Cellebrite said it cut off Russia, but Russia used is tools anyway

Russian authorities hacked into the telephone of a salient governmental hostile portion helium was successful custody, utilizing exertion made by forensics steadfast Cellebrite — adjacent aft the institution had said it chopped ties with Putin’s authorities agencies, according to a new report that raises caller questions astir whether Western tech companies tin genuinely power however their tools are utilized erstwhile they’re successful the wild.

The lawsuit is simply a cautionary communicative for immoderate exertion institution that sells to governments. Cellebrite, an Israeli outfit with a 2nd office successful Virginia that sells to governments each implicit the satellite — including successful the U.S — had announced it would halt providing hardware and bundle to Russia. It seemingly didn’t, oregon couldn’t, travel through.

Researchers astatine The Citizen Lab, integer rights radical based astatine the University of Toronto, said they recovered grounds that a Russian authorities investigative portion utilized a telephone hacking instrumentality made by Cellebrite to interruption into the iPhone of section quality rights dissident and absorption person Andrey Pivovarov successful June 2021. 

Three months earlier that hack, Cellebrite had announced that it would “immediately” halt selling its exertion to its Russian authorities customers. On its authoritative website, Cellebrite claims that arsenic of March 2021, erstwhile it chopped ties with Putin’s government, the institution “can halt the instrumentality from functioning oregon receiving bundle updates.” 

It’s unclear wherefore that didn’t hap successful this case, and the occurrence exposes an uncomfortable information astir surveillance tech, which is that erstwhile almighty hacking and surveillance technologies scope the incorrect customer, clawing them backmost isn’t truthful easy. The tools proliferate, get abused, and tin support getting abused, often agelong aft the institution that made them has washed its hands of the customer.

“It’s not surprising, and [it] is the effect of the policies of Cellebrite,” said Eitay Mack, an Israeli quality rights lawyer who has agelong campaigned against surveillance exertion makers similar Cellebrite and spyware shaper NSO Group. 

Mack argued that ceasing sales, and adjacent revoking a bundle license, doesn’t halt a erstwhile Cellebrite lawsuit from abusing the company’s technology, arsenic this lawsuit demonstrates. Mack besides pointed retired that Cellebrite refuses to accidental whether it asks customers to dismantle the hacking tools it sold to them, a captious spread that its ain cut-ties announcements don’t address.

This case, Mack added, suggests that erstwhile customers tin inactive maltreatment Cellebrite’s telephone unlocking tool, dubbed UFED, adjacent aft the institution stops supporting the lawsuit and presumably revokes its bundle license. In theory, that should marque the company’s devices little useful. 

John Scott-Railton, a elder researcher astatine the Citizen Lab, told TechCrunch that Cellebrite “should besides remote-disable deployments pursuing credible reports of abuse, and extremity the epoch of plausible deniability by implementing cryptographically-signed watermarks connected each imaged devices.” In plain terms, Cellebrite should beryllium capable to remotely ceramic its ain tools erstwhile they’re being misused, and it should physique successful a benignant of integer fingerprint truthful that immoderate information extracted with its exertion tin beryllium traced backmost to which circumstantial instrumentality was used.

Cellebrite sells hardware devices designed to unlock and hack into cellphones that are connected to them. Over the years, researchers person documented cases wherever institution customers utilized its exertion against dissidents, quality rights activists, and journalists successful Hong Kong, Kenya, and Jordan. In effect to immoderate of these findings, Cellebrite has chopped ties with Bangladesh, China and Hong Kong, Myanmar, and Serbia.

In an email to the Citizen Lab, which helium shared with TechCrunch, Cellebrite’s main selling serviceman David Gee said that the institution “stopped all income and services to the Russian Federation successful March 2021, terminating existing licenses, and immediately began unwinding each ineligible contracts. Any usage of bequest Cellebrite hardware successful Russia aft March 2021 is wholly unauthorized.”

Gee, arsenic good arsenic Cellebrite’s spokesperson Victor Cooper, did not respond to a bid of circumstantial questions sent by TechCrunch.

In the lawsuit of Pivovarov, the Citizen Lab researchers said they were capable to find forensic grounds connected his telephone that it had been hacked with Cellebrite UFED, aft Russian authorities detained him and confiscated his iPhone 12 and MacBook successful May 2021. 

Pivovarov besides shared with the researchers a tribunal papers helium received arsenic portion of his prosecution. In it, the Russian government’s Criminalist Expert Center elaborate its usage of Cellebrite UFED to interruption into his phone, stating that the authorities utilized UFED to extract information including WhatsApp and Telegram messages. They also searched the telephone for governmental terms, arsenic good arsenic the names of absorption figures, which included targets of what researchers person described arsenic alleged Russian authorities hacking campaigns.   

Pivovarov was the manager of the present defunct absorption radical Open Russia. He was aboriginal sentenced to 4 years successful prison, earlier being freed successful August 2024 arsenic portion of a captive exchange betwixt Russia and Western countries that besides freed Wall Street Journal newsman Evan Gershkovich.

The Russian Embassy successful Washington D.C. did not respond to a petition for comment.