An official FBI document dated January 2021, obtained by the American association “Property of People” through the Freedom of Information Act.

This document summarizes the possibilities for legal access to data from nine instant messaging services: iMessage, Line, Signal, Telegram, Threema, Viber, WeChat, WhatsApp and Wickr. For each software, different judicial methods are explored, such as subpoena, search warrant, active collection of communications metadata (“Pen Register”) or connection data retention law (“18 USC§2703”). Here, in essence, is the information the FBI says it can retrieve:

  • Apple iMessage: basic subscriber data; in the case of an iPhone user, investigators may be able to get their hands on message content if the user uses iCloud to synchronize iMessage messages or to back up data on their phone.

  • Line: account data (image, username, e-mail address, phone number, Line ID, creation date, usage data, etc.); if the user has not activated end-to-end encryption, investigators can retrieve the texts of exchanges over a seven-day period, but not other data (audio, video, images, location).

  • Signal: date and time of account creation and date of last connection.

  • Telegram: IP address and phone number for investigations into confirmed terrorists, otherwise nothing.

  • Threema: cryptographic fingerprint of phone number and e-mail address, push service tokens if used, public key, account creation date, last connection date.

  • Viber: account data and IP address used to create the account; investigators can also access message history (date, time, source, destination).

  • WeChat: basic data such as name, phone number, e-mail and IP address, but only for non-Chinese users.

  • WhatsApp: the targeted person’s basic data, address book and contacts who have the targeted person in their address book; it is possible to collect message metadata in real time (“Pen Register”); message content can be retrieved via iCloud backups.

  • Wickr: Date and time of account creation, types of terminal on which the application is installed, date of last connection, number of messages exchanged, external identifiers associated with the account (e-mail addresses, telephone numbers), avatar image, data linked to adding or deleting.

TL;DR Signal is the messaging system that provides the least information to investigators.

  • Takeaways:

    • End-to-end encryption works.
    • The only trustworthy computer is your computer. Don’t use cloud storage.
    • The only trustworthy software is open-source software. Proprietary software serves the interests of the proprietor, not the user.

    All of this was already well-known, of course, but it’s always nice to get confirmation.

  • Thanks for the great summary! Also a good reminder to people that storing your backups on a “as secure as we decide it is” service like iCloud isn’t ideal if you want to protect your data from government snooping.

    Edited to remove pre-coffee salt and lack of nuance.

    • This perspective lacks nuance.

      a service like iCloud is a bad idea if you care about your privacy

      Like all security and privacy measures, you have to consider your threat profile. From whom are you trying to maintain privacy from? If it’s other people or companies, then using a service like this is perfectly okay. If you’re worried about state actors or governmental agencies coming after you, then you have a very different set of requirements and considerations than most people, and you should plan accordingly.

      But saying that services like this aren’t for people who care about their privacy is a little disingenuous. As with all things, it’s a matter of degrees.

    • Generally agree, but this document is also from January 2021. Apple brought E2EE to almost all aspects of iCloud in December 2022 including iCloud Backups. It’s opt-in, so theoretically, if you were having a conversation with a contact who didn’t opt-in to E2EE but backed up their iMessages to iCloud, the government could still access your messages via that contact even if you opted-in to E2EE, but still.

    •  twhite   ( @twhite@lemmy.ml ) 
      link
      fedilink
      English
      61 year ago

      Yeah but I’m still mad about their decision to drop SMS/MMS.

      Wonderful app, great handling of signal to signal messaging, but it really took away my ability to sell end to encryption to friends and family.

      •  Luke   ( @lukecooperatus@lemmy.ml ) 
        link
        fedilink
        English
        11
        edit-2
        1 year ago

        it really took away my ability to sell end to encryption to friends and family

        As I understand it, SMS and MMS aren’t encrypted (and that’s why support was dropped). Unfortunately, you were never selling your friends e2e as long as they kept using SMS, even if they used it through Signal. In fact, it’s arguable that the false perception of security in “now I’m texting through Signal, and that means it’s secure!” was even more damaging than never having switched in the first place. (Unless they went all the way and stopped using SMS, of course.)

