In June 2021, Russian authorities employed Cellebrite’s UFED forensic tools to access the iPhone of detained opposition activist Andrey Pivovarov, despite the company’s announcement three months earlier that it would cease selling its products to Russia and Belarus.
Details of the Incident
The findings, reported by Citizen Lab on June 25, 2026, are based on evidence found on Pivovarov’s phone and an official report from the Russian government that identifies the forensic tool used. The investigation focused on extracting data related to political contacts and opposition figures, indicating that this was not a case of remote spyware but rather a forensic analysis conducted on a device in custody.
Background on Pivovarov
Pivovarov, who led the opposition group Open Russia, was detained on May 31, 2021, when he was removed from a flight at St. Petersburg airport. His iPhone 12 and MacBook were confiscated without his consent, and he did not provide passwords for the devices. The devices remained in custody until 2023, during which time Pivovarov was sentenced to four years in prison and later released in August 2024 as part of a prisoner exchange.
Evidence of Cellebrite’s Use
Citizen Lab researchers examined Pivovarov’s phone in the fall of 2025, uncovering traces of forensic activity that dated back to 2021. MobileLockdown records indicated a connection to a Cellebrite host ID on June 17, 2021, providing high-confidence evidence that the UFED tool was utilized. Additionally, a forensic report prepared for Russia’s Investigative Committee explicitly named Cellebrite’s UFED Physical Analyzer and UFED 4PC, detailing the extraction of data from messaging applications like WhatsApp, Telegram, and Viber.
Implications of the Findings
The situation raises critical questions about the effectiveness of sales cutoffs for forensic tools. Although Cellebrite announced in March 2021 that it would stop selling to Russia and Belarus, existing hardware can continue to function offline, which poses a risk that was not addressed by the cutoff. Cellebrite stated that any use of its legacy hardware in Russia after March 2021 is “entirely unauthorized” and emphasized that the tools remain operational without their support.
This incident adds to a growing list of Cellebrite abuse cases in various countries, highlighting the challenges in controlling the use of forensic technology once it is in the hands of law enforcement agencies.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
