Cellebrite has cut off communication with Serbia due to misuse of its phone unlocking tools. Why not others?

Last year, phone hacking tool maker Cellebrite announced it had suspended Serbian police as agents, after human rights researchers alleged that local police and intelligence agencies used its tools to hack into the phones of a journalist and activist, and plant spyware.

This was a rare example of Cellebrite publicly boycotting a customer following documented allegations of abuse, citing the AI ​​technical report to make its decision.

But following recent similar accusations of abuse in Jordan and Kenya, the Israel-based company responded by dismissing the allegations and refusing to commit to investigating them. It’s not clear why Cellebrite changed its approach, which appears to be at odds with its previous actions.

On Tuesday, researchers at The Citizen Lab at the University of Toronto published a report alleging that the Kenyan government used Cellebrite tools to unlock the phone of Boniface Mwangi, a local activist and politician, while he was in police custody. In another report issued in January, The Citizen Lab accused the Jordanian government of breaking into the phones of several local activists and protesters using Cellebrite tools.

In both investigations, Citizen Lab, an organization that has investigated the misuse of spyware and hacking techniques around the world, based its conclusions on finding traces of a specific application linked to Cellebrite on the victims’ phones.

The researchers said these traces are a “high confidence” signal that someone used Cellebrite’s unlocking tools on the phones in question, because the app itself was previously found in VirusTotal, a malware repository, and was signed with digital certificates owned by Cellebrite.

Other researchers have also linked the same application to Cellebrite.

“We do not respond to speculation and encourage any organization with specific, evidence-based concerns to share them directly with us so we can act on them,” Victor Cooper, a Cellebrite spokesperson, told TechCrunch in an email.

When asked why Cellebright acted differently on the Serbia case, Cooper said: “The two positions are not comparable,” and that “high confidence is not direct evidence.”

Cooper did not respond to several follow-up emails asking whether Cellebrite would investigate The Citizen Lab’s latest report, and what the differences, if any, were with its case in Serbia.

In its investigations in Kenya and Jordan, Citizen Lab contacted Cellebrite prior to publication of the reports to provide the company with the right to respond.

In response to Jordan’s report, Cellebrite said that “any proven use of our tools in violation of human rights or local law will result in immediate deactivation,” but did not commit to investigating the case and declined to disclose specific information about customers.

However, for the Kenya report, Cellebrite acknowledged receipt of The Citizen Lab’s inquiry but did not comment, according to John Scott-Railton, one of the Citizen Lab researchers who worked on the Cellebrite investigation.

“We urge Cellebrite to disclose the specific criteria it used to approve sales to Kenyan authorities, and disclose the number of licenses it has revoked in the past,” Scott-Railton told TechCrunch. “If Cellebrite was serious about its rigorous screening, it would have no problem making that public.”

After earlier reports of misuse, Cellebrite, which claims to have more than 7,000 law enforcement customers around the world, cut ties with Bangladesh and Myanmar, as well as Russia and Belarus during 2021. Cellebrite previously said it stopped selling to Hong Kong and China following US government regulations restricting the export of sensitive technology to the country. Local activists in Hong Kong accused the authorities of using Cellebrite to unlock protesters’ phones.