Russian authorities used Cellebrite's phone-hacking tool against a dissident shortly after the Israeli firm announced in March 2021 it would cease operations in the country, according to researchers. The development underscores the difficulty of policing dual-use surveillance technology once it reaches authoritarian hands.
The finding suggests Cellebrite has been unable to fully reclaim or disable its products already deployed by Russian government clients. Researchers tracked the specific tool signature used in the hack, which matched Cellebrite's forensic extraction software, indicating continued access despite the company's stated policy change.
Technical analysis of the compromised device revealed the extraction capability used was from Cellebrite's premium product line, typically reserved for law enforcement and intelligence agencies. Indicators of compromise included abnormal device behavior and specific file artifacts consistent with the company's known extraction methods.
Cellebrite has not commented on the specific incident. The company's previous statements emphasized its commitment to human rights and compliance with export controls, though this case raises questions about the effectiveness of such restrictions.
The broader context involves ongoing challenges in controlling proliferation of powerful surveillance tools. Security experts note that once such technology is transferred, vendors have limited technical means to revoke access, highlighting systemic vulnerabilities in export control regimes.