TI-2026-061C — The Forensic Alibi

Classification: HIGH · Dual-Use Surveillance · Mobile Forensics / Transnational Repression Confidence: HIGH on the facts (deployments, dates, classification, vulnerabilities — all sourced); the argument is that these facts defeat the "neutral law-enforcement tool" defence on the vendor's own timeline. TLP:WHITE — external firm, customers and publicly-named victims cited from published reporting. Series: The Fake Umbrella — Part C. C is for Cellebrite. The friendliest word in surveillance is "forensics." It means science, courtrooms, catching the guilty. It is also the alibi. Facts are facts. They are good for some and bad for others. You decide.

The seed: a phone that was cracked after the company said it left

In June 2021, Russian authorities took the seized iPhone of a jailed opposition activist named Andrey Pivovarov and opened it — every message, contact, photo, deleted fragment — using Cellebrite's UFED. Citizen Lab confirmed it forensically in 2026. The detail that turns this from a data point into a thesis is the date: it was three months after Cellebrite publicly announced it had stopped selling to Russia.

Read what that means slowly. The company's defence — "we exited that market" — was true and irrelevant at the same time. UFED is a box. Once a police force owns the box, it keeps cracking phones whether or not the invoice renews. As the researchers put it: a sales cutoff did not kill the tool. "We left" is a statement about billing. The capability stayed, in the same hands, doing the same thing, to the same kind of person.

That is Part C in one sentence: the most respectable word in the surveillance industry — "forensics" — is doing the heaviest lifting of any costume in this series, and it does not survive its own receipts.

Who is Cellebrite — and why "forensics" is the perfect cover

Cellebrite DI Ltd. Founded 1999 in Petah Tikva, Israel. Its flagship, UFED (Universal Forensic Extraction Device), unlocks and extracts the full contents of iOS and Android phones. NASDAQ-listed (CLBT, ~$2.4B), largest shareholder Sun Corporation of Japan, and — per the corpus dossier 034D — it recruits heavily from IDF Unit 8200, Israel's signals-intelligence corps. It has bought its way into the United States: CTS (Virginia, July 2024, staffed for maximum-clearance federal work) and Corellium ($200M, June 2025, mobile-device virtualization).

Now the move that makes the whole thing work. NSO's Pegasus is regulated as a defence export and licensed by the Israeli Ministry of Defense — which is how NSO ended up sanctioned and litigated. Cellebrite's products are classified "dual-use civilian." Same core act — reach into a target's phone and take everything — but the civilian label routes it around the export oversight that constrains Pegasus. The word "forensics" is not a description of restraint. It is a regulatory category chosen to avoid restraint. A phone-cracker that calls itself a "digital intelligence platform for investigators" gets to sell where a phone-cracker that calls itself "spyware" cannot.

The deployments: where the "neutral tool" actually went

Strip the brochure and read the customer list as it surfaced — every entry via reporting, not the company's disclosure:

Look at the column that is not there: the terrorists and child-abusers of the sales pitch. They may exist in the ledger too — but the cases that surface, again and again, are a journalist's source list and a jailed dissident's messages. The tool sold to "help law enforcement catch criminals" keeps being found in the hands of states whose definition of "criminal" is "reporter."

The pattern: they only ever leave after they are caught

Cellebrite's answer to all of this is that it terminates abusive customers. It does — and the timing is the tell. Serbia, Russia, Belarus, Bangladesh, Hong Kong, China: every exit followed external exposure — an Amnesty report, a Citizen Lab forensic analysis, a press investigation — never an internal audit that caught it first. The sequence is invariant: sell → get caught → exit → issue statement. A company that policed its customers would leave before the journalist's phone was cracked. This one leaves after, once the cracking is on the front page. "We cut them off" is not a conscience. It is a crisis-communications reflex, and it arrives, by construction, one victim too late.

