4 ms·

>My guess is that it’s pretty rare that the Cellebrite evidence is the dispositive crux of a case, meaning, but for evidence pulled from a phone using a Cellebr

>My guess is that it’s pretty rare that the Cellebrite evidence is the dispositive crux of a case, meaning, but for evidence pulled from a phone using a Cellebrite device, the jury would not have voted to convict. Let's also consider cases that could have warrants that would not have been approved if the integrity of the data from a Cellebrite extraction was questionable. I could see some defense lawyers challenge the validity of warrants from this.

alisonkisk 5y ago
No way. "I put a file on my device whose only purpose is to obstruct justice" does not cancel probable cause for a search.
- ambicapter 5y ago
  I love the conflation between Cellebrite, private Israeli business, with "Justice", I presume around the world?
- cyphar 5y ago
  The issue is that the Celebrite device may have scanned someone else's device that contained a malicious file, meaning that any forensic evidence collected for your device is questionable. But IMHO (IANAL) this won't actually have an impact -- the defense would need to have some evidence that the particular Celebrite machine was hacked and that this had an impact on the data taken from that particular device. "It could've been hacked" is purely speculative and isn't nearly enough to get evidence thrown out. I mean, courts routinely accept phone screenshots as evidence -- "it could be a fake screenshot" is much more likely thing to happen, and yet you'd still need to provide evidence that the screenshot might be fake. Not to mention that the bar for warrants is even lower -- you only need "probable cause" in the US.
  - salawat 5y ago
    Reasonable doubt. The defense doesn't need to prove anything except that the prosecution hasn't done their job of assuring they've chased down everything they have to. The prosecution, if relying on Cellebrite, can no longer just say "we dumped the contents of the phone" without picking up the additional investigative burden of proving their chain of custody was not maliciously tampered with successfully. That means source code audits, admitting knowledge of the tool into the public record, or doing cross checks with another tool that isn't known to be vulnerable to an undisclosed exploit, which only holds out til the same type of thing happens to the other tool.
- Jaygles 5y ago
  > Cellebrite’s products are part of the industry of “mobile device forensics” tools. “The mobile forensics process aims to recover digital evidence or relevant data from a mobile device in a way that will preserve the evidence in a forensically sound condition,” using accepted methods, so that it can later be presented in court. >“For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question." A tool with such a vulnerability, one that can affect past, present, and future uses of it, absolutely calls into question the "forensically sound condition" of the data it produces. One wouldn't even need to argue that they or the person they are representing was the one who could have corrupted the data. It could have been any previous device that was scanned.
- qualudeheart 5y ago
  Obstruct justice? Cellebrite is often used by authoritarian unjust postliberal states. I have personally spoken to important figures in these countries with great political power or influence in the economy. Usually they`re very anti privacy except when it comes to their personal shady dealings. “Obstruction of justice” is a moral imperative when “justice” is defined and administered by those with the moral character of Roland Freisler.
roywiggins 5y ago
Even warrants based on bad information, as long as the people authorizing the warrant thought the information was true, it's not enough to make the warrant illegal. As long as they thought the warrant was legal at the time, the evidence gathered won't be excluded. https://en.wikipedia.org/wiki/Good-faith_exception?wprov=sfla1 https://en.wikipedia.org/wiki/Good-faith_exception?wprov=sfl...
greenyoda 5y ago
In the U.S., warrants only require "probable cause"[1], not evidence "beyond a reasonable doubt". The fact that there's a tiny probability that some data could have been corrupted probably wouldn't affect the validity of a warrant. Cops can get warrants based on much less reliable sources, such as a statement from a witness or an informant. [1] https://en.wikipedia.org/wiki/Probable_cause https://en.wikipedia.org/wiki/Probable_cause

alisonkisk 5y ago

No way. "I put a file on my device whose only purpose is to obstruct justice" does not cancel probable cause for a search.

ambicapter 5y ago
I love the conflation between Cellebrite, private Israeli business, with "Justice", I presume around the world?
cyphar 5y ago
The issue is that the Celebrite device may have scanned someone else's device that contained a malicious file, meaning that any forensic evidence collected for your device is questionable. But IMHO (IANAL) this won't actually have an impact -- the defense would need to have some evidence that the particular Celebrite machine was hacked and that this had an impact on the data taken from that particular device. "It could've been hacked" is purely speculative and isn't nearly enough to get evidence thrown out. I mean, courts routinely accept phone screenshots as evidence -- "it could be a fake screenshot" is much more likely thing to happen, and yet you'd still need to provide evidence that the screenshot might be fake. Not to mention that the bar for warrants is even lower -- you only need "probable cause" in the US.
- salawat 5y ago
  Reasonable doubt. The defense doesn't need to prove anything except that the prosecution hasn't done their job of assuring they've chased down everything they have to. The prosecution, if relying on Cellebrite, can no longer just say "we dumped the contents of the phone" without picking up the additional investigative burden of proving their chain of custody was not maliciously tampered with successfully. That means source code audits, admitting knowledge of the tool into the public record, or doing cross checks with another tool that isn't known to be vulnerable to an undisclosed exploit, which only holds out til the same type of thing happens to the other tool.
Jaygles 5y ago
> Cellebrite’s products are part of the industry of “mobile device forensics” tools. “The mobile forensics process aims to recover digital evidence or relevant data from a mobile device in a way that will preserve the evidence in a forensically sound condition,” using accepted methods, so that it can later be presented in court. >“For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question." A tool with such a vulnerability, one that can affect past, present, and future uses of it, absolutely calls into question the "forensically sound condition" of the data it produces. One wouldn't even need to argue that they or the person they are representing was the one who could have corrupted the data. It could have been any previous device that was scanned.
qualudeheart 5y ago
Obstruct justice? Cellebrite is often used by authoritarian unjust postliberal states. I have personally spoken to important figures in these countries with great political power or influence in the economy. Usually they`re very anti privacy except when it comes to their personal shady dealings. “Obstruction of justice” is a moral imperative when “justice” is defined and administered by those with the moral character of Roland Freisler.

roywiggins 5y ago

Even warrants based on bad information, as long as the people authorizing the warrant thought the information was true, it's not enough to make the warrant illegal. As long as they thought the warrant was legal at the time, the evidence gathered won't be excluded. https://en.wikipedia.org/wiki/Good-faith_exception?wprov=sfla1 https://en.wikipedia.org/wiki/Good-faith_exception?wprov=sfl...

greenyoda 5y ago

In the U.S., warrants only require "probable cause"[1], not evidence "beyond a reasonable doubt". The fact that there's a tiny probability that some data could have been corrupted probably wouldn't affect the validity of a warrant. Cops can get warrants based on much less reliable sources, such as a statement from a witness or an informant. [1] https://en.wikipedia.org/wiki/Probable_cause https://en.wikipedia.org/wiki/Probable_cause