A Democrat senator warned Wednesday that unidentified governments are surveilling iPhone and Android users via their apps' push notifications.
In a letter to the Department of Justice, Sen. Ron Wyden (D-Ore.) said that his office received a tip that foreign government agencies were demanding that "push" notification records from Apple and Google be provided. He warned that those notifications, which are shown on an Android phone's or iPhone's respective front screens, can be used to spy on users.
Google's and Apple's push notifications mean the two firms are "in a unique position to facilitate government surveillance of how users are using particular apps," the senator wrote. His letter did not elaborate on the foreign governments that may have used them to surveil users.
“Apple and Google should be permitted to be transparent about the legal demands they receive, particularly from foreign governments, just as the companies regularly notify users about other types of government demands for data,” Mr. Wyden wrote in the letter,
Mr. Wyden noted that as "with all of the other information these companies store for or about their users, because Apple and Google deliver push notification data, they can be secretly compelled by governments to hand over this information."
“These companies should be permitted to generally reveal whether they have been compelled to facilitate this surveillance practice, to publish aggregate statistics about the number of demands they receive, and unless temporarily gagged by a court, to notify specific customers about demands for their data," he added.
Related Stories
Mr. Wyden also on the Department of Justice (DOJ) to repeal or change “any policies that impede this transparency.”
In a statement to several news outlets, Apple said that Wyden's letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.
"In this case, the federal government prohibited us from sharing any information," the company said in a statement. "Now that this method has become public we are updating our transparency reporting to detail these kinds of requests."
Google said that it shared Wyden's "commitment to keeping users informed about these requests."
“We were the first major company to publish a public transparency report sharing the number and types of government requests for user data we receive, including the requests referred to by Senator Wyden,” the Google statement said.
Most users give push notifications little thought, but they have occasionally attracted attention from technologists because of the difficulty of deploying them without sending data to Google or Apple. Earlier this year French developer David Libeau said users and developers were often unaware of how their apps emitted data to the U.S. tech giants via push notifications, calling them "a privacy nightmare."
In a separate case, Apple several months ago released an update to iPhones and other devices to deal with the Pegasus spyware created by Israel-based NSO Group. Researchers with the University of Toronto’s Citizen Lab said in a post in September they found Pegasus on an Apple device of an employee who worked at a Washington-based civil society group.
In 2021, Apple filed a lawsuit against NSO Group, which the firm described in a news release as a "state-sponsored" actor that spends "millions of dollars on sophisticated surveillance technologies without effective accountability."
Pegasus has only been used to surveil a small number of individuals, Apple has stressed. But it said that "researchers and journalists have publicly documented a history of this spyware being abused to target journalists, activists, dissidents, academics, and government officials."
"Apple devices are the most secure consumer hardware on the market—but private companies developing state-sponsored spyware have become even more dangerous," Apple said at the time.
Reuters contributed to this report.