The tool that cannot even tell the truth it is sold to establish

Here is the finding that should end the "forensic" claim outright. In 2021, Moxie Marlinspike — the creator of Signal — got hold of a Cellebrite UFED unit and tore it open. He found arbitrary-code-execution vulnerabilities: a specially-crafted, otherwise-innocuous file placed on a phone could, when UFED scanned it, execute code inside the extraction tool and alter any report it generates — not just this scan, but past and future ones — with no detectable trace.

Sit with the implication. The entire value of "forensics" is integrity: that the extracted evidence is a faithful, tamper-proof copy admissible in court. Marlinspike demonstrated that UFED's output can be silently forged. The instrument sold as the neutral, scientific witness can be made to lie — which means every conviction resting on a UFED extraction rests on an evidentiary foundation its own maker could not keep sound. The "forensic" in "forensic tool" is, at the level of provable fact, not established.

The seven questions

Who is this? Cellebrite DI Ltd — an Israeli, Unit-8200-staffed, NASDAQ-listed phone-extraction vendor selling UFED as "digital intelligence for law enforcement."

Why did it attack? It doesn't attack — it equips. It sells the capability to reach into any seized phone and take everything, to whoever the customer decides to point it at.

Who does it claim to be? A neutral forensic-science provider for lawful investigators — the courtroom, not the spy agency. The "forensics" framing is the entire brand.

Whom is it related to? Unit 8200 (staffing), Sun Corporation (ownership), the US federal-contracting world (CTS/Corellium), and — since 2011 — the WikiLeaks Spy Files catalogue, listed beside Amesys, Gamma/FinFisher and HackingTeam.

Where is the money? A public company (~$2.4B) selling hardware/licences to police and intelligence agencies worldwide, now pushing to become a top US government contractor. The customer is the state; the product is access to its subjects' phones.

What is the official anchor? A deliberately chosen one: "dual-use civilian" classification — the export category that lets it operate where defence-controlled spyware cannot. The anchor is the loophole.

What if it is not who it claims? It is exactly who it claims — a lawful forensics vendor. The finding is that "lawful forensics," as actually deployed and as actually built, is a phone-cracker for whoever holds the badge, and its badge-holders include the people jailing the journalists.

What if…

• What if UFED mostly catches real criminals? Probably it does, in democracies with warrants. That does not neutralise the documented other column — and a capability this total (everything on the phone, no adversarial process at the point of extraction) is defined by its worst authorised use, not its median one. A master key is judged by who can turn it, not by the doors it usually opens.
• What if the abuses are rogue customers, not Cellebrite? The rogue-customer defence dies on the timeline: Cellebrite kept selling into these markets until exposure, and the tool kept working after exit. You cannot both claim "we vet and terminate" and be surprised, serially, only when a journalist gets caught in the press.
• What if "dual-use" is just an honest legal classification? Then explain why the same intrusion, at NSO, is a defence export and, at Cellebrite, a civilian one. The function is identical; only the oversight differs. A classification that changes the regulator without changing the act is not a description. It is a manoeuvre.

Steelman: the strongest defence — and why it fails

Built at full strength:

"Cellebrite is lawful forensic tooling used by thousands of legitimate police forces to solve serious crime — child exploitation, homicide, terrorism. It requires physical possession of a device, usually under warrant; it is not remote spyware like Pegasus. It complies with export law, publishes ethics commitments, and terminates customers who abuse the tool. Condemning it condemns lawful policing itself."

