Cellebrite cut off Serbia in 2025. The labs say its tools ran through the 2026 election anyway
Cellebrite publicly cut off Serbia in February 2025. Three forensic labs say its extraction tools were used there anyway, into 2026, and the repetition after an earlier cutoff in Russia reads as a claim about the business model, not one bad customer.
Vincent Jiang · 3 min read
Serbia's own intelligence agency, the Security Information Agency (BIA), used Israeli phone-extraction vendor Cellebrite's−2.37% — Cellebrite, down 2.37 percent today hardware during police interrogations to unlock opposition figures' phones and load spyware onto them, and it kept doing so after Cellebrite publicly cut the country off. Citizen Lab, Amnesty International's Security Lab and Belgrade's SHARE Foundation published synchronized forensic findings on October 26, one day after Aleksandar Vučić conceded the election he lost after 14 years in power 12.
What the labs documented
The forensics confirm a layered operation: Pegasus, the remote-access spyware made by Israel's NSO Group, on iPhones; NoviSpy, a custom Android implant built by the BIA; and Cellebrite's Universal Forensic Extraction Device (UFED), interrogation-room hardware that unlocks a seized phone, pivoting from unlock to spyware install. Amnesty traced that chain through a Qualcomm+0.49% — Qualcomm, up 0.49 percent today kernel flaw, CVE-2024-43047, rated 7.8 on the CVSS severity scale and patched only in October 2024 1.
At least 15 people were targeted in 2026, among them University of Belgrade rector Vladan Đokić, whose office was raided in March, and prosecutor Rade Bajić, who investigated the Kushner-linked Trump Tower deal in Belgrade and was called a criminal on state television by Vučić 17. Amnesty found Cellebrite software still deployed in Serbia weeks after the company announced in February 2025 it was halting use of its products by certain Serbian customers 23.
The pattern, not the outlier
The Russia precedent is the tell. In June 2026 Citizen Lab forensically confirmed Russian authorities used a Cellebrite UFED on activist Andrey Pivovarov's iPhone in June 2021, months after Cellebrite canceled its Russian contracts, and Russia's own Ministry of Interior forensic report confirms it; Cellebrite's reply was that post-termination use is "entirely unauthorized" 4.
Citizen Lab's answer cuts to the design flaw: offline mode and legacy architecture made it hard for the company to actually cut anyone off, and its terminations are reactive, coming only after third-party exposure 4. Serbia fits the same shape: halted in February 2025, still deployed weeks later, documented again in the 2026 chain 123.
Revenue kept climbing while operating income fell in the last two quarters
- Revenue
- Operating income
Data
| Revenue | Operating income | |
|---|---|---|
| Q3 '24 | 106.86M | 19.45M |
| Q4 '24 | 109.05M | 15.73M |
| Q1 '25 | 107.55M | 12.27M |
| Q2 '25 | 113.28M | 14.42M |
| Q3 '25 | 126.03M | 18.99M |
| Q4 '25 | 128.82M | 20.81M |
| Q1 '26 | 128.3M | 9.12M |
| Q2 '26 | 131.14M | 6.95M |
What the buyer base is worth
For Cellebrite's customers and shareholders, the compliance regime is the asset being tested, because the company's entire revenue base is government law-enforcement and intelligence buyers, and repeat documented misuse is what invites export limits, procurement reviews and vendor bans in exactly the democracies it sells to. The financials already show strain arriving before any regulator moves.
Revenue grew 15.8 percent year over year to $131.1 million in the quarter ended June 30, 2026, per SEC filings, but operating income fell 51.8 percent and net income fell 67.3 percent 6. Meanwhile the company's largest market keeps buying: the US Department of Homeland Security renewed an $11 million contract, used primarily by Immigration and Customs Enforcement, in September 2025 3. And on August 13, alongside second-quarter results, Cellebrite lowered its full-year revenue outlook 5.
The counterpoint
Cellebrite's defense is coherent on its own terms: it terminated Serbia, it says tools sold before a cutoff work without support or consent, and its ethics committee reviews every sale. All true as far as the record goes. What the record does not carry is a single disclosed instance of the company remotely disabling a misusing customer, or publishing how its ethics committee decides. Citizen Lab notes no detailed public disclosure of those decisions exists 4.
The verdict watch
Cellebrite reports third-quarter results on November 12 5. Two things decide whether this stays a valuation issue or becomes a license issue: whether operating margin keeps compressing while the misuse record grows, and whether any democracy's export regulator or procurement office moves first. The burden sits with the company to show a termination that actually switches the tool off.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
