is to be used by law enforcement in criminal investigations, typically with a warrant under the Fourth Amendment that allows them to search someone’s phone and seize data from it.Ĭellebrite’s products are part of the industry of “mobile device forensics” tools. Nevertheless, I have a raised eyebrow for Signal here too.Ĭellebrite is an Israeli company that, per Signal’s blog post, “makes software to automate physically extracting and indexing data from mobile devices.” A common use case here in the U.S.

Is that motion likely to succeed? What will be the likely ramifications of Signal's discovery in court cases? I think the impact on existing cases will be negligible, but that Signal has made an important point that may help push the mobile device forensics industry towards greater accountability for their often sloppy product security. While Cellebrite has since taken steps to mitigate the vulnerability, there's already been a motion for a new trial filed in at least one criminal case on the basis of Signal's blog post. In April, the team behind the popular end-to-end encrypted (E2EE) chat app Signal published a blog post detailing how they had obtained a Cellebrite device, analyzed the software, and found vulnerabilities that would allow for arbitrary code execution by a device that's being scanned with a Cellebrite tool.Īs coverage of the blog post pointed out, the vulnerability draws into question whether Cellebrite's tools are reliable in criminal prosecutions after all. It's popular with law enforcement agencies as a tool for gathering digital evidence from smartphones in their custody. Cellebrite's software extracts data from mobile devices and generates a report about the extraction. You may have seen a story in the news recently about vulnerabilities discovered in the digital forensics tool made by Israeli firm Cellebrite. (I kinda doubt they’ll hire me again if they read this, though.) Full disclosure: I’ve done some consulting work for Signal, albeit not on anything like this issue. This blog post is based off of a talk I gave on at the Stanford Computer Science Department’s weekly lunch talk series on computer security topics.

Ufed reader archive