🤖 AI Summary
米国Federal Bureau of Investigation (FBI)は、被告のiPhoneからSignalアプリの削除後も残っていたメッセージ通知データをforensic(法的解体)的に抽出することができたと報告されています。この件に関連した裁判で証言した複数の人々によると、被告がSignalアプリを使用している際、メッセージ通知やプレビュー表示をロック画面に表示させることにより、iPhoneの内部メモリにそのデータが保存されることがわかりました。
FBIは特定の事件(テキサス州アラヴァロで警官に首を撃つなどした疑いで逮捕された被告らによる火薬使用と財産破壊)に関連して、通知データから削除されたSignalアプリメッセージを抽出しました。Signalアプリが通知表示やプレビュー機能を有効にしている場合、そのメッセージはAppleの内部通知ストレージに保存され、iPhoneが再起動しても消去されないという特徴があります。
FBIによって証人として出廷したSpecial Agent Clark Wiethornは、Lynette Sharp被告( colaborating witness )の電話から取り出したメッセージデータについて証言しました。これらのメッセージはSignalアプリ内での削除設定にもかかわらず、Appleの通知ストレージに保存されていたため、FBIが抽出することができたと報告されています。
この事例は、信頼性の高い暗号化通信アプリケーションでも、特定条件下では内部データが取り出せる可能性があることを示唆しています。Signalアプリは既に通知表示を無効にする設定を提供しているにもかかわらず、ユーザーにはその機能を有効にしておくことが推奨されるという教訓も抽出されました。
An anonymous reader quotes a report from 404 Media: The FBI was able to forensically extract copies of incoming Signal messages from a defendant's iPhone, even after the app was deleted, because copies of the content were saved in the device's push notification database, multiple people present for FBI testimony in a recent trial told 404 Media. The case involved a group of people setting off fireworks and vandalizing property at the ICE Prairieland Detention Facility in Alvarado, Texas in July, and one shooting a police officer in the neck. The news shows how forensic extraction -- when someone has physical access to a device and is able to run specialized software on it -- can yield sensitive data derived from secure messaging apps in unexpected places. Signal already has a setting that blocks message content from displaying in push notifications; the case highlights why such a feature might be important for some users to turn on.
"We learned that specifically on iPhones, if one's settings in the Signal app allow for message notifications and previews to show up on the lock screen, [then] the iPhone will internally store those notifications/message previews in the internal memory of the device," a supporter of the defendants who was taking notes during the trial told 404 Media. [...] During one day of the related trial, FBI Special Agent Clark Wiethorn testified about some of the collected evidence. A summary of Exhibit 158 published on a group of supporters' website says, "Messages were recovered from Sharp's phone through Apple's internal notification storage -- Signal had been removed, but incoming notifications were preserved in internal memory. Only incoming messages were captured (no outgoing)."
404 Media spoke to one of the supporters who was taking notes during the trial, and to Harmony Schuerman, an attorney representing defendant Elizabeth Soto. Schuerman shared notes she took on Exhibit 158. "They were able to capture these chats bc [because] of the way she had notifications set up on her phone -- anytime a notification pops up on the lock screen, Apple stores it in the internal memory of the device," those notes read. The supporter added, "I was in the courtroom on the last day of the state's case when they had FBI Special Agent Clark testifying about some Signal messages. One set came from Lynette Sharp's phone (one of the cooperating witnesses), but the interesting detailed messages shown in court were messages that had been set to disappear and had in fact disappeared in the Signal app." Further reading: Apple Gave Governments Data On Thousands of Push Notifications
Read more of this story at Slashdot.