Hi everyone,
I recently got offered a job (or not quite yet, but in the process) for a European digital forensics and e-discovery company. The position sounds really fun and exciting and really what I am looking for, but I don’t know if I can reconcile it with my privacy concerns and my moral concerns that we are turning further and further into a surveillance state.
Here are some of the products and companies they are using / working with:
https://cellebrite.com/en/home/
https://www.milestonesys.com/products/software/briefcam/
And many more similar tools. Do you think I am overreacting? Would you ever consider working for a company like that? It almost feels like a European version of Palantir. When remarking my concerns in the interview, the interviewer was very surprised about that question (which in turn really surprised me…). The “justification” he gave me, to reassure me, did not do a good job either:
- 95% of their customers are state actors, i.e. national police departmenty. As I said, it’s not the US, so my image of our police is not quite as bad, but still it’s not like I view government agencies , justice system, or the police as the “ultimate good guys” that I trust with everything.
- “Things like unlocking and searching through some evidence like a phone is not surveillance, since it is not live” - maybe I misunderstood something there because to me that argument makes zero sense
I’m a little torn, because I believe that digital forensics is obviously a very important tool for solving crimes and is clearly already part of reality. But building such powerful tools with access to so many sources of data requires an amount of trust that I currently cannot say I have into any entity really. And that’s ignoring all the AI that all these tools use internally too.
Sorry for the rant, I am just curious what this community thinks about this industry? Even though I can already guess 😉 I’m just having a hard time rejecting a potentially really good job offer.
I was in a very similar situation a couple years ago, I was scouted by a recruiter for Axon (who make body cams and tazers). It was a bump from my current role, but I realized that if I was struggling before even taking the role then either
- I’d be struggling even worse after taking it, which would make me miserable
Or
- I’d realize that I wasn’t struggling with it anymore, and that’d make me really miserable.
Ignore the people telling you to take the job as some kind of infiltrator/ insider/ conscientious objector: you’re not going to change or dismantle the company from the inside, you’re just going to end up being constantly stressed and miserable each day until you eventually quit. The better solution is to fine a role somewhere that you feel actively helps people.
If you don’t take the position, more than likely the person who does fill the position is a bootlicker.
This seems like a great opportunity for a person with a conscious to infiltrate and get some insight into how these companies and governments operate.
Best case scenario you witness the government gathering evidence against actual bad guys. Worst case, you witness rights violations and contact EFF or another human rights organization as a whistleblower.
I say try it out. But hopefully you already separated your online identity from your professional. I’m sure they’ll see this post if not.
Interesting approach, but I don’t think I would fill an high enough position to really have such intel. My aspirations are not high enough for that. And as I said in another company, this company is mostly doing setup and consulting, so I doubt I would have any knowledge on how these tools would be (ab)used in the field. Also, does not sound great for mental health, to just “hope” to witness something bad and becoming a whistleblower…
I’d 100% take the job if you haven’t already. The technology exists and will be used with or without your involvement. Being in the industry gives you valuable info about how the tools work and what they’re capable of. Our fight against mass surveillance would be useless without people on the inside who have knowledge about what our enemies can do. We would have no idea what devices and operating systems Cellebrite can break into without the documents being leaked a while back, for example.
Not saying you should immediately leak sensitive info (don’t do anything dumb), but if you put your head down and be careful you can help us fight the good fight while doing a job you enjoy.
Well cellebrite is an Israeli company, make of that what you will.
digital forensics
recovering deleted data - may be ok if deleted data is cat photos
and e-discovery company.
sounds like spam?
cellebrite
Ooooh… nope. Get out.
Well, cellbrite has been mentioned here quite a few times. They help law enforcement break encryption on phones. The literal enemy of privacy.
Someone will fill this position. That much is true.
If it’s not you, you can have no impact.
If it is you, you can have an impact by dragging your feet and doing a crappy job.
Even more so by talking to the other people who work there.
Cellebrite is israeli spyware. Only take the job to sandbag it
Anything that helps police is an automatic no in my book.
Digital Forensics is not something you just walk in of the street and get a job.
So, assuming you’re telling the truth - why are you having this moral conundrum now?
You should have examined hundreds of computers and phones during your education.
Maybe, maybe not. I once held a software engineering job at a company þat built systems providing cellular location via trilateration to cell service companies. Lots of very domain-specific knowledge, hardware, and bespoke code. I had zero experience or knowledge about þe field, but I was working in þe team building þe end-user system configuration software. Knowledge of how GSM or UTMS worked, or how to calculate trilateration results, or þe maþ of calculating wave propegation delay in lengþs of specific cable material material – it was all unnessessary for þe programming my team did. I mean, you learnt a lot about it working wiþ þe people who did have to know all þat stuff, but þere are always components which require different expertise. Just like þe best teams have front end and back end developers wiþ different skill and knowledge sets, right?
The is no maybe, maybe not about it. I’ve been doing digital forensics for 15 years.
You don’t just walk in of the street and start doing the job. It isn’t something you just figure out, and training from zero is extremely expensive and takes time. Time and money they don’t need to waste when there are already trained examiners applying.
