How the FBI Extracted Deleted Signal Messages

0:00The FBI was able to forensically extract signal messages that were supposed to be deleted, and they've been stored in the iPhone notification database.

0:13Hello, and welcome to the 404 Media podcast, where we bring you unparalleled access to hidden worlds both online and IRL. 404 Media is a journalist-founded company and needs your support. to subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm your host, Joseph, and it's a little bit different today. We have another of the 404 Media co-founders, that being Emmanuel Mayberg. Hello. And then we also have our regular contributor, Matthew Gull.

0:54Hello. All right. If I sound very tired, which I am, it's because we were up all night. Okay, not all night. Relatively late into the night playing the video game Marathon, which we're going to talk about in the subscribers only section because Emmanuel wrote about it. I'll leave that there for the time being. But Emmanuel, do you want to take the lead on this first story? Yeah. The first story today is from Joe. The headline is, FBI extracts suspects deleted signal messages saved an iPhone notification database. Joe, let's start with what is the case itself? What is the Prairieland Detention Center?

1:39Yeah. So this is a really significant case because it is the first one after the Trump administration designated Antifa. I'm sorry. I'm European. I'm going to say Antifa and not Antifa. I might jump between the two of them. I know the Americans say it differently. But the first time President Trump designated that umbrella term a domestic terrorist organization. So this is the first case sort of using that designation to push charges on people. The specific incident itself was at this Prairieland detention ice facility in Texas back in July. And fireworks were let off. There was vandalizing. and then one person also shot a rifle which hit a police officer in the neck.

2:30There were all of these different sorts of charges, but of course the big ones are about material support for terrorism, that sort of thing, which is only possible because now Antifa has been labelled as this domestic terrorist group, even though of course I'm sure listeners know that it's not really a group, It's an ideology, perhaps even a loose collection of ideologies. But that's this specific case. And that would already be sort of newsworthy and important on its own. But obviously, I looked at it more from a technological angle. So you spoke to two people who were present for the FBI testimony during the trial.

3:14What did they say? Yeah. So first of all, there is a website from sort of supporters of the defendants of this case. I don't have the URL in front of me, but it is linked in the story. And I go to that and I see a section mentioning Signal. And it says, I'm paraphrasing, the FBI testified about recovering deleted Signal messages from a phone because of notification settings. I'm like, well, that's very, very interesting. I have never, ever heard of that, although people have suspected it for a while. But this was, as I said, just a summary from supporters of the defendants. I couldn't write an article just based on that.

4:01So it took me a long time. And the supporters did help out with putting me in touch with various people. But I spoke to an attorney representing one of them, and then a supporter who was in the room. And I'll just read what the supporter said. They said, quote, we learned that specifically on iPhones, if one's settings in the Signal app allow for message notifications and previews to show up on the lock screen, then the iPhone will internally store those notifications or messages, previews, in the internal memory of the device, end quote. And then the lawyer I spoke to, she corroborated that. She was taking notes at the time and they essentially said the same thing.

4:42So now I have the summary from the supporters. I have a supporter who was in there and an attorney all saying the same thing, which is that the FBI was able to forensically extract signal messages that were supposed to be deleted. The app was supposed to be, or it was removed. And they've been stored in the iPhone notification database. Now, of course, we'll talk about it in a minute, but there's a lot of nuance around that. There's a lot of caveats. But to me, that is very, very interesting, right? I imagine, Emmanuel, that you hadn't heard of that being a possibility either. I haven't. And I also thought it was pretty interesting and concerning.

5:21I happened to talk to someone who relies on Signal at work this weekend to do some sensitive business. And they were also surprised and found your story independently because they rely on Signal very heavily. to do all those secure communications. I guess I also want to say, I feel confident in saying this, but Joe, please verbally confirm. We consider Signal to be best in class for encrypted, secure messaging, correct? And we still feel that way despite the story. Yeah, and I'll just say why. So Signal is broadly considered the best option out of the messaging platforms out there. The first is the protocol itself, which is very, very robust, which actually encrypts messages.

6:20And that's so good. That's been white labeled, adopted by Facebook messaging and WhatsApp. And it's in all sorts of other apps as well. I actually know some criminal focused apps have even taken the Signal protocol and they've decided to use that as well. It was used in EncroChat. So there's that part. There's also the disappearing messages feature where you turn that on and anything sent after here will disappear after four weeks, one week, one day, whatever. There is metadata protection as well. So it should obscure who is talking to who and when and that sort of thing. And I think probably, well, maybe not most importantly, but very importantly, is that when authorities or third parties go to Signal, Signal retains very, very, very little user data.

