The Israeli spyware company, Cellebrite is, along with its blood cousin, NSO Group, known in the cyber-surveillance sector for producing the most advanced and intrusive technology on the world market. They’re also among the profitable with market valuations in the billions. I’ve regularly profiled the latter company. But Cellebrite has evaded some of the more damaging media exposure afflicting its dirty-ops cousin.
As it prepares for a public offering, the company is cleaning up its act. Among the dirtiest of its clients have been China, Belarus, Indonesia, Saudi Arabia, and Bangladesh. Both Israeli companies claim their products are sold only to police agencies for the purpose of preventing crime and capturing criminals. But if that were ever the case, it is no longer. Customers are largely the security services of repressive regimes seeking to identify and eliminate legitimate political dissent. Oh, and Cellebrite’s UFED device has even been listed for sale on eBay! So if you’re a terrorist or criminal seeking cyber-intelligence on rivals or even your local police force, you know where to turn.
The company’s flagship product is UFED, a device which, when connected to a cell phone, can bypass its password protection and encryption to extract all its data and make it accessible to the client. US police departments have spent millions on it to gather evidence in criminal investigations. Even public schools have purchased the system to spy on their students. In Texas, a police officer confiscated a student’s phone and used UFED to retrieve messages between the latter and a teacher which exposed a romantic relationship and led to the teacher’s arrest.
Bangladesh is a particularly brutal example of Cellebrite’s clients. Since 2004, the country’s Rapid Action Battalion has targeted gays, atheists, and political dissidents in a campaign of summary executions, torture, and disappearances which killed 465 people in 2018 alone. A 2005 Human Rights Watch report said that it had killed 350 people in first year of its existence. The Dhaka Tribune attributed nearly 1,100 murders to it from 2004-2008.
An Israeli legal filing protesting sale of the technology to Bangladesh noted:
“According to…human rights groups in Bangladesh…the Bangladesh security forces have been accused of using drills to torture their victims, beatings, long detentions in subhuman conditions and even hanging people upside down,” Mack wrote, noting that there were also reports of victims being shot in their knees; having their testicles beaten; their fingernails pulled out; their heads held underwater; alongside sexual violence, threats of rape and rape itself. “Mock and real executions,” the document also noted.
As a Muslim country, it does not officially do business with Israel. But the Israeli company easily overcame that hurdle by establishing a Singapore subsidiary which fulfilled the $350,000 contract, according to Al Jazeera. Nine security agents were sent to Singapore to train in the use of UFED. Nor is this an unusual commercial arrangement. Israeli spy merchants from Matti Kochavi to NSO Group maintain multiple such cut-outs which permit them do billions in business with Arab and Muslim countries bypassing the boycott.
Israeli human rights attorney, Eitay Mack, has campaigned for years to end the export of such deadly Israeli technology. The defense ministry, which nominally reviews and approves sales of advanced security-military technology to foreign nations, never rejects such trade. After all, it is a huge money-maker for the Israeli economy. It also strengthens relationships between Israel and its client states (when you’re a pariah state, you need all the friends you can get).
In fact, Cellebrite had done such a good job in assisting Bangladeshi death squads with their dirty work that the foreign ministry urged the country to become the latest Muslim country to normalize relations. Mack told me:
On May 22, Gilad Cohen, Israel Foreign Ministry’s deputy director general for Asia and the Pacific, urged the Bangladesh government to establish diplomatic ties for the “benefit and prosperity” of the people of the two countries. [So] Celleberite’s announcement that it will stop selling its hacking system to Bangladesh proves that the MOD [Ministry of Defense] and these kinds of companies only understand public and media pressure.
When the ministry refused to consider the moral ramifications of sale of these products, Mack turned to the Supreme Court. It too not only refused to act, it clamped a veil of secrecy over all the proceedings, including its decisions. Recently, the Court has eliminated Mack’s recourse to it by ruling that it has no jurisdiction over matters concerning the defense ministry. That means he may no more bring such claims before it at all.
The only positive result of such a disastrous legal ruling is that it makes for a far more compelling case before the International Criminal Court, which requires the appelant to have exhausted all means of accountability in his home country’s legal system before appealing to it for relief. The ICC has already opened an investigation of Israeli war crimes from 2016 till the present. The crimes of Israel’s spyware industry could easily be folded into such a brief.
While use of the spyware brings with it a trail of human suffering, the creators of the technology, like any venture capitalist, have only one thing in mind: profit. The quickest path to a big payday is taking your company public. It permits early investors and company founders to turn their company shares into cash or other types of liquid assets. In the case of Cellebrite, the SPAC will value the company at $2.4-billion. NSO, which has been treated brutally in the media after a recent expose of spying on 50,000 cell phone numbers belonging to presidents, prime ministers and princes, hopes that a SPAC will enable it to avoid the process of finding a buyer willing to ignore all that terrible publicity.
In preparation for the big day, Cellebrite is wiping all the blood off its hands and face. In its filings with the SEC it offers these soothing passages:
“Cellebrite does not sell to countries sanctioned by the U.S., EU, UK or Israeli governments or that are on the Financial Action Task Force (FATF) blacklist,” Cellebrite said in its SEC filing.
“We pursue only those customers who we believe will act lawfully and not in a manner incompatible with privacy rights or human rights. For example, we have chosen not to do business in Bangladesh, Belarus, China, Hong Kong, Macau, Russia and Venezuela partially due to concerns regarding human rights and data security, and we may in the future decide not to operate in other countries or with other potential customers for similar reasons,” the document said. The August filing included an update about the formation of an “Ethics and Integrity Committee,” whose mission “is expected to include advising on ethical considerations related to the use of our technologies.”
That might sound good to an uninformed individual. But the reason the list of countries it refuses to do business with for ethical reasons is so long and impressive, is that these are many of its most deadly former clients. Cellebrite had ditched many of these countries earlier, after Mack’s research exposed its sordid connection to them. But Bangladesh was one of the last dominoes to fall.
Cellebrite, like NSO, can write a soothing, reassuring bit of prose for a public dubious of the heinous acts of which it’s accused. This is what it told Haaretz:
…The company “is committed to ethics as part of its core values and practice of work and has developed a very strong compliance framework. Cellebrite has strict licensing policies and restrictions that govern how customers may utilize our technology. Our sales decisions are also guided by internal parameters, which consider a potential customer’s human rights record and anti-corruption policies.”
The company is also following in NSO’s footsteps in telling the SEC it will create an ethics committee to guide its business decisions. In truth, the smooth talk and the pablum about ethics are a fig leaf for its ugly deeds. It hopes they will fool regulators and put them into a deep sleep.
Yet another reason why Congress must act against this vile, bloodthirsty industry. As Sen. Ron Wyden and six House members have declared: there must be federal penalties imposed on the misuse of this technology. The penalties must also apply to the banks and private investors whose capital enables the spyware business to be so lucrative.