Signal received federal subpoena with gag order earlier this year, demanding IP addresses, browsing histories, cookies, and more, but could hand over little
SAN FRANCISCO — It has been six months since the Justice Department backed off on demands that Apple help the F.B.I. break the security of a locked iPhone.
Context & Ripple Effects
The Signal subpoena lands in the middle of a multi-year campaign by the Justice Department to extract data from encrypted services. In 2015 the department obtained a court order demanding Apple turn over iMessages in real time, which Apple said it could not comply with; by early 2016 it was pursuing orders against roughly a dozen more iPhones, and an inspector general later faulted the F.B.I. for seeking the high-profile unlock order before exhausting its own options.
What is new here is the target and the scope: rather than asking a company to break a device, the subpoena demands the metadata trail — IP addresses, browsing histories, cookies — from a messaging service built to hold as little as possible, wrapped in a gag order of the kind that kept Apple silent about its subpoena of House Democrats' records until it expired years later.
First-order effects
- Signal hands the Justice Department almost nothing: the subpoena's demand list reads like a surveillance wish list for a conventional web service, and Signal's architecture simply does not retain most of it.
- The gag order means users under investigation learn nothing at the time — the same opacity that delayed Apple's notification of the lawmakers whose records were pulled in the Russia leak probe.
Second-order effects
- Rival encrypted services now have a published template showing that data minimization is itself a compliance strategy: whatever a service never stores, a subpoena cannot reach, which pressures competitors to justify what they do log.
- For the Justice Department, repeated dead ends against Apple and Signal push investigative effort toward the remaining data chokepoints — push-notification tokens and account identifiers — where Apple has since said a mere subpoena suffices while Google requires a court order.
Third-order effects
- If the pattern holds, the contest between law enforcement and encrypted services migrates from breaking cryptography to harvesting metadata, making what services choose to retain — not what they encrypt — the decisive policy battleground.
- Widespread gag orders on routine subpoenas set up a structural conflict over disclosure: companies can only document government demands years after the fact, fueling calls for transparency reporting and narrower secrecy rules.
The trend: Law enforcement is shifting from demanding that companies break encryption to subpoenaing the metadata around encrypted communications, and services are responding by designing their systems to hold nothing worth seizing.