\n<\/p>\n
Russian authorities hacked into the phone of a prominent political opponent while he was in custody, using technology made by forensics firm Cellebrite \u2014 even after the company had said it cut ties with Putin\u2019s government agencies, according to a new report<\/a> that raises fresh questions about whether Western tech companies can truly control how their tools are used once they\u2019re in the wild.<\/p>\n The case is a cautionary tale for any technology company that sells to governments. Cellebrite, an Israeli outfit with a second headquarters in Virginia that sells to governments all over the world \u2014 including in the U.S<\/a> \u2014 had announced it would stop providing hardware and software to Russia. It apparently didn\u2019t, or couldn\u2019t, follow through.<\/p>\n Researchers at The Citizen Lab, digital rights group based at the University of Toronto, said they found evidence that a Russian government investigative unit used a phone hacking tool made by Cellebrite to break into the iPhone of local human rights dissident and opposition politician Andrey Pivovarov in June 2021.\u00a0<\/p>\n Three months before that hack, Cellebrite had announced<\/a> that it would \u201cimmediately\u201d stop selling its technology to its Russian government customers. On its official website, Cellebrite claims<\/a> that as of March 2021, when it cut ties with Putin\u2019s government, the company \u201ccan stop the device from functioning or receiving software updates.\u201d\u00a0<\/p>\n It\u2019s unclear why that didn\u2019t happen in this case, and the episode exposes an uncomfortable truth about surveillance tech, which is that once powerful hacking and surveillance technologies reach the wrong customer, clawing them back isn\u2019t so easy. The tools proliferate, get abused, and can keep getting abused, often long after the company that made them has washed its hands of the customer.<\/p>\n \u201cIt\u2019s not surprising, and [it] is the result of the policies of Cellebrite,\u201d said Eitay Mack, an Israeli human rights lawyer who has long campaigned against surveillance technology makers like Cellebrite and spyware maker NSO Group.\u00a0<\/p>\n \t\t\tDo you have more information about Cellebrite? Or about how Cellebrite\u2019s customers are abusing its tech? We\u2019d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email<\/a>.<\/a>\t\t<\/div>\n Mack argued that ceasing sales, and even revoking a software license, doesn\u2019t stop a former Cellebrite customer from abusing the company\u2019s technology, as this case demonstrates. Mack also pointed out that Cellebrite refuses to say whether it asks customers to dismantle the hacking tools it sold to them, a critical gap that its own cut-ties announcements don\u2019t address.<\/p>\n This case, Mack added, suggests that former customers can still abuse Cellebrite\u2019s phone unlocking tool, dubbed UFED, even after the company stops supporting the customer and presumably revokes its software license. In theory, that should make the company\u2019s devices less useful.\u00a0<\/p>\n John Scott-Railton, a senior researcher at the Citizen Lab, told TechCrunch that Cellebrite \u201cshould also remote-disable deployments following credible reports of abuse, and end the era of plausible deniability by implementing cryptographically-signed watermarks on all imaged devices.\u201d In plain terms, Cellebrite should be able to remotely brick its own tools when they\u2019re being misused, and it should build in a kind of digital fingerprint so that any data extracted with its technology can be traced back to which specific device was used.<\/p>\n Cellebrite sells hardware devices designed to unlock and hack into cellphones that are connected to them. Over the years, researchers have documented cases where company customers used its technology against dissidents, human rights activists, and journalists in Hong Kong, Kenya, and Jordan. In response to some of these findings, Cellebrite has cut ties with Bangladesh<\/a>, China and Hong Kong<\/a>, Myanmar<\/a>, and Serbia<\/a>.<\/p>\n In an email to the Citizen Lab, which he shared with TechCrunch, Cellebrite\u2019s chief marketing officer David Gee said that the company \u201cstopped\u00a0all sales and services to the Russian Federation in March 2021,\u00a0terminating\u00a0existing licenses, and\u00a0immediately\u00a0began\u00a0unwinding all legal contracts.\u00a0Any use of legacy Cellebrite hardware in Russia after March 2021 is entirely unauthorized.\u201d <\/p>\n Gee, as well as Cellebrite\u2019s spokesperson Victor Cooper, did not respond to a series of specific questions sent by TechCrunch. <\/p>\n In the case of Pivovarov, the Citizen Lab researchers said they were able to find forensic evidence on his phone that it had been hacked with Cellebrite UFED, after Russian authorities detained him and confiscated his iPhone 12 and MacBook in May 2021.\u00a0<\/p>\n Pivovarov also shared with the researchers a court document he received as part of his prosecution. In it, the Russian government\u2019s Criminalist Expert Center detailed its use of Cellebrite UFED to break into his phone, stating that the authorities used UFED to extract data including WhatsApp and Telegram messages. They also\u00a0searched the phone for political terms, as well as the names of opposition figures, which included targets of what researchers have described as alleged Russian government hacking campaigns.\u00a0\u00a0\u00a0<\/p>\n Pivovarov was the director of the now defunct opposition group Open Russia. He was later sentenced<\/a> to four years in prison, before being freed in August 2024<\/a> as part of a prisoner exchange<\/a> between Russia and Western countries that also freed Wall Street Journal reporter Evan Gershkovich.<\/p>\n The Russian Embassy in Washington D.C. did not respond to a request for comment.<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\nContact Us<\/h4>\n