{"id":6430,"date":"2021-12-02T06:08:00","date_gmt":"2021-12-02T06:08:00","guid":{"rendered":"https:\/\/blog.gridinsoft.com\/?p=6430"},"modified":"2023-10-06T05:08:48","modified_gmt":"2023-10-06T05:08:48","slug":"fbi-study-guide-showed-what-data-officers-can-get-from-messengers","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/fbi-study-guide-showed-what-data-officers-can-get-from-messengers\/","title":{"rendered":"Unlocking the Secrets of Messaging Apps: An In-Depth FBI Study Guide on Accessible Data for Law Enforcement"},"content":{"rendered":"<h4>An FBI study guide has been made publicly available as part of a Freedom of Information law request filed by Property of the People, an American non-profit organization that deals with government transparency.<\/h4>\n<p>The resulting document contains <a href=\"https:\/\/propertyofthepeople.org\/document-detail\/?doc-id=21114562\" target=\"_blank\" rel=\"nofollow noopener\">training tips for agents<\/a> and explains what kind of data can be obtained from the operators of various messengers and what legal permissions will be required for this.<\/p>\n<figure id=\"attachment_17099\" aria-describedby=\"caption-attachment-17099\" style=\"width: 1894px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" src=\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi-lawfull-access.jpg\" alt=\"Secure Messaging Apps Data\" width=\"1894\" height=\"1033\" class=\"size-full wp-image-17099\" title=\"\" srcset=\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi-lawfull-access.jpg 1894w, https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi-lawfull-access-300x164.jpg 300w, https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi-lawfull-access-1024x558.jpg 1024w, https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi-lawfull-access-768x419.jpg 768w, https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi-lawfull-access-1536x838.jpg 1536w, https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi-lawfull-access-1568x855.jpg 1568w\" sizes=\"auto, (max-width: 1894px) 100vw, 1894px\" \/><figcaption id=\"caption-attachment-17099\" class=\"wp-caption-text\">Secure Messaging Apps Data<\/figcaption><\/figure>\n<p>The document is dated January 7, 2021, and, in general, does not contain any fundamentally new information, but it gives a good idea of what information the FBI can currently receive from services such as Message, Line, WhatsApp, Signal, Telegram, Threema, Viber, WeChat and Wickr.<\/p>\n<div class=\"su-quote su-quote-style-default su-quote-has-cite\"><div class=\"su-quote-inner su-u-clearfix su-u-trim\">It was previously known that the FBI has legal leverage to obtain personal information even from the operators of secure messengers (which usually focus on confidentiality).<span class=\"su-quote-cite\"><a href=\"https:\/\/twitter.com\/iblametom\/status\/1465390658395553808\" target=\"_blank\" rel=\"nofollow noopener\"> Forbes reporter Thomas Brewster said on Twitter<\/a><\/span><\/div><\/div>\n<p>In general, the training document confirms that usually the FBI cannot access the encrypted messages themselves, but they can request other types of information that can also be useful in investigations.<\/p>\n<table>\n<thead>\n<tr>\n<td><strong> Application <\/strong><\/td>\n<td><strong> Legal Permissions and Other Details <\/strong><\/td>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong> Apple iMessage <\/strong><\/td>\n<td><strong><span>Reading message content is limited. <\/span><\/strong><br \/>\n<span>Summons: Help you find out basic information about a subscriber. <\/span><br \/>\n<span>18 USC \u00a72703 (d): Helps to identify requests in iMessage 25 days from the specified date. <\/span><br \/>\nPen Register: Impossible.<br \/>\nSearch warrant: helps you get backups from the target device; <span>if the target uses iCloud backups, encryption keys must be provided, and iMessages can also be retrieved from iCloud if the target has activated Messages in iCloud.<\/span><\/td>\n<\/tr>\n<tr>\n<td><strong> Line <\/strong><\/td>\n<td><strong> Reading of message content is limited. <\/strong><br \/>\nRegistration data of the suspect and\/or victim (profile picture, name, email address, phone number, LINE ID, registration date, etc.).<br \/>\nUsage Information.<br \/>\nContent of text chats for a maximum of 7 days for specified users (only if end-to-end encryption is not active and not used, and only if a valid warrant is received; however, videos, images, files, location data, voice calls, and other such data will not be disclosed).<\/td>\n<\/tr>\n<tr>\n<td><strong> Signal <\/strong><\/td>\n<td><strong> The content of messages cannot be read. <\/strong><br \/>\nDate and time of user registration.