California Prosecutors Are Still Trying To Get Signal To Hand Over User Info It Simply Doesn't Possess

Encrypted messaging app Signal is slowly educating federal prosecutors on the meaning of the idiom "blood from a stone." Usually this refers to someone who is judgment-proof (or extortion-proof or whatever), since you can't take money a person doesn't have.

This would be the digital equivalent. Prosecutors in California have tried three times this year to obtain data on Signal users that Signal never collects or retains. Issue all the subpoenas you want, Signal says, but don't expect anything to change. We can't give you what we don't have. (h/t Slashdot)

Here we are in the second half of 2021, Signal still knows nothing about you, but the government keeps asking.

Because everything in Signal is end-to-end encrypted by default, the broad set of personal information that is typically easy to retrieve in other apps simply doesn't exist on Signal's servers. Once again, this request sought a wide variety of information we don't have, including the users's name, address, correspondence, contacts, groups, call records.

As usual, we couldn't provide any of that. It's impossible to turn over data that we never had access to in the first place. Signal doesn't have access to your messages; your chat list; your groups; your contacts; your stickers; your profile name or avatar; or even the GIFs you search for. As a result, our response to the subpoena will look familiar. It's the same set of Account and Subscriber Information" that we can provide: Unix timestamps for when each account was created and the date that each account last connected to the Signal service.

That's it.

That handles one request from prosecutors in Santa Clara County, California. Another one was greeted with the same response a few days later -- this time from the Central District of California. Apparently the lesson wasn't learned back in April, when the same district made the same request for data and got the same answer from Signal. Two grand jury subpoenas and one search warrant later and the answer remains the same.

The search warrant had a few more wrinkles of the government variety, even if the end result was Unix timestamps. According to the Signal post, the government attached a gag order to this warrant and renewed it four times while being told by Signal that the company had nothing more to turn over in response. There was nothing remotely adversarial about this process. The government made four secrecy requests, got all four granted -- all without acknowledging Signal's motion to unseal. The court also refused to schedule a hearing or even return phone calls from Signal's legal reps.

It seems like the government will keep trying, though. Signal doesn't get hit with many requests for user info, but prosecutors spending the public's money seem willing to define insanity through their ineffective actions. And for companies providing encrypted communications, the best way to protect users is to gather as little info about them as possible. When the government comes knocking, it's sometimes best to have nothing to give it.