California Prosecutors Are Still Trying To Get Signal To Hand Over User Info It Simply Doesn't Possess
from the keep-burning-that-toner,-g-men dept
Encrypted messaging app Signal is slowly educating federal prosecutors on the meaning of the idiom "blood from a stone." Usually this refers to someone who is judgment-proof (or extortion-proof or whatever), since you can't take money a person doesn't have.
This would be the digital equivalent. Prosecutors in California have tried three times this year to obtain data on Signal users that Signal never collects or retains. Issue all the subpoenas you want, Signal says, but don't expect anything to change. We can't give you what we don't have. (h/t Slashdot)
Here we are in the second half of 2021, Signal still knows nothing about you, but the government keeps asking.
Because everything in Signal is end-to-end encrypted by default, the broad set of personal information that is typically easy to retrieve in other apps simply doesn’t exist on Signal’s servers. Once again, this request sought a wide variety of information we don’t have, including the users’s name, address, correspondence, contacts, groups, call records.
As usual, we couldn’t provide any of that. It’s impossible to turn over data that we never had access to in the first place. Signal doesn’t have access to your messages; your chat list; your groups; your contacts; your stickers; your profile name or avatar; or even the GIFs you search for. As a result, our response to the subpoena will look familiar. It’s the same set of “Account and Subscriber Information” that we can provide: Unix timestamps for when each account was created and the date that each account last connected to the Signal service.
That’s it.
That handles one request from prosecutors in Santa Clara County, California. Another one was greeted with the same response a few days later -- this time from the Central District of California. Apparently the lesson wasn't learned back in April, when the same district made the same request for data and got the same answer from Signal. Two grand jury subpoenas and one search warrant later and the answer remains the same.
The search warrant had a few more wrinkles of the government variety, even if the end result was Unix timestamps. According to the Signal post, the government attached a gag order to this warrant and renewed it four times while being told by Signal that the company had nothing more to turn over in response. There was nothing remotely adversarial about this process. The government made four secrecy requests, got all four granted -- all without acknowledging Signal's motion to unseal. The court also refused to schedule a hearing or even return phone calls from Signal's legal reps.
It seems like the government will keep trying, though. Signal doesn't get hit with many requests for user info, but prosecutors spending the public's money seem willing to define insanity through their ineffective actions. And for companies providing encrypted communications, the best way to protect users is to gather as little info about them as possible. When the government comes knocking, it's sometimes best to have nothing to give it.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: california, encryption, privacy, prosecutors, subpoenas
Companies: signal
Reader Comments
Subscribe: RSS
View by: Time | Thread
Take a page from libraries
Libraries learned this long ago. The government will eventually want to know what you know about patrons, so just don't collect it, or make sure that your information is purged regularly.
[ link to this | view in thread ]
A la Simpsons:
Dzzt OW!
Dzzt OW!
Dzzt OW!
[ link to this | view in thread ]
Well, I guess that means Signal will end up in contempt of court for not bothering to collect the required data.
[ link to this | view in thread ]
"The court also refused to schedule a hearing or even return phone calls from Signal's legal reps."
Well its good to see that the 'justice' system is balanced.
Once does wonder why those who have sent more than 1 request are still employed. They company told them here is 2 dates, its the ONLY information we have to give you... and they still send requests demanding data they imagine has to exist.
One also wonders what these investigations were & why super secret don't tell anyone about this was required.
[ link to this | view in thread ]
Re:
"and they still send requests demanding data they imagine has to exist."
Perhaps they think that if they keep asking for the data, Signal will get the message and start collecting it.
[ link to this | view in thread ]
Re: Take a page from libraries
Libraries learned this long ago.
I used to run an OPAC over a decade ago. The Chief Technical Archivist had me purge all check out data for a book once it was checked back in, including the transaction backups. That meant I had to make "cold" backups each night. I finally got funds to make a RAID 50, then break the RAID for backups, then re-sync it after the backup.
[ link to this | view in thread ]
'It's not coming out of my bank account so...'
It's amazing the sort of behavior that agencies are willing to engage in when it's not their money they're wasting.
[ link to this | view in thread ]
So basically…
What the prosecutors did could be comparable (if far less violent and deadly) to getting Saddam Hussein to give up his weapons of mass destruction. That is, you can't make someone relinquish what they don't have, and if you do, it is you who is the Barbarian, not the victim.
[ link to this | view in thread ]
maybe court officials do not understand how an app can work without recording user data ,
since most apps record tons of user data
i think they can still say user xx sent a message at 5pm, but i could be wrong .
[ link to this | view in thread ]
Re: Re: Take a page from libraries
Yep, my library friends were just talking about how a feature an ed-tech company was trying to sell them (that their system used prior checkout info to better recommend books) was the thing that made them decide to never use that company's products.
[ link to this | view in thread ]
Been using Signal since the beginning and as long as they continue to do stuff like this I will continue to use them. If law enforcement wants to see my messages, serve me with a search warrant and stop trying to use subpeonas and the Third Party doctrine to violate my rights.
[ link to this | view in thread ]
[ link to this | view in thread ]
Re: Re:
That is precisely what prosecutors want Signal to do, and they can always petition for a court order forcing Signal to start collecting this data.
[ link to this | view in thread ]
Gag order constitutionality
Last I checked, gag orders were only (barely) constitutional because they are limited in time, limited in scope, and can be challenged in court.
If they can be extended indefinitely by ex parte proceedings, and the court simply ignores attempts to challenge one, then they lose whatever constitutionality they ever had.
What’s the penalty for ignoring an order a court has no authority to make in a court proceeding you aren’t a party to?
[ link to this | view in thread ]
Re: Re: Re:
Signal lawyer(s): You and what law?
Forcing a company to hand over data they already have is one thing, demanding that they shoot their own business in the back by crippling the encryption they use so that they start collecting that data explicitly so that you can demand it from them might be a bit higher a legal hurdle to pass, though given how eager the court was to sign off on the gag orders it also wouldn't surprise me if they gave that the green-light too.
[ link to this | view in thread ]
Re: Gag order constitutionality
What’s the penalty for ignoring an order a court has no authority to make in a court proceeding you aren’t a party to?
Vastly more than the prosecutor and/or judge would face for asking for/issuing those gag orders.
It's one thing to say that gag orders are already on shaky constitutional ground and that unchallengable gag orders should be treated as well into unconstitutional territory but you still need to get one or more judges to agree with that and have the money needed to do so, until you do that you're going to leave yourself wide open for penalties for violating what will be treated as a valid court order.
[ link to this | view in thread ]
Probably a checklist at the prosecution office
[ link to this | view in thread ]
Of course they can
Of course Signal can produce the information demanded. All they have to do is nerd harder.
[ link to this | view in thread ]
Re:
Maybe they thought Signal was lying, because they think all services collect all the information they can on their users.
[ link to this | view in thread ]