Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone? [closed]

Question

I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones.

There are several third party tools they can use, but one of the most popular is 'Cellebrite'.

My understanding of this device was that they could NOT access an encrypted, password protected phone BFU (before first unlock), as long as it was a modern device and the firmware was updated to the most recent version.

But time and time again, the police are able to crack any phone they want. It takes time sometimes, but they get in there eventually.

There was even a case not too long ago where they couldn't easily access the iphone they had seized, so they went to Apple's HQ and Apple unlocked it for them.

I assume Samsung would comply with the police as well.

Not to mention the stack of backdoors or zero day bootrom exploits the intelligence agencies could be sitting on.

So what is the point of encryption in regards to law enforcement, really? If they are getting in either way, why even bother?

How can one ensure their device is 100% (or even 99.9%) protected? Buy a Chinese phone? But then you have to worry about surveillance from China. Not to mentioned the hardware exploits that could be used.

Extending this to computers, what is the point of even having things like VeraCrypt or Bitlocker exist if the government can go to the manufacturer and get them to crack it open? If they can utilize zero days and hardware and bios exploits every time?

Answer 1

You cannot ensure that the device is 100% protected, the same way that you cannot 100% ensure that nobody could ever break into an apartment, get access to your bank account etc.

It is instead always a trade-off between costs on one side and security on the other. Costs can involve the actual money, but it also involves usability, efficiency ... . To find the right balance you need to understand your actual risks which depend both on your personal situation and the value of the data. Messages containing just food recipes usually have a low value even in repressive countries, while messages which show conflicts with the government might be of low sensitivity in some countries but might be considered very sensitive in others.

So, if the government is interested in your data then you need to have different protections than if only your friend is too nosy. Phones are usually designed for high usability while still providing sufficient protection in face of attackers with limited resources - which includes limits on knowledge, money, time, ... needed to break into your phone. If the value of the data on your phone is low then it will not be worth for attackers to invest lots of resources to break into the phone, and this is true for governments too.

And even if you get a real secure device with lots of digital locks protecting your information which make it really hard even for you to get access, then there can simply be non-digital ways to force you to reveal this information - even if these might be illegal in some places. So you cannot assume that information are safe just because they are stored on a seemingly safe device. Obligatory xkcd:

Answer 2

Most people seem to have this binary opinion of whether the government can/can't break into phones/computer/encryption/etc but it is a lot more nuanced than that. The more important question is can they be bothered and also something not really talked about called "public interest".

If you are selling a bit of dope out of your apartment and the Police come a knocking and find that your phone is encrypted out the wazoo are they going to be bothered to break into it to find out the names of a few local drug users? Is it in the public interest to spend resources in order to identify such people? Probably not. On the other hand if the Police come a knocking because you are planning the next 9/11, they are going to be a lot more motivated, plus there is also a strong public interest to get into your devices. They will have a blank cheque to do anything to get into it. So the first question is whether what you are being investigated for is worth the time and money.

You mention the Apple incident. Apple actually refused to help the FBI break into that specific phone and further refused requests from the FBI to build backdoors into future IOS versions. The FBI went to Cellebrite who employ a number of very clever people and Cellebrite built a tool to get around Apple's encryption. Ultimately this is what companies like Cellebrite do and this is how they make their money. It comes down to the age old arms race of building a more secure system and the other team figuring out how to break it (take safe manufacturers vs safe crackers for instance).

Ultimately some of the premises upon which you build your question are flawed (such as companies helping the government every time), but the reality is against a motivated enough attacker with unlimited resources no device is 100% secure. Basically you encrypt your phone/data for the same reason you lock your car/house - it offers some protection against some people.