Russia still using Israeli tech to hack detainees’ cellphones, 21 October 2022

Russia’s main investigative arm continues to use the tools of Israeli digital intelligence company Cellebrite to break into the cellphones of people arrested, according to documents from the agency accessible online.

Cellebrite...announced in March 2021 that it was immediately halting sales of its products and services in Russia and Belarus. This followed revelations that its technology was being used by the Investigative Committee of Russia, which answers directly to President Vladimir Putin, to persecute opposition leaders.

Cellebrite’s flagship product is the Universal Forensics Extraction Device, or UFED. It enables law enforcement agencies to break into password-protected cellphones and copy all the phone's data, including photos, documents, text messages, contacts and the call history...

“In our industry you need to know very well who you sell to and who you don’t sell to. We have an internal regulator, an internal legal department,” Cellebrite CEO Yossi Carmil said in a 2019 interview...

Haaretz asked the company if it had remotely disabled its hacking tools sold to Russia after it announced that it was halting operations in that country. In response, Cellebrite’s lawyers sent Haaretz a letter which did not address the issue of remote disabling.

“On March 18th, 2021, Cellebrite announced that it has completely ceased operations in Russia, according to its ethical stance and without being required to do so by any legal authority. Cellebrite does not operate in Russia and does not sell its products or services to the Investigative Committee or to any other entity in Russia. If user licenses for its products were sold in the past in Russia, these licenses were immediately halted and entered the ‘blacklist’ – service is not provided for them and they certainly are not supported by Cellebrite in any way,” the lawyers wrote.

“Cellebrite has no information whatsoever on the use of its products in Russia, and if any such use is made, this is done without a license, without permission from the company and amid a gross violation of the agreements and the law by the criminal user”...

If Cellebrite can indeed remotely disable its products, then according to official Russian documents available online - it hasn’t done so. The documents confirm research by human rights lawyer Mack and vot-tak.tv – an independent collective of journalists from Russia, Ukraine and Belarus...

In a letter to Cellebrite's CEO and to Amir Eshel, the director general of the Defense Ministry, which is responsible for oversight of the company, Mack said Cellebrite should be urgently ordered to stop exporting its systems to Russia and disable the devices already in the hands of the Investigative Committee...