My understanding (under US law) is that accessing computer systems without authorization is illegal.

However, you can totally make tools to hack your own stuff.

And this company only advertises their unlocking abilities to law enforcement services, who are presumably authorized to access the device (via warrant). So the company itself isn't accessing devices without authorization, so they aren't technically "hacking anybody".

> law enforcement services, who are presumably authorized to access the device

Cue Tony Soprano saying "warrant! WARRANT!" to his housekeeper.

What are the chances that Cellebrite requires clients to supply a warrant for each device they unlock?

I don't think they would need to?

Cellebrite sells law enforcement an on-premise method to unlock devices. At that point it's no longer Cellebrite unlocking the phones, it's Law enforcement who is unlocking the devices.

Since they (at glance) only sell to law enforcement I think it's reasonable to assume that they expect their device to be used legally (they aren't selling it to @xxXRUSKI1337Hax04xXX who we all no is up to no good.)

Disclaimer: My understanding is mostly of US law, the company is Israeli and I'm not familiar with Israeli law, or the laws of other countries Cellebrite contracts with, although I think this would similarly apply to most jurisdictions

They may sell to law enforcement, but they can end up in private hands: https://news.ycombinator.com/item?id=20080814

That device turned out (way down at the bottom of the thread where it's easy to miss) to be a non-law-enforcement model used by e.g. cellphone stores to transfer data between unlocked phones.

> The device bought in the thrift store appears to be a device to copy data from phones already unlocked and open, in other words, not the most interesting device they have, and it's from 2014.

It is not law enforcement grade, just simple copier Cellebrite made for mobile phone stores to copy data from old phone to new one.

Police officers conducting a search of a suspect's premises must present a valid search warrant. Police officers requesting that a telecom company aid in surveillance of a suspect must present a valid search warrant. Google, despite of late being the butt of all jokes, will not cooperate with police officers unless a valid warrant is presented. Thus it follows that Cellebrite isn't somehow excluded from following the law just like all those other companies, and cannot support unlocking of iPhones or other devices without being shown a valid search warrant.

Celebrate doesn't need to know anything about warrants. They sell a physical device to law enforcement agencies. They don't validate individual uses of the equipment. Seems to me no different than a gun manufacturer selling guns to law enforcement and not needing to validate individual firings of the gun.

First, police officers conducting a search do not need to present a warrant; they can certainly ask for you to volunteer access. Companies that require law enforcement to provide a warrant may be obligated to do so by some kind of data protection legislation, but I doubt this is generally the case; more likely, we would consider this a courtesy to their customers.

Finally Cellebrite does not seem to actually do any unlocking; rather, it sells it's tool to the government. As long as that sale is legal, they are out of the picture.

You have more than enough information on your phone to enable a parallel construction.

> What are the chances that Cellebrite requires clients to supply a warrant for each device they unlock?

Why would they need to?

They supply devices to clients that can be reasonably expected to have access to warrants at need. The US legal system, at least, does not consider it reasonable for Cellbrite to actively monitor and police every use of its products by its legal customers to ensure full adherence to surrounding legal requirements.

Depends on the client and purpose and actual action.

Thinly veiled PR like this is advertisement to state agencies who will contract their work out to you. Even if it is work with a government that your own government doesn't agree with, thats when the lack of munitions regulation on exploits comes into play. So as long as your state client isn't on the OFAC list, you can take the contract.

Why wouldn't it be?

Because hacking is illegal in most jurisdictions.

Exploiting probably isn't illegal, but as soon as you begin to use these exploits against other people to access their data it is illegal. So selling the exploit or performing it for clients would mean assisting someone in breaking the law.

They probably aren't going to get in trouble since their clients are often government agencies themselves.

It's only illegal to access a device without authorization, and they only sell to law enforcement (who presumably have a warrant or whatnot, and thus authorization) so Cellebrite themselves isn't accessing anybodies systems.

> Because hacking is illegal in most jurisdictions.

You are writing this on “Hacker News”. Maybe you should rephrase that.

Depends on the definition.

unlocking a carrier-locked phone under contract

-vs-

unlocking a carrier-locked phone out of contract

-vs-

unlocking a phone (password or fingerprint locked)

-vs-

unlocking a phone stolen/you don't own (hacking)

Accessing any computer system without authorization is that part that is generally illegal, "Hacking" itself isn't illegal, and while accessing your bosses computer while it's unlocked isn't "hacking" it's still illegal.

However most countries can authorize law enforcement to access the device under various conditions (for example a warrant). So while the owner of the device doesn't authorize accessing the device, the law allows the police to access it.

Not if you have connections and hire the right people.