Russia's Use of Cellebrite Technology
Russian authorities utilized Cellebrite phone-cracking technology to gain access to a device belonging to a prominent domestic human rights activist, Andrey Pivovarov, who was arrested and imprisoned. This was despite the company canceling its contract with the Russian government. The University of Toronto's Citizen Lab arrived at this conclusion after analyzing Pivovarov's phone and examining court documents that confirmed the usage of Cellebrite's UFED product.
Pivovarov was arrested in March 2021, sentenced in 2022, and released in 2024 as part of a prisoner exchange. Citizen Lab discovered evidence that authorities accessed his phone around June 2021, while the phone was in Russian government hands. Investigators also found that Russian authorities might have used information obtained from Pivovarov's phone to surveil other regime opponents, including fellow dissident Anastasiya Burakova, who was targeted in a hacking campaign linked to Russia's Federal Security Service (FSB).
Cellebrite's Response
Cellebrite provided a response to Citizen Lab's report, stating that its technology would be ineffective in Russia today. According to Cellebrite spokesperson Victor Cooper, any use of legacy Cellebrite hardware in Russia after March 2021 is entirely unauthorized. The Cellebrite hardware previously sold, prior to March 2021, would now be incompatible with modern devices and would operate without the company's technical support, consent, or legal sanction.
Citizen Lab noted that the historic architecture of Cellebrite forensic systems means that much of the functionality in the UFED product has continued to operate long after updates cease. Furthermore, Cellebrite systems have historically featured an offline mode, making it difficult for the company to meaningfully cut off problematic customers.
Implications and Concerns
The investigation contributes evidence that the contract cancellation did not immediately block Russia from leveraging Cellebrite's tools for political persecution. This raises concerns about the effectiveness of canceling contracts with governments that have a history of human rights abuses. The fact that Cellebrite's technology can continue to be used even after the company has canceled its contract highlights the need for more robust measures to prevent the misuse of such technology.
The Russian Embassy in Washington, D.C. did not immediately respond to a request for comment. The incident highlights the ongoing challenges of balancing the use of technology for law enforcement purposes with the need to prevent its misuse by authoritarian regimes.
Conclusion
The use of Cellebrite's UFED product by Russian authorities to break into a human rights activist's phone, despite the company canceling its contract, raises important questions about the effectiveness of such measures in preventing the misuse of technology. As technology continues to evolve, it is essential to develop more robust measures to prevent its misuse and ensure that companies like Cellebrite take steps to prevent their technology from being used for political persecution.
- The University of Toronto's Citizen Lab analyzed a phone belonging to Andrey Pivovarov and examined court documents confirming the usage of Cellebrite's UFED product.
- Russian authorities accessed Pivovarov's phone around June 2021, while the phone was in Russian government hands.
- Cellebrite stated that its technology would be ineffective in Russia today and that any use of legacy Cellebrite hardware in Russia after March 2021 is entirely unauthorized.
Source: CyberScoop