Last month, Israeli phone-hacking firm Cellebrite joined the trend and like many Israeli hi-tech companies launched a large-scale public relations campaign.
As is now common, this PR blitz includes billboards and a set of video clips starring the “Heroes Behind the Heroes” – or in other words, the company’s own employees. The Cellebrite campaign’s goal is to highlight the role the firm plays in aiding police forces all over the world.
A screen capture from Cellebrite’s ‘heroes’ campaign
Cellebrite is known for its flagship UFED product series. These are a series of physical devices and supporting software that form a digital forensic suite. Cellphones are plugged into the UFED, and allow investigators to break into them and collect a great deal of information stored in the devices – such as text messages, location history, call history and contacts. This service is provided with the blessing and support of the Israeli government – especially that of the Defense Ministry – which oversees defense and dual use exports, such as in the case of cyber companies or those working in the defense and security space.
A letter sent on Thursday by Eitay Mack, a lawyer and human rights activist, to the company and the director general of the Defense Ministry Amir Eshel, shines light on a dark corner of this industry and shows how Cellebrite’s technology serves oppressive dictators that supply security units with the tech to repress protest, harm the freedom of expression and persecute human rights activists and journalists.
In his letter, Mack claims to expose that Cellebrite’s heroes – represented in the campaign as toy figures – can take pride in their work’s indirect link to the two Nobel Peace Prize winners for 2021. The prize was awarded to Maria Ressa, the editor, co-founder and CEO of the Rappler website in the Philippines, and a harsh critic of that country’s president Rodrigo Duterte – who is responsible for the deaths of thousands of people as part of his “war on drugs;” and the other winner, Dmitry Muratov, the editor in chief of the Russian newspaper Novaya Gazeta – and a famous opponent of the Putin regime.
Ressa and Muratov were awarded the prize “for their courageous fight for freedom of expression” in their countries, the Norwegian Nobel Committee said when announcing the awards. “At the same time, they are representatives of all journalists who stand up for this ideal in a world in which democracy and freedom of the press face increasingly adverse conditions,” the committee’s chairwoman added.
The Russian side of the story was exposed in the past by investigations by Mack, reported in Haaretz. Last year, Cellebrite was forced to announce it was leaving Russia and Belarus because of the revelation of the sales of its technology to a Russian security unit called the “Investigative Committee,” which answers directly to Russian President Vladimir Putin – and operates against journalists. Mack’s investigation showed how the Israeli technology was used to hack into the phone of Lyubov Sobol, a candidate for the Russian parliament and a lawyer for the Anti-Corruption Foundation headed by Alexei Navalny.
Israeli phone-hacking firm Cellebrite halts sales to Russia, Belarus in wake of Haaretz report
Israeli NSO spyware found on phones of Jordanian, Bahraini women’s rights activists
Citizen Lab vs. NSO: The small Canadian institute taking down Israel’s ‘mercenary spyware’ firms
Now it turns out that the company’s technology also reached the Philippines, and it is used by Duterte’s government – which is infamous for its extrajudicial killings as part of the war Duterte has declared against drugs. Amnesty International described the war against drugs in the Philippines in 2019 as a large-scale murder enterprise, and called on the United Nations to investigate Duterte for crimes against humanity.
Journalists are also in Duterte’s sights. On the day he was sworn into office in 2016 he made sure to make sure his views were known: “Just because you’re a journalist you are not exempted from assassination, if you’re a son of a bitch.”
“The threat was carried out and since Duterte took office, 22 journalists have been killed in the Philippines,” wrote Mack. One example is Jesus Malabanan, who was involved in investigative reporting on the war on drugs and was killed at the start of December.
On Friday, the Rappler reported that 17 police officers face murder charges for their involvement in “Bloody Sunday,” the day on which nine human rights activists were killed in March 2021.
