Cellebrite asks cops to keep its technology secret

The pseudoscience of those forensics is powerful because if has a lot of technobabble that makes it sound well supported by evidence, and because it can pass as a science to the jury and even judges. The crime series that people eat up rely on dishing that technobabble step by step so the average person feels like they're being educated in detail about something that can apparently be replicated by anyone because "it's science". Science is for everyone and people can peer behind the curtain to see how the sausage is made.

But Cellebrite is unambiguously a private, for profit enterprise. They haven't established themselves as a "science" like authority in the average person's eyes, they actively avoid explaining the processes. They're just a company paid by a customer to deliver what the customer wants. So in the average person's eyes the difference should be obvious: this isn't science, it's not for everyone (just for the Police), and the people are not allowed to peer behind the curtain. And like authorities like to say "honest people don't need to hide things".

So as far as jury trials go there may still be a fighting chance.

> Many of the tools law enforcement uses are straight up hocus pocus, and they lack the training or ability to question their methods.

I suspect that the real issue is the lack of incentive; it doesn't matter whether they know (or are capable of figuring out) that their science is bunk if there's no consequences for the status quo to continue.

> Instead of rectifying their mistakes, they swept it under the rug and forgot about it.

Yeah, that should be a crime. Their fraud led to false imprisonment

Peer-reviewed science have less than a hundred years of history.

Even today, Large scale experimental science seldom get review from outside their lab. (Because the lab literally hire every expert in that sub-field)

Calling something "not science" because it is not peer reviewed is just ignorant

Peer reviewed studies have a roughly 50% replication rate… that’s not ver good either

The US Federal government still uses polygraph in the security clearance process today. In 2013, they indicted several people for teaching others how to beat the test. Here’s the DOJ press release (prepare to lose brain cells):

https://www.justice.gov/opa/pr/owner-polygraph-indicted-alle...

Clearly our government and legal system think highly enough of the technique to include it in interview processes. The NSA even has an entire production video rebuking the criticisms of polygraph. It’s not just a tool (in the eyes of the government) used to trick dumb criminals into spilling the beans.

This is not true. It's a requirement in many states' probations that probationers undergo regular polygraphy. If they fail the polygraph enough times, they get kicked out of state-mandated therapy and are violated.

Thousands of people are in prison right now over failed polygraphs.

In places with strong courts that won't put up with this, probation officers simply tell the therapist to write up the probationer for some other, vague non-compliance issue should they fail enough polygraphs

Reminds me of the old urban legend about using a photocopier as a polygraph:

https://youtu.be/rN7pkFNEg5c?t=95

Hell why not add juries themselves to the list? A widely cited 2011 study[^0] found that the probability of a jury granting parole was around 65% at the start of a session but dropped to nearly 0% right before lunch. After having lunch the probability again jumps to ~65%

What kind of justice system do we have where whether or not people have had lunch is the biggest factor in outcomes?

[^0]: https://www.pnas.org/doi/full/10.1073/pnas.1018033108

It’s pretty much just complete non-replicable BS. The claim is that the rifling on gun barrels differs from gun to gun, and that they can examine grooves made in the bullets by the rifling and compare them to other rounds shot through the same barrel and find a match. It doesn’t stand up to independent scrutiny, and I would imagine that with modern machining the gun to gun differences in rifling on the same mass produced guns are minimal. Perhaps there are differences in fowling in well-used guns, but the notion that they’re gonna match a flattened bullet to a specific barrel is ridiculous. Basically a few kooks across the country wear white coats and claim that they can do this “science” and prosecutions pay them to be expert witnesses. Juries eat it up. It’s really nuts.

The only legitimate analysis they’re doing is ammo brand matching. “Hey, there was a Sellier & Bellot 380 Auto casing at the murder scene. The suspect had S&B 380 in his gun safe. We got him.”

There's really no way to relate rifling/etc to a specific gun. Unless it was forged in some bespoke process that can also be accessed and replicated the rifling pattern will look like 100,000 different guns. Other analysis is also bunk (blood spatter, gunpowder stuff, etc). Ammo matching can provide circumstantial evidence but is likely defeated by just shutting your mouth.

Most criminals subject to this are probably caught because they loaded the magazine without gloves and left a fingerprint on the casing that gets completely etched into it on firing. Or, you know, police do actual police work and pressure the right people into narc'ing on the suspect.

