A hot potato: Are foreign governments spying on you via push notifications provided by Apple and Google? US Senator Ron Wyden says it really does happen, and Apple has since confirmed the practice. It seems that the Department of Justice had been preventing the companies from revealing details of the process.
Wyden sent a letter to the DoJ on Wednesday urging the department to permit Apple and Google to educate the public about demands for smartphone app notifications.
The senator writes that his office received a tip in 2022 that government agencies in foreign countries were demanding push notification records from the two tech giants. Wyden’s staff has been investigating the tip for the past year, which involved contacting Google and Apple. The companies said information about the practice was restricted from public release by the government.
Push notifications cover a wide range of uses, from letting you know about new messages or updates to breaking news and in-app events. Wyden says most users are unaware that they pass through Apple’s and Google’s servers rather than coming directly from an app. The data the companies acquire include metadata detailing which app received a notification and when, as well as the phone associated with the account. They might also acquire unencrypted content that could include the text a user sees in an app notification.
Wyden says that Apple and Google can be “secretly compelled by governments to hand over this information,” and should be permitted to be transparent about the demands they acquire, particularly from foreign governments. He called on the Justice Department to repeal or change any policies that impede this transparency.
Apple has confirmed that the federal government prohibited the company from sharing any information about the process, but, following Wyden’s letter, it has now updated its transparency report to “detail these kinds of requests” in a separate section on push notifications. Cupertino’s law enforcement guidelines now note that push notification records “may be obtained with a subpoena or greater legal process.”
Google said it was committed to keeping users informed about these requests. “We were the first major company to publish a public transparency report sharing the number and types of government requests for user data we acquire, including the requests referred to by Senator Wyden,” Google said in a statement.
It’s unclear which foreign governments have been requesting the push notification metadata from Apple and Google and for how long. Reuters’ source describes them as “democracies allied” to the US.
