The willingness of digital forensics firms to sell to virtually any paid law enforcement agency, regardless of the country’s human rights record, has not sparked any minor controversy. These tools, critics say, allow bad governments expansive and invasive powers, and can be used in investigations that illegally target activists or journalists.
In what appears to be a key example of this problem, a new report published this week by the Committee to Protect Journalists shows how the US and Israeli digital forensics firms were recently used by the government of Botswana to investigate multiple journalists for … well, that part is not entirely clear.
The report detail it ordeal of Oratile Dikologang, journalist and co-founder of the Botswana People’s Daily News, who was arrested last year and reportedly tortured after being accused of spreading “fake news” about the country’s president and Covid-19. Police officers, claiming that Dikologang was responsible for producing a series of inflammatory Facebook posts, accused him of “Posting statements with the intent to mislead people about the COVID-19 infection.” They then allegedly transported him to a local station, stripped him of his clothes and put a black bag over his head before questioning him about his sources.
In interviews with CPJ, the reporter denied actually writing the social media posts in question. and said that authorities sought to use the incident to retrieve information from him about his reporting practices.
Adding to the dystopian tenor of this episode was how data mining tools were used by police to quickly gain a full understanding of the identity of the journalist’s contacts. Authorities reportedly used the Universal Forensic Extraction Device (UFED) product from Israeli company Cellebrite and the Forensic Toolkit from US company AccessData, which helped police extract thousands of data from the journalist’s phone. CPJ Reports:
Dikologang told CPJ he refused to reveal his sources – but provided the password on his phone. Police then “successfully extracted” and “deeply analyzed” thousands of the journalist’s messages, contacts, images, audio files and videos, as well as social media accounts and apps, according to one. affidavit they submitted to the court to support the pending lawsuits.
G / O Media can get a commission
Jonathan Rozen, one of the researchers who investigated the episode, said the presence of digital forensic technology in government investigations of journalists is a growing problem. In many cases, CPJ has discovered this type of technology being sold in countries where authorities “have demonstrated a willingness to arrest journalists, seize their devices and request access. [to the contents] of these devices, ”Rozen said during a phone call with Gizmodo.
“The idea that the authorities could seize and access the contents of your phone, your searches, the information you collect in the course of your work – that has a real deterrent effect. [on journalism]. Privacy is a really important press freedom, ”he said. “Wherever we have identified the acquisition of this technology by the authorities, journalists are alarmed.”
Companies should revisit their sales practices and look at these issues more holistically, Rozen said.
“We have been engaging with these companies for some time now, as have other researchers,” he said. “We consistently get responses that refer generally to human rights considerations. Their terms of service make sweeping claims of compliance with human rights verification … and we don’t know exactly what those processes include. What kind of due diligence do these companies do before selling this technology to a security agency or government? ”
Recent research has also shown how easily some of these data mining devices can be manipulated, which can potentially spoil the evidence. The permanent question of what exactly is going on with Cellebrite security – also useful highlighted by Moxie Marlinspike, CEO of Signal—Add an extra level of concern to incidents like this.
Rozen also said the Botswana episode is one of a growing number of cases around the world in which journalists have been jailed for spreading false information. In Dikologang’s case, the legal charges against him included a host of violations, including the production of “offensive electronic communication”, “publication of alarming statements” and violation of Covid-19 emergency regulations. government by “publishing with the intent to deceive,” Rozen said. Governments around the world have increasingly relied on similar arguments to attack journalists, he added.
We reached out to Cellebrite and AccessData for comment. We will update this story when they come back to us.
