Galveston County Sheriff | Phone extraction
The Sheriff's Office has run Cellebrite since 2019 and added a second tool, GrayKey, in 2023. Both are renewed on the consent agenda every autumn, and neither has ever been discussed in front of the Commissioners Court.
At a glance
- First in the county record
- 2 December 2019: an agreement with Cellebrite [1]
- What is running now
- A Cellebrite cell phone data extraction subscription, bought through the reseller Carahsoft, and a GrayKey license from Magnet Forensics, which acquired Grayshift [2] [3]
- A third tool the Court never voted on
- PenLink, described as software for cell phone forensics, $4,827 in the Sheriff's adopted budget for fiscal year 2023. It appears in a budget schedule filed beneath a Cellebrite renewal and in no item title in 49,553 items [7]
- How they are approved
- On the consent agenda every time. The October 2023 renewal sat in a block of 67 items and the November 2023 renewal in a block of 43; both 2024 renewals passed inside blocks of 63 [4] [5]
- Times either was debated
- None in the minutes we read [6]
- A policy governing their use
- None has been presented to the Commissioners Court in the record we read [6]
- How many devices have been extracted
- Not stated in any county record we read [6]
How it happened
- Procurement
Cellebrite arrives
The Court approved an agreement with Cellebrite. Renewals follow in September 2020 and December 2022. [1]
- Procurement
A third tool, in a budget table
A page of the county's adopted budget for fiscal year 2023, filed beneath that December's Cellebrite renewal, lists the Sheriff's Criminal Investigation contracts for the year. Alongside Cellebrite at $6,800 and Grayshift at $16,677 it carries PenLink, described as software for cell phone forensics, at $4,827. PenLink appears in no item title the Court has ever voted on. [7]
- Procurement
Two tools, one consent block
Consent item 30 renewed the Cellebrite contract for a cell phone analyzer. Four weeks later, on 27 November, consent item 25 renewed a contract with Grayshift for a mobile forensic access tool, in a block running from item 1 to item 43 that named no exceptions at all. [4]
- Procurement
Grayshift becomes Magnet Forensics
Consent item 38 renewed the GrayKey license, now from Magnet Forensics, for criminal investigations. Three weeks later the Cellebrite subscription was renewed through Carahsoft. [5] [2]
Phone extraction tools copy what is on a mobile phone: messages, photographs, location history, deleted material a normal user cannot reach. Galveston County has had one since 2019 and two since 2023.
What the county has
Cellebrite first appears in the Commissioners Court’s record on 2 December 2019 and has been renewed since, most recently as a cell phone data extraction subscription bought through the reseller Carahsoft. A second tool arrived in November 2023: a mobile forensic access tool from Grayshift, whose GrayKey product is now sold by Magnet Forensics after an acquisition, and which the Court renews each autumn for criminal investigations.
There is a third, and the Court has never voted on it. A page of the county’s adopted budget for fiscal year 2023, filed beneath that December’s Cellebrite renewal, lists the Criminal Investigation division’s contracts for the year: CovertTrack at $6,510, Cellebrite at $6,800, Grayshift at $16,677, LeadsOnline at $11,653, PenLink at $4,827, and Verizon at $1,500 for pole camera service. PenLink is described there as software for cell phone forensics, and appears in no item title in the 49,553 items the Court has considered since 1995.
How they get approved
On consent, every time. The October 2023 renewal was item 30 in a block running from item 1 to item 67, carried in one motion that named four items held back for separate votes. The Grayshift renewal that November was item 25 in a block of 43 that held nothing back. The GrayKey renewal in October 2024 was item 38 in a block of 63.
Nothing about that is irregular. It is how a Texas commissioners court disposes of routine contract renewals, and a subscription renewal genuinely is routine in the sense that matters to a purchasing department. What it means for a resident is that the county’s decision to be able to copy the contents of a phone has never been made out loud.
What the record does not say
No Galveston County record we read states how many devices have been extracted, in what kinds of case, whether a warrant is required as a matter of office policy, how long the extracted data is kept, or who else can see it. The Court has never been shown a policy.
What a resident can ask for
The Texas Public Information Act reaches the Sheriff’s Office directly. The questions worth putting are the three above, and the answers, if they exist, sit in an office policy manual rather than in anything the Commissioners Court has ever seen.
What we do not know
- What PenLink is used for, and how it differs from the two tools the Court does vote on.
- How many devices the Sheriff's Office has extracted data from, and in what kinds of case.
- Whether extraction requires a warrant as a matter of office policy, and who signs off.
- How long extracted data is kept and who else can see it.
What you can do
Show up
Systems like this one are approved by boards, councils and committees that meet in public. We have confirmed where each of them meets in Galveston County and how public comment works there.
How to show up in Galveston County →Protect yourself
Practical steps to shrink your personal data trail. Our guides publish at launch; until then, EFF's Surveillance Self-Defense is the best starting point.
Surveillance Self-Defense →Sources
- 1. Galveston County Commissioners Court, agreement with Cellebrite, 2 December 2019 · Meeting record · · accessed
- 2. Cellebrite renewal through Carahsoft, before the Court 4 October 2024 · Meeting record · · accessed
- 3. Magnet Forensics GrayKey license renewal, before the Court 4 October 2024 · Meeting record · · accessed
- 4. Galveston County Commissioners Court, minutes, 30 October 2023, consent item 30 · Meeting record · · accessed
- 5. Galveston County Commissioners Court, minutes, 14 October 2024, consent item 38 · Meeting record · · accessed
- 6.
- 7.
Get the digest
A regular digest of what changed in the world of surveillance: the counties we published, the devices that appeared on the map, and the public meetings where these decisions get made. We send it when there is enough to report.
One click to unsubscribe. What we do with your address is on the newsletter page.