Pakistan’s spy agency, enforcement agencies, using Israel’s intrusive cyber tech since 2012: Report

Jerusalem: Israeli cyber tech firm, Cellebrite, has sold Pakistan’s Federal Investigation Agency (FIA) and various police units products that are highly intrusive and can lead to gross human rights violations despite the two countries not having diplomatic ties and Israeli norms prohibiting such deals, a local media report said on Thursday.

The Israeli firm's products have been in use by Pakistani agencies since 2012, Ha’aretz newspaper reported in an investigative report.

Cellebrite’s flagship product, UFED, is traded in Nasdaq and enables law enforcement agencies to engage in digital forensic work by hacking into password-protected cell phones and can copy information stored on the device, including pictures, documents, text messages, call logs and contacts.

Unlike Israeli company NSO, whose sale of Pegasus cyber tech grabbed worldwide attention, and other manufacturers of offensive-cyber products, Cellebrite operates in a grey area between security exports and civilian ones.

In 2020, the export of forensic equipment such as that produced by Cellebrite came under the Defence Ministry’s oversight, since it was included in the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, which defines which dual-use (security use and civilian use) products require oversight, the report noted.

However, International shipment records show that until at least 2019, Cellebrite Asia-Pacific Pte (its Singapore subsidiary) sold products directly to companies in Pakistan and to its Federal Investigation Agency, the Israeli daily reported.

This happened despite Cellebrite’s end-user license agreement forbidding sales to Pakistan.

In other proofs presented in the report, the investigative piece notes that in 2012 it was reported in Pakistan that the Sind Province police had acquired UFED Touch Ultimate devices made by Cellebrite, and their use has been expanding since.

The Express Tribune newspaper had also published pictures that clearly show Cellebrite’s product, the Israeli daily said.

“Operating manuals, documents and official invitations for bids show that police units and the FIA regularly use these systems," Ha’aretz claimed.

“FIA officials, past and present who were tasked with enforcing the draconian cybercrime law, even state in their LinkedIn profiles that they have been trained and certified to use these systems and that they use them on a regular basis”, it noted.

Court rulings in Pakistan also refer to the extraction of forensic evidence from telephones but do not specify which technology was used, the report said.

The country’s different agencies use forensic systems made by other companies as well, but in an FIA invitation for bids from 2021 for systems made by two other firms, Belkasoft and Compelson, both were required to support files produced using Cellebrite’s technology, the report stressed.

Bidding requests issued by Pakistan’s Punjab police include a request for three UFED Ultimate devices, it further added.

Another bidding request by the counterterrorism division of the Peshawar police, from May of this year, also includes a request to renew the UFED license for another two years.

In yet another strong proof presented of the Israeli firm’s firm roots in Pakistan, a 2021 catalogue from Pakistan’s National Radio and Telecommunication Corporation (NRTC) touts a long list of technologies produced in the country.

On page 17, there is a listing for a UFED Touch 2 by Cellebrite.

On the next page, NRTC advertises BlackBag’s Mobilyze digital forensic technology, which was acquired by Cellebrite in 2020, the report pointed out “The company does not sell to Pakistan, directly or indirectly," Cellebrite told the Israeli daily, but it refused to explain how that claim squares with Cellebrite-Singapore’s shipment certificates to Pakistan and with official tenders in Pakistan that demonstrate that the country’s investigation agency and police use its technology.

“Cellebrite is committed to its goal of creating a safer world by providing solutions for law enforcement bodies that permit them to solve crimes more quickly,” the company was quoted as saying in its response.

“For that purpose, we have developed strict means of oversight that ensure proper use of our technology in the context of investigations carried out by virtue of the law”, it stressed.

“As a global leader in digital intelligence, Cellebrite’s solutions assist thousands of law enforcement agencies to convict those who endanger public security and to do justice to the victims of crime”, the cyber tech firm argued.

The Israeli Defence Ministry reportedly declined to comment.

Cellebrite’s CEO, Yossi Carmel, as per the report, says that their products are sold only to police departments and security forces to “fight serious crime, including terrorism”.

  However, Ha’aretz reported that Cellebrite’s hacking tools have over the years found their way to organisations that oppress human rights activists, minorities and the LGBTQ community.

The Daily has reported on numerous occasions that the Israeli firm’s clients include oppressive regimes that were or still are subject to sanctions.

Such clients include Bangladesh’s notorious Rapid Action Battalion, Belarus, China (including Hongkong, Uganda, Venezuela, Indonesia, the Philippines, Russia and Ethiopia, the report said.

The security forces in Pakistan are known to commit serious violations of human rights and freedom of expression.

A US State Department report on Human Rights in 2022 accused Pakistan of “significant” lapses.

“Significant human rights issues included credible reports of unlawful or arbitrary killings, including extrajudicial killings by the government or its agents; forced disappearance by the government or its agents; torture and cases of cruel, inhuman, or degrading treatment or punishment by the government or its agents; harsh and life-threatening prison conditions; arbitrary detention; political prisoners; transnational repression against individuals in another country; arbitrary or unlawful interference with privacy; serious restrictions on free expression and media, including violence against journalists ....”, the report had pointed out.

Pakistan, in 2016, also passed a cybercrime law, the Pakistan Electronic Crimes Act, or PECA, which imposed severe limits on online freedom of expression, particularly criticism of the government.

The law permits the exercise of strict online censorship without a court order and also allows the police to collect information from locked devices without a court order.

The South Asian nation went on to amend the draconian law last year to accord an expanded definition of potentially suspicious activity, making it much more regressive.

“PECA has been used to silence freedom of expression on the pretext of combating ‘fake news,’ cybercrime, and misinformation," Nadia Rahman of Amnesty International, was reported as saying in response to the amendment.

Israeli lawyer and human rights activist, Eitay Mack, has been harshly critical of Cellebrite and the Israeli Defence Ministry, which he accuses of “providing oversight” of the company.

“Pakistan is not just another undemocratic country that is violating human rights, but a country that is ruled by the military and its intelligence units, which support international terrorist and crime organisations," Mack was quoted as saying.

“Cellebrite’s systems could be used not only to persecute women and religious minorities that have ‘desecrated Islam’ but also to persecute journalists and opposition activists who are working to uncover the military’s ties with terror organisations like the Taliban and Al Qaeda," he emphasised.

Unlike other instances when Israel used its cyber tech capabilities to promote diplomatic ties with countries like Saudi Arabia, UAE and Morocco, Mack feels this is just a case of another Israeli company focusing on making profits, benefitting from the Defence Ministry's “negligent oversight”.

“Because of internal political considerations in Islamabad (the Pakistani capital) and due to Israel’s strategic relationship with India, there is no way that the sale of any type of security equipment to Pakistan will advance Pakistan’s relations with Israel," the activist lawyer said.

Ha’aretz newspaper also quoted a 2013 British government report alleging Israeli export of arms to Pakistan, including electronic warfare systems, radars and advanced fighter jet systems.

Israel and Pakistan have hobnobbed towards political normalisation in the past with a meeting between foreign ministers and a “chance handshake” between their top leaders, but there has been no significant progress given the acute public hostility against Israel in Pakistan.

Occasional contacts continue using Israeli permission to allow Muslim pilgrimage to the holy Al Aqsa mosque and delegation visits to promote inter-faith dialogue.