ScatterChat back into Gaim but did not make it a priority, and he noted how much work it took to keep a fork going. No merge ever happened. Gaim also changed its name: on 6 April 2007 the Gaim team announced a settlement with AOL over the “AIM” trademark, and Gaim became Pidgin, libgaim became libpurple and gaim-text became Finch. Pidgin 2.0.0, the first release under the new name, came out on 3 May 2007.
What was the difference between ScatterChat and Off-the-Record Messaging?
ScatterChat was meant to be a complete, integrated package for non-technical users, with an emphasis on documentation and ease of use. It offered encrypted file transfers and built-in Tor support. Off-the-Record Messaging, known as OTR, had the advantage of message deniability, meaning a transcript could not prove cryptographically who wrote what.
At the time the ScatterChat project said there was room for both tools, hinted that the two might work together, and called Off-the-Record Messaging an excellent alternative. No joint project followed. Of the two, only Off-the-Record Messaging is still distributed: its Pidgin plugin, version 4.0.2, is listed as current by the project and still ships in Debian 13 and Arch Linux. It only covers one-to-one chats inside Pidgin 2.x, though, and most people now use apps like Signal that encrypt end to end by default.
Why was ScatterChat’s encryption module licensed under the HESSLA?
The Hacktivismo Enhanced-Source Software License Agreement (HESSLA) took the GPL as its model but added a ban on use by human rights abusers and oppressive governments. Oxblood Ruffin of Hacktivismo and the Cult of the Dead Cow wrote it with attorney Eric Grimm, and it was published in November 2002. It also banned anyone from adding spyware or surveillance code to modified versions, and it let both Hacktivismo and end users take legal action against misuse.
Those restrictions made the HESSLA incompatible with the GPL. The project said this was why SourceForge turned down its hosting request and why some Linux distributions would not package ScatterChat. Neither the Free Software Foundation nor the Open Source Initiative has approved the HESSLA, so it is not an approved free software or open source licence.
The developers admitted they did not know how well the licence would work in practice. They argued that it reflected the spirit of the project and opened a debate in the open-source world. Should every user benefit from developers’ work, whatever they do with it? Was it right that a government-backed project such as China’s Red Flag Linux could build on free software? Should authoritarian governments have access to tools that make their aims easier to achieve?
The project’s view was that even if the community rejected the HESSLA, it would have succeeded by starting that debate, getting developers to rethink their beliefs and drawing attention to hacktivism, which it saw as a new and growing idea.
If the HESSLA restricted human rights abusers, could the United States government use ScatterChat?
The maintainer answered this one himself, in strongly worded terms that reflected the politics of 2006. His answer is summarised here as history. It is not legal guidance, and it is not this site’s position.
He wrote that because of what he saw as the Bush administration’s lack of respect for basic human rights, US government agents were not allowed to use ScatterChat by default. He offered to make exceptions department by department and published a list that he said was incomplete. The departments he allowed were:
- The Department of Education.
- The Department of Justice, including the FBI. He said this might surprise people coming from a privacy advocate, but he respected the FBI and thought most agents were honourable. He pointed out that public corruption and civil rights abuses were among the Bureau’s stated priorities at the time.
- The Department of Commerce.
- The State Department. He praised its work pushing other countries to respect human rights and complained that the White House often watered down its recommendations.
- The Department of the Treasury. He added it with a joke about the IRS and his yearly tax bill.
He explicitly denied permission to three organisations:
- The Department of Defense, over the treatment of prisoners at Guantanamo Bay and policies he said supported torture.
- The Central Intelligence Agency, over the abduction of foreign nationals in Europe and their transfer to countries where they faced torture.
- The White House, for not reversing those policies and, in his words, violating the Constitution by spying on peaceful citizens without warrants.
He added that whistleblowers inside any department were encouraged to use ScatterChat.
What security researchers found in ScatterChat
Independent analysis turned up real protocol flaws within weeks of release. On 11 August 2006 Steven Murdoch of the University of Cambridge published “Protocol design is hard: Flaws in ScatterChat” on the Light Blue Touchpaper blog. He found three main problems:
- Leaky ECB-based encryption. Instant messages used a custom mode of operation built on ECB, and its padding leaked information. If a single conversation carried an extremely large number of messages, an eavesdropper could spot patterns. This was recorded as CVE-2006-4021, a birthday attack on the custom ECB padding. File transfers used CTR mode and were not affected.
- Partial forward secrecy. ScatterChat advertised perfect forward secrecy. Murdoch concluded that it held up if one party’s key was compromised, but not if both were.
