16 January 2020 Paris, France) – The Israeli forensics firm Cellebrite has announced a $33 million acquisition that it says will help it expand its forensics capabilities beyond smartphones, something it has long talked about. The company has acquired BlackBag Technologies, a forensics firm with a focus and highly-regarded reputation in computer forensics.
And U.S. Attorney General William Barr must be rejoicing, given his criticism of Apple for not helping the FBI unlock iPhones of the Pensacola Navy base shooter. Now we have a merger between two digital forensics providers which promises to create a one-stop-shop for the feds’ Apple hacking needs.
Also worthy to note: BlackBag has a partnership with Grayshift, the U.S.-based company whose GrayKey can break into many versions of Apple’s famous smartphone, so it could bring three of the leading companies in the sector together. Grayshift has been a major rival to Cellebrite. But note: Cellebrite hasn’t responded to questions about how the merger would affect BlackBag’s relationship with Grayshift.
And a strange note: both Cellebrite and Grayshift have signed contracts with the Executive Office of the White House in 2019, according to contracts unearthed by Forbes. The reasons for Trump’s purchases of those technologies has never been revealed.
I meet with representatives from both companies every year (some chats on-the-record, some off-the-record) at what is becoming a preeminent event, the Digital Investigations Conference. And just a short promo for that event: it is Switzerland’s only such conference that provides a platform for academics, law enforcement, military intelligence, computer forensic experts, vendors, partners and sponsors working in digital investigations and e-Discovery but draws attendees from across Europe. And since it became a four day event — two days of keynote addresses and detailed session presentations, and two days of a stream of hands-on workshops — it is hitting everybody’s “must go” event list. Plus, a large amount of international customers attend to “shop”. And it is the only event my media company, Project Counsel Media, participates in as a sponsor. The June 2020 event is taking final shape. The full agenda will issue shortly. You can keep track by clicking here, as well as learning about the details of registering.
I think the press release announcing the acquisition nails it. Cellebrite co-CEO Yossi Carmil said that the deal will allow Cellebrite to accelerate and expand the forensics work it does:
“This acquisition will allow Cellebrite to accelerate the delivery of new Digital Intelligence solutions and services that will empower our customers and allow them to maximize the efficiency and accuracy of their digital investigations.”
Cellebrite is pretty much recognised as a leader in terms of iOS forensics, offering things like the UFED forensics tool to law enforcement agencies. Cellebrite sells most of its technology as “on-premise,” which means police can purchase it and use it themselves as-needed, as many times as required. Cellebrite has primarily focused on smartphone and cloud security so far.
In fact, Cellebrite is the firm the FBI used to unlock the iPhone 5C used by the San Bernardino shooter. The FBI is believed to have paid Cellebrite around $1 million to do unlock the device. It’s incredibly likely that the FBI will again turn to Cellebrite for help unlocking two iPhones tied to the Pensacola Naval Air Station shooting from last month.
In a recent post I noted that Apple has made security on the Mac a priority in recent years with its new T2 security chip, which offers numerous benefits for users. BlackBag Technologies has published details on the T2 security chip in the past, including how its “MacQuisition” technology can work with the chip.
Stepping back and looking at the acquisition, it clearly expands Cellebrite’s portfolio of “Digital Intelligence” solutions. As I have noted before, those solutions provide flexible form factors and quick-extraction capabilities to enable rapid exploitation of intelligence, along with lightweight decoding and analysis capabilities for use in forward settings. One Cellebrite law enforcement customer I spoke with last year noted:
Cellebrite has this “all-in-one solution” so it gives us a unified platform with access to all aspects of a digital investigation. It really gives us critical insights, and in a controlled and coordinated fashion. And it accelerates our investigative process. I mean, with one vendor I have complete coverage of all digital data collection tools I need, no matter the source: mobile devices, computers, cloud data, etc. It also means I have a broad array of field acquisition capabilities including consent-based evidence collection … a biggie, these days … so I can orchestrate (I know I sound like I am puffing but I am not) an entire digital intelligence operation.
You can read the full press release by clicking here.
And here are two short clips from my past interviews with both companies as a brief introduction. I will have more detailed interviews at the June 2020 event:
BlackBag Technologies develops innovative forensic acquisition, triage, and analysis software for Windows, Android, iPhone/iPad, and Mac OS X devices. In a short clip from a longer piece we did in 2017, James Buckland talks about the challenges in forensic acquisition and how BlackBag Technologies can help. There are a lot of tools out there that do these things, but BlackBag’s success is due to the fact that their tools are extremely good … and very easy to use: