A push notification, from a technical standpoint, is just a way to wake up an app. It doesn’t have to contain any information.
So when you get a message, the messaging service sends a push notification through Apple/Google, which is a way of saying “Hey messaging app, wake up”. The app then starts running in the background on your phone, connects to it’s server, asks if there is anything new to know about, and the server tells it about a new message, if any. This can then generate a notification on your phone, but importantly what you are seeing in the notification did not come through Apple/Google, all that did was the “Hey messaging app, wake up!”.
If authorities then request this data from Apple/Google, all they can see is the times at which your messaging app was asked to wake up. Not whether any message was actually received, or what it contained, or from who. Because all that never touched Apple/Google’s systems, not even in an encrypted form.
That being said, some data can be sent directly through the Apple/Google system along with the wake up message, so it’s not impossible that some apps include some metadata there. In theory they shouldn’t. For example simple marketing notifications or ads often are just included with the push, because it’s simple to do.
all they can see is the times at which your messaging app was asked to wake up. Not whether any message was actually received, or what it contained, or from who.
I don’t know, are they? As far as we know they could only get unsent notifications, which are obviously still with Apple/Google because the target phone is offline and so they couldn’t be delivered yet. Which would explain why they only got thousands of them, not billions.
A push notification, from a technical standpoint, is just a way to wake up an app. It doesn’t have to contain any information.
So when you get a message, the messaging service sends a push notification through Apple/Google, which is a way of saying “Hey messaging app, wake up”. The app then starts running in the background on your phone, connects to it’s server, asks if there is anything new to know about, and the server tells it about a new message, if any. This can then generate a notification on your phone, but importantly what you are seeing in the notification did not come through Apple/Google, all that did was the “Hey messaging app, wake up!”.
If authorities then request this data from Apple/Google, all they can see is the times at which your messaging app was asked to wake up. Not whether any message was actually received, or what it contained, or from who. Because all that never touched Apple/Google’s systems, not even in an encrypted form.
That being said, some data can be sent directly through the Apple/Google system along with the wake up message, so it’s not impossible that some apps include some metadata there. In theory they shouldn’t. For example simple marketing notifications or ads often are just included with the push, because it’s simple to do.
And why are they collecting that information?
I don’t know, are they? As far as we know they could only get unsent notifications, which are obviously still with Apple/Google because the target phone is offline and so they couldn’t be delivered yet. Which would explain why they only got thousands of them, not billions.