Cellebrite cuts off Serbia over abuse of phone-cracking software against civil society

The Israeli company Cellebrite announced Tuesday that it will no longer allow Serbia to use its software, which is deployed by law enforcement worldwide to unlock mobile phones.

The decision comes on the heels of an Amnesty International report in December alleging that Serbian authorities used the powerful technology to secretly break into phones belonging to civilians and then installed spyware.

Cellebrite has been “systematically deployed” in Serbia and regularly targets members of civil society, Amnesty said in its report.

In a statement on Wednesday, Cellebrite said it assesses the national governments it sells its software to on an “annual and ad-hoc basis due to political and cultural shifts.” The company said that after investigating Amnesty’s findings it determined that it could no longer license its product to Serbia.

“Ethical, judicial and lawful use of our technology is paramount to our mission of accelerating justice and saving lives around the world,” the company said. 

“Our robust compliance and ethics program is designed so that democratized nations around the globe use our technology ethically and lawfully – all paramount to our mission of accelerating justice, safeguarding communities and helping to save lives.”  

According to its website, Cellebrite examines recent and long-term human rights records and studies “other factors that we consider restrictive” before working with specific governments.

The company says it “vigorously supports the democratic ideals” of free speech and a free press and does not develop products that “support” surveillance or monitoring efforts by governments, according to its website.

Serbia is governed by an authoritarian regime known for cracking down on dissidents, journalists and demonstrators. Citizens have regularly protested against the government since 2021, leading to widespread repression.

Serbia has not been truly democratic since 2019, experts say, and has become increasingly authoritarian in recent years. In a report released Tuesday by Freedom House, the authors say the country’s attack on democratic institutions has led to an “entrenchment of authoritarian rule.”

On Tuesday, authorities raided the headquarters of at least four civil society groups, alleging they abused U.S. Agency for International Development funds, the Associated Press reported.

The International Fact-Checking Network, which assesses government claims worldwide for veracity, strongly condemned what it called bogus corruption allegations, according to the outlet.

“This is not the first time that government institutions in Serbia have attempted to intimidate independent media and civil society organizations, but it is an unprecedented escalation of government repression,” the group’s statement said.

The Amnesty International report about Cellebrite revealed that an environmental activist and journalist were victims of the break-ins.

Investigative reporter Slaviša Milanov’s phone was allegedly infected with spyware after police detained him in a traffic stop in February 2024, Amnesty’s report said. He was taken to a police station and his phone was confiscated while he was questioned. After he was released, he noticed his data and WiFi settings had been disabled and he took his phone to the organization’s Security Lab.

Researchers there found evidence of a Cellebrite product and a new form of spyware produced in Serbia. Milanov said police had not asked for his phone’s passcode, nor did they disclose that they were searching his phone.

Amnesty International released a statement Wednesday, saying that Cellebrite must do more to prevent repressive regimes from using its software.

“This important finding demonstrates that Cellebrite’s due diligence processes should be revamped to ensure its products are not being used to abuse human rights,” said Donncha Ó Cearbhaill, head of the Security Lab. 

“Any further exports of surveillance or digital forensics technology to Serbia must be stopped until the authorities have implemented an effective and independent system of control and oversight over any measures that could restrict people’s right to privacy, freedom of expression or peaceful assembly.”