        So, nothing is lost from that perspective. Now you can more accurately recommend ppl to use Signal messages instead of SMS and know that you are more accurately selling e2e with every convert because they can’t keep using insecure messaging through Signal.

      • That’s fair, though personally I’m kindof glad they did. “Signal is a secure messaging app” is a lot easier to explain to non-tech-savvy people than “Signal is a secure messaging app, as long as you are messaging someone who is using Signal too. It can also send regular texts but they can’t be encrypted.” Leaving that nuance out would have left people texting with a false assumption of security, but I lost several people explaining it because it “sounds complicated”.

        •  twhite   ( @twhite@lemmy.ml ) 
          link
          fedilink
          English
          1
          edit-2
          1 year ago

          You’re correct I should have better worded my point: Signal used to be a single app that someone could install that could handle sending out their regular unencrypted SMS messages and Signal encrypted messages.

          Signal also did exactly what you’ve described - auto-enabled encryption when it detected another signal user by phone number.

          The net result was more people using encrypted messaging.

        • Signal accounts are based on your phone number, so if you’re messaging a number that has an account with Signal, the app could see that and would send the message through Signal’s protocols to that Signal account instead of with the SMS protocol which is not encrypted.

        • I believe once upon a time, back when Signal was called TextSecure, it actually supported this. I don’t remember how it knew the remote party was on TextSecure, I think it may have just let you send anyone encrypted messages, regardless of whether they could read them but I could be wrong. It’s been a long time.

  • Also remember this is useless without complementary security measures:

    1. Encrypt the storage on any device where these are installed (including your desktop/laptop drives if you install e.g. the desktop version of Signal).
    2. Lock your devices with pin or password, and store that pin/password only in your head (there’s no such thing as telepathy at this point in time so they can’t physically force it out of you, unlike biometric data like your fingerprints).

    If you are relying on “Legally they’re not allowed to,” instead of, “They simply can’t, despite all they might try,” then you’re not doing it right.

  • iMessage is now fully secure like Signal and Telegram, if you’ve enabled advanced data protection in your Apple ID. This also protects your photos and other personal information from snooping and data breaches. Apple users should turn on this great feature in Settings -> iCloud.

    • I think it is because it is a bit nuanced. I used to host a matrix server and if the FBI was like hey, give us the data to something.

      I’d just give them anything they wanted. I did not allow signups, I only gave access to one friend and only had it setup as a learning project.

      I’m sure my friend wouldn’t do anything shady on it, I’ve been close friends with him for about 30 years. But I’m not going to fight the fbi on their behalf. Plus, if they were using the server for something that the fbi needed to get involved with, I’d be pissed they used my server to do it.

      tl:dr anyone can host a matrix instance and each host could have different levels of access.

    • I’m wondering the same thing.

      I am a long time signal user but I just started using Matrix yesterday and now I’m very curious about whether Signal or Matrix is better somehow in terms of security/privacy.

      • I stopped using Signal after they said no alternate clients, then got into crypto, then introduce a proprietary shim to their stack.

        I plan on someday actually running my own Matrix server for myself and family, right now I’m on Matrix.org though. At this point I don’t know how folks recommend Signal over Matrix. There are a lot of clients, so maybe the choice of clients is too confusing? IDK.

        But anyone saying Matrix isn’t easy enough for non-tech folks to understand, my sister, niece, even wife set up Element themselves on their phones without issue. My father and step-mother both use Element with us. I configured it but they know how to message and do video chat and things.

        • Thanks for sharing! I really want to get my family on Matrix now.

          We have not been able to find a solid chat/video call app that the entire family (various ages and tech aptitude) can effectively use. We’ve been bouncing around to various apps since COVID lockdowns started. We had been using Slack for a while but the video calling in Slack is unusable now.

