MSAB’s Henrik Tjernberg On Ethics In Digital Forensics And Consumer Privacy

Christa: In an era of profound social change, few industries find themselves at the intersection between law, technology, and social justice the way digital forensics does. This month on the Forensic Focus podcast, our vendor edition welcomes Henrik Tjernberg chairman of the board of our longtime sponsor MSAB. Having served in that role since 2002, Mr. Tjernberg has been in the unique position of seeing from a business perspective, how digital forensics has shaped and been shaped by these forces and what it all means for the industry as we enter a new decade. Mr. Tjernberg, welcome.

Henrik: Thank you so much.

Christa: So, you’ve been MSAB’s board chairman since 2002. Tell us a little, please, from your vantage point about the company and its growth over the past two decades. What are some of the most significant milestones?

Henrik: Well it’s been a really interesting two decades here, and a lot of things have happened during that period of time, of course. And a natural starting point, and important one, is of course the starting point for for this kind of business, because we’ve been been working since 1985, and started working with mobile phones in the mid nineties when the digital [indecipherable] was introduced to the market. And that meant a lot, of course it meant that you could start communicating with your handsets. And of course also connecting to the internet, that was also a new technical feature arriving in the mid nineties. So we existed during the .com boom, and that affected us, as many other technological companies. And after that, in the aftermath, they didn’t really know what to do.

And we had some equipment, we had learned a lot about mobile phones, and as a matter of coincidence, a Swedish policeman turned up at our office and said, I am exploring your technology to retrieve evidence from these kinds of handsets. And of course, that was a rather basic thing because in your handset you had some telephone book, and you had some notes, and perhaps missed calls, received calls. And I didn’t think even SMS was beginning to get off as a technology to use. 

So we thought that was interesting. So we helped the policeman, and that was really the starting point for mobile forensics for us. And we were then pioneering in this industry. That was not an existing market at that time. So a lot of freedom of course, but a lot of demands from our customers. Of course, in the beginning, the Swedish police, but we also realize that for instance, a Great Britain had come a bit on that road so far. So we started, in fact, our marketing in Great Britain at that time, and then received an impressive response from the police force who were really interested in this. They used at that time a lot of consultancy, very expensive and such, and took some time. And we realized that in fact, the product that can do this on demand or something, could hit the market. 

So it started then, and we have expanded since then. And it was a profitable company already in 2005, a year after we introduced our first solution. And I’d also like to mention the second point in time as a milestone, I think, and that was the introduction of the smartphone. And then Apple introduced their first iPhone, something great happened to in the marketplace because you’ve got the tool you can use for so many things, and a lot of things had to do with communication.

You could use it for chatting. You could use it for playing. You’ll use it for accessing data or the internet: a lot of things. And of course the beginning of the social media structure and everything you could do with that. And, and that meant also what changed in what we did than what we do today, because in the beginning, there were a lot of different handsets, a lot of different operating system, a lot different manufacturers’ handsets, you know, the basic players are Ericsson and Nokia, Siemens, Motorola, and a lot of them doesn’t do anything about mobile phones today, but then around then Apple arrived, and this kind of new tool got into the hands of the customer. 

It also got into the hands of all the criminals, of course. And that really was used for criminal activities and, well, that’s often the case when it comes to new technology, they are very fast starting to use it. And the problematic thing is, it takes some time for the police to get up to speed in that arena. And we thought this is an opportunity for us to help the police getting the advantage of the new technology.

But the conclusion is that everything is happening, and new things all the time. You need to be aware of it and act upon the new information and what is happening, and it’s moving fast.

Christa: Yep. So you’re you mentioned that the police use of the tools have been really a key part of the growth of the company since its inception, really. In those two decades, how have some of the trends just geopolitically and also socially generally shaped MSAB’s vision, direction and strategy?

Henrik: Well yes, of course. Many things happen in during these periods, you know. The starting point was of course the war on terror, or terrorism, starting with the 9/11 event and the awful thing that happened. I think most of the population around the globe… that started a hunt for terrorists. And of course we had the bombings in the London subway and even in Spain later on. And that started a movement for preventing and hunting terrorists. And that was a key part in what we did of course, with the demand for new products, new solutions that could help the police in this, it was really important. And we were early to adapt for this. 

And of course also starting a mission where we said that it’s important not — I think we will come back to that — but the demand for mass surveillance started to grow, and I thought that it was not a good way to deal with this, because it’s better to focus on those that were real or suspect for this. 

