Push notifications – those pop-up alerts on your phone generated by apps when you aren’t using them – are now being used by federal and state police in criminal investigations.
As a Fort Lauderdale criminal defense lawyer, it’s my job to stay up-to-date on the ways in which Florida criminal investigations are evolving – which they are doing constantly as technology advances. Push notification intel, metadata generated by the app companies, are one we expect will catch more than a few folks by surprise. Already, their use has raised alarm among privacy experts.
Also known as “push alerts,” they’re pretty much standard with use of any modern smartphone. They essentially “wake up” the phone to alert users to important updates or news, without the user having to constantly keep the phone on (and also without the user’s interaction). When they are sent, they generate a small string of code, known as a push token. That little bit of data is stored on servers owned by Google and Apple (out of reach of users), which can be requested or subpoenaed by police to pinpoint the email addresses, device, and location of individuals suspected of crimes. It can also tell investigators who you’re talking to and sometimes the content of those communications.
It’s been used on apps like Talkatone (a phone service) and encrypted messaging apps like TeleGuard and Wickr. Although these apps promised users it would save no data, developers still crafted a system of collecting push tokens linking back to users through push notifications. Police have even been able to successfully obtain the two-factor authentications for these apps by requesting coding from the tech companies.
Although some of this information has been simply handed over to law enforcement upon request, company polices are slowly shifting to require court orders before doing so. But as a Fort Lauderdale criminal defense lawyer can explain, that doesn’t necessarily ensure your data will be private – especially because such policies can often be sidestepped if the police are asserting “exigent” or emergency circumstances.
Although advocates say this data is mostly used for cases involving child pornography, kidnapping, and homicide, it’s not limited to those. The Washington Post was able to identify at least 130 search warrants and court orders that law enforcement agencies had submitted to Facebook, Google, Apple and other technology firms for push alerts data. Those included criminal investigations into cases involving drugs, guns, and the events of Jan. 6, 2021 in Washington, D.C. Continue reading