X

Signal chat app's creator: US government demanded our user data

Open Whisper Systems, which provides the encrypted messaging service, is no longer legally prevented from telling users the government compelled it to hand over what user data it could.

Laura Hautala
Laura Hautala
Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce, Amazon, earned wage access, online marketplaces, direct to consumer, unions, labor and employment, supply chain, cybersecurity, privacy, stalkerware, hacking. Credentials
  • 2022 Eddie Award for a single article in consumer technology
See full bio
Laura Hautala
2 min read

You never know if the government is secretly compelling your favorite internet company to hand over its data on users.

Well, sometimes you do.

On Tuesday, the ACLU announced it succeeded in getting a gag order (PDF) lifted for its client Open Whisper Systems, creator of the Signal messaging service. That's the service favored by antisurveillance activists like Edward Snowden. The order prevented Open Whisper Systems from disclosing it had received a subpoena demanding user information (PDF).

That doesn't mean US intelligence agencies are poring over Snowden's communications as you read this. Signal uses end-to-end encryption, meaning all messages that pass through its systems are scrambled up and only the sender and recipient can read them. Still, Signal collects some minimal metadata on users.

The data subpoenaed by the US government included "the name, email, any associated accounts acquired through 'cookie data,' and IP addresses, which can show geographic location," the ACLU said in a statement.


But Open Whisper Systems founder Moxie Marlinspike said the company doesn't track who users communicate with, and it was able to tell the government only the date and time that accounts were created and the last date a user connected to the service.

The company fought the gag order, Marlinspike said, "because our interest is basically in transparency. We want our users to understand what's going on, and what kind of information we have to provide in situations like this."

Signal hasn't won the right to tell any specific user if he or she was targeted, said Josh Bell, a spokesman for the ACLU. "The gag order was much, much broader than that," Bell said. Under it, "the company can't talk about the fact there is any government surveillance going on."

The gag order, approved by a federal judge, was set to last for one year, Bell said.

First published October 4, 12:32 p.m. PT.
Update, 1:17 p.m.: Adds commentary from Open Whisper Systems founder Moxie Marlinspike.