Cellebrite's Surveillance Tech Still Used by Russia Despite Company's Claims

Russian authorities have been using Cellebrite's phone hacking tools to target dissidents and opposition politicians, despite the company's claims to have cut ties with the Russian government.

A recent report by The Citizen Lab, a digital rights group based at the University of Toronto, found evidence that a Russian government investigative unit used a phone hacking tool made by Cellebrite to break into the iPhone of local human rights dissident and opposition politician Andrey Pivovarov in June 2021. This incident raises fresh questions about whether Western tech companies can truly control how their tools are used once they're in the wild.

The case is a cautionary tale for any technology company that sells to governments. Cellebrite, an Israeli outfit with a second headquarters in Virginia that sells to governments all over the world — including in the U.S — had announced it would stop providing hardware and software to Russia. However, it appears that the company did not follow through on this promise.

Researchers at The Citizen Lab found evidence that a Russian government investigative unit used a phone hacking tool made by Cellebrite to break into the iPhone of local human rights dissident and opposition politician Andrey Pivovarov in June 2021. Three months before that hack, Cellebrite had announced that it would "immediately" stop selling its technology to its Russian government customers.

• It's unclear why Cellebrite didn't stop the device from functioning or receiving software updates, as it claims to do.
• The episode exposes an uncomfortable truth about surveillance tech, which is that once powerful hacking and surveillance technologies reach the wrong customer, clawing them back isn't so easy.
• The tools proliferate, get abused, and can keep getting abused, often long after the company that made them has washed its hands of the customer.

Cellebrite's chief marketing officer David Gee said in an email to The Citizen Lab that the company "stopped all sales and services to the Russian Federation in March 2021, terminating existing licenses, and immediately began unwinding all legal contracts. Any use of legacy Cellebrite hardware in Russia after March 2021 is entirely unauthorized."

However, the incident suggests that Cellebrite's efforts to control how its technology is used may not be as effective as the company claims. The tools can still be used and abused, even after the company has cut ties with the customer.

In theory, if Cellebrite had remotely disabled the tool or implemented cryptographically-signed watermarks on all imaged devices, it should have prevented this abuse.

John Scott-Railton, a senior researcher at the Citizen Lab, told TechCrunch that Cellebrite "should also remote-disable deployments following credible reports of abuse, and end the era of plausible deniability by implementing cryptographically-signed watermarks on all imaged devices." In plain terms, Cellebrite should be able to remotely brick its own tools when they're being misused, and it should build in a kind of digital fingerprint so that any data extracted with its technology can be traced back to which specific device was used.

Cellebrite sells hardware devices designed to unlock and hack into cellphones that are connected to them. Over the years, researchers have documented cases where company customers used its technology against dissidents, human rights activists, and journalists in Hong Kong, Kenya, and Jordan. In response to some of these findings, Cellebrite has cut ties with Bangladesh, China and Hong Kong, Myanmar, and Serbia.

In the case of Pivovarov, the Citizen Lab researchers said they were able to find forensic evidence on his phone that it had been hacked with Cellebrite UFED, after Russian authorities detained him and confiscated his iPhone 12 and MacBook in May 2021. Pivovarov also shared with the researchers a court document he received as part of his prosecution, which detailed the Russian government's use of Cellebrite UFED to break into his phone.

The incident highlights the challenges that companies face in controlling how their technology is used once it's in the wild. It also raises questions about the effectiveness of companies' efforts to prevent the abuse of their surveillance tools.