A Democratic senator warned on Dec. 6 that unidentified governments are surveilling iPhone and Android users via their apps’ push notifications.
Google’s and Apple’s push notifications mean that the two firms are “in a unique position to facilitate government surveillance of how users are using particular apps,” the senator wrote. His letter didn’t elaborate on the foreign governments that may have used them to surveil users.
“Apple and Google should be permitted to be transparent about the legal demands they receive, particularly from foreign governments, just as the companies regularly notify users about other types of government demands for data,” Mr. Wyden wrote in the letter.
Mr. Wyden said that as “with all of the other information these companies store for or about their users, because Apple and Google deliver push notification data, they can be secretly compelled by governments to hand over this information.”
“These companies should be permitted to generally reveal whether they have been compelled to facilitate this surveillance practice, to publish aggregate statistics about the number of demands they receive, and unless temporarily gagged by a court, to notify specific customers about demands for their data,” he said.
Mr. Wyden also called on the Department of Justice (DOJ) to repeal or change “any policies that impede this transparency.”
In a statement to several media outlets, Apple stated that Mr. Wyden’s letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.
“In this case, the federal government prohibited us from sharing any information,” the company said in a statement. “Now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”
Google stated that it shared Mr. Wyden’s “commitment to keeping users informed about these requests.”
Most users give push notifications little thought, but they’ve occasionally attracted attention from technologists because of the difficulty of deploying them without sending data to Google or Apple. Earlier this year, French developer David Libeau said users and developers were often unaware of how their apps emitted data to the U.S. tech giants via push notifications, calling them “a privacy nightmare.”
In 2021, Apple filed a lawsuit against the NSO Group, which the company described in a statement as a “state-sponsored” actor that spends “millions of dollars on sophisticated surveillance technologies without effective accountability.”
Pegasus has been used to surveil only a small number of individuals, Apple has stressed. But it stated that “researchers and journalists have publicly documented a history of this spyware being abused to target journalists, activists, dissidents, academics, and government officials.”
