By Eduard Halimi
There is a word that draws attention in the document made public in the media regarding the most sensational event of the past week. SPAK found traces of secret service communications in the BIOME function of a cell phone, which subsequently led to the arrest of the head of the secret service.
And how was SPAK able to find Signal communications and Secret Service secrets themselves?
Let’s agree on one thing: even the most strongly encrypted communications are not necessarily traceless since encryption is often not broken; the trace that the communication left on the device is found.
When BBM lost the security and importance it once had, about 10 years ago, SkyECC, EncroChat, etc. appeared, which I have talked about before. It is already known that Telegram has changed its cooperation policy with the authorities.
Diplomats, officials, politicians, journalists, lawyers, businessmen and intelligence services use encrypted applications precisely because they require confidentiality.
But the security of a communication does not depend only on the application. It depends on the whole chain: application → operating system → device → notifications → backups → metadata → physical access → scientific expertise.
You can have an almost impenetrable vault of information, it’s true. But if, after opening the safe, he leaves a copy of the document on the table, the problem is no longer the safe; you are the one who left a document out. But our case surpasses the fiction of many events. Even if it were to go to Netflix, there would be no need to add fictional elements to it, because they would only weaken it.
But how secure are encrypted communications and what can scientific expertise find on our phone? Signal is considered one of the most secure communication platforms. Messages and phone calls are protected with end-to-end encryption: content is encrypted on the sender’s phone and decrypted only on the recipient’s device. Signal itself declares that it does not have messages, phone calls, contact lists or call logs on its servers to hand over to the authorities.
So how did SPAK manage to find traces of the supposedly “disappeared” Signal messages?
The answer is much more interesting than the idea of ”breaking” Signal. It is in the last paragraph of what the media has published: “Regarding the communications… stored in the BIOME function, 508 forms of communication were found… video calls, sms…” Since the issue was interesting and very technical, I asked one of the IT experts what BIOME was.
BIOME is a memory that the user (us) does not see.
BIOME is not a function of Signal, nor is it a file where the user chooses to save conversations.
It is part of the internal architecture of iOS, where the system can record various data and traces about the activity and interactions of the device. They may be invisible to the user. Apparently, they were invisible even to the secret service. The wonder is: how did the secret service not know this!?
For a scientific police expert this is important. The SPAK expert, it seems, has found these traces. This does not mean that BIOME automatically contains the text of every Signal conversation.
The expert I asked told me that maybe not all 508 communications can be deciphered, but traces can be found that show that a communication or activity took place.
If an expert act says that hundreds of calls, voice calls, video calls, messages or chat messages have been identified in BIOME, this should not be automatically read as if the experts have hundreds of complete conversations. Maybe yes, maybe not. Curiosity is great, obviously.
The issue of whether BIOME has probative value is different and belongs to the debate between SPAK and the defense lawyers, because in a criminal process this difference is essential. It will also be interesting to apply the test of this case to the Constitutional Court, in light of its recent decision regarding telephones and their expertise.
Proving that A communicated with B at 22:14 is not the same as proving what A said to B. And the messages leaked to the media are not even 10% of those 508 communications cited. But that belongs to the lawyers of the suspects and not to the spectators, including me. The purpose of this analysis is not to judge the nature or probative strength of the evidence.
How the FBI “broke” Signal and the comparison with our case
In a federal trial in Texas in April 2026, an FBI agent testified that experts had recovered incoming Signal messages from a defendant’s iPhone, even though Signal had been deleted from the phone and the messages were disappearing. They were found in iOS’s internal notification database, not by breaking Signal’s encryption.
When a Signal message arrived on the phone and its contents were displayed as a notification, iOS could store a copy of that information in its notification database. Due to an iOS issue, some notifications that should have been hidden may remain on the device. The FBI found them right there.
Is it the same technical path followed by SPAK experts? We cannot know this without seeing the expertise. But the US case shows that the information that disappears from Signal may have left its mark elsewhere on iOS.
Just about two weeks later, in April 2026, Apple released iOS 26.4.2 and fixed the problem that allowed notifications intended for deletion to remain on the device.
And here an interesting question arises: what version of iOS did the phone have at the time it was seized?
SPAK’s history with the Secret Service and the FBI’s with Signal remind us of something that is often forgotten:
“In the digital age, ‘encrypted’ does not mean ‘traceless.”
“Disappearing” does not necessarily mean that every trace that the operating system has created has disappeared in the same second. And SPAK experts don’t always need to break down the front door. Sometimes it is enough to look for what is left behind: the trace that the message left on the iPhone. And perhaps this is the most interesting secret of modern secret communications:
It is not enough to know whether the message is encrypted. You also need to know what remains after the message is gone.
