Citizen Lab finds Russian authorities used Cellebrite tools on dissident despite sales ban
The incident highlights the limitations of revoking software licenses and raises questions about whether companies can effectively control surveillance hardware once it leaves their direct oversight.
Security researchers at the Citizen Lab have identified evidence that Russian authorities utilised Cellebrite forensic technology to hack the iPhone of opposition politician Andrey Pivovarov in June 2021. This breach occurred three months after the Israeli forensics firm announced it would immediately cease sales and services to Russian government agencies. The findings challenge Cellebrite’s assertion that it can remotely disable devices or prevent them from receiving software updates once commercial ties are severed.
Pivovarov, the former director of the now-defunct opposition group Open Russia, was detained by Russian authorities in May 2021. His iPhone 12 and MacBook were confiscated, and subsequent forensic analysis revealed that Russian experts used Cellebrite’s UFED tool to extract WhatsApp and Telegram messages. The authorities also searched the device for political keywords and the names of opposition figures.
The incident underscores the difficulties governments and regulators face in controlling surveillance technology once it has been sold. Eitay Mack, an Israeli human rights lawyer, criticised Cellebrite’s policy, noting that ceasing sales and revoking licenses does not prevent former customers from abusing existing hardware. Mack argued that the company refuses to clarify whether it requires customers to dismantle hacking tools it has sold, a gap that allows former clients to continue using the technology for surveillance.
John Scott-Railton, a senior researcher at the Citizen Lab, stated that Cellebrite should implement remote "bricking" capabilities for misused tools and use cryptographically signed watermarks to trace data extraction to specific devices. He suggested that the company should be able to remotely disable deployments following credible reports of abuse, thereby ending plausible deniability regarding the origin of extracted data.
Cellebrite’s chief marketing officer, David Gee, stated in an email to the Citizen Lab that the company stopped all sales and services to the Russian Federation in March 2021, terminating existing licenses and unwinding legal contracts. Gee asserted that any use of legacy Cellebrite hardware in Russia after that date is entirely unauthorised. However, neither Gee nor spokesperson Victor Cooper responded to specific questions regarding how the company prevents such unauthorised use of its technology.
Pivovarov was sentenced to four years in prison for his political activities but was released in August 2024 as part of a prisoner exchange involving Wall Street Journal reporter Evan Gershkovich. The Russian Embassy in Washington D.C. did not respond to a request for comment regarding the use of the forensic tools.
The case serves as a cautionary tale for technology companies that sell to governments, illustrating that powerful hacking and surveillance tools can proliferate and be abused long after the manufacturer has attempted to cut ties with a client. Cellebrite has previously cut ties with other jurisdictions, including Bangladesh, China, Hong Kong, Myanmar, and Serbia, following documented cases of its technology being used against dissidents and journalists.
