27 Jan 2022Police routinely use the data extraction technology Cellebrite to obtain data from mobile phones for their investigations. But there could be problems with them relying on this hi-tech digital scanning tool to collect evidence to present in court.
There are growing concerns about the technology, with some experts claiming the software may have security flaws. These vulnerabilities could result in falsified data slipping into police investigations.
What is Cellebrite software?
The Israeli technology, Cellebrite, is used to instantly extract messages, photos and other information from mobile phones.
It is a valuable tool for police, enabling them to explore a suspect’s connections or trace evidence of criminal activities.
How does Cellebrite work?
It takes just a few seconds for police to scan a mobile phone with technology such as Cellebrite. They usually download the entire contents of the phone and gain an enormous level of intelligence.
Police can scan a device during a stop and search on reasonable grounds, patrolling in a vehicle, or while questioning a suspect – often without the knowledge of the person. Usually, they are seeking confirmation of drug dealing, child sexual abuse, murder or gang activity involving assault or robbery.
Code can be planted to take over Cellebrite scan and rewrite data
It has been reported that the technology has security flaws in its software that could be exploited to manipulate data during its extraction from mobile phones.
It was claimed faults in the surveillance tool made it possible to plant code on a phone that would take over Cellebrite’s hardware while scanning the device. This could potentially rewrite the data. (See Signal founder: I hacked police phone-cracking tool Cellebrite, The Guardian, April 2021.)
Can Cellebrite evidence be relied on in court?
Apart from questions of breaching privacy, I have seen people charged over messages they had cc’d to other people’s phones. In my experience, defendants usually plead guilty when confronted with evidence gleaned from their mobile phone.
But there could be defences mounted based on possible faults in the technology. In the US, a defence attorney is challenging a conviction that relied on Cellebrite evidence. (See Signal’s Cellebrite hack is already causing grief for the law, Gizmodo, April 2021.)
Cellebrite software widely used to convict criminals
A quick search of the word Cellebrite in the Austlii site of Australian court judgements reveals that many law enforcement officers rely on this technology to secure convictions.
One such case led to a murder conviction, after data gathered by a digital scan revealed the defendant had boasted to a friend that he had “anked” the victim. (See Signal’s hack of surveillance tech used by police could undermine Australian criminal cases, The Guardian, May 2021.)
Before submitting evidence gleaned from surveillance technology such as Cellebrite, law enforcement needs to be certain it can be relied upon. If the software is suspected of being faulty, this could result in a miscarriage of justice.
For information on the powers of the police to access computers, please see New laws extend police power to hack suspects’ personal computers and What do new critical infrastructure laws mean for Australian businesses?
