"Cellebrite zero-day exploit used to target phone of Serbian student activist" 28 February 2025

Amnesty International’s Security Lab, in collaboration with Amnesty’s European Regional Office, has uncovered a new case of misuse of a Cellebrite product to break into the phone of a youth activist in Serbia. The attack closely matches the form of attack that we previously documented in a report, ‘A Digital Prison’, published in December 2024. This new case provides further evidence that the authorities in Serbia have continued their campaign of surveillance of civil society in the aftermath of our report, despite widespread calls for reform, from both inside Serbia and beyond, as well as an investigation into the misuse of its product, announced by Cellebrite.

Though not documented in this blog post, Amnesty International has also found evidence of at least two further cases of misuse of Cellebrite against civil society (beyond the ones noted in the report), suggesting that the practice remains widespread and that Serbia’s Security-Information Agency (Bezbedonosno-informativna agencija – BIA) and the Serbian security services remain confident that they can continue using such oppressive tactics with impunity.

In a statement published on 25 February 2025, Cellebrite announced that it has suspended the use of its products by “relevant customers” in Serbia following Amnesty International’s December 2024 report, which documented widespread misuse of Cellebrite’s technology by Serbian authorities. The latest findings of further abuses make these suspensions a necessary and crucial first step in halting the ongoing and unlawful misuse of the company’s products...

...Student activist detained by plain clothes officers at protest

“Vedran” (name has been changed to protect the student’s security, privacy and confidentiality) is a 23-year old student activist who regularly participates in the ongoing student protests in Belgrade. Although he is loosely associated with several youth organizations he considers himself a part of the broader peaceful student protest movement that has swept Serbia since November 2024.

On 25 December 2024, “Vedran” wanted to check out an “open meeting with young people” which was organized by the ruling Serbian Progressive Party in Belgrade...At the entrance to the protest point, “Vedran” left his vuvuzela with the security. After a while (at around 17:30 CET), seven men in plain clothes approached him and forced him into a car. Despite his demands that they identify themselves, they did not introduce themselves and acted aggressively. They asked him why he was there and why he carried a vuvuzela and demanded that he show them his phone. He refused and was then driven to a police station in Sava Mala (part of Belgrade). “Vedran” told Amnesty International that as soon as he entered the police station, around 18:30 local time, he switched off his telephone and handed it over to the officers...

...The forensic analysis found clear evidence of exploitation which Amnesty International can confidently attribute to the use of Cellebrite’s UFED product. The logs also show that the Cellebrite product enabled the authorities to successfully gain privileged root access to the phone and to unlock the device...

..Cellebrite stated on 25 February that:

After a review of the allegations brought forth by the December 2024 Amnesty International report, Cellebrite took precise steps to investigate each claim in accordance with our ethics and integrity policies. We found it appropriate to stop the use of our products by the relevant customers at this time. 

...Cellebrite could not provide Amnesty International with additional information on the duration for which the customers have been suspended, nor what conditions or human rights protections are required before they will be allowed to use Cellebrite products again. The case reinforces the urgency for Cellebrite to introduce meaningful and effective safeguards to reduce the risk of their products enabling human rights abuses, including thorough review of their due diligence procedures; the implementation of technical mechanisms to limit the invasiveness of Cellebrite forensic tools; and to provide compensation and redress for the victims whose rights have been violated by the unlawful use of their products...