The developer of the secure messenger Signal said that the Santa Clara County police wanted to obtain very specific personal information about certain users, including IP addresses, as well as the date and time for each login to the system.
Details of the search warrant received from police in Santa Clara point to efforts that US law enforcement will undertake to obtain confidential information.
Santa Clara police were trying to obtain information about the name, postal address, telephone number and email address of a specific Signal user. Also required were billing records, account opening and registration dates, detailed records of incoming and outgoing calls, voice messages, video calls, emails, text messages, IP addresses, and dates and times for each login, including time and the number of authorizations.
Signal only provided law enforcement with timestamps regarding the account listed on the search warrant. The timestamps showed the dates when the account last connected to Signal. As the Signal administration noted on their blog, they do not collect requested user information by default.
“It’s impossible to transfer data that we never had access to. Signal does not have access to messages, chat list, groups, contacts, stickers, profile name or avatar, or even GIFs that users are looking for, ”said the Signal developer.
Following this, law enforcement agencies issued a nondisclosure order, according to which Signal could not publicly announce that it had received a search warrant. The nondisclosure order was renewed four times, resulting in Signal's request to disclose a search warrant repeatedly denied. In total, it took Signal almost a year before the company was able to legally publicly disclose information about this process.
Recall that the ProtonMail webmail service found itself in a similar situation. Administration disclosed The IP addresses of some of its French users associated with the Youth for Climate green movement. The data was provided at the request of the French authorities, after which these users were arrested. Meanwhile, ProtonMail's privacy policy says the company "does not keep IP logs by default," and "no personal information is required to create a secure email account."