Cellebrite, a leading digital forensics company, has announced that it has stopped Serbia from using its technology, following allegations that Serbian police and intelligence agencies used Cellebrite's tools to unlock the phones of a journalist and an activist, and then plant spyware.

The allegations surfaced in a December 2024 report by Amnesty International, which accused Serbian authorities of using Cellebrite's forensics tools to hack into the cellphones of a local journalist and an activist. According to the report, once the phones were unlocked, the authorities installed an Android spyware, dubbed Novispy, to continue surveilling the two individuals.

In response to the allegations, Cellebrite conducted an investigation and found it necessary to stop the use of its products by the relevant customers. In a statement, the company said it took "precise steps to investigate each claim in accordance with our ethics and integrity policies." However, Cellebrite did not name the customer in question, despite previously acknowledging Amnesty's findings on the use of surveillance technologies against civil society in Serbia.

The move by Cellebrite is seen as a critical step in addressing the abuse of surveillance technology. Donncha Ó Cearbhaill, the head of the Security Lab at Amnesty International, praised the decision, stating that "withdrawing licenses from customers who misused the equipment for political reasons is a critical first step." Ó Cearbhaill emphasized that Serbian authorities must now conduct their own thorough and impartial investigations, hold those responsible to account, provide remedies to victims, and establish adequate safeguards to prevent future abuse.

The incident raises concerns about the responsible use of surveillance technology and the potential for abuse by governments and law enforcement agencies. It also highlights the importance of companies like Cellebrite taking proactive steps to ensure their products are not used to violate human rights. As the use of surveillance technology continues to grow, it is essential that companies, governments, and civil society organizations work together to establish clear guidelines and safeguards to prevent abuse.

Despite the positive step taken by Cellebrite, questions remain about the nature of the suspension. When asked whether the suspension was permanent or temporary, and whether there was anything the customer could do to be reinstated, Cellebrite's spokesperson Victor Cooper declined to comment. The lack of clarity on these issues underscores the need for greater transparency and accountability in the use of surveillance technology.

The incident also serves as a reminder of the importance of whistleblower protections and secure channels for reporting abuses of surveillance technology. Individuals with information about similar cases can contact TechCrunch securely through Signal, Telegram, Keybase, or email.

In conclusion, Cellebrite's decision to stop Serbia's use of its technology is a crucial step in addressing the abuse of surveillance technology. However, it is only the beginning. As the use of surveillance technology continues to evolve, it is essential that companies, governments, and civil society organizations work together to establish clear guidelines and safeguards to prevent abuse and protect human rights.