Celebrite said it cut off Russia’s route, but Russia used tools anyway

Russian authorities hacked the phone of a prominent political dissident while he was in custody, using technology made by forensics company Cellebrite – even after the company said it was cutting ties with Putin’s government agencies, according to the British newspaper “Daily Mail”. New report This raises new questions about whether Western tech companies are truly able to control how their tools are used once they spread.

The case serves as a cautionary tale for any technology company that sells its products to governments. Cellebrite, an Israeli company with a second headquarters in Virginia that sells its products to governments around the world – Including in the United States – Announced that it will stop providing hardware and software to Russia. It seems that he did not follow up on the matter, or was unable to do so.

Researchers at The Citizen Lab, a digital rights group based at the University of Toronto, said they had found evidence that a Russian government investigative unit used a phone hacking tool made by Cellebrite to break into the iPhone of local human rights dissident and opposition politician Andrei Pivovarov in June 2021.

Three months before this hack, Cellebrite did just that Announce It will “immediately” stop selling its technology to customers in the Russian government. On its official website, Cellebrite Claims That as of March 2021, when it severed ties with Putin’s government, the company could “stop the device from working or receiving software updates.”

It’s unclear why that didn’t happen in this case, and the episode reveals an uncomfortable truth about surveillance technology: that once powerful hacking and surveillance techniques reach the wrong customer, getting them back won’t be easy. Gadgets proliferate, get abused, and can continue to be abused, often long after the company that made them has washed its hands of the customer.

“This is not surprising, and is a result of Cellebrite’s policies,” said Itay Mack, an Israeli human rights lawyer who has long campaigned against surveillance technology makers such as Cellebrite and spyware maker NSO Group.

Halting sales, and even revoking the software license, does not prevent a former Cellebrite customer from abusing the company’s technology, as this case demonstrates, Mack said. Mack also noted that Cellebrite declines to say whether it requires customers to disassemble the hacking tools it sold to them, a critical gap its own advertising did not address.

Mack added that this case indicates that former customers can still abuse Cellebrite’s phone unlocking tool, called UFED, even after the company stops supporting the customer and presumably revokes its software license. In theory, that would make the company’s devices less useful.

John Scott-Railton, a senior researcher at Citizen Lab, told TechCrunch that Cellebrite “should also disable remote deployments after credible reports of abuse, and end the era of plausible deniability by implementing cryptographically signed watermarks on all imaged devices.” In plain terms, Cellebrite must be able to remotely hack its own tools when they are misused, and must build in some sort of digital fingerprint so that any data extracted using its technology can be traced back to the specific device that was used.

Cellebrite sells devices designed to unlock and hack connected cell phones. Over the years, researchers have documented cases in which the company’s agents used its technology against dissidents, human rights activists, and journalists in Hong Kong, Kenya, and Jordan. In response to some of these findings, Cellebrite has severed its ties with Bangladesh, China and Hong Kong, Myanmarand Serbia.

In an email to Citizen Lab, which he shared with TechCrunch, David Gee, Cellebrite’s chief marketing officer, said the company “ceased all sales and service to the Russian Federation in March 2021, terminated existing licenses, and immediately began canceling all legal contracts. Any use of older Cellebrite devices in Russia after March 2021 is strictly unauthorized.”

Gee, as well as Cellebrite spokesman Victor Cooper, did not respond to a series of specific questions sent by TechCrunch.

In the case of Pivovarov, Citizen Lab researchers said they were able to find forensic evidence on his phone indicating that it had been hacked using Cellebrite UFED, after Russian authorities arrested him and confiscated his iPhone 12 and MacBook in May 2021.

Pivovarov also showed researchers a court document he received as part of his trial. In it, the Russian government’s Forensic Expert Center detailed its use of Cellebrite UFED software to break into his phone, noting that authorities used UFED to extract data including WhatsApp and Telegram messages. They also searched the phone for political terms, as well as the names of opposition figures, which included targets of what researchers described as alleged Russian government hacking campaigns.

Pivovarov was the director of the defunct opposition group Open Russia. he He was later sentenced To four years in prison, before it is completed Released in August 2024 As part of Prisoner exchange Between Russia and Western countries, which also released Wall Street Journal correspondent Ivan Gershkovich.

The Russian Embassy in Washington, D.C., did not respond to a request for comment.