Governments will find push notification spying harder to do now that they no longer enjoy easy access to records of push notifications sent to iPhone users. Apple changed its policy so that law enforcement and other government agencies need a court order to obtain this data.
Previously, the data — which could be used to gain info about users’ activities — was available from Apple with just a subpoena.
Push notifications spying: A new form of digital surveillance
Push notification spying became a public controversy after Sen. Roy Wyden published an open letter to Attorney General Merrick B. Garland in early December.
“Apple and Google are in a unique position to facilitate government surveillance of how users are using particular apps,” Wyden wrote at the time. “I write to urge the Department of Justice (DOJ) to permit Apple and Google to inform their customers and the general public about demands for smartphone app notification records.”
Apple and Google keep records of when an app sends a push notification to an iPhone or Android device. These can be used to track what someone is doing, and perhaps even where they are. That’s different from systems like iMessage that are protected by end-to-end encryption.
The end of easy push notification spying on iPhone users
As indicated by Wyden’s open letter, Apple had previously been barred from saying anything about push notification spying. The company said in a statement on December 7 that “the federal government prohibited us from sharing any information and now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”
Before the change, the Apple ID associated with push notifications could be obtained with a subpoena, which is much easier to get than a court order. Since then, Apple updated its Legal Process Guidelines document (.pdf) to say that this data “may be obtained with an order under 18 U.S.C. §2703(d) or a search warrant.” That means a judge now must approve the data request.
That makes Apple’s policy essentially the same as Google’s, which previously required a court order to obtain push notification records.
Via: Reuters
