# Cellebrite Advanced Services Agreement The 2024-10-07 DocuSign-executed **composite General Terms and Conditions** bundle binding the City of Little Rock to Cellebrite's **Advanced Services** lab work for 36 months. This is the parallel Cellebrite procurement to [[Cellebrite Inseyets-UFED Purchase (Carahsoft Quote 49570615)]] — where the Carahsoft quote covers the on-device extraction software and 40 cloud unlocks, the Advanced Services Agreement covers Cellebrite's lab-based extraction of devices its customers cannot unlock on their own. The Advanced Services portion was filed as **Arkansas competitive-bid exemption #44 (single source)** for $21,136.06. ## What's inside The "2024.10.07 Cellebrite General Terms and Conditions for Advanced Services - FULLY EXECUTED.pdf" is a **243 KB composite bundle** containing several distinct contractual texts on a single DocuSign envelope: 1. **Advanced Services General Terms and Conditions** (pp. 1–14) — the lab-services contract; the focus of this source page. 2. **Endpoint SaaS Terms of Service** — bound by the same envelope; identifies **Cellebrite DI Ltd.** as the contracting entity for SaaS products (the Israeli parent, not the US subsidiary). 3. **UFED/Inseyets EULA** — the end-user license agreement for the device-side software the Carahsoft quote provisions. 4. **Training Services Terms and Conditions** — for the operator-certification training the cloud unlocks may require. The **Advanced Services T&C** governs the substantive lab work; the other three texts are bundled background. The companion **competitive-bid exemption form** (`LRPD_Cellebrite_Approved_10.17.24_Comp. Exemption Form.pdf`, separately extracted) is the LRPD-side procurement justification. Signed by [[Latreasa Mullins-Sanders]] 2024-10-14, approved by [[Lisa King]] 2024-10-17. **Amount: $21,136.06. Line Exemption: #44 (single source).** ## Key takeaways - **36-month term.** Unlike the year-by-year software subscription (Carahsoft quote), the Advanced Services Agreement obligates the City for three full years. - **Devices are shipped to Cellebrite's labs.** §1 of the Advanced Services T&C uses Incoterms ("Customer to ship devices to Cellebrite's designated laboratory") — meaning LRPD must physically transfer custody of suspect devices to Cellebrite's facility for unlocking. - **§5.5 — interception and circumvention authority.** Authorizes Cellebrite to "intercept communications" and "circumvent measures designed to prevent unauthorised access" in performing the lab service. (Tier-1 corpus.) - **§5.7 — employee-reporting mitigation.** Obliges the customer to "mitigate the risk" that its own employees will report Cellebrite's services to law enforcement. (Tier-1 corpus.) - **§6.4 — non-disclosable trade secrets.** Treats Cellebrite's unlocking "Sources and Methods" as non-disclosable trade secrets, which under Arkansas FOIA the City has limited authority to override (§§11.1, 11.8 carve out Arkansas FOIA compliance). - **§10.3 — cross-border data transfer.** Permits extracted Personal Data to be "transferred or stored outside the EEA or the country where Customer is located" — meaning data extracted from devices physically located in Little Rock may be transferred internationally as part of the lab work. (Tier-1 corpus.) - **§13.1 — export-control compliance.** Multi-jurisdiction export law subject; §13.16 selects Arkansas as governing law. - **Endpoint SaaS Terms §14.4 — Israeli export controls.** The Endpoint SaaS Terms identify **Cellebrite DI Ltd.** (the Israeli parent) as the contracting entity and disclose that the Service is "subject to certain export, re-export, customs or import controls, applicable in **Israel**, the European Union, the United States… the US Export Administration Regulations (EAR)." (Tier-1 corpus.) - **Annex B — Data Processing Addendum.** GDPR + EU Law Enforcement Directive 2016/680 references; defines processing as "unlocking… decoding… extracting data from digital devices, collecting end user data from cloud services." Names **Chainalysis** as a crypto sub-processor. (Tier-1 corpus.) ## Verbatim citations > "§5.5: … Cellebrite is authorised to … intercept communications … and circumvent measures designed to prevent unauthorised access." (Tier-1 corpus, [[CLR-2026-778]], 2024.10.07 Cellebrite General Terms and Conditions for Advanced Services - FULLY EXECUTED.txt) > "§5.7: … Customer shall use reasonable efforts to mitigate the risk that its own employees will report Cellebrite's services to law enforcement." (Tier-1 corpus, same) > "§6.4: … Cellebrite's unlocking 'Sources and Methods' are non-disclosable trade secrets." (Tier-1 corpus, same) > "§10.3: … Personal Data may be transferred or stored outside the EEA or the country where Customer is located." (Tier-1 corpus, same) > "§14.4 (Endpoint SaaS Terms): … the Service is subject