        • ̷W̷̶̷h̷̶̷i̷̶̷l̷̶̷e̷̶̷ ̷̶̷F̷̶̷r̷̶̷a̷̶̷n̷̶̷c̷̶̷e̷̶̷ ̷̶̷i̷̶̷s̷̶̷n̷̶̷’̷̶̷t̷̶̷ ̷̶̷a̷̶̷ ̷̶̷p̷̶̷a̷̶̷r̷̶̷t̷̶̷ ̷̶̷o̷̶̷f̷̶̷ ̷̶̷F̷̶̷V̷̶̷E̷̶̷Y̷̶̷ ̷̶̷"̷̶̷t̷̶̷h̷̶̷e̷̶̷ ̷̶̷f̷̶̷i̷̶̷v̷̶̷e̷̶̷ ̷̶̷e̷̶̷y̷̶̷e̷̶̷s̷̶̷ ̷̶̷a̷̶̷l̷̶̷l̷̶̷i̷̶̷a̷̶̷n̷̶̷c̷̶̷e̷̶̷"̷̶̷,̷̶̷ ̷̶̷i̷̶̷t̷̶̷ ̷̶̷i̷̶̷s̷̶̷ ̷̶̷e̷̶̷x̷̶̷t̷̶̷r̷̶̷e̷̶̷m̷̶̷e̷̶̷l̷̶̷y̷̶̷ ̷̶̷l̷̶̷i̷̶̷k̷̶̷e̷̶̷l̷̶̷y̷̶̷ ̷̶̷t̷̶̷h̷̶̷a̷̶̷t̷̶̷ ̷̶̷i̷̶̷t̷̶̷ ̷̶̷i̷̶̷s̷̶̷ ̷̶̷c̷̶̷o̷̶̷m̷̶̷p̷̶̷r̷̶̷o̷̶̷m̷̶̷i̷̶̷s̷̶̷e̷̶̷d̷̶̷ ̷̶̷b̷̶̷e̷̶̷c̷̶̷a̷̶̷u̷̶̷s̷̶̷e̷̶̷ ̷̶̷M̷̶̷a̷̶̷t̷̶̷r̷̶̷i̷̶̷x̷̶̷ ̷̶̷w̷̶̷a̷̶̷s̷̶̷ ̷̶̷c̷̶̷r̷̶̷e̷̶̷a̷̶̷t̷̶̷e̷̶̷d̷̶̷ ̷̶̷b̷̶̷y̷̶̷ ̷̶̷t̷̶̷h̷̶̷e̷̶̷ ̷̶̷F̷̶̷r̷̶̷e̷̶̷n̷̶̷c̷̶̷h̷̶̷ ̷̶̷g̷̶̷o̷̶̷v̷̶̷e̷̶̷r̷̶̷n̷̶̷m̷̶̷e̷̶̷n̷̶̷t̷̶̷ ̷̶̷i̷̶̷n̷̶̷ ̷̶̷2̷̶̷0̷̶̷1̷̶̷8̷̶̷.̷̶̷ ̷̶̷ ̷̶̷

          Keep in mind that op’s foia request is from 2021.

          Edit - I’m misremembering. Disregard.

          https://en.wikipedia.org/wiki/Matrix_(protocol)

          The initial project was created inside Amdocs, while building a chat tool called “Amdocs Unified Communications”,[4] by Matthew Hodgson and Amandine Le Pape [fr]. Amdocs then funded most of the development work from 2014 to October 2017.[5] Matrix was the winner of the Innovation award at WebRTC 2014 Conference & Expo,[6] and of the “Best in Show” award at WebRTC World in 2015.[7]

        •  Liz   ( @Liz@midwest.social ) 
          link
          fedilink
          English
          11 year ago

          I stopped using signal when it was clear they don’t know what they’re doing with anything besides encryption and security. Literally every UI/UX change they made while I was using the app was a downgrade. When they decided to drop SMS, that was the last straw.

          I just use google’s messenger, which has encryption and SMS. Exactly what I want. Heck if I know what data is recoverable for governments and non-government hackers.