Often it is in these kind of terrorist events that I mentioned, you can see that afterwards, the police say that, well, we had these up on our radars, we could have had surveillance of these individuals, but we didn’t have the resources to continue that. So when we stopped doing that, the also let them commit these kinds of crimes. And I believe it’s important that you focus on what can solve crimes and what can prevent crimes. And I think that’s the lesson that even the law enforcement have learned during these years.

Christa: You wrote a blog post recently in response to a New York Times article about MSAB in Myanmar. So your blog post reflected that MSAB chose to “withdraw our services to regimes that have turned their backs on democracy.” What are some other examples of times when MSAB had to choose justice over profits?

Henrik: Well that’s of course a question that we have to handle all the time, I would say. And the natural times we can mention, of course, is China and Hong Kong, which we choose to withdraw from a year ago or more. And of course we do these kinds of difficult decisions all the time. 

We cannot, so to say, put that on paper and be happy with it, because things are changing all of the time and we need to make these kinds of decisions even every day. So quite often, I would say, and that’s of course a discussion and a judgment. But I say as a general rule — and I think it’s important for our business as well — that we we choose the right thing to do before profit.

And I think it will be profitable over time. That’s important, because they work together. In short term, it could be an economic loss for the company, but long-term, it will be a profit. So it’s not so that we choose between profit and the just thing to do. It’s how we think about it. And we think it’s a good time… we are in the business of trust, and everyone; our customers, public opinion, and everyone, should trust that we do the right thing. That’s important.

Christa: To that point, and your earlier points about terrorism and surveillance, it does seem as if much of the world is in flux with privacy and security intention globally. So the lines may not always be as clear as in Myanmar. How can corporate leadership keep track and pivot when needed in response to these subtler shifts in political whims?

Henrik: Well, it’s really difficult, I would say, because this is not black or white, it’s a gray scale, and things change over time, a lot of things. I think you should start with the standpoint, what are your long-term goals? And for us, it’s important to be the good guys: do what’s right. Have this moral compass. We believe in human rights, we believe in freedom of speech, freedom of expression and everything around that. It’s important, we believe in democracy and building that. 

Then you need to gather information. As much information as you can around the situation in the target region or the target customer. And we do that by looking at those who are professional in these areas. And we have looked at Freedom House, we have looked at Human Rights Watch and Amnesty International. We have also a person in the board of directors, former foreign minister in Sweden, the former prime minister in Sweden, Mr. Carl Bildt, that has an extensive knowledge of international business and what is happening in different regions. 

And as also a security check we also are under oversight with the Swedish export control authority, that’s called ESP. And of course we need export licenses and such from them. And those are also professionals in doing these kinds of [indecipherable]. So with that said, also we can’t give a guarantee that we own or otherwise make the right decision, but we are always ready, and we have processes for correcting any mistakes we make, and doing that quickly.

Christa: To that point, your tenure began the year following the US Enron scandal. Just last year, the World Economic Gorum promoted stakeholder versus shareholder capitalism. In your view, how can corporate leaders maintain their sense of balance between good ethics and good business so as to avoid missteps?

Henrik: Yes. that’s also an interesting, and quite a difficult, question. I know Milton Friedman once said that the business of business is business. And I don’t totally agree with that, because I think the business of business is the right business and doing the right thing. And I believe that be a boost for shareholders and other stakeholders in this business, but you need a moral compass, you need DNA, as we call it. That’s doing the right thing, selling to the right people, selling to the right organizations. 

Because of course, it can happen that our equipment can be used in the wrong way. And then we take precautions to prohibit that, of course we have every kind of document in place for it, but we also need this kind of gut feeling for what is right and what is wrong. And we try to build that into our company culture. So everyone, every coworker in MSAB knows what is the right thing to do and what is not. 

Of course, this is a continuous process. And also it’s good for our business, because it makes it easier for us to recruit new people. They like this idea of doing the right thing. And I became 60 last year. So I’ve been around for a while, and of course with MSAB, but when I started at the Royal Institute of Technology in Stockholm, I remember that the two things that were interesting at that point for students, that was the salary, and of course the brand name of the company. So Ericsson in Sweden and ABB, and the ITL course was interesting companies to work for.

