Cellebrite, whose tech was likely used to unlock the San Bernardino shooter's iPhone, buys BlackBag for $33M to expand its capabilities beyond smartphones
Chance Miller / 9to5Mac :
Context & Ripple Effects
Cellebrite enters 2020 on a steep commercial trajectory: a filing showed ICE will pay it between $30M and $35M over one to five years, more than ten times its 2017 contract, and leaked documents showed it has let NYC police unlock and extract data from iOS and high-end Android devices on their own since 2018. Its public reputation was made in the San Bernardino case, though reporting later indicated the FBI did not use Cellebrite and instead paid for an undisclosed software flaw.
The $33M BlackBag acquisition extends that business past smartphones into computer forensics, deepening a vendor lock-in pattern with government customers. It also enlarges a target: in 2017 a hacker stole 900GB of data from Cellebrite, a reminder of what its client lists and tooling are worth to adversaries.
First-order effects
- Cellebrite's government and law-enforcement customers — ICE, NYC police, and the agencies Forbes reported it pitched on iOS 11 unlocks — can now source phone and computer forensics from one vendor, raising switching costs with each added capability.
Second-order effects
- Rivals in computer forensics now face a competitor with proven government budgets and a multi-device bundle, pressuring them toward their own consolidation or pricing concessions to agencies that previously bought phone and desktop tooling separately.
- Every expansion of Cellebrite's tooling widens the attack surface that produced the 2017 900GB breach, making the security of its own infrastructure a direct concern for the agencies whose operations depend on it.
Third-order effects
- If agencies keep consolidating forensic spending with single vendors, the market moves toward full-stack evidence-extraction platforms — and the concentration of unlock capability, client data, and breach history in one company sharpens the case for oversight of how such tools are sold and secured.
The trend: Law-enforcement forensic tooling is consolidating around multi-device vendors whose government contracts are growing faster than the scrutiny of how their tools are sold and protected.