It should be noted that both the United Nations and the United States contributed a number of UFED devices to security and investigative bodies in the Philippines. But in January 2020, the U.S. Senate voted in favor of a resolution that condemned the persecution and incrimination of journalists, among other things, and demanded that the administration of then-U.S. President Trump impose personal sanctions on those responsible for human rights violations in the Philippines, as well as reexamine American military assistance to the country to ensure human rights are protected.
Deceptive transparency
It must be noted that Mack and Haaretz did not find documentation proving that the Israeli technology was used against Ressa, or other journalists, in the Philippines. However, it is important to remember that government transparency in the Philippines can be deceptive – on one hand, it is possible to find easy-to-use websites devoted to the public’s right to know, with information on every rifle, machine gun and pistol purchased from Israel – and there are thousands of those. However, when it comes to information on what use is done with these systems, there is close to nothing.
Nonetheless, Mack is careful in his letter to explain why the sale and supply of the products Cellebrite makes still proves a threat to freedom of expression, journalists and human rights activists. The reason, he writes, is that the system is placed in the hands of the very units accused of such violence. His letter explains that the Cellebrite system is used by various units in the country – including the police, Justice Ministry and even the intelligence service known as the National Bureau of Investigation, which is directly responsible for actions against the freedom of expression. In November, the Philippines Justice ministry issued a new tender for purchasing two licenses for operating UFED systems, as well as the purchase of another model, the UFED Touch2 Ultimate.
A USB device is attached to Cellebrite’s UFED TOUCH, a device to extract data from a mobile device. Signal’s founder revealed he cracked Cellebrite’s software and that it is exposed to manipulation Issei Kato/ REUTERS
“Cellebrite’s systems are and were sold directly to the unit in the Philippines Justice Ministry charged with leading the fight against cyber crime,” wrote Mack. “This unit, which is called the Office of Cybercrime was established in a special law to prevent cyber crime (sections 23 to 25 of the law), and is responsible for its enforcement, together with the Philippines police (PNP) and the security service (NBI).
“In other words, there is no significance that the systems from Cellebrite were sold to the Office of Cybercrime and not directly to the police or security service, because they act together on the matter of enforcing the law to prevent cyber crimes,” he wrote.
The law Mack is referring to is the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), which was the basis for Ressa’s conviction in June 2020. She was convicted for a form of cyber libel – even though the article she was charged over was published before the law went into effect in October 2012. However, the case was allowed because a spelling mistake in the article was corrected in 2014 – and the judge considered this to be a republication of the original article.
The cyber crime law applies to offenses such as computer break-ins and the exploitation of children for purposes of pornography. Alongside the serious crimes, the law also has a section on “cyber libel” – for which the punishments are much harsher than for libel not carried out over the internet. The law imposes a punishment of up to 12 years in prison – and this is what Ressa was convicted of.
The cyber libel charge was “political” and that “the law is being weaponized in an attempt to control the public narrative. We will not be intimidated and will continue to shine the light on actions of impunity,” Ressa told the Committee to Protect Journalists (CPJ).
Cyber libel
It is worth noting that both this reporter and Mack do not deny that a country like the Philippines could indeed make good use of tech like that being supplied by Cellebrite. The country faces daunting tasks from ISIS-affiliated terror cells to rampant crime. However, the spirit of Duterte’s war on drugs has a trickling effect and in recent years it also launched a large number of disinformation campaigns through Facebook that have incited against journalists or any critic of the government’s policies, making use of the law as a threat.
A display screen for Cellebrite at the annual European Police Congress in Berlin, Germany, February 4, 2020. Hannibal Hanschke/ REUTERS
In one of the most famous cases in the country Senator Leila de Lima who was investigating extrajudicial murders by the regime turned into a target of such a campaign. The Facebook campaign included calls to have her jailed and in February 2017 she was arrested over drug charges. She has since been jailed, despite the EU, Amnesty International and others calling for her release.