But today, I think it’s moved in the right direction. Those you are recruiting, they are interested in, do we have a moral compass? Do we have a standpoint, the ethical standpoint in what we do? And they are all asking these questions. So of course salary is important, but it’s also important to… what you should work, or working week, should be a good thing. And that to feel good, you can go to sleep knowing you have done a good job, both for humanity as a whole and for the company. So I believe it works together. 

And in these kind of times, there are a lot of acronyms thrown around companies. You have, a couple of years ago, it was CSR, corporate social responsibility. Today I think it’s ESG, it’s environmental, social, and governance. And of course ETI: ethical trading initiative, and such things. And those are important, but the most important thing of all is what you actually do. Having a adopted these kind of acronyms doesn’t help anything unless you use them and integrate them into your work. So that’s the important thing, and that’s what we are doing at MSAB.

Christa: As an example, in your blog posts, you also wrote: “we work to prevent mass surveillance wherever it is introduced.” Can you tell us a little more about those efforts? How is MSAB uniquely positioned to prevent mass surveillance?

Henrik: Yes. Of course I think mentioned a little about that earlier, but the police can use two different directions trying to solve crimes. You can believe that all the citizens are suspects. That leads to more surveillance, and that leads leads to a huge amount of data. And that leads to a step from democracy, I believe. Or you can use equipment that’s targeted at really suspects. And that’s what our equipment does. It makes it possible for the police that focus on the evidence that the suspects have in their phones. So that’s the important thing. 

And I usually take up an example from Sweden. Of course, we are often proud of being one of the leading democracies, or human power states, and doing everything by the book, and everyone should look up to us. But if you look closely, in the beginning after all the terror events and everything, the EU enforced a directive called the data retention directive that forced every operator active in Europe, or EU, had to by law store information of every call made, every access to the internet, every SMS sent and received, and where the position was for those. After a special case in the supreme court of the EU, that directive was redrawn. It was against human rights. It was against the privacy. You have the right to have a private source of your conversations and what you do. So that was withdrawn, and many countries in the EU took away that kind of legislation. Sweden didn’t. 

So that came up, a new case from Sweden and the Swedish law had to be removed. And after a while, Sweden put up a new legislation around this, and the legislation contained the same faults as the first one. So today all the operators in Sweden need to store information when a grandmother needs to talk to her granddaughter, you know. And of course all the criminals, they know how to bypass this, because they use encrypted chats and they use everything else, but not the thing that the operators are storing.

So that’s important, because a lot of resources — the cost for doing these kinds of mass surveillance that the government does — is enormous, and it doesn’t give any new information. It doesn’t give any important information, but what it does is, it removes freedom. It removes human rights from Sweden’s citizens. And even NSA realized a couple of years ago that doing this kind of mass surveillance is removing the focus from those who are suspects. 

So it’s a combination of having focus on where the law enforcement should have the focus, on those who are really the criminals and those who are committing crimes, not having focus on those who are innocent and will never do any crimes. So that’s my point here, that mass surveillance costs a lot and gives nothing but reducing freedom from ordinary citizens. And I sometimes use the quote from Benjamin Franklin saying that you cannot trade freedom from security. I think that’s important. 

The discussion is, well, if you have nothing to hide, you have nothing to be afraid of. And that’s why it doesn’t matter if the government looks at what you do all the time. But I think it’s a dangerous thing to do, because that is a step away from democracy, the freedom of speech, freedom of expression. Even if you don’t think so, it means that you have in your mind that someone else might read what I’m writing or might see me, or might listen to what I’m saying. And that’s a restriction you shouldn’t have any democracy.

Christa: Well, yeah, because the definitions of what counts as criminal behavior can really change, can’t they?

Henrik: Yes. Yes. And of course in a democracy, you don’t know if it’s a good government or so, and looking at the United States, of course, you have powers. You have those who are executives, and those who are creating laws or legislation, and those who are the judging system. And they shouldn’t be out anonymous. They should be doing their job different from the the other parts. And then you keep, who is guarding the guards, so to speak, someone is guarding the other guards. So that’s the way I think it’s from the [indecipherable], how you should look at that. 

But in Sweden, we don’t have that. You don’t have a court looking at if new legislation is okay with the constitution. No, and we have the belief that government is always good. But even in Germany during the Nazi time, the government were chosen by democracy means, right? So, you need to build systems in these kinds of democracy systems. And that means you cannot allow the government to get these kind of tools to survey their citizens. That’s important.

