THE ISRAEL-BASED FIRM Cellebrite, which specializes in software that breaches cellphones, enjoys a reputation as a silver bullet in 21st-century policing whose products are used only to beat terrorists and find abducted kids. Like any good, vaguely sinister corporate spy outfitter, the company has never publicly confirmed which governments are among its customers, and deflects questions about whether it would sell its infamously powerful software to a repressive, rights-violating regime.
Political activist Mohammed al-Singace (commonly referred to as Abdali) was arrested at his home on the morning of May 15, 2013, in the tiny island petro-monarchy of Bahrain. For years, Singace brother of the well-known dissident Dr. Abduljalil al-Singace, currently serving a life sentence for his role in Bahrains February 2011 protests had worked to bring attention to the Bahraini governments mishandling of poverty and inflation and to advocate for the poor. The Bahraini government is among the worst human rights offenders in the world, routinely disappearing and torturing dissidents and citizen organizers for purely ideological reasons. According to Amnesty International, over the past year, hundreds have been convicted in unfair trials, and many defendants in terrorism cases were convicted largely on the basis of confessions that they said interrogators had forced them to make under torture; some received death sentences. In particular, torture and other ill-treatment of detainees, mainly suspects in security or terrorism-related cases, remained rife
within the Criminal Investigations Directorate (CID).
Shortly after his arrest, Singace was transferred to Building 10" of Bahrains infamous Jau Prison, a facility known for its particularly brutal treatment of prisoners. According to the Bahrain Center for Human Rights, Singace says his beatings began while he was still in bed:
[Singace] stated that he was tortured from the moment of his arrest from his bed as policemen beat him with an unknown machine causing him to bleed and fall unconscious. While being unconscious, they beat and kicked him mostly on the back, hands and head. The signs are still visible on Alsingace as he entered the court with hands that looked abnormal, in addition to a wound on his head, and neck pain which he still suffers from.
According to the Bahrain Institute for Rights and Democracy, Singaces beard was also shaved against his will.
BKQ0PJJCcAAk_gx Political activist Abdali al-Singace. Photo: FacebookBeatings and humiliation are timeless torture techniques, but for draconian police forces desperate to construe personal association as criminal conspiracy, the ability to exploit the contents of someones cellphone is still novel. Getting into someones phone without their cooperation is more technically sophisticated than simply hanging them upside down or battering them, given how typical it is to lock your device with a password or even a fingerprint and this is where Cellebrite comes in. Aimed at law enforcement, military, intelligence and e-discovery personnel, the companys marketing materials promise unprecedented access to the widest variety of mobile devices and operating systems through the use of its trademarked Universal Forensic Extraction Device, which siphons virtually every scrap of data from a phone and makes it searchable and browsable on a third-party computer. Conveniently, the extraction process completely deactivates or bypasses any password you might have put in place to prevent just this kind of intrusion.
When Cellebrite was founded in 1999, this access would have been limited to call logs and contacts. But in the smartphone era, when Cellebrite started marketing forensics gear to military and police customers (Motto: ACCESS. UNIFY. DEFEND.), billions of people around the world began carrying a full computers worth of information on their person: personal emails, bank records, photos, videos, and IMs. In other words, exactly the trove of personal errata, lists of association, and circumstantial evidence that any police force would covet particularly that of a repressive regime with an acute allergy to due process. Its little surprise that our increasingly martial American police have leapt at the chance to use Cellebrite equipment; a CNN investigation reported that for years, it has been the go- to resource for FBI agents breaking into suspects phones, according to security researchers familiar with the FBIs operations. This new ability to spirit away someones cellphone and copy its contents has already attracted the attention of the ACLU, which worries that Cellebrite tech could help police skirt the Fourth Amendment.
The company is a truly 21st-century corporation: Founded in Israel, Cellebrite is now owned by a Japanese software conglomerate, operating sales offices in New Jersey for customers in Michigan. But the cracking gear isnt just popular among U.S. police: A 2014 CNN Marketplace Middle East segment on the company counted 140 different police clients worldwide. As is typical, this report cited the advancement of ISIS
deep into Iraq and Syria as the explanation for Cellebrites sales to Gulf and North African states, a rationale Cellebrite repeats in all of its marketing materials. Left unmentioned was the possibility that Cellebrite might sell its wares to countries that would buy this power only to abuse it. An impressed, wide- eyed corporate profile by the BBC included one interesting moment, when tech correspondent Rory Cellan-Jones asked Cellebrite VP Yuval Ben-Moshe if there were any ethical limits to its sales:
Cellan-Jones: And who will you sell this equipment to? Is it any law enforcement in any country?
Ben-Moshe: We typically sell to any
I wouldnt say any but
government- owned or government-operated law enforcement agencies around the world.
Cellan-Jones: What about repressive regimes that are intent on spying on their citizens in ways that many people would find offensive? Would you sell to them?
Ben-Moshe: I dont know.
I dont know the answer to that and Im no position to comment on that in this point in time.
Cellan-Jones: So you wont say whether Cellebrite will sell to, say, Saudi Arabia, for example, or Iran, or various regimes around the world which might be oppressive?
Ben-Moshe: We operate under law. Under international and the laws of every jurisdiction and country we work at and this is what guides us.
Not exactly a moral stance. Perhaps Ben-Moshe evaded the question because the company does exactly what Cellan-Jones was asking. Based on a recently uncovered document presented as evidence in Singaces prosecution, we can conclude that Bahrain is among the governments that use Cellebrite technology, because it used the technology against Abdali al-Singace.
Singaces phone was taken from him as he was arrested and placed in police custody, where it was cracked and its contents extracted using Cellebrites UFED technology. A report on the contents of Singaces phone, prepared by Bahrains General Directorate of Anti-Corruption and Economic and Electronic Security and generated by Cellebrites software, was entered as evidence against him during his trial. It contains nearly 20 pages of Singaces private WhatsApp conversations. Other court documents show that photos were taken from Singaces phone as well, including several images that were specifically cited during his sentencing as evidence of criminal association. A page from the prosecutions report can be seen below on the left on the right is a sample Cellebrite report page from the United States National Institute of Standards and Technology:
Click for Full Text!