Signal makes it clear: Cellebrite cannot crack the messenger encryption
In its in-house blog, Signal clarifies a misunderstanding of the last few days: Cellebrite, a provider of digital investigation solutions for law enforcement, for example, made the headlines. Some media reported that Cellebrite managed to crack Signal's encryption. But that's not the case. And Cellebrite had never said that either.
According to the Signal spokesman, Cellebrite published a very embarrassing blog article. In that one described long and broadly how one could access data from Signal – but in possession of the respective Android device with an unlocked screen. Anyone who thinks: "Yes, well, when I hold the device in my hand and it is unlocked – then I can easily access most of the data anyway," says Signal. Accordingly, the blog article was confused and rather off the track.
Cellebrite understood this shortly after publication and therefore quickly deleted the article. Therefore there was a 404 message at times. That didn't work out so well for Cellebrite either. So in the end the original article was replaced by a concise and very vague summary. Signal is now accusing Cellebrite of being unprofessional, as the original article spoke of "challenges" and "intensive research" to make it possible to extract data from Signal. In the initial situation described, it is easy to get data: simply take screenshots in the app or copy and paste content. And essentially that is exactly what the blog post described, just through an automated process. However, that is anything but a laudable achievement, but must be child's play in such a situation. If Cellebrite had to do intensive research for this, that speaks against the supposed competencies of the provider.
In plain language: In order for the tools from Cellebrite to produce anything at all, the respective device must be physically and unlocked already in the possession of the person who wants to access it. Otherwise, Cellebrite cannot access any content and certainly not override the encryption. According to Signal, what Cellebrite ultimately offers is mediocre enterprise software. Signal has now taken the time to clarify the false reports in the hope that at least some people will also become aware of the correction.