Despite Sanctions, Israeli Firm Cellebrite Sold Phone-hacking Tech to Venezuela

Nicolás Maduro's regime says it bought tech from Cellebrite, an Israeli firm that creates devices to extract information from most handheld mobile devices. Cellebrite denies plans to sell them its latest system

Oded Yaron
Send in e-mailSend in e-mail
The 'UFED Touch Ultimate' system, as seen on Venezuela's CICPC website
The 'UFED Touch Ultimate' system, as seen on Venezuela's CICPC websiteCredit: CICPC
Oded Yaron

The Israeli firm Cellebrite sold its phone-hacking technology to Nicolás Maduro's regime in Venezuela, despite American sanctions which ban exports to the country. Meanwhile, Cellebrite vehemently denies any bid to sell its new system, capable of allowing regimes to break into mobile phones, to the South American nation. 

“Cellebrite hasn't worked with defense or police clients in Venezuela for a number of years, and will not change its policy regarding the country as long as the current regime is holding on to power,” the firm said. 

Cellebrite has captured a major slice of the mobile forensics market, providing police forces, government agencies and private companies across the world with hardware and software that enable investigators to extract information from most handheld devices, even if the data has been encrypted, deleted or uploaded to the cloud. The company has faced allegations by human rights activists that it sells its equipment to both the Chinese regime in its bid to crack down on pro-democracy protesters in Hong Kong, and to the government in protest-torn Belarus – claims the firm has either denied or refused to confirm or respond to.

The current allegations too are linked to a petition by human rights lawyer Eitay Mack, made to the Defense Export Control Agency, a part of Israel’s Defense Ministry charged with overseeing arms exports. Mack is demanding the authority also oversee Cellebrite and its activities, this in part due to the Maduro regime’s plans to buy the advanced mobile forensics system - UFED Touch 2. It is unclear if Cellebrite is currently registered as a defense exporter. 

Maduro's regime announced its plans to purchase the system last year, and has since repeated the claims in a number of official statements and publications. In a letter sent by Mack to the oversight authority’s chief Racheli Chen this week, he urged her to “announce immediately to the public that Cellebrite will be required to register as a defense exporter.” 

Venezuela's Maduro annoucnes plans to buy a new system on Twitter
Venezuela's Maduro annoucnes plans to buy a new system on TwitterCredit: Eitay Mack

He further demanded that Cellebrite be banned from exporting “directly or indirectly” the new UFED system. He warned of possible attempts to indirectly sell the system to Venezuela in particular amid reports that said that earlier versions of the system were on sale online on sites like eBay.

Cellebrite has a relatively positive profile in terms of human rights, casting itself as a company committed to high ethical standards despite reports of problematic uses of its technology. Last year, Vice News reported that it has sold its technology to Russia, the United Arab Emirates and Turkey. An additional report by Privacy International claimed that the firm had reached out to the Bahraini regime as well, proposing its technology be used to track refugees.

Its positive image on human rights has started to show crack recently, with reports of its involvement in Hong Kong and Belarus. In Hong Kong, they were accused of selling local law enforcement forensic technology in the form of a device that police officers could use to unlock and extract data from confiscated phones of protesters. While the legal situation in Hong Kong is complex due to the nature of its relationship with China, which is increasingly enforcing new and harsh legislation in the territory, news of the firm selling its technology to Belarus’ infamous intergotation squads, currently cracking down on pro-democracy protesters in the country, casts it in a somewhat harsher light.

Claims it sold its cellphone hacking technology to Belarus – a dictatorship ruled since 1994 by President Alexander Lukashenko – have highlighted the firm’s involvement with repressive regimes and flies in the face of the company’s claims that it does not do business with nations facing sanctions. For example, this is part of the response made by the company in regards to its alleged involvement in Hong Kong and Belarus:

“We do not sell our technology to countries on the FATF (Financial Action Task Force) blacklist or subject to American sanctions, or those by the Israeli government or international community.”

The device that the Maduro regime intended to buy – and had already allocated a budget for – was to be used by the CICPC unit, also known as the Bureau for Scientific, Criminal and Forensic Investigations. In the letter sent by Mack, it was claimed that this unit is not just in charge of scientific forensic investigations, but also plays a role in the extrajudicial executions, kidnappings and torturing of dissident citizens. 