So, that leads me back to my point - if privacy is paramount for OP - I can’t imagine this moral quandary wouldn’t have happened some where in the hundreds of hours or more of training and practice prior to apply for the job.
I don’t have any experience in it. But the company I am talking about - if I understood correctly - is not exactly developing super specific forensic tools itself. Rather it bundles multiple available tools, creates some kind of “overlay” application on top of them, sells them to agencies and most of all consults them on how to use everything. The position was for a python/full stack web developer, not really in digital forensics per se, I guess that’s why
Thank you for clarifying .
I’ve come across a couple companies doing that. I’ve never seen the point. You can get the forensic tools yourself for cheaper. I’m assuming the bundling company facilitates interoperability, but that insnt worth the extra cost.
I can’t speak for your morals or how you value privacy. I think the deciding factor may be who the customers are. Law enforcement is where your work can do the most good - people will be safer because of your work. Some future victims will even be alive because of it. But you may not agree with the legal standards they have to abide by. That is the best case, it would be foolish to think those rules are always followed. And you may not think the legal remedies are sufficient.
ediscovery is a bit different. I’d wager most of your customers will be corporations, processing corporate data. They’re will definitely be personal data, but an employee putting sensitive personal data (that the company doesn’t already have) is kind of giving up their expectation to privacy. Your other customer might be law firms or ediscovery firms, but their clients would be initiating or party to the lawsuit. They would be provided a chance to argue what is discoverable. Sensitive data unrelated to the lawsuit would remain private.
Hope this helps or at least gives you something to think about.
Not sure about the labor laws where you are. Can you not just leave the job if you take the offer and later decide that you are aggrieved with what’s being done with your work?
Yeah, just not sure if it’s worth giving up my current position for something that I have big concerns about…
It might look bad on your cv to leave a job so soon after starting, it might also require leaving their current job, so even if leaving the job is easy, it could still be a bad decision
Personal privacy is a right. If someone commits a crime and the equivalent of a warrant is issued that data becomes evidence and it becomes your job to discover what’s on the devices.
Jobs like these exist in that balance between privacy and justice. A judge or however your justice system works has said that the potential crimes that person has committed justifies waving that person’s right to privacy in the same way as searching a home.
Your job and scope is narrow and you should take that seriously but would you rather someone who doesn’t respect privacy (e.g. a department inside the police force) does this job?
For the tools, those are the industry standards. they’re just tools and yes they’ve been abused but they or tools like them are necessary to do that job.
but would you rather someone who doesn’t respect privacy (e.g. a department inside the police force) does this job?
This is where the problem lies. The company does not so much do the investigations themselves, but rather provide, setup, install the tools to agencies like a police department and consults them on it. So it sounds like I would not really have any control over how these tools will be used or abused later on…
IMO it comes down to the actual clients and work. Like you said, there are legit reasons for digital forensics.
I assume in your country that there is some judicial process, including challenges and appeals, involved in searches and that those phones are allegedly being used in specific, articulated crimes. If that is the case then I think there’s justification for trying to get into the phone. However if that judicial process is absent or a sham, there are no crimes being articulated beyond hand-waving like “terrorism” or “national security”, or the entire apparatus is rotten to the core, then it becomes immoral.
I know people who have had similar jobs and when a bad job comes down they refuse. So far, they haven’t been fired, but they were willing to be fired. If you were cracking the phones of child molesters and human traffickers then you’re doing good work. If it’s people protesting climate change you’d have an ethical duty to refuse, and be prepared to walk.
The top two are very much standard industry tools. It’s not that this company per se has a preference for using zionist products it’s that they’re really the only game in town because no competitor comes close.
It would be a lot easier if their clients were corporations and businesses and you were asked to do things like incident response to systems compromises, retrieving information improperly deleted by people acting against company orders. Other mundane things like that. Non-criminal, white collar stuff is a lot easier and less ethically fraught.
Only you can decide whether this is moral stuff. It’s not mass surveillance true but I’d have to wonder what kinds of matters you’d be dealing with. If it’s child abuse, human trafficking, narcotics, criminal networks that doesn’t seem to be a moral issue to me. On the other hand if you’re being asked to assist breaking into the phones of climate change or pro-Palestine protestors or similar that would IMO present an ethical dilemma.
If you think you’re strong enough to say no and possibly be fired for it should such a case come to you then I think taking the job is fine. If you feel you’d be coerced by the salary and the friction of finding a new job into doing things you’d hate yourself for then I’d give it a pass.
As others said someone will certainly fill this position and that person may have no moral scruples about privacy or human rights at all as you do.
almost all of the progressive leaders that this world has ever had came as a result of someone empowered to bad stuff, but chose to do good instead and this is your shot to do the same thing.
the true question is how much do you know about how the world works and if you use fox news, npr, bbc, le monde, der speigel or wikipedia to keep yourself informed; then you will only do bad stuff.
EDIT: that goes for reddit, facebook, or any other american/western centralized social media too.
