Unknown governments are spying on smartphone users through their apps’ push notifications, a U.S. senator warned Wednesday.
In a letter sent to the Justice Department, Sen. Ron Wyden said foreign officials are demanding data from Google and Apple, part of Alphabet. While details were skimpy, the letter opens up another avenue for governments to track smartphones.
Apps of all kinds rely on push notifications to alert smartphone users of incoming messages, breaking news and other updates.
These are audio or visual indicators that users receive when they receive an email or their sports team wins a match. Users often don’t realize that almost all such notifications go through Google and Apple’s servers.
That gives the two companies unique insight into the traffic going from those apps to their users and, in turn, puts them “in a unique position to facilitate government surveillance of how users use certain apps,” Wyden said.
He asked the Justice Department to “rescind or modify any policy” that prevents public discussion of spying on push notifications.
In a statement, Apple said Wyden’s letter gave them the opportunity to share more information with the public about how governments spy on push notifications.
“In this case, the federal government prohibited us from sharing any information,” the company said in a statement. “Now that this method is in the public domain, we are updating our transparency reporting to detail such requests.”
Google said it shared Wyden’s “commitment to informing users about such requests.”
The Justice Department did not respond to messages seeking comment on the push notification snooping information and whether it prevented Apple and Google from talking about it.
Wyden’s letter cites a “tip” as the source of the tracking information.
His staff did not specify what that tip was, but a source familiar with the matter confirmed that both foreign and U.S. government agencies have asked Apple and Google for metadata related to push notifications to, for example, help link anonymous users of messaging apps to specific Apple or Google accounts.
The source declined to name the foreign governments involved in the requests, but described them as democratic countries allied with the United States.
The source said he did not know how long such information had been collected in this way.
Most users give little thought to push notifications, but they sometimes catch the attention of technologists because of the difficulty of deploying them without sending data to Google or Apple.
Earlier this year, French developer David Libeau said users and developers are often unaware of how their apps send data to U.S. tech giants via push notifications, calling them a “privacy nightmare.”
