Cellebrite said it cut off Russia, but Russia used is tools anyway

A troubling report has revealed that Russian authorities managed to exploit technology from Cellebrite to hack into the phone of a prominent political dissident, even after the forensics firm claimed to have severed ties with the Russian government. This incident raises significant concerns about the ability of Western technology companies to monitor the post-sale use of their products. Cellebrite, an Israeli company with a subsidiary in Virginia, had publicly announced its decision to stop supplying hardware and software to Russian government agencies. However, evidence from The Citizen Lab, a digital rights organization at the University of Toronto, indicates that a Russian investigative unit successfully employed Cellebrite's phone hacking tool to access the iPhone of Andrey Pivovarov, a local human rights activist, in June 2021. This breach occurred just three months after Cellebrite’s commitment to halt its operations in Russia. On its website, Cellebrite asserts that it can deactivate devices or prevent software updates from being delivered. Yet, this case exposes a critical flaw in that promise, illustrating the challenges companies face in retracting powerful surveillance tools once they have been distributed. Eitay Mack, an Israeli human rights lawyer who has been vocal against surveillance technology, remarked that simply terminating sales does not prevent past customers from misusing the technology. Mack also highlighted the lack of clarity regarding whether Cellebrite mandates its former clients to dismantle the hacking tools they acquired, an issue that remains unaddressed in the company's cut-off announcements. This situation suggests that even after discontinuing support, former clients might still wield significant capabilities with Cellebrite’s phone unlocking device, known as UFED. John Scott-Railton, a senior researcher at The Citizen Lab, emphasized that Cellebrite should implement measures to remotely disable its products in cases of credible misuse and incorporate cryptographic watermarks to trace data extraction back to specific devices. Such steps could potentially mitigate the risks associated with the misuse of their technology. Cellebrite manufactures specialized hardware designed to unlock and hack into mobile phones, and various reports have documented instances where its technology has been used against journalists, activists, and dissidents in locations such as Hong Kong and Kenya. In response to these abuses, the company has previously cut ties with several nations, including Bangladesh and Myanmar. In correspondence with The Citizen Lab, Cellebrite's chief marketing officer, David Gee, reiterated that the company ceased all operations in Russia in March 2021 and terminated existing licenses. He insisted that any subsequent use of Cellebrite’s legacy hardware in Russia is unauthorized. The hacking of Pivovarov's devices was confirmed by forensic evidence, detailing how Russian authorities utilized Cellebrite UFED to extract private messages from applications like WhatsApp and Telegram. Pivovarov, who led the now-disbanded opposition group Open Russia, was sentenced to four years in prison but was released in August 2024 as part of a broader prisoner exchange. As the case unfolds, the implications for tech companies and their accountability in the global marketplace remain critical questions, drawing attention to the long-lasting effects of surveillance technology once it has been deployed.