Apple fixed bug that let FBI read Signal messages

The FBI didn't break Signal's encryption. It didn't need to. A bug in Apple's iOS was quietly caching readable previews of Signal messages inside the phone's notification database, surviving even after disappearing messages were enabled, the app was deleted, and the conversation was long gone.

How FBI extracted deleted messages?

The flaw came to light through court documents unsealed in a Texas federal case, first reported by independent outlet 404 Media on April 9. The case involved an attack on the Prairieland ICE Detention Facility in July 2024.

FBI forensic examiners pulled the defendant's Signal messages directly from the iPhone's notification cache, a storage layer that sits entirely outside Signal's encrypted environment and had been retaining message previews without users' knowledge.

Apple addressed the problem in its security notice, revealing that the company had addressed a bug that led to notifications "marked for deletion [being] unexpectedly retained on the device." This update was part of the latest iOS software version. The same day, Signal revealed that it had updated its software, noting on Twitter that "the bugs that made this possible were fixed."

Signal President Meredith Whittaker had already called out Apple in an X post dated April 14, 2023, claiming that notifications for messages that have been deleted should never appear in any OS-level cache. Telegram’s Co-Founder Pavel Durov took a tougher stance, noting that the only solution is to require apps to enforce that there be no previews of notifications at either end of the exchange by default.

End-to-end encryption only works during transmission. It cannot dictate what the underlying OS does with the notification metadata after the message is received.