Cellebrite cuts off Serbia but dismisses Kenya and Jordan abuse claims

Last year, the phone unlocking tools maker Cellebrite announced it had suspended Serbian police as customers. This decision followed reports from human rights researchers who alleged local police and intelligence agencies used its tools to hack into the phones of a journalist and an activist, and plant spyware. Cellebrite cited a technical report by Amnesty International to justify the suspension.

However, the company has taken a different stance regarding recent similar accusations of abuse in Jordan and Kenya. On Tuesday, researchers at The Citizen Lab, a University of Toronto research group, published a report alleging the Kenyan government used Cellebrite’s tools to unlock the phone of Boniface Mwangi, a local activist and politician. This followed a January report in which The Citizen Lab accused the Jordanian government of breaking into the phones of several local activists and protesters using Cellebrite’s tools.

In both cases, researchers identified traces of a specific Cellebrite-linked application on the victims’ phones. The Citizen Lab stated these traces represent a high confidence signal because the same application was previously found on VirusTotal, a malware repository, and was signed with digital certificates owned by Cellebrite.

Cellebrite, which claims to have more than 7,000 law enforcement customers around the world, has dismissed the latest findings. Victor Cooper, a spokesperson for Cellebrite, stated that the situations are incomparable and that high confidence does not equal direct evidence. He added that the company does not respond to speculation. Previously, Cellebrite cut off relationships with Bangladesh and Myanmar, as well as Russia and Belarus during 2021. It also stopped selling to Hong Kong and China following U.S. government regulations restricting the export of sensitive technologies. Local activists in Hong Kong had accused the authorities of using Cellebrite to unlock protesters’ phones.

In response to the reports, John Scott-Railton, a researcher at The Citizen Lab, urged the company to be more transparent. “We urge Cellebrite to release the specific criteria they used to approve sales to Kenyan authorities, and disclose how many licenses have been revoked in the past,” Scott-Railton said.

Why it matters

Cellebrite’s inconsistent approach to cutting off customers following human rights abuse allegations raises questions about the transparency and efficacy of its vetting processes for law enforcement clients around the world.