- by Michael Sainsbury
- The Guardian
- Issue #2208
Photo: pxhere.com (CC0)
Returning from an extended stay in Bali this July, Peter* was stopped by Australian Border Force (ABF) officials at Perth Airport. After searching his bag, they asked to see his phone.
He told MWM, “I said why, and they said something about checking for evidence of drug trafficking or something, then they’re like, ‘Oh, what’s your password? I’m like, why do you want that? They said, ‘Oh, we got to check it for drug trafficking.”
A regular business traveller for more than 15 years, Peter was surprised. This had never happened to him anywhere.
“I sort of was angry but had nothing to hide, so I just gave them the code. They then took the phone for probably half an hour in another room. When they brought it back, I asked for some sort of paperwork for what you’ve done here. But I got nothing.”
After this unsettling experience, Peter followed up with an email to Home Affairs Minister Tony Burke, whose department includes the ABF, wanting to know why these powers exist apparently unchecked. His questions remain unanswered, including what has happened and will happen with his data.
ABF, like every nationwide police force including the Australian Federal Police, and other agencies including ASIO, has a contract with Cellebrite. The Israeli-military-founded company provides software that strips mobile phones and other digital devices of all their data, including related data.
On 2 September, Cellebrite announced that its ‘Guardian’ cloud evidence platform had completed an independent Australian Information Security Registered Assessors Program assessment (IRAP) at PROTECTED level.
IRAP assessment is not government certification, but it clears a key security hurdle for agencies considering the platform. Alarmingly, Cellebrite’s announcement said agencies could move evidence into the cloud and share it between investigators, prosecutors and partner agencies.
Australia has few effective rules governing what happens to the growing stockpile of personal data extracted from phones and other digital devices by the ABF, nationwide police forces and other government security and social services agencies.
As NSW Greens MLC Sue Higginson recently highlighted, “There are no reporting requirements for any government agency on Cellebrite use, and neither are there any known policies or guidelines governing how downloaded data is stored, used, or shared, or any requirement to destroy data after matters have been finalised.”
Now Cellebrite is preparing to move the evidence into the cloud and make it searchable by artificial intelligence. The company has tested Genesis, which the company describes as an Agentic AI Tool “to help make our world safer” with an unnamed Australian police force.
A counter-terrorism detective from an Australian police agency with early access to Genesis was quoted on Cellebrite’s website.
“We’ve used it to do things that surprised us, including generating critical new information from uploaded intelligence profiles, which changed the calculus and timeline entirely, achieving outcomes beyond what we believed possible.”
In other words, it is no longer simply a matter of who can unlock a suspect’s phone. It is who can search the resulting mountain of information, combine it with other government datasets, feed it into AI systems and obtain – and retain – the results.
A phone extraction can capture messages, emails, photographs, location histories, contacts, browsing records and other information belonging to people who are not suspects.
And it is all unchecked without privacy guardrails.
* not his real name
Michael West Report [edited for space]
michaelwest.com.au/cellebrite-gets-government-blessing-to-share-your-phone/