7:11And we know this because several years back, I mean, 2016 at this point, so a long time ago, the New York Times published details about a subpoena, I think, that Signal received. I can't remember the agency, but a US federal law enforcement agency. And the only information that Signal could turn over was, I think, the account creation time, maybe, but certainly the last sort of time it was active. There was no IP address. There was no phone number. There was no sort of identifying information. And that's because Signal does not retain that in the first place. I was actually going to have you ask this question later, but I'll bring it up now because I think it makes sense.

7:55That's all well and good. That all sounds great. There is this like black box when it comes to security and this big gap in knowledge, which is forensic extraction, which is when the authorities or a third party get hold of a phone, they plug it into a device like Celebrite or Graykey that we've covered many, many times. And there's always a question mark over, well, what data could people get from a device or from the Signal app or any sort of security communications app if they have physical access and they have specialized software? And we don't really know about that because these companies don't talk about that.

8:35The authorities don't really talk about it either. We only really know that Celebrite can break into XYZ phone or GrayKey can't get into this phone because there are leaks and we receive those leaks and then we publish them. That's really the only time we figure that out. Or in court cases like this, where authorities do say exactly how they got the data, it's just pretty uncommon for it to be this explicit, you know. Did we get any specifics around how the FBI managed to get these signal messages in this case? Yeah. So I'll just drill down more on the notifications bit, which is that every time, it seems, every time a notification comes into your phone, maybe that's an Apple News Alert, maybe it's an email and it has a subject line or something like that, or, of course, a Signal message that is recorded internally in the iPhone's notification database.

9:38Now, this is different to the Signal app. The Signal app gets the message. After four weeks or a day or whatever, it deletes the message. And you don't see that message when you open the phone. Someone who stole your phone is not going to see that message because it's deleted. And it seems it's also deleted in such a way that it is forensically sound. Because again, it's not like the FBI here got the phone and extracted messages from Signal. They extracted them from the notification database. and that's just something I think has been really, really overlooked. Well, maybe not by Signal because we'll talk about they actually have a fix for it or sort of workaround.

10:18But I think maybe broadly in information security, this isn't something that people automatically think of. And the reason I say that is because this person actually deleted the Signal app from their phone, as in Signal was not even installed when authorities seized and and search the device, and yet the messages were stored in the notification database. So clearly this person thought, well, I'm going to delete the Signal app, then they can't get my messages, while presumably not being aware they're being saved in this other part of the phone. Right, I doubt. I mean, I think what's so interesting about this is I don't think any of us were aware, or at least actively thinking about that issue.

11:01So what is the fix? What can Signal do? Well, it's interesting because Signal already has something where if you go into the Signal app, you go to settings, you go to notifications, you go to, I think, notification content. There's then three different options. There's something like name and preview. And that means when you receive a message, you'll get a notification saying who sent it to you. So it'll say a manual, and then it will say hop on marathon, probably. And then I'll go onto the video game. Or you have one that just says the name. So we'll just say a manual and it'll just say new message.

11:42Or you have one which doesn't even say the name or the message at all. Now a user can control that and they decide how to do that. And I'm hesitant to say it's 100 % fixed, but from all the information available, it seems like that would stop this. Because if Signal is changing how the notifications are even rendered in the first place, say if it just says a name and no message, well, presumably that's going to be the version that's then saved in the iPhone notification database locally. So there's that workaround. Now, I don't know whether Signal made that feature, which has been in there for years and years and years, if I remember correctly.

12:23I don't know if Signal made that feature for this or whether it was more to stop, you know, people looking over your shoulder when you're like on the screen or something or maybe an abusive partner or something like that. I don't know whether they were thinking about forensic extraction and the saving of notifications in the iPhone database. Because I mean, I of course contacted Signal for comment. They acknowledged that request for comment and then they stopped replying to my emails for like a month while I was still going and verifying this. So I don't know why they made that. I don't know how confident they are in that fix.

12:59But that is, you know, it seems like a pretty likely solution to this sort of thing. But I guess we can't say for certain whether when you change those settings to not show a name or not show the content of the message, we don't know if that data is not actually being sent and stored in the notification database or if it's just not displaying it. And we can't say that 100 %? I guess not 100%. And then the other question that comes up to me is more, okay, let's say you read our article and you're like, oh, I'm now going to change my notification settings in Signal, and I do that. That hasn't magically wiped all of the previous notifications which are now stored in your iPhone.

13:41You might have, I have no idea how much, is it one month, six months? Is it indefinite number of notifications? I really have no idea. because again, Apple did not respond to a request for comment either. So it's a black box from all over. The forensic companies and then also Signal, yes, doing a solution, which is great, but not talking to us. And then Apple absolutely not talking to us as well. What if I just turn off notifications across the board on the device? I'm just like, notifications, don't show anything on the lock screen. Yeah, I mean, that would probably work. And then you're going to miss the barbecue.

