Deleted your Signal app? FBI might still extract your messages

Armed with reliable end-to-end encryption, Signal is widely considered to be the best way to communicate more securely. In a recent case, though, the FBI found a way to break into a suspect’s Signal chats – even after the individual deleted the app from his device.

As reported by 404 Media, the FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the suspect deleted the app from the device.

The secret sauce? The device’s push notification database, multiple sources, who were present for FBI testimony in a recent trial, told the media outlet.

“We learned that specifically on iPhones, if one’s settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device,” a supporter of the defendants said.

In other words, the FBI didn’t even need access to the Signal app at all and was able to obtain the messages the defendant had received, even though those chats were set to disappear in the app, and the app itself had been deleted from the device.

The case involved people who set off fireworks and vandalized property at the ICE Prairieland Detention Facility in Texas in July. One suspect shot a police officer in the neck.

All defendants were found guilty of multiple charges each, and that would most probably have been the case even if the FBI hadn’t extracted any Signal messages.

Still, the truth is that any app with permission to show previews and alerts on the Lock Screen will save those previews to the user’s iPhone's internal memory.

This means the FBI probably had plenty of other notifications to sift through as well: from any app the defendant had running on their iPhone, including texts, direct messages on other platforms, purchase history, and calendar reminders.

The case seems scary as Signal is supposed to be extremely safe to use: thankfully, the app already has a setting that blocks message content from displaying in push notifications.

Typically, when a user receives a Signal message, their phone will display a push notification announcing they have received a message, and display the sender and at least some of the message content.

But in the Notifications menu under Settings in the Signal app, users can change what Notification Content appears. This includes Name, Content, and Actions; Name Only; and No Name or Content.

If you change your settings to “No Name or Content,” even if someone accesses your alerts, all they will see is that you received a Signal message – not who sent it or what it contains.

Unlock more exclusive Cybernews content on YouTube.