Cellebrite Claims to Halt Services in Russia, Yet Tools Still Infiltrate the Market

According to a new report, Russian authorities exploited hacking technology from Cellebrite to access the phone of a notable political dissident while he was in detention. This revelation raises serious concerns about the effectiveness of Western tech companies in controlling the use of their tools once they are sold.

This situation serves as a warning for technology firms that engage in government contracts. Cellebrite, an Israeli company with operations in Virginia, had stated it would cease its sales to the Russian government. However, evidence suggests it has either not adhered to this promise or was unable to enforce it.

The Citizen Lab, a digital rights organization at the University of Toronto, reported that a unit of the Russian government utilized Cellebrite’s phone hacking technology to access the iPhone of Andrey Pivovarov, a local human rights advocate and opposition leader, in June 2021.

Only three months prior, Cellebrite had announced intentions to immediately halt its services to Russian government customers. The company claims that as of March 2021, it would have the ability to disable its devices or prevent software updates for such clients.

The reasons for this failure remain uncertain. This incident underscores a troubling reality about surveillance technology: once these powerful tools fall into the wrong hands, reclaiming them is a significant challenge. The technology can be widely abused and may continue to be misused even after the original vendor has severed ties.

Eitay Mack, an Israeli human rights attorney who has been vocal against surveillance technology providers like Cellebrite, stated that simply stopping sales or revoking licenses does not prevent former clients from misusing the technology, as illustrated by this case. He further noted that it is unclear whether Cellebrite requires customers to dismantle the hacking products they acquired—a critical oversight not addressed by the company’s termination announcements.

Mack’s observations indicate that even after halting support and presumably revoking licenses, former clients may still exploit Cellebrite’s phone unlocking tool, known as UFED. Theoretically, this should limit the tool’s effectiveness.

John Scott-Railton, a senior researcher at the Citizen Lab, emphasized that Cellebrite should consider disabling its technology remotely in response to credible abuse reports and incorporate cryptographic watermarks on all devices. This would enable the company to effectively deactivate its tools if misused, as well as to trace any data extracted back to the specific device used.

Cellebrite manufactures devices meant to unlock and infiltrate cellphones. Over the years, there have been instances documented where its technology was misused against activists, journalists, and dissidents in locations like Hong Kong, Kenya, and Jordan. In light of these cases, Cellebrite has ceased operations with clients in countries such as Bangladesh, China, and Myanmar.

The company’s chief marketing officer, David Gee, stated in correspondence with the Citizen Lab that all sales and services to Russia were halted in March 2021, and all existing licenses were terminated. He insisted that any utilization of older Cellebrite hardware in Russia post-March 2021 is unauthorized.

Gee, along with the company’s spokesperson Victor Cooper, did not answer specific inquiries forwarded by TechCrunch.

Citizen Lab researchers reported discovering forensic signs on Pivovarov’s phone that confirmed it was hacked using Cellebrite’s UFED following his detention, where Russian authorities confiscated his iPhone 12 and MacBook in May 2021.

Pivovarov also provided the researchers with a legal document related to his prosecution, which outlined how the Russian Criminalist Expert Center employed Cellebrite UFED to access his phone, extracting information including messages from WhatsApp and Telegram. The authorities also searched for political language and the names of opposition figures, some of whom have been allegedly targeted by Russian government hacking operations.

Pivovarov was the head of the now-disbanded opposition organization Open Russia. He received a four-year prison sentence before being released in August 2024 as part of a prisoner swap between Russia and Western nations, which also facilitated the release of Wall Street Journal reporter Evan Gershkovich.

The Russian Embassy in Washington D.C. did not provide a response to a request for comment.