Governments Can Spy on Your Push Notifications

If I told you governments were spying on you through your smartphone, would you be surprised? Probably not. We all know these little black mirrors are privacy nightmares, even with the extensive data protection features both Apple and Google have added over the years.

However, you'll likely be surprised to learn that governments aren't necessarily tracking your location through your phone's GPS, or tapping into your phone calls (although who knows): We now know they're actually spying on you through your push notifications, of all things.

How governments steal your push notification data

The only reason we know about this is thanks to Ron Wyden. The Oregon senator sent a letter to the Department of Justice (DOJ) on Wednesday urging them to let Apple and Google warn their customers about requests for their smartphone usage.

In the letter, Wyden explains his office received a tip in the spring of 2022 which claims foreign governments were demanding Apple and Google hand over push notification records from users. In the time since, Wyden's office has investigated the issue: When they contacted Apple and Google about this concerning assertion, the companies both said the federal government had blocked them from being able to comment on the practice. That's chilling.

As the letter explains, push notifications aren't a one-to-one connection from your smartphone to the app or service pushing the alert. These notifications need to first pass through Apple and Google's servers: On Apple's side, that's Apple Push Notification Service, while Google uses Firebase Cloud Messaging. All of your push notifications that rely on an internet connection run through these servers before ending up on your iPhone or Android, which means they're all susceptible to this overreach from government agencies.

These push notifications contain quite a bit of data, too. When Apple and Google receive push notification data to their servers, they intercept metadata (data about the app that is receiving the push notification), as well as details about the phone and account that notification belongs to. If Duolingo is trying to send a notification to "Jake's iPhone 14 Pro" on Thursday at 10 a.m., governments demanding my push notification info from Apple might be able to see exactly that.

This is a great moment to implore you to use encrypted messaging services for your texting needs. Encrypted content won't appear in the data that third-parties receive from Apple and Google, so governments aren't actually able to read your iMessages, RCS texts, or WhatsApp alerts, for example. However, if they intercept push notifications from unencrypted alerts, such as messages sent using SMS or an unencrypted Instagram DM, they might be able to see that as part of the data they obtain. The secrets you text through unencrypted methods are kept by you, your friend, and governments around the world.

According to Wired, governments and law enforcement agencies that want this data must first retrieve your push notification "token" from an app developer. You're assigned a token by the apps you download on your devices, which connects you to their push notifications. The government can then take your token to Apple or Google to demand information on the account associated with that token. This has happened in the US before: In 2021, in a Jan. 6-related case, the FBI requested the push notification data for two Meta accounts. Meta did not respond to Wired's request for comment.

Wyden is imploring the DOJ to allow Apple and Google to be more transparent about these requests with the public. Apple, for their part, says that this letter now empowers them to be more public about the practice, although how public they'll be remains to be seen.

What you can do to protect your data from push notification spies

At this point, the details surrounding this practice are still muddy, but that doesn't mean we should sit idly by and wait for Apple and Google to make statements.

If you want to go extreme, you should disable push notifications for all your apps. I'm a big supporter of keeping notifications off for almost all apps, except the ones you actually need, and the recent news only bolsters my stance. There's absolutely no reason that governments, foreign or domestic, should be allowed to see what my apps are notifying me about, but it feels especially egregious to allow them to do it when it's just Snapchat desperately asking me to open the app.

I think you'll find a solid 90% of the apps sending you alerts on your iPhone or Android are bullshit anyway, so disabling them with give you peace of mind and strengthen your privacy. Of course, disabling notifications for certain apps can backfire: You're likely to fall behind in group chats if you disable notifications for your messaging apps, and you might miss meetings and appointments disabling notifications for your calendar. (Sorry, boss.)

At the end of the day, it's a balancing act between privacy and convenience, as it always is. Even with today's news, I'd have trouble disabling notifications for Messages, although it helps that iMessage is encrypted. But other apps I'm more than happy to keep turned off, so I can catch up with them on my own time. (Looking at you, Snapchat.)

All that said, the larger solution will have to come from larger forces. You shouldn't have to disable notifications to preserve your privacy, and governments shouldn't be allowed to ask for this info anyway. Hopefully, Sen. Wyden's letter makes some change in Washington.