Alleged pedophile “LuvEmYoung” had worked to stay anonymous in chatrooms where he bragged about sexually abusing children. A criminal affidavit said he covered his tracks by using TeleGuard, an encrypted Swiss messaging app. Thw FBI had a new strategy. A foreign law enforcement officer got TeleGuard to hand over a small string of code the company had used to send push alerts, the pop-up notifications that announce instant messages and news updates, to the suspect’s phone. An FBI agent got Google to hand over a list of email addresses linked to that code, known as a “push token,” and traced one account to a man in Toledo. Michael Aspinwall, was charged with sexual exploitation of minors and distribution of child pornography and arrested within a week of the Google request. The breakthrough relied on a little-known quirk of push alerts, a basic staple of modern phones: Those tokens can be used to identify users and are stored on servers run by Apple and Google, which can hand them over at law enforcement’s request, reports the Washington Post.
The investigative technique has raised alarms from privacy advocates, who worry the data could be used to surveil Americans at a time when police and prosecutors have used cellphone data to investigate women for potentially violating state abortion bans. The data has become prized evidence for federal investigators, who have used push tokens in at least four cases to arrest suspects in cases related to child sexual abuse material and a kidnapping that led to murder. Law enforcement officials have defended the technique by saying they use court-authorized legal processes that give officers a vital tool they need to hunt down criminals. The Post found more than 130 search warrants and court orders in which investigators had demanded that Apple, Google, Facebook and other tech companies hand over data related to a suspect’s push alerts or in which they noted the importance of push tokens in broader requests for account information.