Cellebrite, the renowned provider of phone unlocking technologies, made headlines last year when it decided to suspend its services to the Serbian police. This decision followed allegations from human rights advocates that Serbian authorities misused Cellebrite's tools to unlawfully access the phones of journalists and activists, leading to the installation of spyware.
This action marked a rare instance where Cellebrite publicly severed ties with a client due to documented misuse, referencing a technical report from Amnesty International as the basis for its decision.
However, the company's response to similar allegations in Jordan and Kenya has raised eyebrows. In these cases, Cellebrite dismissed the claims and opted not to investigate further, which contrasts sharply with its previous approach regarding Serbia.
Recently, researchers from the University of Toronto's Citizen Lab published findings suggesting that the Kenyan government employed Cellebrite's tools to unlock the phone of activist Boniface Mwangi while he was detained. Similarly, a prior report indicated that the Jordanian government used the same technology against local activists and protesters.
The Citizen Lab's investigations indicated that specific traces of a Cellebrite-linked application were found on the victims' devices, suggesting a strong likelihood of the tools being used. This application had previously appeared in malware databases, reinforcing the connection to Cellebrite.
Victor Cooper, a spokesperson for Cellebrite, emphasized that the company does not engage with speculation and encouraged organizations with concrete concerns to reach out directly. When questioned about the differing responses to the Serbian case compared to the recent allegations, Cooper asserted that the situations were not comparable, stating that "high confidence is not direct evidence."
Despite multiple inquiries regarding whether Cellebrite would investigate the Citizen Lab's latest findings, Cooper did not provide further details.
In their reports, the Citizen Lab had reached out to Cellebrite prior to publication to allow the company a chance to respond. Following the allegations in Jordan, Cellebrite stated that any confirmed misuse of its tools would lead to immediate action, yet it has not committed to investigating the recent claims.
John Scott-Railton, a researcher with Citizen Lab, urged Cellebrite to disclose the criteria used for approving sales to Kenyan authorities and to reveal how many licenses have been revoked in the past. He expressed that if Cellebrite is genuinely committed to rigorous vetting, transparency should not be an issue.
In the past, Cellebrite has cut ties with various clients, including those in Bangladesh, Myanmar, Russia, and Belarus, due to concerns over human rights violations. The company has also ceased operations in Hong Kong and China due to U.S. export regulations on sensitive technologies, following accusations that authorities in those regions used its tools against protesters.