Russian Authorities Used Cellebrite Tools to Extract Data from Opposition Politician’s iPhone Despite Contract Termination In June 2021, Russian security services deployed Cellebrite’s Universal Forensic Extraction Device (UFED) to breach the iPhone 12 of Andrey Pivovarov, former director of the pro-democracy nonprofit Open Russia, according to a forensic investigation by Citizen Lab at the University of Toronto. The extraction occurred three months after Cellebrite publicly announced it had ceased all sales to Russian authorities amid human rights concerns. Pivovarov was detained at St. Petersburg Airport on May 31, 2021, after dissolving Open Russia’s Russian branch to shield staff from prosecution under new laws targeting "undesirable organizations." His devices an iPhone 12 and MacBook were confiscated without consent or passwords and held until 2023, following his four-year prison sentence. He was released in August 2024 as part of a U.S.-Russia prisoner exchange. Citizen Lab’s analysis, initiated after Pivovarov flagged potential tampering in 2025, uncovered forensic traces of Cellebrite’s UFED on his device, including a Host ID (90161926980658937761372207) linked to the company in prior investigations. The findings were corroborated by Russian forensic documents, including a Ministry of Interior report (No. 1269-17) explicitly naming Cellebrite’s UFED Physical Analyzer and UFED 4PC as the tools used to extract data. The extraction targeted WhatsApp, Telegram, and Viber communications, along with keyword searches for opposition figures, including Mikhail Khodorkovsky and human rights lawyer Anastasiya Burakova. Cellebrite had publicly terminated Russian contracts in March 2021, with an executive stating that any post-exit use was "unauthorized." However, the offline functionality of UFED tools allowed Russian authorities to continue operations despite the ban. The incident raises concerns about downstream surveillance risks: individuals flagged in Pivovarov’s data, such as Burakova, were later targeted in phishing campaigns by COLDRIVER, an FSB-linked hacking group, as documented in a 2024 Citizen Lab-Access Now investigation. Researchers suggest the extracted data may have informed subsequent FSB operations against regime critics abroad. This case adds to a growing pattern of Cellebrite tool misuse in countries like Serbia, Kenya, Jordan, Myanmar, Bahrain, and Botswana, despite partial contract cancellations. While Access Now and Citizen Lab have urged Cellebrite to implement technical safeguards and human rights due diligence, the company has not announced structural changes to its export controls.