Russia Exploits Cellebrite Technology to Target Dissident Despite Company’s Claimed Withdrawal

Russian authorities have reportedly utilized Cellebrite’s phone data extraction technology to access the devices of a prominent dissident, just three months after the Israeli surveillance firm announced it would cease operations in Russia due to human rights concerns. This incident raises significant questions about the effectiveness of corporate commitments to ethical practices in the face of authoritarian regimes.

Cellebrite’s Universal Forensic Extraction Device (UFED) has been a critical tool for law enforcement and intelligence agencies worldwide. However, the continued use of this technology in Russia, despite the company’s stated withdrawal in March 2021, indicates a troubling inability to effectively sever ties with authoritarian customers. John Scott-Railton, a researcher at Citizen Lab, noted that the architecture of Cellebrite’s systems allows much of the UFED’s functionality to persist even after official updates have ceased.

Citizen Lab’s report highlights that Cellebrite systems have historically included an offline mode, complicating efforts to restrict access to the technology. The report concludes that the design of Cellebrite’s technology makes it challenging for the company to enforce meaningful restrictions on problematic clients.

In correspondence with Recorded Future News, a Cellebrite executive stated that any use of legacy Cellebrite hardware in Russia after March 2021 is unauthorized. Chief Marketing Officer David Gee emphasized that the hardware sold prior to that date would be incompatible with modern devices and would operate without the company’s technical support or legal sanction. He reiterated that Russia remains permanently on Cellebrite’s restricted customer list.

Citizen Lab has documented instances where authorities in repressive regimes, including Serbia, Jordan, and Kenya, have employed Cellebrite technology to infiltrate civil society phones. This pattern raises concerns about the company’s commitment to preventing abuse of its products.

A Dissident Jailed

The case of Andrey Pivovarov, a prominent Russian political activist, illustrates the potential consequences of such technology. Pivovarov was detained by Russian authorities in May 2021, and his devices, including an iPhone 12 and an Apple MacBook, were confiscated. According to Citizen Lab, Pivovarov’s devices remained in official custody until 2023, during which time he was not asked for consent to search them and did not provide passwords.

Citizen Lab researchers have high confidence that Pivovarov’s phone was compromised around June 17, 2021, shortly after Cellebrite’s announced withdrawal from the Russian market. Forensic analysis revealed USB connections to a device with a Host ID previously attributed to Cellebrite.

In July 2022, Pivovarov, who served as the director of the Russia-based Open Russia nonprofit, was sentenced to four years in prison for his activism. Court records corroborate Citizen Lab’s forensic findings, indicating that documents extracted from Pivovarov’s phone were used to build a case against him for “carrying out the activities of an ‘undesirable’ organization.” Although Russian authorities attempted to access his MacBook, they were unsuccessful.

Pivovarov was released in a 2023 prisoner exchange and currently resides in exile in Germany. Despite his newfound freedom, he remains concerned about surveillance. He plans to reach out to Cellebrite’s CEO to inquire why Russian authorities were able to utilize UFED technology despite the company’s claims of withdrawal and how it plans to prevent future misuse.

Pivovarov expressed his apprehension, stating that he is “a little nervous that in the future it can continue,” referring to the potential ongoing use of Cellebrite technology for oppressive purposes.

‘Plausible Deniability’

Cellebrite’s technology is increasingly viewed as a powerful instrument of repression in the hands of authoritarian regimes. It can be employed to extract sensitive information from journalists, monitor opposition movements, and track dissidents’ activities. The implications of this technology extend beyond individual cases, raising broader concerns about the role of commercial surveillance in undermining human rights.

Cellebrite has announced plans to introduce new AI features that could enhance the efficiency of data extraction, further alarming advocates and researchers. Scott-Railton noted that these advancements could enable even more effective extraction of individuals’ social graphs, heightening concerns about privacy and civil liberties.

To mitigate the risks associated with its technology, Scott-Railton suggested that Cellebrite should cease sales to authoritarian regimes, remotely disable technology following credible reports of abuse, and implement cryptographically signed watermarks on all imaged devices to ensure accountability.

In a joint effort, Citizen Lab and the nonprofit Access Now have urged Cellebrite’s executives to halt sales to regimes that have previously misused its technology. They advocate for a commitment to “human rights due diligence” before and after technology sales, emphasizing the need for corporate responsibility in safeguarding civil liberties.

The ongoing situation underscores the complexities and challenges of regulating technology that can be weaponized against vulnerable populations. As the line between commercial interests and ethical responsibilities continues to blur, the implications for cybersecurity, human rights, and global governance remain profound.

For further insights into the evolving landscape of cybersecurity and the implications of surveillance technologies, visit therecord.media.

Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.