Post-Ban Tech Use
Russia Continues Using Cellebrite Tools to Hack Dissidents' iPhones After Company Promised Sales Cutoff
Anonymous
Key Points
1
Haaretz reported in 2022 that Kremlin investigators openly stated they used Cellebrite’s phone-forensics tools, highlighting ongoing misuse after the company’s cutoff to Russia.
2
The 2020 Sobol case shows Russian authorities had already deployed Cellebrite’s tech to raid a dissident’s phone before the March 2021 cutoff, underscoring enforcement gaps.
3
Andrey Pivovarov was detained at the St. Petersburg airport in 2021, and investigators used Cellebrite technology to access his iPhone 12, contributing to a four-year prison sentence.
4
The analysis indicates investigators retrieved extensive information from Pivovarov’s iPhone 12 using Cellebrite tools, illustrating the depth of data accessible via the equipment.
5
Cellebrite publicly stated that any use of legacy hardware in Russia after March 2021 is entirely unauthorized and that the company does not sell to sanctioned regimes, while warning legacy gear would be incompatible with modern devices.
Russian investigators used an Israeli phone-hacking tool to crack open opposition politician Andrey Pivovarov's iPhone 12 in June 2021 — exactly three months after the tool's maker, Cellebrite, said it had "immediately" stopped selling to Russia, according to Citizen Lab. Pivovarov was sentenced to four years in prison, with prosecutors relying heavily on messages pulled from his device.
A joint investigation by Citizen Lab and Access Now released in 2026 found "hard physical evidence" — system logs and cryptographic signatures — proving that Russia's Ministry of Interior used authorized Cellebrite hardware long after the company's promised cutoff. The findings reignite a broader debate about whether corporate pledges to stop selling surveillance tools to repressive regimes are worth anything at all.
How Russia Cracked Pivovarov's iPhone After the Cutoff
On May 31, 2021, Pivovarov, director of the opposition group Open Russia, was pulled off a plane at St. Petersburg airport and detained, The Record reported. Weeks later, forensic logs show his iPhone 12 was plugged into a Cellebrite UFED — short for Universal Forensic Extraction Device — a specialized rig that pulls texts, messages, and app data off phones. Investigators extracted Telegram and WhatsApp messages that formed the backbone of the prosecution's case.
Cellebrite had announced its Russia exit on March 18, 2021. The hack of Pivovarov's phone came on approximately June 17, 2021 — just 91 days later. Bloomberg Law reported that the Citizen Lab findings directly link the hardware used to Cellebrite's proprietary architecture, contradicting the company's claim that legacy gear would be useless against a current-model iPhone 12.
Cellebrite Says 'Unauthorized' — Investigators Say That Misses the Point
Cellebrite's defense rests on one word: unauthorized. The company says any post-2021 use of its tools in Russia is "entirely unauthorized" and that old hardware quickly becomes "incompatible with modern devices." The Pivovarov case blows a hole in that second claim. His iPhone 12 was a then-current model, and the extraction worked.
Technadu reported that Citizen Lab researchers found the Russian Ministry of Interior's forensic lab used "UFED 4PC" and "Physical Analyzer" software — tools named explicitly in official Russian court files. Israeli human rights lawyer Eitay Mack, who originally petitioned to force Cellebrite out of Russia, noted that Cellebrite reserves the right to disable equipment sold to U.S. agencies. He asked why no such "kill switch" was enforced in Russia.
Russia Was Already Using Cellebrite Before the Cutoff Was Ever Announced
The Pivovarov case is not the first. In December 2020, Russian authorities raided the home of Lyubov Sobol, an ally of Alexei Navalny. Forensic reports later showed Cellebrite tools were used to pull data from her devices — months before Cellebrite announced any exit. By December 2022, Haaretz reported that Russian investigators were openly citing "Cellebrite" by name in court filings, treating it as standard procedure.
The pattern matters. This was not a one-off leak of hardware. Russian authorities showed consistent, confident reliance on Cellebrite tools across multiple cases and years. TechBuzz noted that researchers believe the technology's offline mode — meaning it works without an internet connection or updates from Cellebrite — is the core reason a corporate cutoff had no practical effect on the ground.
One Case, Much Bigger Stakes for Surveillance Tech Controls
The damage went beyond Pivovarov. Citizen Lab found that data pulled from his iPhone exposed his entire contact network. Several of those contacts were later targeted by Coldriver, a cyber group linked to Russia's FSB spy agency. One forensic extraction fed a much larger surveillance operation.
Pivovarov was released in August 2024 as part of a prisoner swap that also freed Wall Street Journal reporter Evan Gershkovich. But the legal and policy fallout continues. Advocates are now using the case to push for updates to the Wassenaar Arrangement — a 42-nation export control agreement — to require mandatory remote-disable features in forensic hardware. Cellebrite, which posted $128 million in revenue in Q1 2026 and sells to agencies in over 140 countries, faces growing pressure from ESG-focused investors to prove its safeguards are technical, not just promises on paper.
Sentiment
Mostly NegativeNEGATIVENEUTRALPOSITIVE
Publishers
11
Articles
5
Reach
16
A
AnonymousAuthor