Radley Balko has a great overview on the fundamental flaws with ballistics forensics[1]. The tl;dr is that the core claim of ballistics forensic analysis, that it is possible to reliably differentiate between two models of the same gun using just casings and shells fired from those guns, has never been proven to be valid.

[1]: https://radleybalko.substack.com/p/devil-in-the-grooves-the-...

Some of it (e.g. what bullet type) is real, but angles and distances are largely impossible to reliably.

It should not be about who is presenting the argument, but the weight of the argument itself. For example, for balistics: the debate falls onto whether each individual weapon's barrel would leave a uniquely matching trace that can be analyzed from the fired casing. The argument against this method is that machining precision today is so high that there will be no huge differences between each 2 barrels, that make any match valid as unique and as evidence.

For all the other claims (e.g. polygraph), you can easily search for more information online.

The point is that authority or lack there of should not be a part of your evaluation of the claims, on either side.

Well you can just... look them up. Some of these were new to me (e.g. firearm ballistics). But when it comes to stuff like the unreliability of drug tests or bite mark forensics, it's not at all a secret. Any recently published meta analysis would suffice. In fact I'd be shocked if you could find any in support of these methods.

Why put the onus of the work to quote a bunch of articles on the OP when these are all very easily verifiable with a tiny bit of effort

Ha. I got to see Dr. Mullins speak back in University. Fascinating guy.

Depends on the lengths of the sequences being compared but the birthday problem indicates that it's more common than you'd expect.

At the very least there will be identical multiple births in some of them.

It's way dumber than a PR stunt.

Plenty of Signal users live in totalitarian dictatorships, where the law doesn't care if you're actually guilty. Even in democracies you can't always rely on the courts. "We're planting incriminating evidence on your phone" should lead to mass uninstall of Signal.

Except nobody really believes they did that. Signal would be banned from all App Stores, and moxie would go to jail on so many charges. It's one of those nerd law ideas where 'you can't 100% prove it' is the golden defence except it isn't really - the law can call a bluff, especially when millions of users and multiple app stores already did. It says reasonable doubt, not any doubt.

It wasn’t tampering, the rhetorical skills of the attorney and the dumbass ADAs failure to rein it in bamboozled a poorly prepared expert.

In fairness, the guy was there to talk about a camera, not to describe how NTP on the cellular network works. The defense had the judge questioning the nature of time and space!

Are you suggesting they can't hack phones, and just fake entire address book/location history/all messages? That's obviously false. Is the suggestion that there was some sort of massive conspiracy planting evidence*? I strongly suspect judges won't assign much credence to that.

* Such a conspiracy would have to include Cellebrite, the police and Apple/Google. After all, hacking the phone likely means you have the iCloud keys and can download the backups to verify. Furthermore, the conspiracy would always be at risk from the accused choosing to restore the backups to show some evidence wasn't there. So someone at Apple/Google would have to be complicit as well to modify the backups.

Ouch, that's pretty nasty.

Also, I couldn't help but be amused by cheekiness:

"By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrite. Inside, we found the latest versions of the Cellebrite software, a hardware dongle designed to prevent piracy (tells you something about their customers I guess!), and a bizarrely large number of cable adapters."

sure, but if the phone company says there was an sms, when you open the phone it looks like there is an sms, and cellebrite extracts one, which you then present in a nice power point to the court... then your accusation as to tapering with the evidence and where in the chain of custody it occurred had better be good, or all you are going to do is annoy the court (as someone with dozens , maybe hundred+, of cellebrite reports in various court records) This is what armchair lawyers tend to forget, especially coders tend to forget. The law is not code. The judge is not a complier. When the law does not represent reality (this guys sells drugs and uses his phone to do it being a common reality) , then it becomes news-worthy.

But normally people just look at the reality and go "oh yes, this tool extracts the stuff on a phone and turns it into a pdf/html, how convenient". 99.99% of the time, the time a drug dealer alleging he has no knowledge of the 100's of deals on his phone is about as realistic as your 5 year old nephew with cake smeared on his face denying he ate the last bit of cake... and is treated as such. Should the act of selling drugs be a crime?- completely different topic.

Try your hand with this next time you're arrested and have your phone dumped, I guess. Tons of police departments across the US use them and so many courts have accepted data extracted from devices.

It's a defence often used in CP cases - 'my computer was hacked! I had no idea the computer had CSAM!' - and it always fails. Because hacking is atypical, courts place the burden on the defendant to prove hacking, and there's usually no good way to do that. Same thing here, except the defendant is in an even worse position.

