Governments Using Push Notifications to Surveil Users
Senator Ron Wyden said foreign officials were demanding the data from the tech giants to track smartphones. The traffic flowing from apps that send push notifications put the companies “in a unique position to facilitate government surveillance of how users are using particular apps,” Wyden said.
[…]
In a statement given to Reuters, Apple said that Wyden’s letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.
[…]
Apple advises developers not to include sensitive data in notifications and to encrypt any data before adding it to a notification payload. However, this requires action on the developers’ part. Likewise, metadata (like which apps are sending notifications and how often) is not encrypted, potentially giving anyone with access to the information insight into users’ app usage.
We at the Home Assistant Companion for iOS team have been wanting to implement end to end encryption for our push notifications for a while now but Apple has denied our request for the com.apple.developer.usernotifications.filtering entitlement multiple times. Wondering if with today’s news we could apply again and get it.
Previously:
Update (2023-12-08): Ashley Belanger:
Apple has since confirmed in a statement provided to Ars that the US federal government “prohibited” the company “from sharing any information,” but now that Wyden has outed the feds, Apple has updated its transparency reporting and will “detail these kinds of requests” in a separate section on push notifications in its next report. Ars verified that Apple’s law enforcement guidelines now notes that push notification records “may be obtained with a subpoena or greater legal process.”
[…]
A source familiar with Wyden’s probe told Reuters that “both foreign and US government agencies have been asking Apple and Google for metadata related to push notifications to, for example, help tie anonymous users of messaging apps to specific Apple or Google accounts.” The source could not confirm how long agencies had been sending the requests and would only describe the foreign governments as “democracies allied” to the US.
This is an entire category of stuff the U.S. government has apparently prohibited Apple and Google from disclosing and it is a good reminder that their transparency reports exist at the behest of governments, with their limitations imposed. But, also, Apple specifically blames the “federal government” — I take that to mean the U.S. federal government. Why would they be able to prevent Apple from disclosing this category of law enforcement requests from other countries?
Joseph Cox of 404 Media reviewed one warrant which mentioned push notifications in the case of an Ohio researcher, questioning whether it “is boilerplate language that has been included in the search warrant application”.
Update (2023-12-11): John Gruber:
Law enforcement agents can issue subpoenas on their own, so there’s no oversight here. Google, on the other hand, requires a court order[…]
Apple has updated its Legal Process Guidelines to reflect the company's legal obligation to comply with law enforcement requests for Apple ID information associated with its push notification service.
Tuta (via Hacker News):
When we redesigned the Tuta client back in 2017, we strictly focused on our mission to liberate everyone from being forced to use Google’s services. New evidence now shows this was an excellent move as Google and Apple monitor all your push notifications. But not so with Tuta: We offer one of the very few email apps available without Google’s push notification service. Technically, this was a true challenge; so let's explain how we succeeded!
See also: Bruce Schneier.
Update (2023-12-19): Raphael Satter (via Hacker News):
Apple has said it now requires a judge’s order to hand over information about its customers’ push notification to law enforcement, putting the iPhone maker’s policy in line with rival Google and raising the hurdle officials must clear to get app data about users.
2 Comments RSS · Twitter · Mastodon
@kparichan It sounds like that doesn’t allow what they want to do.
They want that special entitlement to suppress notifications. As others pointed out on Hacker News, and I've done myself, just supporting encrypted/private data in notifications can be done via a notification extension.