Tag: smartphones

The Fourth Circuit Says Border Agents Can Search Your Phone By Hand, No Suspicion Required

The Fourth Circuit issued a disappointing opinion in U.S. v. Belmonte Cardozo, a case in which EFF filed an amicus brief, alongside the national ACLU, its Maryland, North Carolina, South Carolina, and Virginia affiliates, and the National Association of Criminal Defense Lawyers (NACDL).

We argued that electronic device searches at the border should require a warrant based on probable cause, but at minimum, regardless of whether an officer searches by hand or with forensic software that plugs into a device and downloads its entire contents for search, the same Fourth Amendment standard should apply to all device searches at the border.

Unfortunately, the court rejected that argument and ruled that a lower standard applies to manual searches, allowing the government to conduct extraordinarily invasive electronic device searches without any suspicion of wrongdoing, simply because the border officer chooses to search by hand rather than with a forensic tool.

The Border Search Exception Meets Your Phone

The Fourth Amendment requires that government searches of persons or property be reasonable, which usually means obtaining a warrant based on probable cause from a judge.

But a warrantless search can still be reasonable if it falls within an exception to the warrant requirement, including the exception that allows officers to search your belongings at the border. The border search exception allows warrantless searches of persons or property crossing the U.S. border, including the functional equivalent of the border such as international airports, given the government’s interests in controlling who and what may enter the country.

Historically, courts have categorized border searches of luggage, vehicles, and personal effects as “routine” and thus reasonable even if conducted without any suspicion that the traveler has engaged in wrongdoing; courts have also held that more invasive “nonroutine” searches, such as certain body searches and searches that damage property, require reasonable suspicion.

But a person’s privacy interests in the personal data on a phone or laptop are extraordinarily different than their limited privacy interests in the contents of their suitcase.

Keep reading

Carney wants sweeping powers over your phone while using a foreign one himself

Prime Minister Mark Carney wants sweeping new powers over Canada’s telecommunications system. But according to a recent Wall Street Journal report, when it comes to his own communications, he’s reportedly relying on a U.K.-based cellphone to communicate with foreign leaders.

If true, the irony is impossible to ignore.

The Carney government is pushing Bill C-22, legislation that would significantly expand Ottawa’s authority over Canada’s telecommunications sector in the name of national security. The bill would give the federal government broad powers to issue security orders to telecommunications companies, require providers to comply with government directives, and increase federal oversight of Canada’s communications infrastructure.

Canadians are being told these extraordinary powers are necessary because secure communications matter.

Apparently, that principle may not apply to the Prime Minister himself.

According to the Wall Street Journal, Carney has continued using a British cellphone while speaking with foreign leaders. If that reporting is accurate, Canadians deserve answers.

The issue isn’t simply where the phone was purchased; it’s about whether the Prime Minister is following the same security, transparency, and record-keeping standards imposed on everyone else in government, and now on the public. 

Among the questions that should be answered:

  • Communications security: Was the device approved for sensitive government communications under standards established by the Communications Security Establishment (CSE) and Treasury Board?
  • Government records: Were official calls, text messages and other communications retained in accordance with the Library and Archives of Canada Act and federal information management policies?
  • Access to Information: If government business was conducted using a foreign device or foreign telecommunications provider, are those records preserved in a manner that complies with the Access to Information Act, or could they be more difficult for Canadians to obtain?
  • Government device policies: Was the phone issued, managed and secured by the Government of Canada, or was it a personal device used for official business?
  • Foreign jurisdiction: Were official communications routed or stored through infrastructure subject to U.K. law, and what security assessment was conducted before using that device to communicate with foreign leaders?
  • Bill C-22: Why is the government demanding unprecedented oversight of Canadian telecommunications providers on national security grounds while the Prime Minister reportedly relies on a foreign telecommunications provider for his own communications?

Ottawa insists foreign technology, foreign influence and foreign infrastructure pose national security concerns. Yet the Prime Minister himself reportedly chose a foreign cellphone and foreign carrier while conducting international diplomacy.

Keep reading

Starmer Calls for Spyware on All Phones

British Prime Minister Keir Starmer strode onto a stage at London Tech Week and handed Apple, Google and friends a three-month ultimatum with all the menace of a substitute teacher confiscating phones at the door. Build us controls that stop children from taking, sharing, or viewing nude images, switch them on by default across every phone and tablet already humming away in the nation’s pockets, and look sharp about it.

