The Australian Federal Police is trying to buy cutting-edge technology to hack into the smartphones of suspected criminals and terrorists.
In the face of the rising use of encryption technology, the AFP has gone to the market this week offering contracts to experts who can “bypass user locks”, such as passcodes on smartphones, to extract all their data.
Passcodes and other locks have proven to be a problematic for law enforcement around the world, with Apple and the US Federal Bureau of Investigation ending up in court last year following the San Bernardino terrorist attack, as investigators sought to unlock an attacker’s iPhone. The legal battle was abandoned after the FBI found a “third party” — rumoured to have been Israeli technology firm Cellebrite — that could access the phone without a passcode.
Agencies including the AFP have been using software from Cellebrite, but it is not known if it has provided the agency with the capability to “hack” into passcode-protected smartphones.
The AFP paid $160,000 for a 12-month software licence with the company’s regional subsidiary last November, and had bought licences for “Cellebrite Units” as long ago as 2011.
The AFP revealed its push for the hacking technology with the release on Tuesday of request-for-tender documents for the “Supply of Mobile Phone Forensic Tools”. Although it is not listed as an “essential” requirement, the tender documents say it would be “desirable” that an “investigator can bypass user locks (where possible)”. Matthew Warren, a cybersecurity expert at Deakin University, said the term “user locks” would be a reference to passcodes or fingerprint recognition, but the AFP refused to comment. “For operational reasons the AFP is not able to provide further information on the nature of these contracts,” it said.
A spokesman for Attorney-General George Brandis said the government backed the use of technology companies in investigations. “It is vital that law-enforcement and national security agencies have the tools to deal with the increasing use of encryption by terrorists, pedophiles and violent criminals.”
The tender documents state that the AFP has been using technology to extract smartphone data for at least eight years.
“Since 2009 mobile phone data retrieving units have been purchased and distributed across the AFP nationally to fulfil the requirements for investigators to logically acquire and review the contents of legally seized mobile telephones,” the documents state.
Among the essential requirements listed for bidders were tools that could extract data from a “legally seized” device, along with information from SIM cards and removable storage drives.
It is understood authorities prefer to use warrants and court orders, rather than data-extraction tools. A person can be obliged to provide passcodes or passwords to comply with a search warrant, but there have been cases where people have refused.
Apple also has a policy that states: “For all devices running iOS 8 and later versions, Apple will not perform iOS data extractions in response to government search warrants because the files to be extracted are protected by an encryption key that is tied to the user’s passcode, which Apple does not possess.”