Cameron County DA and Cameron County Sheriff | The drug task force's phone extraction tools
Cameron County is the purchasing body for the South Texas High Intensity Drug Trafficking Area, and the task force's phone unlocking subscriptions are renewed by a vote of five county officials in Brownsville. The items say "software license" and name no device.
At a glance
- What it is
- Grayshift and Cellebrite tools, which unlock and copy the contents of a seized mobile phone, held by the South Texas High Intensity Drug Trafficking Area [1] [2] [3] [4] [5] [6] [7]
- Who buys it
- Cameron County, through its Auditor and its District Attorney, as the purchasing body for the task force. The task force is funded by the federal Office of National Drug Control Policy [1] [5] [6] [8]
- What the county has posted spending
- $56,090.00 in February 2022, $28,070.00 in August 2022, $55,990.00 in December 2022 and $30,795.00 in May 2023, all to Grayshift, LLC. The 2024 GrayKey and Cellebrite renewals state no price [1] [2] [3] [4] [5] [6]
- How it was bought
- Three of the four Grayshift licenses are posted as sole source purchases [2] [3] [4]
- Which agencies use it
- Not stated. The task force spans agencies in South Texas; the county's items name only the task force
- A policy
- None appears in any county notice we read: nothing on when a phone may be extracted, what is kept, or for how long
How it happened
- Procurement
PenLink, as a sole source
The Court's notice carries a contract with PenLink for training for South Texas task force intelligence members, as a sole source purchase, alongside $26,657.60 of training equipment from CDW-G. [8]
- Context
Two extraction devices sent to be destroyed
The District Attorney brings an item to have two outdated Cellebrite forensic extraction devices belonging to the task force unit, identified by serial number, destroyed at a recycling center as no longer serviceable. It is the clearest confirmation in the county's record that the unit had been using them. [7]
- Procurement
A $56,090 software license with no device word in it
A software license for the South Texas task force from Grayshift, LLC, $56,090.00. The item says nothing about what the software does. [1]
- Procurement
A third Grayshift license in one year
$55,990.00 to Grayshift, LLC as a sole source, following $28,070.00 in August. A fourth follows in May 2023 for $30,795.00. [3] [2] [4]
- Deployment
GrayKey, named at last
The renewal item spells out the product for the first time: a one year GrayKey license with advanced unlimited consent and before-first-unlock extractions, 125 action credits and instant unlock or brute force advanced actions, against a serial number. [5]
- Deployment
Cellebrite, renewed against two serial numbers
A one year renewal of the task force's Cellebrite UFED 4PC Ultimate subscription, covering two serial numbers, brought by the District Attorney. [6]
Between February 2022 and May 2023 the Cameron County Commissioners’ Court was asked four times to buy a software license from a company called Grayshift, for $56,090, $28,070, $55,990 and $30,795. Three of the four were posted as sole source purchases. Not one of the four items said what the software does.
It unlocks phones. Grayshift makes GrayKey, a device that defeats the passcode on a seized mobile phone and copies what is inside it, and the county’s own renewal item in March 2024 finally spells the product out: a GrayKey license with advanced unlimited consent and before-first-unlock extractions, 125 action credits, and instant unlock or brute force advanced actions. Three months later the Court was asked to renew a Cellebrite UFED 4PC Ultimate subscription against two serial numbers, Cellebrite being the better known maker of the same kind of tool.
Why a county on the Gulf coast is buying them
None of this equipment belongs to Cameron County in the ordinary sense. The county is the purchasing body for the South Texas High Intensity Drug Trafficking Area, a federal task force funded by the Office of National Drug Control Policy, and the task force’s purchases come to this Court because somebody has to sign for them. The tools sit with the task force’s unit, and the county’s items name no member agency.
That arrangement is the reason these purchases are visible at all. A task force is not a government anyone votes for, and it holds no public meetings. The only reason a resident of the Rio Grande Valley can learn that a drug task force renewed a phone-unlocking subscription in June 2024 is that a Texas county had to post an agenda item about it.
It is also the reason the visibility stops where it does. The county’s record says what was bought and what it cost. What has to be true before somebody’s phone is opened, what is copied out of it, how long that copy is kept, and what happens to it if the person is never charged, are not county questions, so the county’s papers do not answer them.
What happened to these items is not published
Cameron County posts its agendas and does not publish its minutes. Every item above is what the Court was asked to consider on the date given.
What we do not know
- Which agencies in South Texas use the task force's phone extraction tools?
- What has to be true before a seized phone is extracted, and who decides?
- What is copied off a phone, how long is it kept, and what happens to the data of people who are never charged?
- Does any audit record exist of extractions performed?
What you can do
Show up
Systems like this one are approved by boards, councils and committees that meet in public. We have confirmed where each of them meets in Cameron County and how public comment works there.
How to show up in Cameron County →Protect yourself
Practical steps to shrink your personal data trail. Our guides publish at launch; until then, EFF's Surveillance Self-Defense is the best starting point.
Surveillance Self-Defense →Sources
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
Get the digest
A regular digest of what changed in the world of surveillance: the counties we published, the devices that appeared on the map, and the public meetings where these decisions get made. We send it when there is enough to report.
One click to unsubscribe. What we do with your address is on the newsletter page.