It's possible that governments have been spying on our smartphone usage through our iOS and Android push notifications, according to an investigation conducted by U.S. Senator Ron Wyden and reported to the Department of Justice (via Reuters).
Senator Wyden warned in his letter that both Apple and Google can be compelled to release push notification data, Wyden's letter explains, which can contain metadata that is of interest to governments. This can detail the app, the device and the account of the person who received the notification, but could also contain other unencrypted content, including app backend functions or the actual text that has been sent to the user.
Both Apple and Google stated to Wyden's team that, due to a gag order from the federal government, they were prevented from sharing any information about requests relating to push notification data.
The letter cited a "tip" as the source of the information, but would not elaborate on who the tipper is. However, another source familiar with the matter confirmed to Reuters that both foreign and US government agencies have been asking Apple and Google for metadata related to Push Notifications. The source would not confirm which foreign countries were involved in making the requests but has described them as democracies allied to the United States.
Senator Wyden has called for the government to either repeal or modify policies that hinder public discussion about the practice, while Apple meanwhile has claimed that, with this information now being publicly available, it will aim to be more transparent about reporting these kinds of requests. It has since updated its law enforcement guidelines (PDF) to inform the public how push notifications can be used, and that this information "may be obtained with a subpoena or greater legal process".
Google too said it would make a "commitment to keeping users informed about these requests," in line with Senator Wyden.
However, the Department of Justice has declined to comment on the push notification surveillance, or if it had indeed enforced a gag order on both Apple and Google.
Turning off push notifications is your only option
Push notifications are one of those things that we, as users, never really think about. They are the most commonly used method for many apps to receive messages from a central source, which will often pass through a Google or Apple server on its way to you. As they have to be allowed to work by the user, and as such represent a lot of user interests and thoughts, they're an ideal surveillance target.
The statements in Apple's law enforcement guidelines suggest that turning off the push notifications will stop this data being transferred, at the expense of not getting pings when a new message or update appears. On Apple this is as simple as going into the Settings app, selecting Notifications and then toggling them off for each app.
Meanwhile, Android users can go into the Setting app, and then Notifications. From that menu they can go into Manage App Notifications they can deselect individual apps. This may be different depending on the model of the phone used.
Both Google and Apple claiming that they are aiming to be more open with how data is used is a good sign. However, the concerning use of an alleged gag order needs to be monitored and investigated, as does the possibility of surveillance via push notifications in general.
