Lately, the Israeli malware firm, NSO Group, named one of the 20 worst digital predators in the world, has garnered the most scandalous headlines. Exposes published by 16 difference global media outlets noted it was spying on 50,000 cell phone numbers for police states and intelligence agencies in 50 client countries. But another Israeli company, Cellebrite, has gone under the radar, though its technology is as dangerous and is in more widespread use around the globe. The company is also far more lucrative.
The Cellebrite unit involved in invasive phone hacking was founded in 2007. The company itself was founded in 1999 by three Israeli entrepreneurs. But they didn’t linger. After a few years, they exited pocketing a part of the $17-million sale price as it was sold to a Japanese holding company, Sun Corp. The Japanese made a killing, as Cellebrite went public today using a SPAC vehicle that valued the company at $2.4-billion. They earned hundreds of millions in profits and have retained a stake in the publicly-traded company.
Cellebrite’s technology, which I’ve reported on here, allows a hacker to physically crack any cell phone’s security measures and bypass encryption to extract all of its data. The main difference between NSO Group’s Pegasus and Cellebrite’s UFED technology is that the former involved a remote exploit and the latter requires physical access to the phone. Though one might think Pegasus would be a more useful product because it works in a more covert, surreptitious way, actually UFED is far more useful to police and intelligence agencies (and death squads) who detain suspects and confiscate their phones.
As an example, it’s widely believed that the FBI paid Cellebrite $1-million to hack the iPhone of the Islamist terrorist who attacked an employee holiday party in San Bernardino.
The rich payday for technology companies involves going public. That’s when early investors cash out and earn their billions in profits. Traditionally, the primary method was an IPO in which the company sold shares to the public and paid off its founders and early investors. But lately, the SPAC has become more popular. It involves merging a company with an empty shell company already trading on the stock market. Because IPOs are strictly regulated and the SEC and involve highly-detailed reporting requirements, some consider it an onerous, time-consuming way to bring a company public.
A SPAC avoids a great deal of this complicated process. In Cellebrite’s case, it announced the SPAC and within a few months the SEC had approved it and the company made its debut on NASDAQ. A side benefit to this financial maneuver is that controversial companies with heavy ethical baggage like NSO (which is considering a SPAC roll-out as well) and Cellebrite can bypass much of the intrusive focus on their business practices, which tend to repel potential buyers. In the case of NSO, it lost several major buyers who were put off by the stench emanating from its public reputation (it’s accused of playing a key role in the murders of Jamal Khashoggi and a Mexican Journalist). An eventual buyer, Novalpina Group, collapsed after it sued the Guardian for libel concerning an unflattering profile of NSO.
Digital Rights NGOs like Access Now and Citizen Lab, which have led the fight against these digital predators, have also pointed out that wealthy entrepreneurs, investment companies and banks provide the capital which fuels the growth of these companies. In Cellebrite’s case, Globes noted that its coming out party was enabled by:
Leading institutional investors, including Light Street Capital and Makena Capital, and strategic investor Axon Enterprise, Inc., participated in the private investment…BofA (Bank of America) Securities and J.P. Morgan Securities are acting as placement agents to Cellebrite, and TWC Tech Holdings. BofA Securities is also serving as capital markets advisor to TWC Tech Holdings. White & Case LLP and Meitar Law Offices are serving as legal advisors to Cellebrite, while Herzog Fox Neeman will support the SPAC.
The hefty fees they rake in constitute blood money earned at the expense of human rights activists spied on, jailed, tortured and murdered. According to Access Now:
Cellebrite [sales] raise red flags for [it] going public. These include alleged deals with the governments of Bahrain, Nigeria, Myanmar, Indonesia, India, Vietnam, and Saudi Arabia, as well as Botswana, where Committee to Protect Journalists investigations have implicated Cellebrite’s tech in searches of devices of journalists allegedly tortured by security agents.
As Sen. Ron Wyden and six Democratic House members have said, the money-men behind such dirty deals must be held accountable. Profits earned via torture and murder are horrifying and must end. We need Congressional legislation to stop this horror show.
Cellebrite has sought to immunize itself from much of the opprobrium NSO generated by creating an elaborate “ethics and integrity” program. An entire section of its website is devoted to the subject. But on closer examination, the reassuring words and glossy pictures promise much and deliver little. There are no practical commitments, no benchmarks measured with concrete data, no reporting. It’s all a smokescreen which these companies have developed to anaesthetize the public, and so eliminate any ethical challenge to its business practices.
In my case, I’m especially shocked that my local Seattle Police Department, already under fire for massive levels of violence used against Black Lives Matter protesters last summer, permitted Cellebrite to exploit it in showcasing the use of UFED to track and arrest child sex traffickers. Given the obliviousness with which SPD operates, I’m not at all surprised it would hook up with such a sleazy corporate partner.
Why aren’t there more lawsuits against these thugs?
Cellebrite was founded in 1999. The San Bernardino phone was hacked by Azimuth Security, as reported this year by The Washington Post.
@Deri: Thanks for those corrections.
[comment deleted: anti-Semit’n arois!!]
you mention the SPD use of Cellebrite. I wonder if you think that the privacy of the child sex traffickers is more important than the harm they do to children.
[comment deleted: comments must be substantive and contain a reasoned argument. Cheering for someone else’s comment is not suitable.]
@ David Allon: Nice attempt to divert from the subject of the post, which was the huge level of damage to the lives and privacy of tens of thousands of victims of Cellebrite. But sorry, I’m not going to bite on your fishing pole line on this one.