Apple and Google phone users spied on through phone push notifications

U.S. Senator Ron Wyden warned that foreign governments are spying on smartphone users by compelling Apple and Google to turn over push notification records, according to a letter he sent to Attorney General Merrick Garland Wednesday.

Wyden, D-Ore., said his office investigated a tip from last year alleging that government agencies have been “demanding” these records from both companies. Since push notifications like news alerts, emails, and social media alerts travel through Apple and Google’s servers, they can reveal unique insights about how individual people use particular apps, Wyden explained in the letter.

Governments can force Apple and Google to hand over these records, just like they can be compelled to share any other information they have regarding their users, according to the letter. In the U.S., however, Wyden said information about push notification records cannot be released to the public.

“Apple and Google should be permitted to be transparent about the legal demands they receive, particularly from foreign governments, just as the companies regularly notify users about other types of government demands for data,” Wyden wrote. “I would ask that the DOJ repeal or modify any policies that impede this transparency.”

Push notification records can reveal which app received a notification, when it was received, the phone and Apple or Google account that the notification was delivered to, and in some cases, the unencrypted text displayed in the notification, according to the letter.

Wyden did not specify which governments have asked Apple and Google for push notification records. The senator’s office did not immediately respond to CNBC’s request for comment.

A source confirmed to Reuters that foreign government agencies, as well as U.S. government agencies, have asked both Google and Apple for information from push notifications. For instance, the agencies have asked for metadata that can help connect anonymous users on messaging apps to specific Apple and Google accounts, according to the report.

“In this case, the federal government prohibited us from sharing any information,” an Apple spokesperson said. “Now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”

A Google spokesperson said the company shares Wyden’s commitment to keeping people informed about requests for push notification records.

“We were the first major company to publish a public transparency report sharing the number and types of government requests for user data we receive, including the requests referred to by Senator Wyden,” the spokesperson said in a statement. The company did not clarify where it publishes requests for information about push notification records, or if it is restricted.

The Department of Justice did not immediately respond to requests for comment.