14:18You're going to miss the work message. I don't hate that. At that point, camera's the phone at that point. Yeah. I will say for real though, I'm pretty loose about digital hygiene stuff in terms of my brain, not in terms of security. And I'm going to check my phone a million times a day anyway. Yeah. So it's just like I'm fine not getting notifications and just seeing what I missed when I opened my phone. Just as a FYI. so what should people know about forensic extraction here anything else like what to keep in mind when I don't know I'm traveling and TSA takes my phone and I know they're going to poke around yeah it's mostly just that I don't know like I do like some security trainings sometimes like I did one recently in Costa Rica which I mentioned in behind the blog to our paying subscribers.

15:18And I had a slide on Signal in that because I taught these people how to use Signal securely and perhaps if you're going to face a legal threat like we have before, all of that sort of thing. But there is always that looming question. And I'm looking at the slide now, which I published in that behind the blog. And the top bullet point is knowing whether deleted Signal messages can be obtained, like forensically as the context is difficult to say. And I still stand by that. I would say now we have a data point where the FBI were not able to get deleted messages from the Signal app. I mean, maybe that's just because the app was deleted, but they were able to get them in this other way.

16:02And I think that unfortunately, forensic extraction is just so complicated. And there are so many different variables. Well, like what version of Signal were they running or probably more importantly, what version of the operating system were they running? Did the person give consent for their phone to be searched and gave over the passcode or used face ID? Did authorities have to break into it? There's all of these very complicated layers interlocking in various different ways. And you cannot expect an ordinary user or even a fairly tech-savvy user to know and understand and be able to counter all this.

16:42One, because it's so complicated. and two because of this like fog of war around it and where we don't really know um what is happening what isn't what i would say is that that means you probably need to turn to something um more fundamental where it's like well i'm gonna stop third parties getting into into my device at all and we recently published uh an article about how the fbi was unable to get into a Washington Post reporter's phone because she had lockdown mode enabled on her phone. So who knows? Maybe if the FBI had got in, they could have seen incoming signal messages stored in the iPhone notification database, but they couldn't even get into the phone in the first place because there was this other more fundamental setting called lockdown mode that stopped access in the first place, if you see what I mean.

17:37A couple of last things. One is this person I was talking to about your story this weekend, they asked me, well, should I switch to a different app? And I said, no, absolutely not. Continue to use Signal. We recommend Signal. We continue to recommend Signal after the story. It's a very good organization. It's a very good protocol. And it's still best in class. It's what we use and it's what we recommend you use. At the same time, I don't think people always have this in mind. The fact that you're using Signal is good. It doesn't mean that it's like, I'm using Signal, so no one is ever going to get my messages 100%.

18:21I am certain of that. We don't know. As you say, there's all these other black boxes in the mix. Things can happen. And you need to keep that in mind. That being said,

18:34this isn't a problem that just impacts Signal. This is a problem for other apps as well. So we continue to recommend people use Signal. And we also, I think, can see that this is a problem that is not impacting just Signal, right? Yes. So, I mean, here's a hypothetical. If the case had involved like Telegram, let's say, and the case there was, oh, this person deleted the app and the FBI managed to get Telegram messages through the iPhone notification database, we would still write that story. That would be very, very interesting as well. It's just that in this case, it happened to be Signal. Now, of course, all messaging apps send notifications.

19:31That's the entire point. So you know that you've received a message and that's going to be WhatsApp, iMessage, Telegram, Signal, Wicca, Session, which is shutting down soon because it's not getting much funding. So it is very much chat app agnostic. What this highlights is a much more fundamental friction between secure messaging apps, which might do everything they could possibly do and the phone they're running on and the operating system. It's not like Signal doesn't have control over iOS, you know, the operating system by phone. It doesn't have control over Android, you know, from Pixel phones or whatever.

20:13There is a friction there where some data from a secure communications app may sort of like accidentally, inadvertently be stored elsewhere in the phone. So yes, it's not a Signal problem. it can be a telegram or whatsapp like whatever you know um it's going to uh impact probably those as well i guess just the last thing i'll say is that after i published this sort of as suspected a couple of people reached out with different cases that they found mentioned signal messages being uh forensically extracted because they were stored in the notification uh database one I'm looking at which right now and I haven't fully looked into the context of it but I believe it's um you know a hate crime like anti-semitic attacks or at least van uh vandalism and one part of the document says quote phone notifications that captured incoming signal messaging end quote so it's even more explicit like in in that court record now if I'd seen that court record a while ago I could have just used that to write a story rather than quite painfully trying to find two people who were in the courtroom to hear the FBI speak.

21:25But that's what we know now. And I think this is very, very useful information for people to know. Even if your phone isn't going to be seized or searched by a third party, you still now understand the limits of a secure messaging app. All right. We'll leave that there. When we come back after the break, we're going to talk about a bunch of Matthews reporting about the pushback to data centers being built, not just in Maine, but actually around the country as well. We'll be right back after this.

