"Push Notifications," surveillence, and law enforcement

[Syonyk]

Or “Yet another way your cell phone is probably worse than you thought.”

Some stuff went around in December regarding push notifications, and it’s come up again.

https://www.washingtonpost.com/technology/2024/02/29/push-notification-surveillance-fbi/ / https://archive.ph/ktvJN is a recent article on it, talking about some of the usefulness of this technique.

The alleged pedophile “LuvEmYoung” had worked to stay anonymous in the chatrooms where he bragged about sexually abusing children. A criminal affidavit said he covered his tracks by using TeleGuard, an encrypted Swiss messaging app, to share a video of himself last month with a sleeping 4-year-old boy.

Cut through the 2024 election noise. Get The Campaign Moment newsletter.
But the FBI had a new strategy. A foreign law enforcement officer got TeleGuard to hand over a small string of code the company had used to send push alerts — the pop-up notifications that announce instant messages and news updates — to the suspect’s phone.

An FBI agent then got Google to quickly hand over a list of email addresses this month linked to that code, known as a “push token,” and traced one account to a man in Toledo, an affidavit shows. The man, Michael Aspinwall, was charged with sexual exploitation of minors and distribution of child pornography and arrested within a week of the Google request.

The breakthrough relied on a little-known quirk of push alerts, a basic staple of modern phones: Those tokens can be used to identify users and are stored on servers run by Apple and Google, which can hand them over at law enforcement’s request.

Of course, this should be gated by something robust, like, say, court orders and such, right? Right?

Google has said it requires court orders to hand over the push-related data. Apple said in December that it, too, would start requiring court orders, a change from its previous policy of requiring only a subpoena, which police and federal investigators can issue without a judge’s approval.

But in three of the four cases reviewed by The Post, Apple and Google handed over the data without a court order — probably as a result of the requests being made on an emergency, expedited or exigent basis, which the companies fulfill under different standards when police claim a threat of imminent harm.

Back in December, Wired had a writeup on the problem: Police Can Spy on Your iOS and Android Push Notifications | WIRED

If you have push notifications turned on for sensitive apps, you may want to reconsider your settings.
Content

The United States government and foreign law enforcement can demand Apple and Google share metadata associated with push notifications from apps on iOS and Android, according to a US senator and court records reviewed by WIRED. These notifications can reveal which apps a person uses, along with other information that may be pertinent to law enforcement investigations.

==========

Anyway. “Push notifications considered harmful.” You may want to disable them. It seems that turning them off in each app that uses them is probably better than the global setting, it’s unclear as to if the phone filtering them still allows them to be generated and sent and then mutes them at the phone end.

Or, just run a device that doesn’t support them. I believe GrapheneOS is one that doesn’t support the normal push notifications route these days, and of course flip phones don’t support that crap either!

[Aminda]

Won’t UnifiedPush partially resolve this for apps that support it?

https://unifiedpush.org/

While Ntfy is probably enough popular that I wouldn’t be surprised if the official instance was getting law enforcement requests, it can be selfhosted and there are also Nextcloud plugin and XMPP (mod_unifiedpush for Prosody, and some separate service that speaks with XMPP server) based solutions amongst others.

[Syonyk]

I’m not familiar with that - how usable is it for a typical end user who isn’t custom compiling all their apps?

[Aminda]

Well it depends on the app as that must support it and generally on the first launch the app just asks how the user wants the pushes offering either Google (unless the app is installed from F-Droid) or list of the UnifiedPush apps on device. For example FluffyChat Matrix client documentation (disclaimer: I am moderator there)

Push Notifications without Google Services

The UnifiefPush website would probably also give better explanations than me having morning coffee