4 ms·

No way. "I put a file on my device whose only purpose is to obstruct justice" does not cancel probable cause for a search.

ambicapter 5y ago
I love the conflation between Cellebrite, private Israeli business, with "Justice", I presume around the world?
cyphar 5y ago
The issue is that the Celebrite device may have scanned someone else's device that contained a malicious file, meaning that any forensic evidence collected for your device is questionable. But IMHO (IANAL) this won't actually have an impact -- the defense would need to have some evidence that the particular Celebrite machine was hacked and that this had an impact on the data taken from that particular device. "It could've been hacked" is purely speculative and isn't nearly enough to get evidence thrown out. I mean, courts routinely accept phone screenshots as evidence -- "it could be a fake screenshot" is much more likely thing to happen, and yet you'd still need to provide evidence that the screenshot might be fake. Not to mention that the bar for warrants is even lower -- you only need "probable cause" in the US.
- salawat 5y ago
  Reasonable doubt. The defense doesn't need to prove anything except that the prosecution hasn't done their job of assuring they've chased down everything they have to. The prosecution, if relying on Cellebrite, can no longer just say "we dumped the contents of the phone" without picking up the additional investigative burden of proving their chain of custody was not maliciously tampered with successfully. That means source code audits, admitting knowledge of the tool into the public record, or doing cross checks with another tool that isn't known to be vulnerable to an undisclosed exploit, which only holds out til the same type of thing happens to the other tool.
Jaygles 5y ago
> Cellebrite’s products are part of the industry of “mobile device forensics” tools. “The mobile forensics process aims to recover digital evidence or relevant data from a mobile device in a way that will preserve the evidence in a forensically sound condition,” using accepted methods, so that it can later be presented in court. >“For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question." A tool with such a vulnerability, one that can affect past, present, and future uses of it, absolutely calls into question the "forensically sound condition" of the data it produces. One wouldn't even need to argue that they or the person they are representing was the one who could have corrupted the data. It could have been any previous device that was scanned.
qualudeheart 5y ago
Obstruct justice? Cellebrite is often used by authoritarian unjust postliberal states. I have personally spoken to important figures in these countries with great political power or influence in the economy. Usually they`re very anti privacy except when it comes to their personal shady dealings. “Obstruction of justice” is a moral imperative when “justice” is defined and administered by those with the moral character of Roland Freisler.

ambicapter 5y ago

I love the conflation between Cellebrite, private Israeli business, with "Justice", I presume around the world?

cyphar 5y ago

The issue is that the Celebrite device may have scanned someone else's device that contained a malicious file, meaning that any forensic evidence collected for your device is questionable. But IMHO (IANAL) this won't actually have an impact -- the defense would need to have some evidence that the particular Celebrite machine was hacked and that this had an impact on the data taken from that particular device. "It could've been hacked" is purely speculative and isn't nearly enough to get evidence thrown out. I mean, courts routinely accept phone screenshots as evidence -- "it could be a fake screenshot" is much more likely thing to happen, and yet you'd still need to provide evidence that the screenshot might be fake. Not to mention that the bar for warrants is even lower -- you only need "probable cause" in the US.

salawat 5y ago
Reasonable doubt. The defense doesn't need to prove anything except that the prosecution hasn't done their job of assuring they've chased down everything they have to. The prosecution, if relying on Cellebrite, can no longer just say "we dumped the contents of the phone" without picking up the additional investigative burden of proving their chain of custody was not maliciously tampered with successfully. That means source code audits, admitting knowledge of the tool into the public record, or doing cross checks with another tool that isn't known to be vulnerable to an undisclosed exploit, which only holds out til the same type of thing happens to the other tool.

Jaygles 5y ago

> Cellebrite’s products are part of the industry of “mobile device forensics” tools. “The mobile forensics process aims to recover digital evidence or relevant data from a mobile device in a way that will preserve the evidence in a forensically sound condition,” using accepted methods, so that it can later be presented in court. >“For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question." A tool with such a vulnerability, one that can affect past, present, and future uses of it, absolutely calls into question the "forensically sound condition" of the data it produces. One wouldn't even need to argue that they or the person they are representing was the one who could have corrupted the data. It could have been any previous device that was scanned.

qualudeheart 5y ago

Obstruct justice? Cellebrite is often used by authoritarian unjust postliberal states. I have personally spoken to important figures in these countries with great political power or influence in the economy. Usually they`re very anti privacy except when it comes to their personal shady dealings. “Obstruction of justice” is a moral imperative when “justice” is defined and administered by those with the moral character of Roland Freisler.