- No identity binding or key confirmation. Because of this gap, the protection could be bypassed in some cases.
Murdoch judged the practical impact as low. The flaw did not let an eavesdropper decrypt messages or unmask a user who was routing through Tor. His overall verdict was that the flaws were not critical but did create a vulnerability under some threat models. The developers said they would fix the issue in version 2.0.
The lesson has aged well. Homemade protocols built by small teams tend to fail in ways only outside review catches, which is why today’s advice points to tools whose cryptography has been published and studied in the open.
What to use instead in 2026
You should replace ScatterChat with tools that are maintained, open to public review and actively patched. Two of them cover most of what it tried to do.
| Need ScatterChat tried to meet | Maintained option today | What it does NOT protect |
|---|---|---|
| End-to-end encrypted chat and files | Signal (Signal Protocol, post-quantum SPQR layer since October 2025) | Your phone number is still needed to register, and a compromised phone exposes your messages |
| Hiding where you connect from | Tor Browser from the Tor Project | Anything you reveal yourself, such as logging in to accounts tied to your name |
| Deniable one-to-one chat in a desktop client | Off-the-Record Messaging plugin 4.0.2 for Pidgin 2.x | Group chats, and contacts who are offline |
On 2 October 2025 Signal added SPQR, a post-quantum ratchet that runs alongside its Double Ratchet. Signal calls the result a “Triple Ratchet”, and it uses ML-KEM-768. The design draws on research presented at Eurocrypt 2025 and USENIX Security 2025, and PQShield reports that Cryspen was brought in to formally analyse the protocol and check the deployed code.
The Tor Project shipped stable Tor Browser updates every few weeks through 2026. Keep it updated rather than relying on an old build. No single tool makes you anonymous. Encryption protects what you say, but much of the metadata about who you talk to and when can still be exposed, depending on the service.
FAQ
Is ScatterChat still safe to use?
No. ScatterChat has not been maintained for many years, so known and unknown flaws will never be fixed. Its instant messaging encryption had a documented weakness, CVE-2006-4021, and its forward secrecy and identity checks were also flawed. Use a maintained messenger such as Signal instead.
Who made ScatterChat?
Hacktivismo made it. The group was linked to the Cult of the Dead Cow and released the client at H.O.P.E. Number Six in New York City on 22 July 2006. Public records credit J. Salvatore Testa II as its lead developer. It was a fork of the Gaim messenger, which was later renamed Pidgin.
Did ScatterChat make users anonymous?
Not on its own. It could send traffic through Tor, which makes it harder to trace where a user connects from. Murdoch’s analysis said the ECB flaw did not reveal the identity of a user who was using Tor. Even so, no tool from then or now guarantees full anonymity, because your own habits and your accounts can still identify you.
Is Off-the-Record Messaging still around?
Yes, but it occupies a niche. The Pidgin plugin’s current listed version is 4.0.2, built for Pidgin 2.x, and Debian 13 and Arch Linux still package it. It offers deniability for one-to-one chats, but for everyday use most security guides now point to apps that encrypt end to end by default.
What replaced ScatterChat for activists and journalists?
Signal is the common choice for encrypted messaging. Tor Browser is used to reach the open web and onion services without revealing your location. The EFF’s Surveillance Self-Defense guides explain how to choose between tools based on who you are trying to protect yourself from. That kind of threat modelling is the habit ScatterChat’s documentation tried to teach.
Is the HESSLA licence still used?
Rarely. Neither the Free Software Foundation nor the Open Source Initiative has approved it, and it is incompatible with the GPL, so mainstream projects avoid it. One derived licence, the Torrify Ethical Software License Agreement (TESLA), was used for a time by the xB Browser.
Sources
- Steven Murdoch, “Protocol design is hard: Flaws in ScatterChat”, Light Blue Touchpaper, University of Cambridge Computer Laboratory, 11 August 2006
- CVE-2006-4021, ScatterChat custom ECB padding birthday attack, National Vulnerability Database
- Signal, “Signal Protocol and Post-Quantum Ratchets” (SPQR announcement), October 2025
- PQShield, “Diving into Signal’s New Post-Quantum Protocol”
- Tor Project, tor-announce release notes for Tor Browser 15.0
- Electronic Frontier Foundation, Surveillance Self-Defense
- Off-the-Record Messaging, downloads page at cypherpunks.ca
- Hacktivismo, Hacktivismo Enhanced-Source Software License Agreement text
- LWN.net, coverage of the Gaim to Pidgin renaming, April 2007
- InfoWorld, “ScatterChat secures IM for dissidents”, 2006