A newly disclosed terrorism case shows how the FBI used Apple’s push notification logs to peer into Signal traffic on iPhones once thought opaque to investigators. Instead of breaking Signal’s end‑to‑end encryption, agents pulled metadata and message previews from Apple’s servers, where push payloads briefly transit to trigger on‑screen alerts.
Court filings describe how law enforcement requested Apple’s push notification records linked to specific devices, then correlated those entries with seized phones and carrier logs. The technique exploited Apple’s central role as a relay for notification payloads, turning what looks like a background convenience feature into a detailed activity ledger that mapped who messaged whom and when, and in some instances what was said.
The case underscores a growing focus on metadata, traffic analysis, and server‑side storage rather than direct cryptographic attacks. Privacy advocates now warn that any service relying on centralized push infrastructure can expose a parallel channel of insight for investigators, even when the underlying message encryption and cryptographic protocol remain intact.
