Founded by alumni of Israel’s elite cyber-intelligence Unit 8200, Cellebrite DI Ltd. has grown from its military origins into a global force in digital forensics. Based in Israel, the company is best known for its flagship Universal Forensic Extraction Device (UFED), a system capable of bypassing smartphone encryption to access nearly all user data.
Its suite of tools—including Physical Analyzer, Pathfinder, and Endpoint Inspector—enables deep digital excavations, offering law enforcement and private enterprises the ability to reconstruct years of personal history from a single device. More recently, Cellebrite has integrated artificial intelligence into its platforms, promising faster, more intuitive analysis of seized data.
But as the company’s reach has expanded, so too has the scrutiny. Civil rights groups and digital watchdogs argue that Cellebrite’s products, while marketed for legitimate criminal investigations, are frequently deployed by repressive regimes to surveil journalists, target dissidents, and suppress protests. The technology’s global footprint now spans some of the most politically charged corners of the world—and its misuses offer a chilling glimpse into the future of digital authoritarianism.
In Serbia, Amnesty International uncovered a disturbing pattern: police and intelligence agencies used Cellebrite tools not only to unlock activists’ and journalists’ phones, but to install malware—specifically NoviSpy—that enabled remote access to microphones, cameras, and personal files. One such case involved journalist Slaviša Milanov, whose phone was seized under false pretenses, unlocked, and infected, all without judicial oversight or informed consent. While Cellebrite responded by suspending sales to Serbian authorities and terminating related contracts, Amnesty and other groups warned that the move was reactive rather than systemic, and emphasized the need for transparency and enforceable safeguards.
Similar concerns erupted during the 2019–2020 pro-democracy protests in Hong Kong, where police reportedly used Cellebrite devices to extract data from thousands of arrested demonstrators. Despite growing pressure, Cellebrite continued to sell to Chinese clients until U.S. export controls eventually forced a halt. In Myanmar, data obtained through Cellebrite or its subsidiary BlackBag was used to convict Reuters journalists reporting on military abuses. In Bangladesh, Cellebrite’s tools were used by the Rapid Action Battalion—an agency accused of extrajudicial killings and torture.
Across continents, the story repeats itself. In Botswana, police seized a journalist’s phone and used Cellebrite to investigate critical Facebook posts. In the Philippines, the company trained government agencies tied to President Duterte’s notorious drug war, enabling mass phone extractions during a campaign marked by alleged human rights violations. Even in the United States, Immigration and Customs Enforcement (ICE) has signed multi-million-dollar contracts with Cellebrite to extract data from asylum seekers and detainees. The FBI, facing encrypted devices during high-profile investigations, has turned to Cellebrite when other methods failed—including in the 2024 case involving the accused shooter of former President Donald Trump.
In 2025, Cellebrite unveiled a new layer of sophistication: generative AI that automatically summarizes chat logs and audio, identifies key relationships, and builds visual maps of interpersonal connections. The tool, designed to streamline investigations, has also raised serious questions about profiling, bias, and the lack of transparency in automated systems. Another recent development scans for child sexual abuse material using vetted databases—a potentially life-saving feature, but one civil liberties advocates fear could lead to overreach, false positives, and indefinite data retention.
Australia offers a striking microcosm of the global dilemma. Cellebrite holds more than 170 contracts with federal and state agencies, spanning police departments, social services, and even sports regulators. In New South Wales, police have extracted phone data without warrants—not just from suspects, but from victims and witnesses as well. In some cases, sensitive material such as counseling notes and private conversations has been passed to defense attorneys with little regard for relevance or privacy. Contracts with agencies like Services Australia even include clauses allowing Cellebrite to retain, modify, or access data after extraction—raising troubling questions about ownership, jurisdiction, and control.
Despite this broad and invasive use, Australia lacks legal mandates for oversight, data deletion when no charges are laid, or even limits on the scope of extractions. There are no statutory requirements for transparency, public reporting, or annual audits, leaving citizens exposed to unchecked surveillance with few means of recourse.
Amnesty International, and other advocacy groups have emphasized, only legally binding standards—rooted in due process and human rights—can ensure responsible use.
These groups call for governments to reevaluate or suspend contracts with forensic tech firms like Cellebrite. Proposed reforms include mandatory warrants for device extraction, strict relevance thresholds for data access, automatic deletion of data when no charges are filed, and compulsory public oversight. Tech companies, in turn, must conduct human rights due diligence and face real consequences for misuse.
From Hong Kong’s detained protesters to Serbian journalists, Filipino suspects, and American asylum seekers, Cellebrite’s technology is reshaping the balance between public safety and personal liberty. In the absence of robust legal frameworks, tools designed to assist criminal justice are enabling state surveillance and repression on a global scale.
Australia’s experience—where privacy violations persist without remedy or regulation—should serve as a warning. Without urgent reforms, it’s not just our phones at risk. It’s democracy itself.