      • Well, there are a few leakage issues with Matrix, but there’s also the benefit that you can stand up your own server or use one based in a country you’re comfortable having access to your basic connection data.

        So unlike Signal where the hashes are all stored in one place, with Matrix no single government has control over the entire network.

    • I think it is because it is a bit nuanced. I used to host a matrix server and if the FBI was like hey, give us the data to something.

      I’d just give them anything they wanted. I did not allow signups, I only gave access to one friend and only had it setup as a learning project.

      I’m sure my friend wouldn’t do anything shady on it, I’ve been close friends with him for about 30 years. But I’m not going to fight the fbi on their behalf. Plus, if they were using the server for something that the fbi needed to get involved with, I’d be pissed they used my server to do it.

      tl:dr anyone can host a matrix instance and each host could have different levels of access.

    •  Steeve   ( @Steeve@lemmy.ca ) 
      link
      fedilink
      English
      10
      edit-2
      1 year ago

      There’s a lot of misinformation about Facebook on Reddit. They absolutely deserve scrutiny, but their main problem has always been growing too big too fast and all regular capitalism stuff. If you actually look further into their scandals than Reddit comment sections it becomes apparent that most of their issues (Cambridge Analytica, general misinformation, hate speech, etc) comes from just regular ol corporate incompetence at a massive scale rather than maliciousness. I don’t know if that makes anyone feel any better lol.

      They are trying to turn it around though and they’re investing a shit ton in privacy and trying to tackle “bad actors” and misinformation problems on their platforms (because I guess the scrutiny worked). They’re pushing heavily for Messenger to be fully E2EE like WhatsApp, so it’s pretty clear that they want to work with local law enforcement about as much as you want them to.

      They should definitely be heavily scrutinized, but I think a lot of the Meta criticism goes past constructive conversation and into rage-fueled hate, especially on Reddit and other competing social medias.

  • Telegram states at their site that: “To this day, we have disclosed 0 bytes of user data to third parties, including governments.”

    But according to Spiegel this is false. I don’t know German, I read the article using google translate, correct me if I’m wrong.

    Here is a quote from the article: “Contrary to what has been publicly stated so far, the operators of the messenger app Telegram have released user data to the Federal Criminal Police Office (BKA) in several cases.”

    If this is true, the fact that they are lying is very worrying…

      • I don’t think this is what they mean. If you read the whole paragraph they also talk about “[…]the data that is not covered by end-to-end encryption”…

        It says that they have nothing to give on Secret chats, and then: “To protect the data that is not covered by end-to-end encryption[…]” … “Thanks to this structure, we can ensure[…]” … “To this day, we have disclosed 0 bytes of user data to third parties, including governments.”

        I mean, I would consider phone numbers, IPs, metadata, non-secret chats (I don’t know if that’s a thing, never used Telegram), to be “user data”.

    • To clarify because this is always a point of confusion whenever the topic comes up. Telegram is, of course, transport encrypted. Someone listening on the wire cannot read your data. It is not end-to-end encrypted, meaning Telegram can always read your messages and can, in principle, give anyone access.

      •  ookees   ( @ookees@beehaw.org ) 
        link
        fedilink
        English
        10
        edit-2
        1 year ago

        That’s not entirely true. Telegram’s one on one secret chat is end to end encrypted. As well as one on one voice and video calls. Group chats are not end to end encrypted.

        Additionally Telegram does have an auto delete features built in for all of its chat types. So while I can’t entirely rule out that Telegram could have a backup of a chat somewhere, you have a bit more piece of mind if you turn on the auto delete feature.

      • It’s worrying how Telegram says “all your chats are protected with strong encryption” while this is just standard stuff nowadays (wasn’t when Telegram came out, to be fair). While it’s technically true, it’s almost sure to be misinterpreted and have it sound like it’s equal to actual e2ee software

    • Right? The data they can collect there is pretty much entirely useless unless they can also gather the location of last connection. But even then, not terribly helpful.