Ressa may be the best known of the journalists being pursued by the Duterte government by legal means, but she is not the only one. Other forces in the country are taking cue from the leader and are fighting journalists: In November, two people close to Duterte – his energy secretary and a major donor to his political campaigns – filed libel and cyber libel complaints against 21 journalists who published stories on an allegedly questionable natural gas project.
“Have not a shadow of a doubt that the purpose is to silence the press and deter journalists in the months before the elections to be held on May 9, 2022,” wrote Mack.
Trying to find out what came out of the many cyber law cases filed in the country leads to mixed results with vague reports about gangs of hackers, human traffickers and gambling rings and others being captured. Even those who are spreading coronavirus disinformation have been stopped using the law, reports claim.
However, reports about the cases against journalists or members of the public critical of the government are less publicized. This despite the fact that per reports published by the different units in the country, cyber libel seems to be the most common reason the cyber law is used. Roughly one of four investigations opened in 2018 about digital crimes were for libel and this was also the case in 2020.
Even those reports that do exist paint a grim picture: A city council member accused their local mayor of sending thugs to kill someone. A severe accusation, the post making the claim was deleted after only 20 minutes and the council member published an apology. They were then sentenced to 8 years in prison thanks to the cyber law’s libel clause.
The chilling effect of the law on the media is clear to see: For example, the outgoing police chief in the country was embarrassed after images of him celebrating his birthday, despite coronavirus restrictions, with a party were made public. His supporters were quick to say the photos were old and he threatened to use the cyber law’s libel clause against anyone who published them or shared them online.
Oversight questions
Everytime Cellebrite or Israel’s defense oversight body is asked about their sales, they always say there is strict regulation over the usage of the devices and that there are rigid ethical rules governing them. But this begs the question: Does Cellebrite not know what’s actually being done with its tech?
Is it possible they do not actually know how their tech is being used or that they are unfamiliar with the country and its president? How can the defense ministry, which Mack has taken to court for selling arms to the Philippines, claim ignorance?
If Cellebrite and the defense ministry do not know, then in what sense can there be said to be oversight over such sales? It seems more likely that Cellebrite and the defense ministry know exactly who they are selling to.
One could ask whether there is perhaps good reason for the lack of existence of any specific evidence linking Cellebrite’s technology with the actions taken against journalists in the Philippines – perhaps the oversight is working well, and the firm and the defense establishment are working quietly behind the scenes to make sure the tech is not misused.
However, this too seems unlikely as no information about the actual usage exists and a freedom of information request filed with the Philippines security service, the NBI, was rejected so that no data exists about how the tech itself is actually used – and that is true for Cellebrite, the Israel oversight body and journalists alike.
Moreover, despite claims of strict oversight, a review of the different contracts reveals they contain no clauses defining any such oversight or lay out any criteria regarding human rights.
Furthermore still, many of the deals are signed with non-Israeli companies that only serve as sales representatives for the Israeli cyber firms, so that there is no real way for them to be regulated by Israel.
It is also possible that neither Israel nor Cellebrite actually care about misuse of its product. As was the case with its sales to Russia, Hong Kong, Bangladesh or China, it is only after publication that Cellebrite seems concerned with how its tech is used.
In its response, Cellebrite noted the positive sides of the use of its technology this time: “Cellebrite is committed to its mission of creating a safer world while providing solutions to law enforcement organizations and being careful that its products are used legally and ethically. To do so, we have developed strict oversight mechanisms that will ensure appropriate use of our technology within the framework of investigations conducted according to the law. The ethics committee that advises us includes experts in human rights, international law and technology,” said the company.
“As a global leader in digital intelligence, Cellebrite’s solutions aid thousands of law enforcement agencies in convicting those who endanger public safety, and to carry out justice for the victims of crime. We are proud of our employees who are aiding these customers, enabling them to save lives and protect them, and to do justice while protecting the privacy of communities all over the world,” added Cellebrite.
English
Arabic
Chinese (Simplified)
Dutch
French
German
Italian
Portuguese
Russian
Spanish