Christa: I’m going to switch gears a little bit. In your opinion, how is media coverage on both mobile forensics capabilities and geopolitical trends shaping the digital forensics industry?

Henrik: Well, of course media is a special business because they are wanting to tell a story, and often they have decided what the story is before they gather facts for their story. And that’s a problem you need to deal with. I would like them to gather facts and then write a story based on the facts. But I learned that it’s difficult to change their approach during when they already decided what to write. And I think it’s a lot of kind of misunderstanding. For instance, in Myanmar the last couple of weeks, we saw that there were some discussions around surveillance and what we in fact do, and I think it’s great. We cannot do surveillance. And this, we developed our system not to do surveillance. We can look into… like you look at the fingerprint, you don’t get it in real time. You look at it afterwards to be able to investigate the crime. 

And I think that’s so important: that police need to be able to invest crimes and get the suspect and get proof of suspicion to stand up in court. And we have this system in place. Listening to people that might be innocent, that’s not the way to move forward. And with this news media, they get hung up on: we are listening to people, our equipment can be used to crack down or beat publication or human rights movements or such. And that’s not the case. The case is that our equipment can be used for, for retrieving information and evidence from… some single piece of evidence from the handset or the mobile device.

And I would like, of course, the media to be more proactive and… how should I put it? They should also see the good things we are doing, how this can be used in the greater good for just keeping democracy alive and helping democracy to grow in those areas where it’s starting. I mentioned earlier the Arab spring in 2010. And we thought that was a democracy movement, we thought that this is a starting point of, at least in the Middle East and the areas around that, they should move the in democracy. And we like to help them, because building democracy is not done overnight. It takes some time. It takes time to build these kinds of institutions as I mentioned, the law enforcement and judgment systems and [indecipherable] everything around democracy, to keep it stable is a rare thing.

And it’s fragile to keep. But that didn’t… in the Arab spring, it didn’t turn out well, we have still the conflict in Syria. And so that means we really need to think how support the starting point for democracy. We cannot wait until it’s up and running, because that takes some time, and we need to help them and support them during that. And I believe — wholly believe — that preventing crime and making it possible to stop child abuse, violence, drug affairs, everything around that, is really important. Even building democracy.

Christa: In this landscape, including the narrative that media is driving, how do you think the industry as a whole is doing at responding, both in terms of public image and in terms of customer satisfaction, including some of those factors that you just mentioned? Where could we all improve?

Henrik: Well, we can improve a lot, I would say. We can stand up for what we believe in. We can stand up for what we do. We have a tendency of hiding, and just trying to avoid any media coverage of what we do. And I can understand it from the law enforcement point of view that they want to not reveal what they’re using, how they are investigating crime and such, but that’s of course some judgment you need to make. It’s important for the public opinion to gain trust in the police. 

And we can see, for instance, an example that in London Metropolitan Police, which is one of our good customers, how they gained trust from the public by using our tools in connection with when they reported crimes. And you get a feeling that the police are acting when crimes are reported, and that’s important. You shouldn’t just make a note in a notebook and say, ah, we’;; see if you have time for this in the later stage. You should be ready to retrieve evidence, retrieving information, making the start point of an investigation. Then you’re gaining trust from the public opinion. And that’s an important thing. 

And I really think both the industry and the law enforcement can help improve that picture from… I think the public picture is very much that… we have a crime solving rate in Sweden below ten percent, today. That’s 9 out to 10 crimes are never solved by the police. And that’s of course not gaining trust from the public. And then the things start: gated communities, and you start to get not a nice society, an afraid society that’s hiding and don’t think that police can really do their work. And then the call for harder punishments arises, more policemen arises, but that’s not the important question. The important question is doing efficient work, making the policemen work more efficiently, solving more crimes and doing that in a faster, quicker way, but maintaining the quality of evidence that the demand for a justice system that you need to take all the evidence into account. I think our equipment helps doing exactly that.

Christa: Well, Mr. Tjernberg, thank you again for joining us on the Forensic Focus podcast. We appreciate your time.

Henrik: Thank you so much. It was nice to be here. 

Christa: Yeah, yeah. I think you raised some really important points for everyone to ponder, so thank you for that. 

Henrik: Thank you so much. 

Christa: Thanks. Also to our listeners, you’ll be able to find this recording and transcription along with more articles, information and forums www.forensicfocus.com. If there are any topics you would like us to cover, or you would like to suggest someone for us to interview, please let us know. 

Leave a Comment