“According to Venezuela's former chief prosecutor, some 8,292 people have been executed without trial by security forces acting on behalf of the government between 2015 and Junt 2017. According to the Venezuelan human rights group COFAVIC, the CICPC unit is responsible for up to a third of those executions.”

It is not clear that Cellebrite is subject to any Israeli oversight of its export activities. The Economy Ministry has said it is under the Defense Ministry’s purview. In response to an inquiry from Mack regarding Hong Kong, the Economy Ministry said it is not responsible for oversight of Cellebrite and has not granted the company an export license, explaining that it falls under the Defense Ministry’s jurisdiction.

UFED Touch Ultimate
UFED Touch Ultimate

They don’t work with Venezuela, but Venezuela works with them

The oppressive nature of the regime in Venezuela did not hinder the company from selling earlier versions of UFED, despite the U.S. embargo that was imposed on the country in 2006. This, despite the company’s claims that it does not sell equipment to companies under sanctions. The U.S. has since expanded and intensified the sanctions on Venezuela and various Venezuelan officials. In 2017, the European Union also slapped sanctions on the country.  

According to evidence available online, CICPC already has what appears to be the UFED Touch Ultimate version, which, according to the sales brochure, was developed in 2013. In other words, the system was sold to the present regime or, at the earliest, to that of his predecessor, Hugo Chavez, who died in March 2013. 

UFED Touch Ultimate

The first reports about the use of Cellebrite technology appeared on the CICPC website in 2015, and according to a Venezuelan appeals court ruling, UFED Touch Ultimate was also used that year to hack suspects’ phones. Since then, the unit has evidently continued to use the device and even displayed it at a security forces exhibition in 2017. 

In Cellebrite’s Terms of Use agreement, it reserves the right to disable its devices from afar. “Software may be provided to [the] buyer with code that allows Cellebrite to disable such software,” the agreement states. But the agreement goes on to say: “Notwithstanding anything to the contrary, Cellebrite may invoke the disabling code without [the] buyer’s consent if Cellebrite reasonably believes that such software has been, is being, or will be used in violation of laws; Cellebrite is required to do so because of a court or regulatory order; [the] buyer has not paid an outstanding invoice more than 60 days after such invoice is due, or; [the] buyer has used the software other than as authorized by the buyer’s license.” 

If Cellebrite’s Terms of Use agreement is to be believed, the software installed in the devices used by the regimes in Venezuela, Hong Kong and Belarus could be disabled from afar. However, the devices are apparently still being used by enforcement organizations in these places. 

In Cellebrite’s Terms of Use agreement, it reserves the right to disable its devices from afar.
In Cellebrite’s Terms of Use agreement, it reserves the right to disable its devices from afar

When the company’s PR representative in Israel was asked if Cellebrite had disabled devices in the past, he declined to answer. He also refused to say when Cellebrite stopped working in Venezuela. 

As reported in relation to Belarus, the Economics Ministry stated that it believes this is dual-use equipment that requires Defense Ministry oversight. The Defense Ministry, meanwhile, will not confirm or deny if it is supervising the company, so it is still unclear whether any regulation has been imposed on it. 

In response to a query from Haaretz, the Defense Ministry said: 

“Operating on the basis of the Defense Export Control Law 5766-2007, the Defense Ministry oversees the export of security equipment (missile equipment, combat equipment and supervised dual-use equipment) in accordance with the lists of supervised products, which are based upon lists of the international supervisory regimes. 

“The Defense Ministry does not provide details about defense export policy and does not comment on specific licenses or entries in the export registry, for security, diplomatic and strategic reasons.”

This response does not clarify whether the company is under supervision, but the reference to “international supervisory regimes” suggests that the Defense Ministry may be implying that the American sanctions do not apply in this case.  

If that is indeed the intention, it cannot be reconciled with previous statements by the Defense Ministry, as attorney Mack noted in his letter. In at least two different cases, the Defense Export Control Agency replied that, “Israel’s defense export policy, regarding certain countries and in general, is frequently reexamined in light of the policy of various international bodies such as the UN Security Council, the European Union and the United States.” 

Comments