In the wake of an FBI investigation, Apple mounted a high-profile campaign on behalf of its users’ privacy. But it turns out our privacy is still being compromised.
Apple keeps a log of everyone you try to contact using iMessage, according to a leaked documented. These logs contain personal contact information, including phone numbers, and are stored in Apple’s servers for 30 days before being deleted. Furthermore, Apple has shared these server logs with police after being compelled by a court order, according to the leaked document obtained by The Intercept.
Apple has exalted iMessage for its end-to-end encryption, meaning that the contents of the messages cannot be accessed anywhere else outside of the iPhone. But Apple is storing contact information and metadata every time an iPhone is used to send a message. Apple acknowledged sharing certain data from its server logs with police.
The company sent the following statement to The Intercept:
“In some cases, we are able to provide data from server logs that are generated from customers accessing certain apps on their devices. We work closely with law enforcement to help them understand what we can provide and make clear these query logs don’t contain the contents of conversations or prove that any communication actually took place.”
So, how are these logs created in the first place? Every time you send a text on your iPhone, the Messages app pings the Apple servers to check if the recipient is a fellow iMessage user. Apple keeps a log of all these queries, including the phone numbers or contact information of the parties involved (iMessage can be linked to an email address), date, time, and IP address.
Apple stores this information on its servers for 30 days, even if the recipient turned out not to be using iMessage (in other words, they’re a green bubble). It’s unclear how often these queries are re-triggered. According to The Verge, they “don’t happen every time a message is sent, but... they do occur on a regular basis.”
Why this matters: Even though Apple admitted to storing contact information and keeping track of every time your iPhone sends a query to its servers to check for iMessage compatibility, Cupertino has made it very clear that a query does not prove that a conversation actually took place.
The query to Apple’s servers is initiated right after you finish typing a phone number into your Messages app, but the query is completed—turning the phone number either blue (iMessage) or green (default SMS)—without you having to send or even type an actual message.
Phone companies comply with similar court orders all the time, sharing metadata and call logs, so this new information simply means the iPhone is on par with other smartphones. However, Apple has a reputation as a staunch guardian of users’ privacy—the company has been very clear as to why it won’t share certain information, but should be just as transparent about the information it does share.
