Unclassified FBI Document: Ability to legally access Secure Messaging App Content and Metadata (January 2021)
Unclassified FBI Document: Ability to legally access Secure Messaging App Content and Metadata (January 2021)
An official FBI document dated January 2021, obtained by the American association "Property of People" through the Freedom of Information Act.
This document summarizes the possibilities for legal access to data from nine instant messaging services: iMessage, Line, Signal, Telegram, Threema, Viber, WeChat, WhatsApp and Wickr. For each software, different judicial methods are explored, such as subpoena, search warrant, active collection of communications metadata ("Pen Register") or connection data retention law ("18 USC§2703"). Here, in essence, is the information the FBI says it can retrieve:
-
Apple iMessage: basic subscriber data; in the case of an iPhone user, investigators may be able to get their hands on message content if the user uses iCloud to synchronize iMessage messages or to back up data on their phone.
-
Line: account data (image, username, e-mail address, phone number, Line ID, creation date, usage data, etc.); if the user has not activated end-to-end encryption, investigators can retrieve the texts of exchanges over a seven-day period, but not other data (audio, video, images, location).
-
Signal: date and time of account creation and date of last connection.
-
Telegram: IP address and phone number for investigations into confirmed terrorists, otherwise nothing.
-
Threema: cryptographic fingerprint of phone number and e-mail address, push service tokens if used, public key, account creation date, last connection date.
-
Viber: account data and IP address used to create the account; investigators can also access message history (date, time, source, destination).
-
WeChat: basic data such as name, phone number, e-mail and IP address, but only for non-Chinese users.
-
WhatsApp: the targeted person's basic data, address book and contacts who have the targeted person in their address book; it is possible to collect message metadata in real time ("Pen Register"); message content can be retrieved via iCloud backups.
-
Wickr: Date and time of account creation, types of terminal on which the application is installed, date of last connection, number of messages exchanged, external identifiers associated with the account (e-mail addresses, telephone numbers), avatar image, data linked to adding or deleting.
TL;DR Signal is the messaging system that provides the least information to investigators.
Takeaways:
- End-to-end encryption works.
- The only trustworthy computer is your computer. Don't use cloud storage.
- The only trustworthy software is open-source software. Proprietary software serves the interests of the proprietor, not the user.
All of this was already well-known, of course, but it's always nice to get confirmation.
And FYI, the info about Signal was confirmed as they received a subpoena a couple years back, and their response was part of the public court records.
Yeah, Signals response pointing to how their service works and than all the data consisting of only these two things war hilarious.
What about if Apples **‘Advanced Data Protection’ ** which I’m not sure if it is only enabled with iCloud+ subscriptions. Where Apple claims that ‘Advanced Data Protection uses end to end encryption to ensure that data types listed here can only be decrypted on your trusted devices, protecting your information even in the case of a data breach in the cloud’ this list includes VERY sensitive things such as FULL device backups, FULL Message Backups (iMessage & SMS etc), iCloud Drive and a whole lot more. Mainly because Apple literally says on their settings page to turn this on ‘Because Apple will NOT have the keys required to recover your data, you will be guided through verification of your recovery methods in case you ever lose access to your account.’
Can someone verify whether using this would mitigate attempts at retrieval of the data and would require a very lengthy brute-force instead of just HANDING OVER the decryption keys.
Thank you OP for continuing bringing this to people’s attention.
signal ftw ✊
Telegram seem to provide the least info, not signal.
But Telegram also have access to more info about its users, considering that messages are not end to end encrypted by default, than Signal does of its. This means that Telegram can share any data it wants, its users are just hoping that it won't. In the case of Signal, they don't have access to any meaningful data in the first place. Also leaving these here:
https://www.wired.com/story/the-kremlin-has-entered-the-chat/
https://tech.hindustantimes.com/tech/news/russian-court-directs-telegram-to-share-encryption-keys-to-access-users-messaging-data-story-1ZhjHvyTQJ89RhhNnp4bGL.html
Here's my foolproof method of not having any issue with the FBI: Don't do illegal stuff.
While Don't break the law, asshole is solid advice for staying off the FBI's radar, it's not really a guarantee.
And sometimes, justice requires breaking the law. Remember that the Holocaust was legal and Stonewall was not.
I'm curious what/if any info can be retrieved from Matrix servers?
I believe Matrix has the same encryption as Signal. Though there are some things that leak metadata, like reactions for some reason. Would like an investigation into it as well, as I pretty frequently use it. Obviously this is assuming it's an encrypted chat. Though would also like to see the comparison of an invite only encrypted room, vs a public joinable encrypted room.
Nope. They are similar, but not the same: Comparison
i love how telegram isn't even encrypted or anything but they just ghost the authorities
This is why I prefer cloud services outside US jurisdiction, and refuse to use anything based in the USA - like iCloud. National Security Letters are a thing, and even massive companies like Apple can't fight them.
To clarify because this is always a point of confusion whenever the topic comes up. Telegram is, of course, transport encrypted. Someone listening on the wire cannot read your data. It is not end-to-end encrypted, meaning Telegram can always read your messages and can, in principle, give anyone access.
That's not entirely true. Telegram's one on one secret chat is end to end encrypted. As well as one on one voice and video calls. Group chats are not end to end encrypted.
Additionally Telegram does have an auto delete features built in for all of its chat types. So while I can't entirely rule out that Telegram could have a backup of a chat somewhere, you have a bit more piece of mind if you turn on the auto delete feature.