Zero-day vulnerabilities, which remain unknown to software and hardware makers until discovered, are particularly dangerous as they can be exploited without any existing patches. Amnesty first noticed traces of one such flaw in mid-2024. Later, while examining the phone of an activist in Serbia, the organization shared its findings with Google’s Threat Analysis Group. This led Google to identify and fix the three security loopholes.
During its investigation, Amnesty found that Serbian authorities had used Cellebrite’s forensic tools to exploit a USB vulnerability, allowing them to bypass security measures and unlock the activist’s device.
Amnesty had previously reported in December that Serbian officials had used similar tools to access the phones of both an activist and a journalist, later installing the Android spyware NoviSpy. Following these allegations, Cellebrite stated earlier this week that it had discontinued its services for its Serbian customers.
A Cellebrite spokesperson, Victor Cooper, pointed to a company statement that acknowledged the Amnesty report. The statement emphasized that Cellebrite had reviewed the allegations from Amnesty’s December 2024 report and conducted an internal investigation. As a result, the company decided to halt the use of its products by the Serbian authorities.
In January, Amnesty was contacted to analyze another case involving a youth activist who was arrested by Serbia’s Security Information Agency (BIA) late last year. According to the report, the circumstances of his arrest and the actions of BIA officers closely resembled previous incidents documented in Amnesty’s December findings. A forensic analysis of the activist’s device confirmed that Cellebrite’s tools had been used to unlock his Samsung A32 without consent or legal authorization.
Amnesty condemned the use of Cellebrite’s technology against individuals engaging in peaceful protests and exercising their right to free expression, stating that such actions violate human rights laws. Bill Marczak, a senior researcher at Citizen Lab, advised activists, journalists, and civil society members to consider switching to iPhones, which may offer stronger protection against these types of exploits. Amnesty’s Security Lab head, Donncha Ó Cearbhaill, warned thatCellebrite’s widespread availability raises serious concerns, suggesting that the full extent of its misuse may still be unknown.
Google has not yet responded to requests for comment regarding the issue.
