US subpoena provides insight into Signal metadata availability
The American organization ACLU has published a subpoena that provides insight into what data the makers of the crypto chat app Signal have access to. They can only see when an account has been created and when the server has been connected.
The ACLU civil rights movement writes that earlier this year the US government wanted access to all data associated with two phone numbers. The government did this by means of a subpoena, or subpoena, to Open Whisper Systems, the organization behind Signal. Open Whisper Systems replies that one of the two telephone numbers is known to the service. The only relevant information it can provide regarding that number is the account creation date and the last time the account was connected to the Signal servers.
Open Whisper Systems states that it cannot provide any additional information, because it does not have it. The ACLU, which represented the Signal makers in the case, further writes that along with the subpoena, the government also imposed a silence order for a period of one year. The reason for this was that information about the existence of the subpoena could seriously jeopardize the ongoing investigation, the government said. The civil rights movement has objected to this gag order, which means that some of the documents are now available for inspection. Typically, companies are required to keep these requests secret by the US government.
According to the ACLU, this shows that the government uses these kinds of silence orders far too broadly, even if they are not actually necessary. The New York Times reports that Microsoft filed a lawsuit against the US government in April, alleging that it is overused. Also, the commands would often be issued without a time limit, unlike the command to Open Whisper Systems.
Signal uses end-to-end encryption and the underlying protocol is used, among other things, to secure messages in chat apps such as WhatsApp and Facebook Messenger. As a result, with a correct implementation, the companies have limited insight into the message traffic and can only view metadata. Which data that is exactly depends on the service. That Signal does not have additional user information is also described in the privacy policy. It was recently revealed that Apple’s iMessage stores metadata about the people a user has contacted.