A recent investigation by the University of Toronto's Citizen Lab has uncovered evidence that Russian authorities used a legacy Cellebrite digital forensics platform to access the iPhone 12 of Andrey Pivovarov, a human rights defender, without his consent. The incident occurred despite Cellebrite terminating its contract with the Russian Investigative Committee in March 2021. The Citizen Lab's analysis revealed 'traces of the use of Cellebrite's forensic tools' on Pivovarov's device, which was seized by Russian authorities in 2021. The researchers found that the authorities used Cellebrite's UFED Physical Analyzer and UFED 4PC toolkit to extract data from the device, including WhatsApp, Telegram, and Viber messages. The investigation highlights the challenges of ensuring the responsible use of digital forensics tools, particularly when they fall into the wrong hands. Cellebrite claims that the hardware used by Russian authorities predates current sanctions and was used without its consent. However, the Citizen Lab accuses Cellebrite of failing to meet its corporate responsibility to respect human rights, citing a history of selling to governments with track records of persecuting activists and dissidents. The incident raises important questions about the technical architecture and system design decisions of digital forensics platforms, as well as the practical engineering trade-offs involved in ensuring the secure and responsible use of these tools. The fact that Russian authorities were able to use a legacy platform to breach Pivovarov's device, despite Cellebrite's claims of having cut off access, underscores the need for more robust security measures and stricter controls on the use of digital forensics tools.

Source: Engadget