Vendor Cutoff Failed to Stop Seized-Device Forensics
A sales cutoff does not stop abuse once the forensic gear is already in government hands. The new piece here is confirmation, not a new exploit: Citizen Lab now ties Russian authorities’ June 2021 access to Cellebrite UFED on a seized iPhone, showing the tool kept working offline months after Cellebrite said it would stop selling to Russia and Belarus.
The evidence comes from two places that line up: traces on the phone itself and a Russian prosecution report that names UFED Physical Analyzer and UFED 4PC. The report also shows searches for opposition contacts and failed login attempts against the MacBook, which fits the picture of custody-side extraction rather than remote intrusion.
The gap is the one vendor cutoffs do not close. If a device is already seized, offline forensic systems can still pull data from it long after support ends, so the control is weaker than it looks when the hardware remains in the field.
Russia used Cellebrite phone-hacking tool to crack down on dissident after firm cut off country
The continued use of the powerful data extraction product soon after the company in March 2021 said it would stop working with Russia suggests the firm has been unable to pull back its technology from authoritarian government customers, researchers say.