FBI demands Signal user data, but there’s not much to hand over

The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber name, addresses, telephone numbers, email addresses, method of payment"—on two of its users.

Further, OWS was prevented for at least several months from publicly disclosing that it had received such an order until the ACLU successfully challenged it.

While details of the case remain sealed, the ACLU published a number of partially redacted court documents, including its initial response to the FBI.

Through its ACLU attorney Brett Max Kaufman, OWS noted that “only one of the two listed numbers is associated with a Signal account,” so the company couldn’t provide any further details.

For the other number, however, the company said that it keeps minimal records about its users.

All Signal messages and voice calls are end-to-end encrypted using the Signal Protocol, which has since been adopted by WhatsApp and other companies. However, unlike other messaging apps, OWS makes a point of not keeping any data, encrypted or otherwise, about its users. (WhatsApp also does not retain chat history but allows for backups using third-party services, like iCloud. That allows for message history to be restored when users set up a new device.)

“The only information responsive to the subpoena held by OWS is the time of account creation and the date of the last connection to Signal servers,” Kaufman continued, also pointing out that the company did in fact hand over this data.

Signal's "privacy by design" was quickly applauded by National Security Agency whistleblower Edward Snowden.

The FBI came after #Signal, only to find they log only account creation date & last login time. @Google, take note. https://t.co/njyiqCA2i0

— Edward Snowden (@Snowden) October 4, 2016

In the same letter, Kaufman also notified the FBI of his intention to fight the gag order.

In a blog post, he wrote:

To its credit, the government quickly agreed with us that most of the information under seal could be publicly disclosed. But the fact that the government didn't put up too much of a fight suggests that secrecy—and not transparency—has become a governmental default when it comes to demands for our electronic information, and critically, not everyone has the resources or the ability to work with the ACLU to challenge it.

OWS immediately recognized that even though the government required some secrecy over the subpoena, it did not need, nor could it justify, total secrecy. So OWS came to us, and we went to the government, which agreed to reverse its original demand for secrecy—and now OWS’s customers and the broader public can see for themselves just how wildly overbroad the government’s gag order was from the jump. And while this—the only one ever received by OWS—is now public, there are many more like it, hiding in the filing cabinets in the U.S. attorney’s offices across the country.

Across the country, two Stanford researchers are attempting to get years’ worth of surveillance orders released by the federal court in the Northern District of California, where OWS and many other tech firms are based.