Signal is a great choice for those who emphasize privacy in a messaging service, but its ability to remain so partially depends on the operating system itself.
As reported by 404 Media, this involves a case involving a group of people setting off fireworks and vandalizing at an ICE facility in Texas in July 2025, with one shooting a police officer in the neck.
During the trial, an FBI agent testified that the agency was able to recover Signal messages from the iPhone’s notification data. Although the app and all accompanying messages were deleted, agents were somehow able to get the data that was preserved in the iPhone’s internal memory.
The FBI did not detail its process of attaining this data. However, possibly at play here is how push notifications on iPhones work.
Each push notification uses something called a “token” that can either be validated or invalidated. When an app is deleted, the token used to send push notifications isn’t automatically invalidated.
When you also consider that the server does not know if an app is still installed after a recently-sent notification, the token will still continue to push notifications out. It’s then left for the iPhone to decide whether to display them or not.
This could have been prevented through one of Signal’s settings, which prevents a message’s contents from being previewed in iOS’ notifications. Instead, the defendant in the case did not have this setting enabled, allowing the system to store the notification.
It’s also possible the FBI acquired the data through an iPhone backup. There are various commercially-available tools for law enforcement that exploit iOS vulnerabilities to extract data.
All of this is a reminder that everything you delete might not actually be gone forever.
Leave a Reply