Oregon Senator Rob Wyden alleged foreign governments may be spying on Americans through their push notifications in a letter to the U.S. Department of Justice (DoJ) Wednesday. Sen. Wyden asked Apple and Google to share this information with the U.S. government as well, which would evade the 1986 Electronic Communications Privacy Act (ECPA) that protects this data.
Push notifications allow Apple and Google to see detailed metadata about the information flowing to users, which could tie anonymous online accounts to specific people. Wyden’s request seems aimed at allowing the U.S. government to have greater access to this data, which it currently needs a search warrant to obtain. Google and Apple already notify users if their metadata is requested by a foreign government, according to their privacy agreements. The Democratic Senator from Oregon is asking the DoJ to “repeal or modify any policies” for Apple and Google to share this information, which seems to refer to the ECPA.
Apple and Sen. Wyden did not immediately respond to Gizmodo’s request for comment.
Wyden received a “tip” last year that foreign governments were “demanding” smartphone push notification records, and Apple largely confirmed that this was the case in a statement to Reuters Wednesday.
“In this case, the federal government prohibited us from sharing any information,” Apple told Reuters. “Now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”
The House of Representatives also turned its attention to cybersecurity Wednesday, according to The Record. The House Judiciary Committee overwhelmingly approved a bipartisan bill that would require all U.S. spy agencies to obtain a court warrant before searching for data about Americans.
Apple will already “notify customers when their Apple account information is being sought in response to legal process from government” in its privacy guidelines. Google has a similar policy, however, neither of them can give the U.S. government access to the same information because of the ECPA. Currently governing bodies in America have to obtain a search warrant to see data about push notifications.
However, Wyden’s request exposes a loophole in the ECPA that allows Apple and Google to disclose information on an “emergency basis,” outlined in Apple’s privacy terms. His request seems to fall under that category. Apple and Google releasing metadata around push notifications to any government, whether it be a foreign entity or the United States, should be cause for concern.
“We were the first major company to publish a public transparency report sharing the number and types of government requests for user data we receive,” said a Google spokesperson to Gizmodo via email. “We share the Senator’s commitment to keeping users informed about these requests.”
Wyden serves on the Committees on Finance, Budget, Intelligence, and Energy and Natural Resources. He’s well connected to the tech space, and his former Chief of Communications went on to work at Meta, and now OpenAI.