
Last week Apple fixed an issue that let the FBI forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app had been deleted, because copies of those messages were stored in the iPhone’s notification database. The move comes directly in response to 404 Media’s coverage of a case in which the FBI was able to extract a suspect’s deleted Signal messages. Apple’s fix means iPhones should no longer save copies of deleted messages from Signal or other apps, and Apple said the patch also purges already saved and related notifications.
While Apple described the issue as a bug, it is one that the FBI has leveraged multiple times to recover the content of Signal messages, according to court records.
“We are very happy that today Apple issued a patch and a security advisory. This comes following 404 Media reporting that the FBI accessed Signal message notification content via iOS despite the app being deleted,” Signal posted on social media on April 22.
💡
Do you know anything else about encrypted messaging apps? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.
Apple’s advisory, which the company sent to 404 Media on the same day, is focused solely on the saved messages issue. It says, “A logging issue was addressed with improved data redaction.” In a follow-up email, Apple said it identified a bug that could cause iPhones to unexpectedly save notifications that were marked for deletion, and that the new patch also retroactively purges any of those saved notifications. Apple said it is the company’s policy to remove any associated notifications when a user has deleted an app.
The case 404 Media covered was related to the ICE Prairieland Detention Facility in Alvarado, Texas, in which a group of people set off fireworks and vandalized property, and one person shot a police officer in the neck. It was the first time authorities charged people for alleged “Antifa” activities after President Trump designated the umbrella term a domestic terrorist organization in September.
404 Media spoke to two people who were present for the testimony of FBI Special Agent Clark Wiethorn during a related trial. They both said the FBI was able to recover incoming Signal messages; that was even though the user had deleted the Signal app from her phone. Harmony Schuerman, an attorney representing defendant Elizabeth Soto, shared notes she took with 404 Media. “They were able to capture these chats bc [because] of the way she had notifications set up on her phone—anytime a notification pops up on the lock screen, Apple stores it in the internal memory of the device,” she wrote in those notes.
A supporter of the defendants said, “We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device.” 404 Media granted this person anonymity to protect them from retaliation.
404 Media also highlighted another case in which the FBI was able to recover incoming Signal messages saved in an iPhone’s notification database. A court record in that case included a long list of Signal messages, and said, “Phone notifications that captured incoming Signal messaging.” Some of those messages were several lines long, indicating that the iPhone’s notification database captured not just a small preview of incoming messages, but their entire content.
Signal’s social media post added: “Note that no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications.”
“We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue. It takes an ecosystem to preserve the fundamental human right to private communication,” it concluded.