Russia extracted Pivovarov iPhone data via Cellebrite UFED Host ID in June 2021 after March cutoff

Forensic MobileLockdown logs from the seized device record USB connections to a Cellebrite host previously attributed by Citizen Lab. Court filings confirm extracted messages and contacts referencing Open Russia were entered as evidence in Pivovarov's 2022 trial. The iPhone 12 yielded data while the paired MacBook remained inaccessible, indicating selective UFED success against iOS 14-era protections.

Cellebrite's offline mode and absence of hardware revocation keys allowed continued operation of legacy UFED units sold before March 2021. Identical patterns appear in Citizen Lab reports on Serbia and Jordan, where post-contract devices retained full extraction capability. This architecture creates structural plausible deniability for vendors while enabling persistent state access to civil-society devices.

Procurement records show Cellebrite systems sold to multiple FSB-adjacent labs between 2018 and 2020 without end-user license revocation clauses. The same dual-use design now surfaces in Kenyan and Serbian cases, confirming a recurring proliferation vector rather than isolated Russian non-compliance.

Without mandatory cryptographic lockout or serial-number blacklisting on next-generation hardware, legacy units will remain operational in restricted jurisdictions through at least 2026.