In 2021, Russian security officers gained access to the iPhone of opposition politician and civil society activist Andrei Pivovarov, the former director of pro-democracy group Open Russia. Russian law enforcement used the Israeli digital forensics tool Cellebrite while the phone was in their custody, according to a new report by the Canadian research group Citizen Lab. Analysts found evidence on the device showing that Cellebrite tools were used around June 17, 2021, after the phone had already been seized by Russian authorities.
Pivovarov was detained May 31, 2021, at Pulkovo airport in St. Petersburg. Investigators confiscated his iPhone 12 and MacBook. He did not consent to a search of the devices and did not hand over passwords. The devices were returned to his lawyer only in 2023. In July 2022, a court sentenced Pivovarov to four years in a penal colony on a charge of “carrying out the activities of an undesirable organization,” a Russian legal designation used to ban and criminalize work with foreign or foreign-linked groups deemed a threat by the authorities. He was released Aug. 1, 2024, as part of a prisoner exchange.
Citizen Lab’s findings are supported by a document produced by the Russian authorities themselves: expert report No. 1269-17, prepared by the Interior Ministry’s Forensic Expert Center at the request of the country’s Investigative Committee. The report explicitly states that Cellebrite’s UFED Physical Analyzer and UFED 4PC were used. Security officers extracted data from WhatsApp, Telegram, and Viber on the phone and searched it for references to Open Russia, as well as the names of Mikhail Khodorkovsky, Anastasia Burakova, and Pivovarov’s partner, Tatyana Usmanova.
Russian security officers were unable to access Pivovarov’s MacBook because disk encryption blocked data extraction, according to the Interior Ministry report. Citizen Lab separately noted that Cellebrite continued to be used by Russian authorities for political prosecutions even after the company said in March 2021 that it had canceled contracts with Russian and Belarusian customers. The Insider has previously reported that Russian security agencies continued using UFED despite Cellebrite’s stated halt in sales.
In response to Citizen Lab’s request for comment, Cellebrite said:
“Any use of legacy Cellebrite hardware in Russia after March 2021 is entirely unauthorized. The Cellebrite hardware previously sold, prior to March 2021, would now be incompatible with modern devices and would operate without our technical support, our consent, or any legal sanction from Cellebrite. Rapid technology advances render legacy digital forensic hardware and software ineffective within a short period of time. Russia remains permanently on our restricted-customer list.”