Where it breaks:

• "Physical possession under warrant" describes the best case and launders the rest. In Botswana, Russia, Bangladesh the "warrant" is whatever the regime says it is. A tool whose only safeguard is the good faith of the state holding it has no safeguard in exactly the states that most need one.
• "We terminate abusers" is refuted by its own sequencing. Termination always trails exposure. A control that only fires after the harm is public, and after the hardware already in the field keeps working, is not a control. It is an epilogue.
• "Not remote like Pegasus" is a difference in delivery, not in intrusion. The extracted haul is the same — the whole phone. And "civilian, not defence" is precisely the reclassification that lets Cellebrite sell into places NSO was blocked from. The lower-drama delivery bought it more reach, not less harm.
• "Lawful forensics" presumes forensic integrity — which Marlinspike disproved. You cannot simultaneously claim the courtroom-grade reliability that justifies the tool and hold a demonstrated capacity for its output to be silently altered. The steelman's own foundation is cracked.
• The one true thing: genuine, warrant-bound, adversarially-tested forensic extraction in a rule-of-law system is legitimate and useful. That earns that use its due. It does not extend to a global sales model that reaches regimes, survives its own cutoffs, and rests on unverified integrity.

Verdict: as a domestic, warranted investigative aid in a functioning democracy, Cellebrite is defensible. As a global product — dual-use-classified to dodge oversight, sold until caught, persistent past exit, forensically unsound, and repeatedly found on journalists' and dissidents' phones — it is HIGH. The word "forensics" is not a mitigation. It is the alibi that let the reach happen. Confidence: HIGH on the facts; the "neutral lawful tool" defence rejected on the vendor's own timeline and its own tool's vulnerabilities.

Read between the lines

The most eloquent thing Cellebrite ever did was choose a word. "Spyware" gets you sanctioned; "digital forensics" gets you a booth at a police conference and a NASDAQ listing. Same act, opposite fate — and the company knew exactly which side of the line it wanted, because it filed itself as "civilian" to stay there. Read that reclassification and you are reading a firm that understood the oversight regime and engineered itself to fall just outside it.

And read the shape of the cutoffs. Six countries, six exits, six times after the story broke. That is not a firm learning from mistakes. That is a firm that has learned the mistakes are survivable as long as the exit statement is fast enough. The pattern isn't reform. It's a business that has priced in getting caught — the occasional public divorce from a regime as a cost of doing business with regimes.

The human layer

A journalist in Gaborone is held for a few hours. She is not charged. Her phone is handed back. But in the interval a grey box copied all of it — the number of the official who leaked to her, the messages from the source who trusted her not to keep receipts, the photo she took that she meant to delete. She walks out "free," and everyone who spoke to her is now a name in a police file, retrieved by a machine that a court in another country would have called forensic evidence. She did nothing prosecutable, so there will be no trial, no disclosure, no defence lawyer to cross-examine the extraction — just a quiet, total, unappealable read of her life and her contacts'. That is the product. Not the terrorist in the brochure. The reporter who was let go, and everyone who ever texted her.

Defense — treat "forensics" as a claim about power, not science

(1) For the public/press: name it plainly. "Mobile forensic extraction" means a tool that copies an entire seized phone. Whether that is legitimate depends entirely on who holds it and under what law — so demand the who and the law, not the euphemism. (2) For technologists: UFED's demonstrated code-execution flaws mean an extraction is not self-certifying evidence; chain-of-custody and tamper-evidence must be proven independently, not assumed from the vendor's logo. (3) For sources and journalists: treat any seized, powered device as fully compromised — the extraction is total and retroactive (deleted ≠ gone). (4) For policymakers: the "dual-use civilian" reclassification is the lever. Close it, and the same tool faces the same export scrutiny as the spyware it functionally equals.

Investigation metadata

Next — TI-2026-061D: D is for Data broker — the "audience insights" and "location analytics" firms (SafeGraph, X-Mode/Outlogic, Venntel) that quietly resold ordinary phone-app GPS to governments, and the day your evening commute became a saleable intelligence product.

"Forensics" was the smartest word anyone in surveillance ever picked. It says courtroom, science, truth — while the box in the evidence room copies a reporter's sources and keeps working long after the company swears it walked away. The tool that promises to establish the truth cannot reliably tell it, and the customers who promised to be lawful were the ones jailing the journalists. Facts are facts. They are good for some and bad for others. You decide.