22:12This episode is sponsored by BetterHelp. You know, I just paid my bills right before hopping on to record this ad read and it feels very appropriate. It's April, it's tax season. I'm a freelancer. Mine are very complicated. There are forms everywhere. There's no W-2 to just plug into TurboTax. Oh no, it's a nightmare and it's stressful. Financial strain affects more than just your bank account. It can take a serious toll on your mental health and your relationships. 88 % of Americans are feeling some form of financial stress going into March. Money worries, they often bring anxiety, sleep disruption, even depression.

22:59And one of the leading sources of conflict among couples, you guessed it, financial stress. So sometimes you just need a little bit of support, someone to talk to. That's where BetterHelp comes in. BetterHelp has quality therapists that work according to a strict code of conduct, and they are all fully licensed to the United States. And there are client reviews for all of them. With more than 30 ,000 therapists, BetterHelp is the world's largest online therapy platform, having served over 6 million people globally. And it works with an average rating of 4.9 out of 5 for a live session based on 1.7 million client reviews.

23:39So when life feels overwhelming, therapy can help. Sign up and get 10 % off at betterhelp.com slash 404media. That's B-E-T-T-E-R-H-E-L-P.com slash 404media. This message is sponsored by Raycon. With Mother's Day coming up, I've been thinking about gifts that don't just look nice, but actually get used. My mom is the kind of person who's always doing something. Walking, running, errands on the phone. So anything that fits into her day is a win. That's why Raycon's Everyday Earbuds Classic stood out to me. They're super easy to throw in and go, whether she's heading out for a walk or taking a call.

24:21And with active noise cancellation, they block out background noise so everything sounds clear. Music, podcast calls, whatever she's listening to. It just makes those everyday moments feel a little more focused and enjoyable. And right now, you can grab them for 15 % off. Multipoint connectivity lets you connect to two devices at once, which is super useful if you're switching between your phone and laptop. The ergonomic design is lightweight and actually stays in place, even if you're moving around a lot. And I like that they come in colors that feel a little more personal. I'm into the cool mint.

24:52You might like something else. It doesn't just look like every other pair of earbuds out there. Here's the big thing, though. Raycon gives you premium audio quality that stacks up with big brands. but at about half the price. They've got over 3 million happy customers and a 30-day happiness guarantee, so there's really no reason to overpay. A couple features that make them my everyday go-to. Up to 32 hours of battery life with the case. Quick Charge gives you 90 minutes of playtime from just 10 minutes of charging. And Awareness Mode is great when I'm out walking or running errands. I can still hear what's going on around me while I'm listening.

25:27I use mine pretty much every day, whether I'm working, walking, or just taking calls. and honestly, I know my mom will get just as much use out of them. Celebrate the moms in your life. Go to buyraycon.com slash 404 and get 15 % off the Everyday Earbuds Classic. Thanks Raycon for sponsoring.

25:56All right, and we are back. Matthew, this is one you wrote. Maine is close to passing a moratorium on new data centers. So, I mean, there's a lot to unravel here, but let's just keep it specific first. What exactly is this new bill trying to stop the construction of? Is it like all new data centers? Like, what's the deal? Anything over 20 megawatts. And it's a moratorium. It's not necessarily like a full stop. It's more of a let's stop so we can build data centers intelligently. So it stops new construction of data centers over 20 megawatts until November 2027. And it calls for something they're calling the main data center coordination council, which is basically like a group that's going to come together and shepherd data center construction a little bit better.

26:56and ask questions about water and noise management and electricity bills. Yeah. I mean, that's a lot of stuff. Even though, as you say, it's not like a full-on ban or block or stoppage. It sounds like it almost gives the state some space and time and powers to figure out, wait, do we actually want to have this data center or not? Yeah, absolutely. And I think that's kind of a market change. And it's one of many market change that I'm kind of seeing as these data centers are constructed. Because for the past year or so, what happens is a developer that's maybe been incorporated in the last six months shows up in a small town with a population under 50 ,000.

27:45They make a pitch behind closed doors to city council members. They get the city council members to sign a nondisclosure agreement. and the public usually learns about the building of a data center a couple weeks before it starts. Yeah, or when there's a data center. Or when there's a data center. Yeah, literally. And that has happened kind of repeatedly across the country. And you're starting to see these big pushbacks here. And one of the ones that was kind of in Maine that happened that kind of precipitated this event, and some of the locals there, including the main monitor, really broke the story.

28:21is that they were going to build this thing in an old mill building. And it was, again, they went, these developers, it was going to be a$300 million project. They went to the city council kind of behind closed doors. And the city council kind of balked. And the whole thing fell apart. And the city council kind of backed off. And one of the reasons the whole thing fell apart is the city council was like, You guys didn't give us enough time. You know, you wanted us to vote on this. Like, you gave us the information six days before the public was set to vote on it. Like, this doesn't work for us.