This #BezosHack is a great example of the stupidity that afflicts forensics. Once you make a hypothesis that can explain something, it becomes the only hypothesis. Everything explainable now has an explanation. The more you don't understand, the more the hypothesis is proven.
Bezos's security consultant started accusing Saudi Arabia back in March, before the FTI forensics got started.
thedailybeast.com/jeff-bezos-inv…
thedailybeast.com/jeff-bezos-inv…
They started with a conclusion, their job wasn't to refute the conclusion, but to find evidence of it. It wasn't possible for them to produce a report saying "we find no evidence of this", even though they actually found no evidence.
They did find a bunch of things they couldn't explain, anomalies. But here's the thing: every forensics investigation finds anomalies they can't explain. The correct conclusion to draw from this is that the forensics isn't able to explain everything.
But when you start with the conclusion that the Saudi's hacked the phone, then that would explain the anomalies. Thus, everything unexplainable becomes support for the conclusion.
In science, they call it "God in the gaps", where everything science can't explain is explained as "God did it". In cybersecurity, it's "hacker in the gaps", where everything unexplained becomes proof that a hacker did it.
Pretty much every forensics investigation I've done has required defending my conclusions from some idiot who tried to use the unexplainable to support their pet theory that explains it. This is especially true given corporate politics, which work just like this politics.
This @AgnesCallamard person from the U.N. doesn't care that consensus of outside experts is that the FTI report shows no evidence. She's got a political ax to grind, so the FTI report is evidence.