to certain export, re-export, customs or import controls, applicable in Israel, the European Union, the United States … the US Export Administration Regulations (EAR) … not … exported or re-exported to countries as to which the United States maintains an embargo." (Tier-1 corpus, same, Endpoint SaaS section) > "Annex B — Data Processing Addendum: … processing means unlocking … decoding … extracting data from digital devices, collecting end user data from cloud services." (Tier-1 corpus, same, Annex B) > "Approved By: Lisa King, 10/17/24 / Department: Police / Amount: $21,136.06 / Line Exemption (Appendix I) — Line # 44 [single source] / Signature: Latreasa Mullins-Sanders / Date: 10/14/2024" (Tier-1 corpus, [[CLR-2026-778]], LRPD_Cellebrite_Approved_10.17.24_Comp. Exemption Form.txt) ## LRPD-favorable negotiated terms The bundle has been redlined to add Arkansas-specific provisions: - **§13.16 — Arkansas governing law.** The contract is governed by Arkansas state law, not Israeli law or California (Cellebrite's contracted-with state for some US business). (Tier-1 corpus.) - **§§11.1, 11.8 — Arkansas FOIA carve-outs.** Cellebrite acknowledges that the agreement and its negotiation cannot block Arkansas Freedom of Information Act disclosure of the contract itself or substantively related records. (Tier-1 corpus.) This carve-out is *the reason this document is in the corpus today*: without it, Cellebrite would likely have invoked confidentiality to challenge production. ## People and orgs mentioned - [[Latreasa Mullins-Sanders]] — LRPD Administrative Services Finance Manager; signed the sole-source exemption request 2024-10-14. - [[Lisa King]] — City of Little Rock Senior Procurement Analyst; approved the exemption 2024-10-17. - [[Stephanie Whitaker]] — LRPD Sergeant; authored the initiating 2024-08-06 renewal memo. - [[William High]] — LRPD Detective; one of LRPD's two certified Cellebrite operators. - [[Cellebrite]] — vendor (corporate parent Cellebrite DI Ltd., Israel; US subsidiary Cellebrite Inc., Vienna VA). - **Joe Gauthier**, **Alexandria Keller**, **Stephanie Yanez** — Cellebrite Inc. sales contacts on the execution correspondence. - **Chainalysis** — third-party crypto sub-processor named in Annex B; cryptocurrency-tracing vendor. ## Concepts invoked - [[Mobile Device Forensic Extraction]] — the product class. - [[Competitive-Bid Exemption (Sole-Source Procurement)]] — Arkansas exemption #44; the affirmative-filing procurement track. - [[CJIS Compliance]] — relevant to chain-of-custody for extracted evidence. - [[Foreign-Headquartered Surveillance Vendors]] — the cross-border-data-transfer and Israeli-export-control axis. ## Events documented - [[2024-10 Little Rock Contracts Cellebrite Phone Forensics (Sole-Source)]] — the Cellebrite procurement event. ## Cross-references - [[Cellebrite Inseyets-UFED Purchase (Carahsoft Quote 49570615)]] — the parallel on-device software procurement on the OMNIA EDU cooperative contract. The two together complete LRPD's Cellebrite capability. - [[Cellebrite]] — vendor org page. - [[Vendor-Imposed Secrecy as Procurement Routine]] — the synthesis built on this agreement's §§5.5/5.7/6.4/10.3 clauses; the boilerplate-vs-deliberate-design question is filed as tension [[T003 - Vendor-Imposed Secrecy or Procurement Boilerplate]]. - [[Sole-Source Procurement Language Avoidance]] — the comparative Conway pattern; whereas Conway *strips* "sole source" language from ordinances to avoid Arkansas filing requirements, Little Rock *affirmatively files* the exemption with documentation. Two procurement paths around the same competition mandate. ## Open questions / follow-ups - **The number of devices LRPD sent to Cellebrite's lab during the 36-month term.** Not in the production. Would require Cellebrite invoicing records or LRPD chain-of-custody logs. - **Whether the Endpoint SaaS Terms §14.4 export-control language has practical effect on Arkansas data.** The contract acknowledges it; whether the City's Cellebrite data has ever been routed through Israel is a Tier-3 question outside the scope of what this contract documents. - **The Chainalysis sub-processor relationship.** Annex B names Chainalysis as a crypto sub-processor — meaning Cellebrite may pass cryptocurrency-related data to Chainalysis as part of extractions. The scope and frequency of this is not documented in the LRPD corpus. - **City Attorney sign-off.** [[Sherri Latimer]]'s 2025-10-31 Flock EULA-risk memo identified several commonplace-but-noteworthy contract provisions; no equivalent Latimer memo appears in the corpus for the Cellebrite Advanced Services Agreement, which carries provisions (§§5.5, 5.7, 6.4, 10.3) at least as substantively notable as the Flock provisions. A successor FOIA could clarify whether Latimer or City Attorney [[Thomas M. Carpenter]] reviewed this agreement.