Forensic tools as instruments of repression: Russia, Cellebrite, and the case of Andrey Pivovarov | Andrea Fortuna

Andrey Pivovarov was removed from a flight at St. Petersburg airport on May 31, 2021, and detained by the Russian security services. He never provided his passwords. He never consented to a device search. None of that mattered.

According to a detailed forensic investigation by the Citizen Lab, Russian authorities used Cellebrite ’s UFED (Universal Forensic Extraction Device) to break into his iPhone 12 on or around June 17, 2021, while the device was in official custody and Pivovarov was awaiting trial on politically motivated charges. The company had publicly cancelled its Russian contracts three months earlier.

In brief

The Citizen Lab forensically confirmed that Cellebrite’s UFED was used to extract data from Pivovarov’s iPhone 12 on June 17, 2021, during official custody.

Russia’s own MVD forensic report explicitly names Cellebrite’s UFED Physical Analyzer and UFED 4PC as the tools used in the extraction.

Russian authorities searched the device for political contacts including Mikhail Khodorkovsky and human rights lawyer Anastasiya Burakova, suggesting the extraction may have seeded further targeting campaigns.

Cellebrite cancelled its Russian contracts in March 2021, but the hardware continued to operate in offline mode, effectively nullifying the cancellation.

Pivovarov’s MacBook, protected by full-disk encryption, was not successfully accessed — a concrete demonstration of why encryption matters.

Cellebrite’s pattern across multiple countries remains reactive: it cancels contracts only after third-party exposure, and its technical architecture has historically made those cancellations easy to circumvent.

Who is Andrey Pivovarov

Pivovarov served as director of Open Russia, a non-profit organization the Russian government designated as “undesirable” in 2017, a classification the European Court of Human Rights later found incompatible with the European Convention on Human Rights. Sensing the escalating legal risk, Pivovarov dissolved the Russian branch of Open Russia on May 27, 2021. Four days later, he was arrested.

In July 2022, he was sentenced to four years in prison for “carrying out the activities of an undesirable organization” — charges that are, by any reasonable reading of international human rights law, politically motivated. He was released in August 2024 as part of a prisoner exchange. After his release, he made contact with Citizen Lab researchers at the World Liberty Congress in Berlin, and agreed to have his devices forensically examined. What they found was not a surprise, exactly, but it was documented for the first time with forensic precision.

The forensic evidence

The Citizen Lab’s analysis focused on MobileLockdown records from Pivovarov’s iPhone, specifically USB connection logs that include a Host ID , a unique identifier assigned to a Cellebrite device. The Host ID found on Pivovarov’s phone (9016926980658937761372207) was one the Citizen Lab had previously attributed to Cellebrite’s forensic hardware.

That alone would be strong evidence. But what makes this case unusual is the corroboration from an unexpected source: the Russian authorities themselves. The MVD Forensic Expert Report No. 1269-17 , produced by Russia’s Forensic Expert Center of the Ministry of the Interior and provided to Pivovarov during his prosecution, explicitly confirms the use of Cellebrite’s UFED Physical Analyzer and UFED 4PC toolkit. The investigators documented extracting data from WhatsApp, Telegram, and Viber, and then searching the device contents for political terms: “Open Russia Civic Movement,” the name of opposition figure Mikhail Khodorkovsky, human rights lawyer Anastasiya Burakova, and Open Russia coordinator Tatiana Usmanova.

This is a useful reminder of how forensic tools actually get used in repressive contexts: to map political networks rather than to investigate crimes. As I’ve discussed before in the context of Android pattern-of-life forensics, the real power of device extraction lies in the reconstruction of relationships, habits, and associations, not in any single message or photo. In the hands of a state prosecutor pursuing political dissidents, that capability is a tool of repression rather than a law enforcement tool.

The MacBook that held

There is, in this story, one piece of genuinely good news. When Russian authorities seized Pivovarov’s Apple MacBook along with his iPhone, they could not get in. The MVD report itself documents the failure: the MacBook’s full-disk encryption made it impossible to extract the file system. The document includes screenshots of the login screen and macOS recovery functionality, the digital equivalent of a photo of someone staring at a locked door.

The forensic analysis found what appear to be failed login attempts on June 17, 2021. There was one apparent “successful” login in the records, but the Citizen Lab...