“This government will not stand by while children are put at risk online,” he announced, before adding the line every tech executive in the room heard as a polite threat.

“Today I am calling on the tech companies to introduce device-level controls to prevent children from taking, sharing or viewing nude images. And if they don’t act, we will.”

Stirring stuff. Nobody wants children harmed, and saying so out loud is the cheapest applause line in British politics.

The trouble is the two innocent-looking words tucked into the speech like a wasp in a picnic basket, the words “device-level.”

Here is what “device-level” means once you peel off the cuddly branding. To catch one naughty photo on your phone, something has to inspect every photo on your phone. All of them.

It is software that leans over your shoulder the instant you raise your camera, squints at whatever you are making, and decides whether you may keep it or it gets reported to authorities.

Engineers named this trick years ago, client-side scanning, and even Apple, a company that would happily sell you the air inside its packaging, built a version of it in 2021 and then sprinted away from the idea the moment people worked out what it did to private messaging.

The worst part is what it does to encryption. End-to-end encryption is meant to mean nobody in the middle can read your stuff, not the app, not your internet provider, not a bored government with a search warrant fetish.

Client-side scanning waltzes around all of that by reading your photo on your own device first, before the encryption clicks shut. The lock on the front door stays bolted. There is just a man with a clipboard standing in your hallway, jotting notes before you turn the key. The math survives. The privacy, meanwhile, is dead.

Step back and admire how casually people are treating this. A government politely asking every phone maker to install a tiny invigilator inside the camera lens, marking your snapshots as they form, would have been thrown out of a Black Mirror writers’ room a decade ago for being too on the nose.

Keep reading

UK Government Plots Digital ID Lockdown On Every Phone In Lockstep With Big Tech

The Labour government in Britain is accelerating its assault on digital privacy under the well-worn banner of child protection. Fresh plans leaked to the press reveal ministers intend to compel Apple, Google and other tech firms to restrict smartphones so thoroughly that a digital ID will be needed to use them with unfettered access.

The mechanism comes in the form of expanded age verification that effectively demands digital identification for device setup and use. What is sold as safeguarding the young is shaping up as a backdoor mandate for every adult in Britain to submit ID just to operate a phone or go online.

This development lands alongside Google’s confirmation that it will soon bring digital IDs to Android devices in the UK via Google Wallet. Users will record a short video selfie and scan a government-issued ID to add a digital version of their passport or other documents.

Keep reading

New Digital ID Bill Ties Your Identity to Your Phone—and Everything You Do Online

Republicans are once again teaming up with Democrats to ram Digital ID through at the federal level.

The bill they’ve just introduced is, if you can believe it, worse than all the others before it.

HR 8250, deceptively named the Parents Decide Act, doesn’t just force everyone to link their identity to use apps on their phones, it mandates that they must do it to use ANY operating system. That means Apple, iOS, Windows, Google, Android, even Samsung—basically everything.

And once that’s in place, there’s nowhere to step outside of it.

But one brave group is refusing to go along.

GrapheneOS has made a statement saying: GrapheneOS will remain usable by anyone around the world without requiring personal information, identification, or an account.

Glenn and Eric Meder from Privacy Academy have been working to educate people on how to escape the digital control grid, including how to put GrapheneOS on your phone—for free. And they have a solution to Digital ID right now.

Keep reading

FBI Recovers Deleted Signal Messages Through iPhone Notifications

The FBI successfully recovered private Signal messages from a defendant’s iPhone even after the app was deleted. Learn how this security loophole works and the simple setting you must change today to keep your chats private.

Most of us prefer using the Signal app because it is supposed to be very secure with a remarkable end-to-end encryption system that hides our chats from everyone else. It also has a message-disappearing feature to help us set a message deletion time.

But the Federal Bureau of Investigation (FBI) found a way to read private Signal messages on an iPhone, even after the app was deleted. This was revealed in a court case in Texas that these messages can stay hidden in the phone’s memory longer than we expected.

How the loophole works

The case involves a woman named Lynette Sharp and an attack on a Texas detention centre in July 2025. During the trial in April 2026, the FBI revealed they recovered her messages even when she had deleted the Signal app. The bureau, reportedly, retrieved the messages from the iPhone’s push notification database.

During the trial, FBI Special Agent Clark Wiethorn explained how investigators accessed the evidence. When a message arrives, the phone shows a little preview on the screen, which is handled by the phone’s operating system and not the Signal app.

