Elevated Surveillance Threat: How Foreign Governments Access Your Notifications

US Senator Ron Wyden has issued a warning about foreign governments engaging in espionage on smartphone users, urging Apple and Google to furnish data related to push notifications. In a letter addressed to Attorney General Merrick Garland, Wyden, a Democrat from Oregon, revealed that his office had scrutinized the data requirements of government agencies from both tech giants.

The focus is on push notifications, such as news alerts, emails, and social media notifications, which traverse the servers of Apple and Google, potentially unveiling unique insights into users’ application usage.

According to Wyden, authorities possess the capability to compel Apple and Google to provide logs and other user data. Notably, in the United States, information concerning push notification logs is not publicly disclosed. These logs can divulge details like the recipient app, reception time, the associated phone, and the relevant Apple or Google account, and occasionally the clear text of the notification.

The specific foreign governments that have sought push notification data from Apple and Google were not disclosed by Wyden. However, Reuters reports that both foreign and US government agencies have made requests for information through push notifications. Examples include requests for metadata aiding in connecting anonymous messaging app users to specific Apple and Google accounts.

An Apple spokesperson mentioned that the federal government initially imposed a ban on the company’s disclosure of any information. However, given the public acknowledgment of this practice, Apple plans to update its transparency report to incorporate data about such requests. Meanwhile, a spokesperson from Google affirmed the company’s alignment with Wyden’s commitment to informing users about push notification data requests.

Google, having been the first major company to release a transparency report detailing government requests for user data, intends to address these requests in its reporting, though the specific platform for disclosing push notification information was not specified.