Apple Now Requires a Judge's Consent To Hand Over Push Notification Data (reuters.com) 19
Apple has said it now requires a judge's order to hand over information about its customers' push notification to law enforcement, putting the iPhone maker's policy in line with rival Google and raising the hurdle officials must clear to get app data about users. From a report: The new policy was not formally announced but appeared sometime over the past few days on Apple's publicly available law enforcement guidelines. It follows the revelation from Oregon Senator Ron Wyden that officials were requesting such data from Apple as well as from Google, the unit of Alphabet that makes the operating system for Android phones.
Apps of all kinds rely on push notifications to alert smartphone users to incoming messages, breaking news, and other updates. These are the audible "dings" or visual indicators users get when they receive an email or their sports team wins a game. What users often do not realize is that almost all such notifications travel over Google and Apple's servers. In a letter first disclosed by Reuters last week, Wyden said the practice gave the two companies unique insight into traffic flowing from those apps to users, putting them "in a unique position to facilitate government surveillance of how users are using particular apps."
Apps of all kinds rely on push notifications to alert smartphone users to incoming messages, breaking news, and other updates. These are the audible "dings" or visual indicators users get when they receive an email or their sports team wins a game. What users often do not realize is that almost all such notifications travel over Google and Apple's servers. In a letter first disclosed by Reuters last week, Wyden said the practice gave the two companies unique insight into traffic flowing from those apps to users, putting them "in a unique position to facilitate government surveillance of how users are using particular apps."
What about third parties?! (Score:4, Informative)
Notifications get funneled through a variety of third-party SDKs when people build apps.
The most popular method is using Firebase, which is owned and controlled by Google (ironically, even most iOS apps use Firebase).
But Firebase is not the only vendor in this space. There is OneSignal, PushCrew, etc.
What are these companies doing to comply with these kinds of orders?
Re: (Score:2)
What are these companies doing to comply with these kinds of orders?
Likely nothing. The orders aren't for them. It so far only applies to requests from law enforcement to Apple.
Re: (Score:2)
What are these companies doing to comply with these kinds of orders?
Likely nothing. The orders aren't for them. It so far only applies to requests from law enforcement to Apple.
Sounds like Apple should form an alliance...
Re: What about third parties?! (Score:2)
Why wasn't it before? (Score:3)
This seems like a slam dunk for your customers; why didn't they have this policy before?
Re: (Score:2, Interesting)
This seems like a slam dunk for your customers; why didn't they have this policy before?
My guess? Because they hadn't been caught yet. Which makes me wonder how many other privacy leaks they're guilty of.
Re:Why wasn't it before? (Score:5, Informative)
This seems like a slam dunk for your customers; why didn't they have this policy before?
Because the government didn't allow them to tell that the method existed [techcrunch.com]. “In this case, the federal government prohibited us from sharing any information and now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”
Re: (Score:2)
Geeze we need "reporting" on every possible kind of malfeasance.
Then Apple can point to the correct ones and disclose.
Re: (Score:2)
This seems like a slam dunk for your customers; why didn't they have this policy before?
Because the government didn't allow them to tell that the method existed [techcrunch.com].
That's a non-answer. It might explain why Apple didn't publish the policy stating they required a judicial order, but it doesn't explain why they didn't have the policy, like Google did.
But to me the really interesting part of this statement is that they claim they were prohibited. That raises a *lot* of questions. Assuming the statement is true, there aren't a lot of mechanisms for the government to tell a company that they're not allowed to disclose something like this. The only one I can think of, actu
Got a warrant? (Score:2)
I'm currently doing development on Android and iOS. On Android we use Firebase. On Apple we use APNS directly.
As recommended by both Apple and Google our notification payloads are minimal: "You've got mail!". The app then phones home to retrieve its messages. I'm curious what you could learn from the notifications. We know the messages themselves are sensitive and take care to protect them. We know about CALEA [wikipedia.org] and related laws, but this is way about my paygrade.
...laura
Re: Got a warrant? (Score:2)
Quite possibly Apple would collect notifications when my phone is turned off and send them all together. Some messages can be merged. So after 200 mails I would receive ONE âoeyou got mailâ message when my phone is turned on.
Apple Now Requires a Judge's Consent? Nope. (Score:2)
Re: (Score:2)
Here's the text in the new Legal Process Guidelines. It doesn't say that a court order or warrant is required, just that it's a suitable method. So "Apple Now Requires a Judge's Consent To Hand Over Push Notification Data" is not actually what Apple is committing to.
Excuse me.
Where are the words "Suitable Method" in your Quoted Text?
Re: (Score:2)
Where are the words "Suitable Method" in your Quoted Text?
I have no relation to the previous poster, but the direct answer is that those words don't appear.
I believe that the point that poster was making was that by saying "(information) may be obtained with (documents)" is that this particular wording does not address the issue of whether there are other ways to obtain the information. Some sort of exclusionary wording such as "(information) may only be obtained with (documents)" would mean that no other methods of obtaining the information were available.
Re: (Score:2)
Thank you. Since the info has always been obtained from Apple by court order or warrant, Apple's statement actually just says that they will follow the law.
Re: (Score:2)
Thank you. Since the info has always been obtained from Apple by court order or warrant, Apple's statement actually just says that they will follow the law.
Exactly. What else does everyone expect?
Re: (Score:2)
Where are the words "Suitable Method" in your Quoted Text?
I have no relation to the previous poster, but the direct answer is that those words don't appear.
I believe that the point that poster was making was that by saying "(information) may be obtained with (documents)" is that this particular wording does not address the issue of whether there are other ways to obtain the information. Some sort of exclusionary wording such as "(information) may only be obtained with (documents)" would mean that no other methods of obtaining the information were available.
So, as I implied, he was lying.
This won't last long ... (Score:5, Informative)
https://www.eff.org/deeplinks/... [eff.org]
Not while the Intel community [thefederalist.com] turns the 4th amendment into swiss cheese.