Lexington Police Department deploys controversial digital evidence analysis software

Lexington, Ky.–The Lexington Police Department is all set to begin using Cellebrite Inc.’s Pathfinder digital evidence analysis software.

The Israeli firm describes the software as a way for law enforcement agencies to “streamline” the investigative process. They say it “identifies patterns, reveals connections, and uncovers leads with speed and accuracy.”

Activists say the company violates the civil rights of Americans by hacking into the private data on their phones–recent Washing Post reporting revealed the firm helped Customs and Border Patrol copy Americans’ phone data at a massive scale.

The company has also been accused of helping repressive governments target journalists, dissidents, and the LGBTQ community, and the ACLU recently argued tools like Cellebrite’s need to be subject to additional oversight in the US.

Signal’s founder, whose product is a target of Cellebrite and was used by racial justice protestors in Lexington in 2020, contends that software vulnerabilities found in Cellebrite’s tools could be used to tamper with evidence.

Here are some of the features offered by Pathfinder, according to a sales letter obtained by the Times:

• Access Locked and Encrypted leading mobile devices. Cellebrite Premium & Premium ES supports Full File-System, User data extraction and Physical extraction from the widest range of iOS and Android devices.
• Large, Established User Community. Since 2007, Cellebrite has deployed more than 60,000 Cellebrite UFED in 100+ countries to support law enforcement, intelligence services, border patrols, military forces, public safety agencies and commercial organizations .
• Industry’s Broadest Device & App Support. Cellebrite has the largest device inventory in the industry that holds more than 15K mobile devices from different vendors, OS, Locations and years. Cellebrite is purchasing dozens of devices each month from different countries to support customer’s needs

The Urban County Council voted to pass Resolution 489-2022 authorizing the Division of Police to purchase the tool for $59,500. It was signed by Mayor Linda Gorton on September 8.

LPD Commander Matthew Greathouse appears to be among those who pushed hardest for the software. He went as far as to write a letter to the Council saying no other solution out there besides Cellebrite’s would work for Lexington. He argued that because LPD already uses software made by the controversial company, “There is not a solution that will integrate with the program we already have in place.”

Greathouse has been caught lying to the public about controversial digital tools before. In September, he told a local news station that a FLOCK license plate reader program, which advocates say violates citizens’ privacy and targets minorities, had been audited and “no inconsistencies” were found. However, an open records request determined his statement to be a lie–the audit he referenced did not exist.

The circular logic presented by Greathouse and LPD seems to suggest that once LPD chooses a vendor like Cellebrite, the firm is more or less “locked in” for a long-term contract with the City.

Despite objections from advocates and others, expect your tax dollars to keep going to Cellebrite for a long time, supporting a company whose headlines include abuses from Australia to Botswana to South Africa to Vietnam:

• Botswana police use Israeli Cellebrite tech to search another journalist’s phone
• No, an Israeli company can’t hack into Signal on your phone
• Creepy hacking tool can unlock almost ANY iPhone or Android smartphone
• Shining a Light on Federal Law Enforcement’s Use of Computer Hacking Tools
• Customs officials have copied Americans’ phone data at massive scale
• Concerns over police reliance on Cellebrite data extraction technology
• Researcher Finds New Vulnerabilities in Cellebrite’s Tools

LPD receives access to the tools in a year that hasn’t been great for their reputation. There have been numerous misconduct allegations made against LPD officers this year, according to our LPD Misconduct Report.

What if the Lexington Police officer who placed a GPS tracker on his ex’s car had been able to also hack into her phone?

What if the Lexington Police detective being sued for federal civil rights violations for framing five UK players had been able to hack into their phones and alter evidence on top of everything else? Would the players have been wrongfully convicted after all?

We will soon live in a city where these and other scenarios are a reality. Be safe out there, Lexington.