"Cellebrite going public? Stop the deal!" 23 August 2021

As the world grapples with the Pegasus Project revelations that put NSO Group in the spotlight, another Israeli surveillance tech company with a disastrous human rights record has quietly continued its bid to go public. Despite mounting evidence that Cellebrite’s technology facilitates abuses around the world and an urgent call from civil society and U.S. lawmakers to stop the deal, Cellebrite announced on August 9 that the U.S. Securities and Exchange Commission (SEC) approved its Form F-4 Registration Statement, paving the way for Cellebrite going public with a NASDAQ listing. To smooth the process, Cellebrite, a subsidiary of the Japanese Sun Corporation, recently published an “Ethics & Integrity” section on its website boasting about its commitment to the “protection of human rights” and “transparency.” Neither Cellebrite’s shareholders nor NASDAQ should be swayed by these empty statements.

... First, like NSO Group’s recent “Transparency Report,” Cellebrite’s “Ethics & Integrity” statements are a clear attempt to distract from actions that speak louder than words. Ignoring the reports of sales of its technology to authoritarian regimes and the disturbing use of Cellebrite tools against journalists, Cellebrite does not disclose any action in response to the points that Access Now and partners have asked it to address. To date, Cellebrite has not:

1. disclosed a meaningful human rights policy and a company code of conduct;
2. demonstrated how the company takes the appropriate measures to conduct proper risk assessment and understand the human rights implications of its products;
3. demonstrated well-designed and implemented policy and procedures for customer due diligence to mitigate human rights risks;
4. sufficiently improved its human rights compliance system based on past abuses;
5. provided remedy to those individuals potentially harmed by Cellebrite’s technology; or
6. provided periodic public communication on the design and effectiveness of its compliance system.

Second, Cellebrite’s “Ethics & Integrity” statements are misleading. Just like in its draft registration statement to the SEC, Cellebrite claims that the company has “chosen not to do business in Bangladesh, Belarus, China, Hong Kong, Macau, Russia, and Venezuela, partially due to concerns regarding human rights and data security.” However, as Haaretz correctly points out, Cellebrite did in fact choose to do business in Bangladesh, Belarus, China, Hong Kong, Russia, and Venezuela. It was forced to halt sales after Haaretz investigations revealed evidence of rights abuses, and Israeli human rights lawyer Eitay Mack filed multiple court petitions asking Israel to revoke Cellebrite’s export license. In the case of the sale to Bangladesh, which was scheduled for review at a September 14th court hearing, Cellebrite never explained why or when it chose to sell its UFED devices to the Rapid Action Battalion, known as the “Death Squad.” Nor did it say when it finally stopped supplying the technology.

Thus, while the company wants the SEC, NASDAQ, and its shareholders and investors to believe that it made the ethical choice not to do business with those countries, and therefore support Cellebrite going public, it does not explain why it was working with E.U. and U.S.-sanctioned regimes with a long history of jailing, torturing, and killing members of the opposition, journalists, and minorities in the first place. Cellebrite wants to take all the credit for its growth as a business and none of the responsibility for doing so by selling its tech to dictators.

Finally, Cellebrite still has not addressed other reported transactions that carry human rights risks and raise red flags for Cellebrite going public. These include alleged deals with the governments of Bahrain, Nigeria, Myanmar, Indonesia, India, Vietnam, and Saudi Arabia, as well as Botswana, where Committee to Protect Journalists investigations have implicated Cellebrite’s tech in searches of devices of journalists allegedly tortured by security agents.

... The Pegasus Project revelations have shown that surveillance companies ignore civil society calls for transparency and addressing human rights abuses until they face a major public relations crisis and multiple lawsuits. Cellebrite’s investors and the wider financial community should not make the same mistake NSO Group investors made. It’s time to stop Cellebrite going public before it’s too late.