The FBI Allegedly Hired Israeli Firm Cellebrite to Hack Terrorist's iPhone

We finally have a name for the government’s “outside party” that claims to be able to hack their way past Apple’s iPhone security: Cellebrite. Neither the government or Cellebrite will confirm it, but sources say the mysterious “outside party” is an Israeli digital forensics firm — and we’re betting that this isn’t the first terrorist’s iPhone they’ve cracked.

On Monday, the government backed out of an important legal hearing with Apple, claiming that an outside party had presented it with another way into a locked iPhone belonging to one of the San Bernardino shooters. Early speculation as to the third party’s identity focused on mavericks like John McAfee or other government organizations, like the CIA and NSA.

McAfee threw up false flags on Twitter, saying that he “played a role” in the government’s new plan, but he later told Inverse that his role was a negative one — he did not want the government to break into the phone.

Cellebrite, on the other hand, has no such qualms. The Israeli-based firm has offices in six countries, including the United States, but its main headquarters are in Petah Tikva, an industrial and tech startup town east of Tel Aviv. Its specialty is “digital forensics,” which encompasses cracking, extracting, reconstructing, or otherwise accessing inaccessible data from digital devices. On its website, Cellebrite lists “Advanced Investigation Services” as one of its specialties. It claims its services and technicians will stay on top of their clients’ (in this case, the government’s) “need to quickly extract, analyze and act on critical mobile device evidence.” And Cellebrite says no amount of locks or encryption will keep them out.

“Even with the most sophisticated mobile forensics tools and technology available, additional expertise and skills may be required to unlock the intelligence of data on devices that are broken, locked, burnt, water-damaged, or contain unknown application data formats and encryption technologies.”

Cellebrite’s headquarters in Petah Tikva are right on the line of paramilitary group Hamas’ rockets’ maximum range. While they’re rarely in direct physical danger, their aggressive approach to digital forensics is most likely welcomed by Israeli authorities for whom terrorism is an everyday concern.

Israeli law gives citizens similar rights to privacy afforded to Americans, but has been known to routinely stretch the bounds of what it can do. In 2012, the Electronic Frontier Foundation reported Israeli border guards forcing travelers to surrender computer and email passwords during searches at the border, so it’s not much of a jump to assume they have a similarly trigger-happy approach to cracking locked devices seized as evidence.

According to the EFF, Israel’s security services (known as Shin Bet), can keep computers or copies of seized data for the vaguely-put duration of “the time required for the seizure.” “There is no specific consideration regarding forensic practices and the ways that your computer files may be copied during the seizure,” the EFF wrote.

While Cellebrite’s connection to the case isn’t confirmed, they certainly haven’t suffered from the leak, which was scooped by Israeli paper Yedioth Ahronoth on Wednesday.

Cellebrite officials neither confirmed nor denied the case, but the Israeli paper Haaretz reported that the company was “confident that a completely hack-proof phone has not been invented yet.”

Leeor Ben-Peretz, executive vice president of products and business development for mobile forensics, gave Haaretz the closest thing to a confirmation we’ve had yet.

“The level of complexity [in phone security] is exponential and it’s at a point that it’s getting difficult—but if anyone can do it, it’s us.”

And that’s assuming they haven’t done it already.