Tucker explained how this guy inside an agency told him what they knew which was sent over Signal. They could have either compromised/compelled Signal or taken over his device. Although Tucker thought it was the former, I think the latter is more likely as it has been done many times.