In theory, a CP felon would have reason to generically hack some another computer (since CSAM storage itself is illegal), and desktop OSs are less secure. In the phone case, you likely need to assume a specific criminal conspiracy entirely meant to convict the defendant, one that must involve the police*, and that's an extremely high bar to meet.

* The police are the ones using the tool; the only way to effectively plant non-generic evidence is to have the corroborating data first and that requires police assistance.

Or perhaps even more likely - process fake data injected by a malicious 3rd party trying to spoof an app.

Which phone model/version? Did they need anything from other owner? From apple? Physical access? USB? Brute force bypass? Anything you can describe about the capabilities and techniques people would be interested in knowing.

> You do understand that everything you know about iPhone's privacy comes from Apple's mouth, right?

No, we know that from the words of independent security experts.

Ah you're correct, Apple denied them the tools and afterwards changed the design so that there are no tools they can give.

They buy and build unpublished exploits and hide them so that they don't get patched - that's why the key software is tricky to get even for gov't agencies, some things for breaking fully-patched recent phones Cellebrite will only do in-house so that the customer can't leak and 'burn' the quite expensive exploit which was used.

I'm pretty sure they do the same thing as a manual iTunes backup. A lot of the older phones with chips before A13 also seem to be variably vulnerable to being jailbroken with CheckRa1n where they can gain root access. It seems likely that Cellebrite uses CheckRa1n for a lot of older phones. There's also the issue of protection levels where if your phone has been unlocked once since boot (AFU), various keys are kept (possibly transparently) in RAM where they can be dumped somehow.

Also, iCloud backup and several other dangerous "features" like iMessage are enabled by default whenever you sign in to iCloud so there's a few backdoors already standard to anyone who uses iCloud. If you sign in in settings, it automatically signs/opts you into iCloud, even if you don't want it.

Nice try, Apple employee!

Exploits.

If the messages are encrypted locally (an option on iOS), and Celebrite fails to brute force your login code, then yes, they cannot extract Signal messages.

No it didn’t. It only allowed it in case of a good-faith mistake, which is very different from intentionally using a Cellebrite to capture evidence illegally.

>People occasionally get the bright idea to ask to inspect the source code

Isn't this a reasonable ask?

Speed cameras are usually tested and certified by an independent third party. With proper cause, there's probably a pretty good chance you could get an expert to review the design files after signing an NDA.

Traffic violations have, I believe, a lower standard of evidence than criminal cases. I am very much not a lawyer, though.

LEOs already use faraday bags and cages for devices they confiscate to prevent remote wipes. Some of the products even include chargers to ensure devices don't go dark (searching for signal eats up battery life, after all) and flush valuable data from memory. How could Apple rely on GPS when the device will be totally offline?

https://www.teeltech.com/mobile-device-forensics-equipment/m...

https://tritechforensics.com/digital-forensics/df-faraday-pr...

https://arrowheadforensics.com/products/evidence-packaging/f...

I would think a more reliable method would be heuristics to detect tampering which triggers enclave destruction when confidence level is high or the activity continues long enough. There are exceptions but the actions that enable deeper exploits rarely resemble normal usage in any way and should be simple to differentiate.

I’m sure Cellebrite never buys new real estate.

If Bitlocker had a backdoor it would have leaked by now. I don't believe that they could keep an "alphabet boys only" backdoor secret for that long.

How would that backdoor even look like? A some sort of master key that can decrypt every Bitlocker encrypted drive? Imagine if something like THAT got leaked.

Who would have access to that key? Microsoft themselves? NSA? FBI? What about the UK, Australia or other US allies? Do their alphabet boys also get access to this?

Do small town cops also get access?

And I'm pretty sure lots of security researchers have tried to find vulnerabilities of Bitlocker. If there was something fishy going on - they would have noticed.

It can potentially be a theatrical farce, but you've only created hypothetical scenarios in your mind for why that might be the case. Even if you did "own both ends", you still have to rely on other parties to contribute the pieces that you don't watch over, unless you're going to be E2EE from scratch (again, because you can hypothetically just say "well what if the encryption scheme itself is backdoored").

sure, all clouds are other people’s computers; laypeople just want things to work and don’t really care about whose root of trust they use.

living in a world where you run everything yourself sounds good in practice but then you can’t communicate with anyone else.

i’d like for the firmware to be open source and for the cloud to be federated, but it’s a pipe dream and i’m busy so i just gotta trust apple in the end

If you’re that paranoid, maybe don’t send super sensitive information using a chat application.