<br \/>\nLast date when the user was connected to the service.<\/td>\n<\/tr>\n<tr>\n<td><strong> Telegram <\/strong><\/td>\n<td><strong> The content of messages cannot be read. <\/strong><br \/>\nUser contact information is not provided to law enforcement to comply with a court order. &amp; nbsp; Telegram may disclose the IP address and number for confirmed terrorist investigations, according to Telegram&#8217;s privacy statement phone to the relevant authorities.<\/td>\n<\/tr>\n<tr>\n<td><strong> Threema <\/strong><\/td>\n<td><strong> The content of messages cannot be read. <\/strong><br \/>\nA hash of the phone number and email address, if provided by the user.<br \/>\nPush Token, if using a push service.<br \/>\nPublic key.\u00a0 Date (no time) when Threema ID was created.<br \/>\nDate (no time) of last login.<\/td>\n<\/tr>\n<tr>\n<td><strong> Viber <\/strong><\/td>\n<td><strong> The content of messages cannot be read. <\/strong><br \/>\nProvided credentials (i.e. phone number), registration data, and IP address at the time of creation.<br \/>\nMessage history: time, date, source number, and destination number.<\/td>\n<\/tr>\n<tr>\n<td><strong> WeChat <\/strong><\/td>\n<td><strong> Content of messages cannot be read. <\/strong><br \/>\nSubpoenas and requests to save accounts are accepted, but data for accounts created in China is not provided.<br \/>\nFor accounts outside of China, provided basic information (name, phone number, email address, IP address) that is retained as long as the account is active.<\/td>\n<\/tr>\n<tr>\n<td><strong> WhatsApp <\/strong><\/td>\n<td><strong><span>Reading message content is limited. <\/span><\/strong><br \/>\nSubpoena: Help you get basic subscriber data.<br \/>\nCourt order: same as subpoena and information about blocked users.<br \/>\nSearch Warrant: This lets you get contacts from the target&#8217;s address book and find out which WhatsApp users have the target in their address book.<br \/>\nPen register: Transmits source and destination metadata for every post every 15 minutes.<br \/>\nIf the target is using an iPhone and iCloud backup is enabled, the data from iCloud may contain WhatsApp data, including the content of messages.<\/td>\n<\/tr>\n<tr>\n<td><strong> Wickr <\/strong><\/td>\n<td><strong>The content of messages cannot be read. <\/strong><br \/>\nThe date and time the account was created.<br \/>\nThe type of devices on which the application is installed.<br \/>\nDate of last use.<br \/>\nNumber of messages.<br \/>\nThe number of external IDs (email addresses and phone numbers) connected to the account, but not the IDs themselves by open test.<br \/>\nAvatar.<br \/>\n<span>Limited information about recent changes to account settings, including adding or stopping devices (does not include message content or routing and delivery information). <\/span><br \/>\nWickr version number.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Let me remind you that I also reported that <a href=\"\/blogs\/fbi-removed-web-shells\/\">FBI removed web shells from vulnerable Microsoft Exchange servers without informing owners<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An FBI study guide has been made publicly available as part of a Freedom of Information law request filed by Property of the People, an American non-profit organization that deals with government transparency. The resulting document contains training tips for agents and explains what kind of data can be obtained from the operators of various [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":6435,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[15],"tags":[123,271,64],"class_list":{"0":"post-6430","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security-news","8":"tag-fbi","9":"tag-telegram","10":"tag-whatsapp"},"featured_image_src":"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2021\/12\/fbi.jpg","author_info":{"display_name":"Vladimir Krasnogolovy","author_link":"https:\/\/gridinsoft.com\/blogs\/author\/krasnogolovy\/"},"_links":{"self":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/6430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/comments?post=6430"}],"version-history":[{"count":5,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/6430\/revisions"}],"predecessor-version":[{"id":17100,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/6430\/revisions\/17100"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media\/6435"}],"wp:attachment":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media?parent=6430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/categories?post=6430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/tags?post=6430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}