Even if Signal deletes the message later, the phone’s system can save a copy of that preview in its own records. To read these saved messages from Signal, the FBI used Cellebrite, a forensic tool often used by law enforcement to scan seized devices.

A key finding is that the FBI could only see incoming messages, not the ones Sharp sent, which confirms the data came from the notification storage. It shows that while the app’s encryption is strong, the phone’s operating system keeps its own logs of everything.

Keep reading

Massachusetts Agrees to Delete Data From App It ‘Secretly Installed’ During Pandemic

Massachusetts officials have agreed to delete data from a contact tracing application that people said was installed on their phones without their permission during the COVID-19 pandemic.

Under a settlement agreement approved by a federal judge on March 31, the Massachusetts Department of Public Health “shall (a) destroy any Primary Data in the Department’s possession, custody, and control, which the Department, exercising all due diligence, has located and … that was made available to the Department from the COVID Exposure Notification Setting on Android Devices; and (b) certify in writing to Class Counsel that such data has been destroyed and will not be provided to any third party.”

The state’s health commissioner also promised not to have data collecting applications installed on people’s phones without their permission for five years.

The settlement came in a case brought by plaintiffs who said the app in question, known as MassNotify v.3 or Exposure Notification Settings Feature-MA, was “secretly installed” on their phones without their permission.

American Institute of Economic Research senior fellow Robert Wright, who lives in Massachusetts, said the app was downloaded onto his Android phone around July 1, 2021, without his knowledge. Johnny Kula, a New Hampshire resident who travels to Massachusetts on a daily basis for work, also said he discovered the app on his phone around the same time, and that it was back on the phone later in 2021 after he uninstalled it.

The plaintiffs’ claims echoed reviews from app store users complaining they had not downloaded the app, but it appeared on their phones. The app, which allowed people to say they had tested positive for COVID-19, and alerted others who had recently been close in location to those people, was downloaded more than one million times, according to court filings. Similar applications were developed by at least 24 other states.

Keep reading

FBI Issues Public Alert on Americans Using Foreign Apps

The FBI identified data security risks from foreign-developed mobile apps used in the United States, the agency warned in a March 31 public service announcement.

“As of early 2026, many of the most downloaded and top-grossing apps in the United States are developed and maintained by foreign companies, particularly those based in China,” the FBI said, without naming any apps.

“The apps that maintain digital infrastructure in China are subject to China’s extensive national security laws, enabling the Chinese government to potentially access mobile app users’ data.”

In the Google Play store, the most popular apps include short-form video platform TikTok, video editor CapCut, artificial intelligence video generator PixVerse, and communication app Telegram X. China-based ByteDance maintains ownership of TikTok and CapCut. PixVerse is owned by a Singaporean company, and the developer of Telegram X is based in the United Arab Emirates.

On Apple’s App Store, the top free apps include CapCut, TikTok, and Chinese shopping apps Temu and Shein.

In its alert, the FBI warned users to be aware of the types of data the foreign apps request access to when they are downloaded.

Keep reading

White House App Found Tracking Users’ Exact Location Every 4.5 Minutes via Third-Party Server

The Trump administration’s newly launched White House App is under scrutiny after a software developer claimed to have found embedded code that tracks users’ precise GPS coordinates every 4.5 minutes and automatically syncs them to a third-party server. The claim, posted on 28 March 2026 by the X account @Thereallo1026, has drawn nearly 260,000 views and prompted questions about data collection practices in government-operated applications.

The post included what appeared to be decompiled source code from the app, revealing what the user described as OneSignal’s ‘full GPS pipeline compiled in.’ According to the post, the code showed the app ‘polling your location every 4.5 minutes, syncing your exact coordinates to a third-party server.’ The White House has not publicly responded to the specific technical claims.

What the Code Allegedly Shows

OneSignal is a widely used push notification platform that, according to its own documentation, updates a user’s GPS coordinates ‘approximately every 5 minutes (based on permission and system rules)’ when location sharing is enabled within a mobile app. The platform is designed to allow developers to segment and target users based on their physical location for messaging campaigns.

The decompiled code shared by @Thereallo1026 references Android location permission strings, background location access, and a foreground update time set to 270,000 milliseconds — the equivalent of 4.5 minutes — alongside a background update time of 600,000 milliseconds, or 10 minutes. If accurate, these constants suggest the app is configured to collect and transmit precise location data at regular intervals, even while running in the background.

Keep reading