Commercial surveillance is real

Commercial Forensics Turned Against Civil Society

Commercial surveillance is no longer theoretical.

New research from Citizen Lab has found high-confidence indicators that a forensic extraction tool from Cellebrite was used on the phone of Kenyan activist Boniface Mwangi while it was in police custody in July 2025.

According to the report, the Samsung device was returned nearly two months later without password protection enabled — a strong signal of successful forensic access.

If accurate, this would have allowed full extraction of:

• Messages

• Files

• Photos

• Financial data

• Saved credentials

• Authentication tokens

Not malware.

Not phishing.

Physical custody plus forensic tooling.

This Is a Different Threat Model

Cellebrite tools are marketed for lawful investigations and digital evidence collection.

They are not spyware in the traditional sense.

They require device access.

But once access is obtained, they can:

• Bypass certain lock protections

• Extract encrypted app data

• Pull deleted artifacts

• Capture keychain credentials

• Clone device contents

For activists, journalists, and dissidents, the risk is simple:

If authorities seize the phone, the perimeter is gone.

A Broader Pattern

Citizen Lab previously documented similar forensic extraction indicators involving activists in Jordan.

Separately, Amnesty International reported that Angolan journalist Teixeira Cândido’s iPhone was infected with Predator spyware developed by Intellexa.

Predator is not a forensic tool.

It is live spyware.

Once installed, it can:

• Access messages

• Activate microphones

• Read emails

• Monitor activity

• Evade recording indicators

It reportedly includes anti-forensics and detection avoidance mechanisms, including regional checks to avoid operating in certain jurisdictions.

That’s a commercial surveillance ecosystem — not isolated misuse.

What This Means for Businesses

You may not be a dissident.

But the technical principles apply broadly.

Modern smartphones contain:

• MFA tokens

• Password manager vaults

• Corporate email

• Cloud session cookies

• Banking credentials

• CRM access

• SaaS integrations

If a device is seized — at a border, during litigation, in a compliance investigation — full extraction could expose far more than text messages.

For SMBs, healthcare practices, law firms, and schools, this raises uncomfortable questions:

• Are corporate devices configured with strong encryption enforcement?

• Are passcodes long enough to resist brute-force bypass tools?

• Is biometric unlock disabled after seizure scenarios?

• Are device management policies enforcing remote wipe?

• Are conditional access controls preventing token reuse?

Because once credentials are extracted, identity becomes the new perimeter.

The Surveillance Economy Is Expanding

The market for commercial surveillance tools is growing.

Vendors argue they support lawful investigations.

Researchers continue to document misuse.

And the technical sophistication is increasing.

The line between:

• Forensics

• Lawful access

• Offensive spyware

Is narrowing in practical effect.

From a cybersecurity standpoint, this is not just a human rights story.

It is a device governance story.

The Strategic Lesson

Security leaders focus heavily on:

• Network defense

• Email filtering

• Cloud security posture

• Endpoint detection

But mobile device custody risk remains under-modeled.

If someone else controls the hardware, your encryption and identity strategy must assume extraction attempts.

Data protection cannot rely solely on:

“Who is holding the device?”

It must assume:

“Could this device be copied?”

The attack surface now includes legal systems, border crossings, and physical seizure events.

That is the modern reality of digital identity.

70% of all cyber attacks target small businesses, I can help protect yours.

#Cybersecurity #ManagedIT #DataProtection #MobileSecurity #MSP