Russian authorities have been accused of exploiting phone hacking tools from Israeli firm Cellebrite, even after the company had publicly severed ties with Russia and Belarus. A damning investigation by the University of Toronto's Citizen Lab has revealed that Moscow used the sophisticated extraction software to access the phone of high-profile prisoner Andrei Pivovarov in May 2021 – months after Cellebrite claimed it had cancelled all contracts with Russia.
The findings raise serious questions about Cellebrite's ability to control its own software, which is widely adopted by law enforcement agencies worldwide, including police forces in the UK and US. Pivovarov, a former director of Open Russia, was detained for over three years before being released as part of a high-profile prisoner exchange. During his incarceration, Russian authorities reportedly used forensic tools to penetrate his phone, extracting extensive personal and professional data, including contacts and message content from messaging apps like WhatsApp and Viber.
Pivovarov has spoken out about the "gross violation" of his privacy, which put many of his associates at risk. He claimed efforts were made to uncover his communications with colleagues and other politicians, potentially for use in further criminal proceedings. Following his arrest, several of his colleagues left Russia immediately, citing fears for their safety.
The Citizen Lab's forensic investigation concluded "with high confidence" that Cellebrite tools were indeed used, a finding corroborated by a document provided to Pivovarov by Russian authorities during his prosecution. This information was instrumental in building the case against him. Furthermore, some of Pivovarov's contacts were later reportedly targeted by Coldriver, a group linked to Russia – a connection that warrants further scrutiny.
Cellebrite has long presented itself as a company operating on the "right side" of the fence, distinguishing itself from firms like NSO Group whose Pegasus spyware has been linked to alleged abuses by foreign governments against dissidents and journalists. However, human rights lawyer Eitay Mack argues that while sales were halted, Cellebrite never disabled the equipment already in use in Russia.
Mack pointed out that Cellebrite's contracts with American authorities suggest it possesses the capability to remotely dismantle its equipment, yet this appears not to have been exercised in Russia. Pivovarov has since written an open letter to Cellebrite, asserting that the ongoing use of their devices by authoritarian states long after contract termination demonstrates a need for the company to cease "effectively shielding clients who abuse your technology."